An attempt by a threat to exploit a weakness in a system.

learn more… | top users | synonyms

5
votes
3answers
439 views

Are CSRF Attacks Really Blind

I'm new to CSRF attacks but don't see how they are always blind. Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like one's medical history. ...
5
votes
3answers
1k views

TLS Renegotiation Indication Extension vulnerability

I am trying to understand the TLS Renegotiation Indication Extension from the RFC. I can understand that it is related to the fact that the renegotiation is sent under the encrypted stream, but I ...
5
votes
2answers
1k views

How effective is an IDS at catching targeted attacks

I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies. I was ...
5
votes
2answers
1k views

Is that possible? A router with arpspoof from factory

Just bought a 3G router from China and then checked the log: [1970-01-01 00:00:00] The system will be restored the factory value. [1970-01-01 00:00:00] The system current version: 1.0.5.1. ...
5
votes
3answers
428 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
5
votes
3answers
3k views

What is a Shrink Wrap code attack?

On my C|EH course I have heard about term "Shrink Wrap Code Attack", but we've only mentioned it. Now trying to do some research and refresh the topics, I can't seem to find serious description of ...
5
votes
1answer
574 views

Can a malicious Tor exit node perform a HTTPS man-in-the-middle attack to see/modify your HTTPS traffic?

Let's say I am browsing the Internet using Tor - visiting https://example.com/login.php - and the NSA is operating the Tor exit node which I am currently routed to use. Can that NSA exit relay swap ...
5
votes
3answers
555 views

Web server file sniffing

What is it called when a user tries several attempts to figure out the files and folder structure on a web server? For example, the attacker will run http://example.com/test.jpg to determine if ...
5
votes
2answers
514 views

SSH : Remote Host Identification Changed

As part of my daily routine, I was SSH'ing to one of the corporate servers. However this time I was presented with following message @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ ...
5
votes
3answers
678 views

Is this a symptom of an attack (DoS/DDoS)?

I work for an e-commerce website in my country and this is the second time we suffer an attack. At least, looks like one. We have a search functionality in our website and the supposed attacker is ...
5
votes
3answers
800 views

How to use and create attack graphs

I am trying to learn more about attack graphs and how they can be used. I have read a little bit about them from some simple Google searches and believe that they could be a useful tool for work. I ...
5
votes
1answer
566 views

How secure is NFC on mobile devices?

Near field communication is becoming more commonly available in modern mobile devices, such as smartphones and tablets. This functionality can be used to communicate between such devices, or with ...
5
votes
3answers
66 views

Attributing attacks

Neophyte here. I didn't find much googling around, so I was hoping maybe someone here could point me in the right direction towards some literature that discusses this in more depth. It's ...
5
votes
4answers
15k views

How to prevent my website from getting malware injection attacks?

My website was banned as a malware website by Google. When I checked the code, I found out that some code injected many files on my server. I cleaned everything manually, edited all files on my server ...
5
votes
2answers
380 views

Tor versus direct monitoring

I know if I use Tor and maybe made a tweet, it gives the government a really tough time tracing the originator. But what if like a police car was directly outside my home for instance. Is it still ...
5
votes
2answers
179 views

Strange escape codes in a GET request - is this a known attack?

I recently came across some entries in nginx's access logs that resemble the following: ##.##.##.## - - [24/Sep/2014:01:21:51 -0400] "GET /767/browser-wars-side-show-ho ...
5
votes
2answers
365 views

Is this a DNS attack?

The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 ...
5
votes
1answer
401 views

Cufon or Prototype as an attack vector for Blackhole exploit kit?

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited. Specifics: It's being detected as a Blackhole exploit kit inside of a Cufon ...
5
votes
1answer
629 views

Trying to prevent Cisco toll fraud

A little back story on the setup first; We have a Cisco VoIP setup at our remote office(where I'm at) and the main CCM/CCX/Unity setup is at the parent company across the US in Connecticut. We have ...
5
votes
0answers
129 views

Kaminsky Bug DNS Cache Poisoning

I'm trying to use Kaminsky DNS cache poisoning method. I'm using bind9 server on ubuntu and static port. So far I achieved to insert a line into DNS cache which is ;additional www.blalba.com 80000 ...
4
votes
4answers
30k views

how safe is the 256 bit encryption used in bank transactions

Most of the banks use a 128 bit or 256 bit encryption. What does this mean? Does it mean that the keys used in ssl are 128 bit long or what? If they are the ssl key lengths then 128 bit rsa keys are ...
4
votes
3answers
569 views

An attack from my Employer

I am working in an ISP company as a junior support specialist. Recently, I have a serious suspicions that one of our "head" stuff member is compromising me by being able to control(see) my traffic.. ...
4
votes
2answers
1k views

Extract AES key by comparing plaintext and encrypted data

Is there a kind of analysis which would enable me to get AES key which was used for encrypting arbitrary data while I have both original and encrypted version of data ? The problem is that the AES ...
4
votes
4answers
423 views

Received a Kindle from a stranger, what are the risks?

While getting a coffee today, a man walked up to me and offered me a kindle. he said he no longer wanted it and that he was looking to give it away. An avid reader, I accepted. It has no accounts on ...
4
votes
2answers
320 views

How can I find out who owns a block of IPs?

