An attempt by a threat to exploit a weakness in a system.

learn more… | top users | synonyms

10
votes
4answers
341 views

Resources for data on security incidents

What resources exist to research data on actual security incidents? I would prefer an online resource but offline resources are acceptable. The cost of access should be less than $100 (US) for ...
6
votes
1answer
704 views

I can receive all PADI packets for PPPoE connections of my ISP, is that a problem?

for debugging why my router wasn't connecting to pppoe i've tried to connect via the pc, it worked, then i started wireshark just to see what was going on, and i've seen that i can read all the PADI ...
6
votes
2answers
2k views

Strange STP traffic in my network, possible MitM attack?

I live at a student dorm, where we are connected to a student network. The administrators of this network have forgotten to disable STP broadcast on non-infrastructure ports. Periodically, I lose my ...
4
votes
4answers
203 views

Attack where browser URL appears valid

I remember reading about an attack where the "location bar" in a user's browser displays a valid URL (e.g. https://www.paypal.com/), but the traffic is really being directed to or intercepted by an ...
15
votes
4answers
3k views

Security of passphrase-protected private key

If an attacker obtains a private key that was created with no passphrase, he obviously gains access to everything protected with that key. How secure are private keys set up with a passphrase? If an ...
4
votes
3answers
435 views

How do I protect myself against the attacks in this php script?

Due to a vulnerability in how PHP was installed (Shared VPS with PHP installed as an Apache module instead of CGI) and hence how OSCommerce was configured (with security of 777 on certain ...
6
votes
1answer
220 views

Collision attacks on OCB?

I've been looking into the OCB cipher mode and everything I hear sounds good. I was planning on implementing it. Everything except for this lone voice, that is: Collision attacks on OCB: We ...
22
votes
3answers
3k views

How do DoS/DDoS work?

In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
18
votes
2answers
770 views

A phone call hack

The other day, I got a call from a relative with an email problem. After a bit more discussion, it turns out that two days previously, a man phoned my relative: stated he was from microsoft; asked ...
6
votes
1answer
4k views

Testing SQL injection using sqlmap

I'm just started using sqlmap ( http://sqlmap.sourceforge.net ) to test for possible sql injection attacks. I got a website which is vulnerable: C:\Python27>python xxx\sqlmap\sqlmap.py -u ...
7
votes
2answers
245 views

Profiling attackers via adaptive games: “Strange game, the only winning move is not to play”

Use of Game Design to Profile Attackers: Interested in any research that links concepts in game design to security systems in an effort to profile the attacker's identity, motives, skills, etc.; if ...
14
votes
5answers
11k views

Security risk of PING?

I have been told that PING presents a security risk, and it's a good idea to disable/block it on production web servers. Some research tells me that there are indeed security risks. Is it common ...
10
votes
1answer
404 views

Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks?

Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related ...
2
votes
1answer
301 views

The impact of the Sony attacks on the security industry [closed]

First of all there was the PSN hack, which was compromised due to a vulnerable version of Apache and no Firewall and using a developer console. Then Sony Greece fell due to an SQL Injection attack. ...
4
votes
1answer
287 views

Attacks against HIDS software running on the same machine

I am interested in the attacks that could be used to compromise or disable HIDS software such as Tripwire or Samhain. I understand that ideally checks should be run periodically and the database ...
10
votes
5answers
1k views

SQL Injection in a Non-Web Application

Does someone know of a good example of a SQL Injection vulnerability that isn't in a web application? What is the user input for this attack? I am looking for a real vulnerability, not speculation. ...
11
votes
5answers
568 views

How to best defend against Targeted Attacks?

We have seen this attack method grow as part of Advanced Persistent Threats (operation Aurora against Google or the G20 French Finance ministry attacks come to mind) but I have no doubt that even ...
8
votes
1answer
153 views

Long running SMTP session

I recently noticed an SMTP session on my server which started when a remote host connected but never seemed to result in any emails being delivered. I could see that it was probably a SPAM site and so ...
47
votes
6answers
9k views

SQL injection — but why isn't escape quotes safe anymore?

I haven't seen this question asked, and feel it's a valuable bit of information to have, especially because this is a huge source of mystery and confusion. Raw SQL When you're writing SQL -- for ...
2
votes
2answers
221 views

What steps can I take to identify what type of compromise of my computer has occured

I got involved in a strange scenario today :-) . Some 'UDPAgent.exe' file/worm/virus was trying to access my collegue's system and the antivirum program was showing that this particular thing is ...
8
votes
4answers
481 views

CAM table attack in 2011?

Today's switches are vulnerable to CAM Table attack? https://secure.wikimedia.org/wikipedia/en/wiki/CAM_Table
2
votes
1answer
2k views

What is an active attack?

Browsing through the site I encountered this Is there a way to negotiate a secret between 2 parties with no prior knowledge? What is an active attack then?
3
votes
3answers
4k views

Facebook spam / phishing attempt?

