An attempt by a threat to exploit a weakness in a system.

learn more… | top users | synonyms

13
votes
5answers
3k views

Access to a router's GUI

During a recent visit to a coffee shop, I noticed that they hadn't bothered changing their default user name and password for their router. I realise that someone could log on and be annoying to ...
13
votes
4answers
870 views

How to react when under attack

Just this week someone has been trying to attack the server of the company where I work. I have noticed that they have been trying to brute force root via ssh. fail2ban is handling that well and I ...
12
votes
8answers
1k views

Randomizing MAC addresses on bootup

Since it is possible to set custom MAC addresses, wouldn't it make sense to have a new one as often as possible/convenient (i.e. on bootup)? It would seem that is useful to both attacker and victim ...
12
votes
7answers
508 views

UNIX Servers: Possible intrusions or attacks that do not use any of the open listen sockets

What type of attacks are there that do not use open TCP or open UDP ports? Is it safe to assume that no open ports means no remote access? (Excluding the possibility that there is a badware already ...
12
votes
6answers
5k views

Index page has been compromised, suspicious files are showing up

My website has been hacked lately and it has been defaced. Now I have weird files, don't know where they coming from. I just want to know, what of these files are harmful or can cause that I get ...
12
votes
5answers
5k views

What is a DoS Attack and how does it differ from a DDoS attack?

Can some one explain to me the concept of Dos Attacks for web applications ? Also what is the distinction between Dos and Distributed Dos ( ie DDos) attacks ? Wikipedia says : In computing, a ...
12
votes
3answers
1k views

Bypassing Address Space Layout Randomization

How effective is ASLR in preventing arbitrary code execution in a buffer overflow type exploit? How hard is it for an attacker to bypass this without simply guessing where the addresses are?
12
votes
1answer
1k views

How to make a report after a ddos attack? what information do I need to write on the report?

In my company, after a DDOS against a server, my employer asked me to make an analysis of the attack and to write down some stuff. What do you think I need to write down in my report? Is there any ...
12
votes
3answers
884 views

Are there valid reasons for spoofing an address?

This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?. Are there valid reasons to spoof an address?
11
votes
8answers
15k views

Is it possible to steal money directly from the systems of a big bank?

Sometimes I imagine: My money in the bank is just a floating point number in a mainframe's memory... So, if I just change 1 bit, I will win a lot of money... The most common way to steal money in ...
11
votes
3answers
12k views

Does X-Content-Type-Options really prevent content sniffing attacks?

In Tangled Web Michal Zalewski says: Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
11
votes
3answers
3k views

Can you extract memory contents from a hibernated Windows machine?

In a recent discussion about hardware hacks, attacks surrounding Windows hibernate popped up. I am not entirely convinced that it would be viable to get stuff out of the memory saved to disk. When ...
11
votes
3answers
2k views

Is null-byte injection possible in Java filenames?

From the Area51 proposal
11
votes
4answers
10k views

What type of attacks can be used vs MongoDB?

I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
11
votes
4answers
724 views

What is the risk of a packet being sniffed when travelling over the internet without SSL/TLS?

We all know to use SSL/TLS to stop people eavesdropping on our connection, but how likely is it that an attacker will actually sniff your unencrypted password or cookie if you don't? If we exclude ...
11
votes
2answers
309 views

security implications of NULL dereference

Suppose we have code like this: struct somedata { int a; int b; }; struct somedata *data; /* ... */ data = malloc(sizeof(struct somedata)); data->a = something; Now, as you can see, NULL ...
11
votes
1answer
523 views

Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks?

Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related ...
11
votes
1answer
428 views

How can an attacker abuse a distributed system?

How can an attacker take advantage of a world where state is eventually consistent and vector clocks are used to settle disagreements? For example, what are the security concerns of using a database ...
10
votes
2answers
1k views

Security of Log Files - Injecting malicious code in Log files

As part of my course project I'm trying to understand various security frameworks and best practices. One of the very popular approach is to maintain Logs. My question is about the security of the ...
10
votes
5answers
2k views

SQL Injection in a Non-Web Application

Does someone know of a good example of a SQL Injection vulnerability that isn't in a web application? What is the user input for this attack? I am looking for a real vulnerability, not speculation. ...
10
votes
7answers
1k views

Cheating or service disruption by altering client-side code

A reasonably white-hatted hacker has demonstrated the ability to insert text of his own choosing into the communication between a java applet and a web based server. Not a simple MITM attack, but ...
10
votes
3answers
1k views

If an XML document is not validated as “Well Formed” or checked against a schema, what are the risks?

When processing an XML document in my application, what are the risks? E.g. if it is not "Well Formed" or is not checked against a schema.
10
votes
4answers
428 views

Resources for data on security incidents

What resources exist to research data on actual security incidents? I would prefer an online resource but offline resources are acceptable. The cost of access should be less than $100 (US) for ...
10
votes
2answers
18k views

Advice on what to do after being hacked?

After running a system scan earlier today, I found that my computer had been infected by a trojan horse. My reason for running the scan was because Windows kept shutting down and then recovering. ...
10
votes
4answers
720 views

What would happen if one of the popular Linux repositories is hacked?