I'm currently going through the logs on my apache install for potential intrustions, and I'm finding a lot of hits for SQL injections and exploit testing, from 173.212.195.* . I'm now trying to find ...
4
votes
4answers
1k views

Is this an attack and how can I fix it?

I don't know where to start in searching the forum for existing threads that might cover my issues. I recently received a spoof email pretending to be from a client for whom I've just started to do ...
4
votes
3answers
512 views

How do I protect myself against the attacks in this php script?

Due to a vulnerability in how PHP was installed (Shared VPS with PHP installed as an Apache module instead of CGI) and hence how OSCommerce was configured (with security of 777 on certain ...
4
votes
2answers
443 views

Are there volatile memory chips which dont retain data after power off?

It was demonstrated that dram modules can retain information up to 10 min after power off in certain conditions. My question - are there memory types which will retain data 10 sec at max even if being ...
4
votes
4answers
453 views

Security risk of adding a HTTP Header with server identifier

We are about to deploy a web application to a web farm of quite a few web servers. During our testing we have found issues happening in one of the servers but not in others. Most of them because of ...
4
votes
5answers
331 views

Can SSL requests be proxied by issuing a second certificate?

Alice wants to login to her account at https://www.bobsbank.com/. However she clicks on a malicious link in an email and instead gets sent to the malicious site https://www.charliesbank.com/. The ...
4
votes
3answers
230 views

Should user input be validated for it's length?

Is it bad not to validate length of user input to text field at server side. May it lead to such vulnerabilities as buffer overflows and other? I think it depends on programming language of ...
4
votes
2answers
280 views

XSS when <, > and " are escaped

I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following : It escapes <, >, " to their URL entities (not &, ) or () You are ...
4
votes
4answers
223 views

Attack where browser URL appears valid

I remember reading about an attack where the "location bar" in a user's browser displays a valid URL (e.g. https://www.paypal.com/), but the traffic is really being directed to or intercepted by an ...
4
votes
4answers
1k views

VGA/HDMI Based Attack

Can I attack a PC via the VGA port? Is VGA one way or does it accept data from the other side? How about HDMI or DVI? And if so, are there known malware or PoCs to do that? or is it theoretically ...
4
votes
2answers
610 views

Is this an example of XSS attack?

A scripter sees on certain web pages it's technically possible to include markup like HTML and CSS/JS. It's technically possible to submit a javascript or iframe and have it display to the visitor ...
4
votes
3answers
198 views

Most informative DEF CON talk?

I didn't make it to DEF CON this last year... I'd like to know what you thought was the most interesting/informative presentation and possibly a link to more information on the topic. [mod - ...
4
votes
3answers
1k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
4
votes
4answers
767 views

Can public keys be a security risk when performing password-less SSH logins?

Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins. The servers being checked put the public key of ...
4
votes
1answer
132 views

Voice Call Safety

When i was dealing with an assistant of my bank through mobile call, she asked me to insert my bank login code after a beep. I was wondering if this procedure is secure against a malicious agent who ...
4
votes
1answer
776 views

How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?

What is CSRF? I need a basic definition that is not just lifted from Wikipedia. I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this. I am using a ...
4
votes
3answers
579 views

PHP IP check as security?

Would just like some input on a PHP script I'm writing. It's just a simple script that only myself should be able to access. I don't have a dynamic IP address, so this isn't an issue for me, but I'm ...
4
votes
1answer
179 views

Computational Feasibility of finding 'Good Links' of the following format

I recently stumbled upon this and am checking here to see if what I am proposing is indeed feasible and can be considered a breach of privacy. For obvious reasons I am not revealing the website ...
4
votes
2answers
219 views

Most secure response for a server to return to a user scanning for exploits

I have ASP.NET servers hosted in IIS, regularly i see bots attempting to scan my server searching for outdated versions of phpMyAdmin, mysql etc. Currently these requests all return 404 because ...
4
votes
1answer
450 views

POODLE and TLS…not SSL

In December there was a new attack surface of POODLE against TLS 1.0 (think this also covers 1.1 and 1.2?). Anyway, as a system administrator for Windows Server 2008/2012 what can we do do prevent ...
4
votes
1answer
938 views

Norse: Cyber Attack Map

This application analyzes web traffic and then beautifully displays attacks on a global map. How does it intercept web traffic so it can analyze it? Isn't web traffic private to everyone except to ...
4
votes
1answer
124 views

Security consequence of Javascript hole in an online chat?

For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat? What is the worst thing they could do?
4
votes
3answers
154 views

Does allowing everyone know when a server process was started pose a security risk?

I recently found that in Microsoft .NET framework an impersonated thread is not allowed to request "time at which the current process was started". This could be done intentionally or this could be ...
4
votes
5answers
3k views

Is there a method to detect an active man-in-the-middle?

Suposing an attacker that has gained access to the router. Is there a way, for the victim, to notice that is being attacked? I think one of my friends is a victim of this kind of attack. How can I be ...
4
votes
2answers
51 views

What's a term to describe multiple shoulder surfing attacks to uncover different parts of the password?

Is there an existing term that describes shoulder surfing attacks where the adversary observes a different part of the password each time, to eventually construct the whole password? An example ...
4
votes
2answers
302 views

How to check if my usb drives are vulnerable by BAD USB

Mark pointed out that only one chip type is vulnerable to BAD USB, id like to check if mine are, am using only Kingston flash drives here so can you tell me if they are, or if there exists a list ...