I got this sent by a friend on facebook and i dont think its a genuine message ___ shared a link on your Wall. This will leave you speechless) ...
18
votes
1answer
2k views

Collision rate for different hash algorithms

Is there any collision rate measure for popular hashing algorithms (md5, crc32, sha-*)? If that depends only from output size, it's quite trivial to measure, but I suppose that depends also of ...
14
votes
4answers
285 views

What should I look at in the event of a major vendor suffering compromise with unspecified impact?

The specific example I have in mind here is the breach of RSA in March 2011 where attackers got away with critical information which could be the seed information which is used to generate the ...
5
votes
3answers
667 views

How to use and create attack graphs

I am trying to learn more about attack graphs and how they can be used. I have read a little bit about them from some simple Google searches and believe that they could be a useful tool for work. I ...
5
votes
3answers
357 views

Web server file sniffing

What is it called when a user tries several attempts to figure out the files and folder structure on a web server? For example, the attacker will run http://example.com/test.jpg to determine if ...
0
votes
1answer
144 views

Real-time Operation systems and attacks

I'm interested on kind of attacks which can be used on 'Industry Control Systems'. I only have found that following malwares: switching-off/disablement the systems stole the information What ...
12
votes
1answer
913 views

How to make a report after a ddos attack? what information do I need to write on the report?

In my company, after a DDOS against a server, my employer asked me to make an analysis of the attack and to write down some stuff. What do you think I need to write down in my report? Is there any ...
1
vote
2answers
137 views

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine? Edit Assume the web server has CSRF vulnerability. No hidden token checking ...
9
votes
3answers
849 views

Demonstrating SQL injection on the following

I've got lines in my php/mysql code which look like this: ... $sqlquery = "SELECT price FROM products WHERE 1=1 AND id=".$_POST['id']; ... ... query is executed ... echo $price; As a ...
34
votes
8answers
3k views

Should I bother teaching buffer overflows any more?

The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
-1
votes
4answers
4k views

SQL injection for a username/password form?

This is how user validation happens on my site: if(!empty($_POST['username']) && !empty($_POST['password'])) { $query = "SELECT * FROM users WHERE username='".$_POST['username']."' ...
12
votes
3answers
961 views

Bypassing Address Space Layout Randomization

How effective is ASLR in preventing arbitrary code execution in a buffer overflow type exploit? How hard is it for an attacker to bypass this without simply guessing where the addresses are?
3
votes
2answers
6k views

Disabling windows firewall remotely

i use metasploit for pentesting windows 2003 sp2 server but when windows firewall is on i am not able to perform pentest successfully is there any way to disable firewall remotly?
7
votes
4answers
764 views

Security attacks on PHP web applications

I know about following security attacks on php applications (html,php,js). XSS SQL Injection CSFR Session Hijacking /Fixation Code Injection Remote file injection Should i know about any other or ...
4
votes
3answers
192 views

Most informative DEF CON talk?

I didn't make it to DEF CON this last year... I'd like to know what you thought was the most interesting/informative presentation and possibly a link to more information on the topic. [mod - ...
4
votes
1answer
551 views

How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?

What is CSRF? I need a basic definition that is not just lifted from Wikipedia. I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this. I am using a ...
12
votes
5answers
1k views

Access to a router's GUI

During a recent visit to a coffee shop, I noticed that they hadn't bothered changing their default user name and password for their router. I realise that someone could log on and be annoying to ...
11
votes
4answers
605 views

What is the risk of a packet being sniffed when travelling over the internet without SSL/TLS?

We all know to use SSL/TLS to stop people eavesdropping on our connection, but how likely is it that an attacker will actually sniff your unencrypted password or cookie if you don't? If we exclude ...
7
votes
3answers
581 views

What prevents this exploit from working (unix SUID)?

If I have a user on a unix system where Im allowed to create new files, what prevents me from downloading an executable file onto that system which is already SUID'ed to root on a different system? ...
43
votes
8answers
65k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
58
votes
6answers
6k views

Can anybody explain XSS?

I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I never fully understand how XSS ...
12
votes
7answers
404 views

UNIX Servers: Possible intrusions or attacks that do not use any of the open listen sockets

What type of attacks are there that do not use open TCP or open UDP ports? Is it safe to assume that no open ports means no remote access? (Excluding the possibility that there is a badware already ...
7
votes
4answers
229 views

Security papers or material focusing on the industrial control systems (SCADA)

Anyone know a good site or a list of resource to start to know issue related to the security of SCADA system ?
10
votes
2answers
551 views

What is a “pre-play” attack?

I understand what a replay attack is, but I keep reading about a pre-play attack. What is it? Is it when someone intercepts an unused message and blocks the sender so they can't finish using it, and ...
10
votes
3answers
549 views

Are there valid reasons for spoofing an address?

This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?. Are there valid reasons to spoof an address?
16
votes
6answers
1k views

What security risks does IP spoofing bring?

By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
9
votes
2answers
915 views

Malware known to use port knocking to evade detection by network scanners?

Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
6
votes
4answers
571 views

Is Stonesoft's “advanced evasion technique” a major problem?

A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques. With these techniques, they claim to be capable of launching attacks on a network ...