An attempt to exploit a weakness in a system, either for nefarious or research reasons. Questions with this tag should be about designing, carrying out, or defending against the attack itself, rather than about the underlying weakness.

learn more… | top users | synonyms

3
votes
1answer
172 views

Challenge: How to find the secret key in homebrew MAC/keyed hash: sha1(key + cookie)?

I am trying to solve a security challenge on a website. Basically, the website computes sha1(key + cookie) to sign a cookie so that the user can't change it himself, and to accomplish the goal you ...
2
votes
1answer
127 views

How can an attacker redirect victims through proxy

Let's say that an attacker is behind a proxy that's using NAT or PAT. Is it possible for him to redirect victims to his machine to achieve some attacks like web phishing or opening reverse TCP ...
-1
votes
1answer
69 views

Oversized XML attack in axis 1.4

How can we prevent oversized XML attack in webservice implemented with Apache Axis 1.4?
1
vote
3answers
499 views

TSource Engine Query DDoS attack

My gaming machine is under DDoS attack and when I used Wireshark I found the following string "TSource Engine Query" in all UDP packets coming from random IP's. I found using Google that some gaming ...
17
votes
3answers
5k views

Avast performing an attack?

I have a Toshiba notebook, which came with Norton Internet Security. In addition, I have installed Avast. I received a warning from Norton about a OS Attack: GNU Bash CVE-2014-6271 intrusion attempt. ...
5
votes
1answer
104 views

Dragnet TEMPEST Surveillance?

Just something I considered recently -- TEMPEST attacks are pretty well known; basically you intercept EM leaks from a computer to discover compromising information (i.e. encryption keys, what's being ...
1
vote
3answers
134 views

CRIME attack - If Javascript can be injected on the attacked machine, why not directly sending the cookie to a remove server?

I read about the CRIME - How to beat the BEAST successor? question and answer, but I don't understand that: If Javascript can be injected and run on the attacked machine, why not directly sending the ...
3
votes
2answers
315 views

how can an attacker access a system through a compromised router?

Let's say an attacker gained access to the admin panel of a home router with port 21, 23 and 80 open. I mean the attacker has full control over the router, thus being able to port forward, etc... ...
3
votes
1answer
73 views

Host based code injection defense vs anti virus?

Recently I came across a paper titled Host-based code injection attacks: A popular technique used by malware. Another paper titled "Bee Master: Detecting Host-Based Code Injection Attacks", suggests ...
81
votes
5answers
10k views

Can simply decompressing a JPEG image trigger an exploit?

The novel Daemon is frequently praised for being realistic in its portrayal rather than just mashing buzzwords. However, this struck me as unrealistic: Gragg's e-mail contained a poisoned JPEG of ...
1
vote
2answers
442 views

TCP- or UDP-based Port Scans, IP Fragmented Packet

Is this normal or is someone trying to hack/attack me? How can I stop this? My router is a Cg3000v2 netgear provided to me by Optus. [TCP- or UDP-based Port Scan]411 Wed Aug 26 00:28:08 2015 ...
2
votes
3answers
182 views

Feasibility of time-based database brute-force attacks on websites

I recently learned that there is an attack that utilizes the fact that when brute-forcing a compared string (e.g. hash from a password or token) in a database the query fails a few nanoseconds earlier ...
0
votes
1answer
214 views

Thousands of 404s from various search engines

Since early April of 2015, my web site has been getting thousands of requests from many search engines for URLs that don't exist and never have existed. I found a similar, but less detailed, ...
6
votes
2answers
699 views

DNSspoof not working

My aim is to DNSspoof. My network is using a wireless router with the address 192.168.1.1 and primary DNS is the same as the router address. I have enabled Kernel IP forward in Linux. DNS host file ...
6
votes
2answers
837 views

UDP flood from my machine, or false positive?