Even though most people consider downloading your Linux software from you own distribution's repositories as safe, thinking about the scenario where a repository gets hacked sounds thrilling. What ...
10
votes
2answers
839 views

In the recent DKIM vulnerability, how did someone determine key length by looking at headers?

Having read this recent article : Wired-DKIM vulnerability, I have a couple of questions. How can one determine the key length that is being used simply by looking at the headers ? And I'm assuming ...
10
votes
4answers
2k views

Real life examples of web site attacks

I've been put in charge of educating developers on web application security. One way I will be doing this is through an explanation of various web attacks (e.g., OWASP top ten). In addition to an ...
10
votes
2answers
699 views

What is a “pre-play” attack?

I understand what a replay attack is, but I keep reading about a pre-play attack. What is it? Is it when someone intercepts an unused message and blocks the sender so they can't finish using it, and ...
9
votes
5answers
3k views

Using Google Search results to determine password strength

Google is a repository of Internet data, as it indexes tremendous amount of data. It uses a prediction service to determine the rest of the search query. With such a huge repository in place, can we ...
9
votes
5answers
3k views

How to catch a gmail hacker/money-scammer? (in conversation with one right now!)

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
9
votes
3answers
939 views

Demonstrating SQL injection on the following

I've got lines in my php/mysql code which look like this: ... $sqlquery = "SELECT price FROM products WHERE 1=1 AND id=".$_POST['id']; ... ... query is executed ... echo $price; As a ...
9
votes
6answers
1k views

Getting credentials using proxy server

Is it possible to get the username and password we enter into sites like facebook using proxy server? The scenario is like this : 1.My laptop is connected to a network. 2.It is configured to use a ...
9
votes
5answers
630 views

Is there anything I can do about IDN homograph attacks?

I have been reading about IDN homograph attacks, and I cannot think of any better way than Tell my users not to trust emails asking for passwords, etc Buy all domains similar to mine (expensive and ...
9
votes
4answers
6k views

In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?

Ars Technica is reporting on a new attack against HTTPS. Called FREAK, the devices reported as vulnerable include iPhones, Android devices, and Macs running OS X. The attack (as has been clarified ...
9
votes
2answers
779 views

Plain Text Password Reset Vulnerability

If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change ...
9
votes
2answers
32k views

How do hackers take advantage of open ports as a vector for an attack?

It is widespread knowledge, and therefore a common practice, to close open ports on any machines connected to the internet. If for example, a typical program uses port xyz as it's communication ...
9
votes
3answers
1k views

Is it possible to prevent a physical attack on full disk encryption?

I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR. With this kernel patch, you can create a partition that is ...
9
votes
1answer
198 views

Long running SMTP session

I recently noticed an SMTP session on my server which started when a remote host connected but never seemed to result in any emails being delivered. I could see that it was probably a SPAM site and so ...
9
votes
2answers
1k views

Malware known to use port knocking to evade detection by network scanners?

Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
9
votes
1answer
599 views

How to stop password recovery attempts on accounts?

I am using social networking services such as My Banking GMail PayPal Facebook Twitter Google+ LinkedIn All of these services text messages me a six digit code to login from anywhere, even a ...
9
votes
1answer
1k views

How to make SQL injection in PostgreSQL's tsquery?

I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format: PHP raised unknown ...
8
votes
4answers
1k views

Can anti-CSRF token prevent bruteforce attack?

I am not much experienced with brute force attacks but I was wondering Suppose, you have a website www.example.com and you want to do brute force attack on that login form but that login form is ...
8
votes
3answers
689 views

How does an attacker approach a website?

What is a typical mindset and method of approach? What are they likely to try first? At what point does a novice give up versus an expert? How would an automated attack differ from a manual one?
8
votes
5answers
1k views

What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?

I am writing a novel in which a researcher attempts to work against a study he is a part of by purposely sabotaging operations on the research compound. I am wondering if the following is plausible. ...
8
votes
4answers
1k views

Automated encryption detection

Is there any program that, given a cipher text, it would tell me what the encryption algorithm is? What if I have the plain text? Is there something that can be done in that case?
8
votes
3answers
2k views

How bad is a Self Contained XSS attack?

Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to ...
8
votes
3answers
2k views

iPhone 5S security: Given someone's fingerprint can I use a 3D printer to create a fake finger with a real fingerprint on it?

With such a big deal being made about the iPhone 5S's fingerprint reader (and formerly the Thinkpads' fingerprint readers) I really wonder how secure it is to use fingerprints in lieu of passwords. ...
8
votes
1answer
854 views

Is it possible to recognise and prevent MitM attacks on devices which use self-signed SSL certs?

I use both Linux and Windows at work on a large enterprise LAN. The majority of the network configuration is out of my reach. Certain SaaS applications that are hosted locally on the enterprise LAN, ...
8
votes
4answers
652 views

CAM table attack in 2011?

Today's switches are vulnerable to CAM Table attack? https://secure.wikimedia.org/wikipedia/en/wiki/CAM_Table
8
votes
3answers
295 views

Is it dangerous to place ~/ssh/config on GitHub?

I am used to version control most of my dot files and push them to a repository on GitHub. I would also like to add ~/.ssh/config to have an up-to-date configuration on all machines. Could an ...