The company that hosts my dedicated server has alerted me to what they think is malicious traffic coming from my machine. They supplied me with graphs showing a large amount of UDP traffic coming from ...
40
votes
4answers
6k views

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then ...
5
votes
1answer
153 views

Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed?

Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by ...
3
votes
1answer
95 views

Is this an attempted cross-site attack?

I have found various 404 errors in my web server log that look like this: http://mywebsite.com/go.php?http://pastebin.com/raw.php?i=ffdkafkjasd ...
1
vote
3answers
165 views

Canvas fingerprinting identifies the OS?

I recently read this article, about how a journalist was hacked. She describes how they used a 'fingerprinting' technique to identify her OS. The way they use a one pixel image, it sounds like the ...
0
votes
2answers
101 views

If there is a malicious attack on one partition, is the other one safe?

I recently have used Bootcamp to set up a new partition and run Windows 7. About half of my HDD is designated to my OS X partition and the other half is allocated to the new Windows 7 partition. If ...
0
votes
1answer
250 views

Hacked bluetooth speaker

I recently purchased a new OontZ Angle Plus bluetooth speaker and I believe that it has been hacked. I can't connect any of my devices to it, the bluetooth light indicates that it has been paired ...
44
votes
2answers
7k views

Is this an attempted SQL injection?

Looking through error logs I found lots of requests to a web-app where the URL contains: ...
3
votes
1answer
100 views

What kind of attacks can target static resources?

Static resources and their caching interests me from the security perspective. Let's say we have an .jpg file requisted from the origin -> going through a reverse proxy with caching -> reaching the ...
7
votes
2answers
7k views

Yahoo mail hacked - how to recover, how did it happen and how to prevent?

I was yesterday informed by some friends that they received spam mails with my name as sender. The sender addresses look like firstnamelastname@spacepc.pt and firstnamelastname@revistaplot.com with ...
0
votes
0answers
44 views

Behaviour of DNS query packet

When the configured name server resolver is not reachable, the query packet will retransmitted after certain t times (in windows, every 1 seconds until 8 seconds,max). The behaviour of the legitimate ...
0
votes
2answers
147 views

Persistent XSS in Blogger domain

I have discovered persistent XSS in blogger domain. I have reported vulnerability to Google Security Team and I received this is the response: Users are permitted to place arbitrary JavaScript, ...
3
votes
4answers
653 views

Famous XSS attacks over JavaScript [closed]

I'm about to graduate in "Computer Science", and I'm writing thesis about the Javascript vulnerabilities. In particular, I'm analyzing the JS vulnerabilities that allow XSS attacks. I would like to ...
3
votes
2answers
201 views

Connected cars: Skills needed for a security specialist [closed]

Connected cars are being mass produced by many car manufactures such as Audi, GM, Honda and Hyundai (Founding members of the Open Automotive Alliance). Recently I have read a scaring article about ...
8
votes
2answers
5k views

Do these regex show that I was hacked?

What do these regex commands mean? I found them when I ran the history command: grep --include=\*.php -rnw . -e "update.creditcard" grep --include=\*.php -rnw . -e "e41e" grep --include=\*.php -rnw . ...
-2
votes
1answer
94 views

Attack on Androids Encryption called FROST

http://www.extremetech.com/computing/150536-how-to-bypass-an-android-smartphones-encryption-and-security-put-it-in-the-freezer I read this article about FROST and in the comments someone was stating ...
1
vote
1answer
78 views

Is it effective to check how many times the same password was entered in fear of a string comparison timing attack?

How many times would an attacker have to enter the same password when doing a string comparison timing attack? I assume it would have to be at least a few dozen times to average out network lag, for ...
3
votes
1answer
99 views

String Comparison Timing Attack in Plain English

Could someone please tell me what a string comparison timing attack is in simple terms? I have Googled this, but all the explanations are very technical. Also, is this attack an better than a brute ...
2
votes
1answer
215 views

Rootkits, Bootkits detection and protection and Firmware alteration

I was hacked in an extremely intrusive manner in late 2013. Ever since then, not a day has passed where I don't think about this. A lot. My question has to do with the likelihood of the attackers ...
1
vote
5answers
88 views

Does services provided by different companies for DDoS protection work well?

Is it necessary to use any DDoS service provided by different web hosting provider and other people? We know, they are running their business to provide security to thousands of web property. They are ...
0
votes
2answers
215 views

Are the Microsoft Windows images found on the internet safe?

Microsoft has stopped offering the Windows images for download. It is now only possible to get the image if one has a key of a retail version of the corresponding OS. The question is now, whether the ...
4
votes
1answer
110 views

How accurate the recent activities location provided by Microsoft emails

One of my emails is on hotmail.com provided by Microsoft. Recently, after few suspicious incidents where my computer was hacked and many other accounts, I changed all my passwords including this ...
2
votes
2answers
84 views

Are documented networks easier to attack? Are undocumented networks easier to protect?

I am learning about network documentation for the first time and have come across the following statement: Undocumented networks might not be protected and can be used to support insider attacks. ...
-1
votes
1answer
81 views

indicators of compromise via email servers

Malicious files are commonly infiltrated on to the network via email attachments. Besides awareness and education to my staff to refrain from clicking on suspicious attachments, I would also like to ...
0
votes
1answer
42 views

Under what circumstance might your email not make to your intended recipient? [closed]

I'm asking because it's one thing to eavesdrop on someone's email, but it's another thing to prevent your email from getting to your recipient. For example, I sent an email to a colleague and he and I ...
2
votes
0answers
145 views

How to do side channel attack on smart cards? [closed]

Assume that I have a smart card and I want to do a differential power side channel attack on its mutual authentication mechanism. This is the mutual authentication mechanism that my card using(Let ...
1
vote
1answer
117 views

Different types of DDoS attacks [closed]

What is behavior of UDP flood, TCP SYN flood, Ping of Death and Smurf attack?
-6
votes
1answer
141 views

Make really personalised wordlist file

i want to make a really customised wordfile with: 4 letters first + 2 numbers example: divo11 or yeve11 And not like this: p0oiw1 or u4hf3e This wordfile is really important. How can I do it?
3
votes
1answer
2k views

LogJam hardening OpenSSH and testing it [duplicate]

I would like to harden my OpenSSH (clientsite) after the LogJam attack. I read this article https://weakdh.org/sysadmin.html and there is one paragraph, which says how to do that. Is this enough and ...
1
vote
2answers
146 views

Strange 'agetty' process running on my VPS.

Recently, I had to reinstall one of my VPS servers (again), due to malware. I took what I considered to be pretty good security precautions. I also locked the root account and am using sudo as well. ...
1
vote
1answer
88 views

What this type of attack called? (gaining peripheral information)

When the intruder looks at the transmitted data and finds information about the sender and the receiver of the data or other peripheral information that won't help him hack the system but know more ...
1
vote
2answers
684 views

How effective is antivirus software? [duplicate]

On one hand, most antivirus websites claim their products are highly effective, and I've seen antivirus "test" videos claiming 95%+ detection rates for new malware (as in less than a day old, not old ...
1
vote
3answers
91 views

How can hackers access WordPress usernames? [duplicate]

Recently I've had brute force attack attempts on some of my WordPress sites and the attackers are using actual usernames other than the default admin (which was removed). How is it possible for them ...
3
votes
1answer
535 views

Is CVE-2013-2566 a practical attack against RC4 or still conceptual?

Is CVE-2013-2566 a practical attack against RC4 or still conceptual and does it only apply to WPA/TKIP?
2
votes
1answer
86 views

Who first introduced the notion of attack graphs?

I've been searching the literature and haven't been able to pin it down. The concept probably existed long before the name was coined, but who is the invention/introduction of attack graphs attributed ...
5
votes
1answer
146 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...