An attempt by a threat to exploit a weakness in a system.
6
votes
1answer
164 views
+100
How can an attacker abuse a distributed system?
How can an attacker take advantage of a world where state is eventually consistent and vector clocks are used to settle disagreements?
For example, what are the security concerns of using a database ...
0
votes
1answer
68 views
What other place (besides libc) attacker redirect control flow after an attack such as buffer-overflow succeeded
I am not sure this is a right place to ask this question or not.
I want to know in previous type of buffer overflow attacks and in modern ones after the attacker succeeded to overwrite return ...
-5
votes
2answers
153 views
What are the security risks of pirating video or music?
In the case of pirating multimedia, be it video or music, which problems may be caused by the video or music file itself? Could a video or an audio file be used to spread malware?
I'm talking about ...
-5
votes
1answer
42 views
History of Buffer Overflow attacks and it's countermeasures? [closed]
I want to know the chronology of BoF attacks and it's countermeasures.
We know it's started about 1972, here's a hypothetical of it:
Buffer Overflow Simple (attack)
ASLR (Contermeasure)
ret2reg ...
2
votes
3answers
160 views
does switching to linux remove existing computer virus
if you change from a malware/spyware infected windows setup to a linux setup will infections migrate to linux if they were on the computer? (when you are hacked/infected is it the op system that is ...
35
votes
8answers
23k views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
5
votes
3answers
152 views
How I can prove that SSH attacks are not from my application?
My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
4
votes
1answer
64 views
Security consequence of Javascript hole in an online chat?
For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat?
What is the worst thing they could do?
-1
votes
2answers
113 views
How do you search for new vulnerabilities? [closed]
I've been asked this question, and I really don't know how would I do it. My answer was to take known vulnerabilities and try to exploit them on a different way, but this is not really a new ...
12
votes
2answers
141 views
Does it make sense to hash a session id before passing it to an advertisement partner?
My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
-4
votes
0answers
59 views
10 Most Common Windows PC Attacks [closed]
I’m trying to make a list of the ten most common attacks a windows computer faces when attacked by an intentional hacker. What I mean by intentional hacker is someone who has set his sights on ...
7
votes
2answers
2k views
Advice on what to do after being hacked?
After running a system scan earlier today, I found that my computer had been infected by a trojan horse. My reason for running the scan was because Windows kept shutting down and then recovering.
...
-4
votes
1answer
135 views
Am I part of a botnet or hack? [closed]
(FYI: my network has been hacked before...see other thread).
I have 2 routers daisy-chained. Router #1 hosts Windows PCs and a VOIP box on subnet 172. Its LAN4 goes to WAN of Router#2, which serves ...
48
votes
7answers
38k views
Can webcams be turned on without the indicator light?
I want to know how secure I am.
I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone.
Recording an end-user's microphone seems to be a ...
-2
votes
0answers
104 views
History of RAT + Strange networking recently… was I hacked again? [closed]
(FYI, my PCs were infected and remote accessed in the past by a friend/stalker, & I’ve reinstalled the network few times already. Recently added Router#2 to double-NAT).
My network has 2 routers ...
7
votes
2answers
245 views
Plain Text Password Reset Vulnerability
If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change ...
4
votes
3answers
164 views
Are CSRF Attacks Really Blind
I'm new to CSRF attacks but don't see how they are always blind.
Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like SurveyMonkey or ...
6
votes
4answers
4k views
How to trace a DDOS attack on a dedicated server and block it?
I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering.
The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
1
vote
4answers
431 views
Can you tell if your computer was hacked and pictures stolen from 2-6 months ago?
Can a home computer, not wireless, be hacked from the outside and have pictures copied? Can I track and see if that happened?
5
votes
2answers
97 views
Password list generation
I've found during a lot of recent pen-tests that companies will use passwords like
c0mp4ny@b(
for a company called "company abc"
Is there any quick and easy way to generate a list of passwords ...
2
votes
6answers
1k views
Efficient way for finding XSS vulnerabilities?
Manual (reliable) way: Put string containing characters that have special meaning in HTML into some parameter of HTTP request, look for this string in HTTP response (and possibly) in other places ...
6
votes
3answers
243 views
Lessen impact of DoS attack on cpu-expensive login?
This is a follow-up to my previous question: Prevent DOS against RSA authentication. This question is also discusses a similar problem: Prevent denial of service attacks against slow hashing ...
2
votes
3answers
86 views
How good is validating source with request.referer than checksum?
I have 2 portals(both are under my control & domain names are different)
In 1st portal, there is a link on click of which User can directly get logged into 2nd portal.
Link which will be hit in ...
19
votes
7answers
4k views
Can I detect web app attacks by viewing my Apache log file?
I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
11
votes
4answers
2k views
Security of passphrase-protected private key
If an attacker obtains a private key that was created with no passphrase, he obviously gains access to everything protected with that key. How secure are private keys set up with a passphrase? If an ...
3
votes
1answer
199 views
Odd user registered and strange behavior. Is it sinister?
I am running a number of web sites. They are all Drupal based, if that is relevant. Recently I have noticed something odd. All my sites have a user registered with the name "zctonglin". I presume ...
-1
votes
1answer
91 views
What service could penetrate my Firewall via UDP on Port 17275?
Has anyone monitored various requests from all over the world on Port 17275 via UDP?
My firewall logs show huge amounts of such requests from lots of different IP Adresses.
I can't find any ...
13
votes
3answers
448 views
What prevents people getting charged over NFC in crowded places?
I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just ...
8
votes
6answers
229 views
Getting credentials using proxy server
Is it possible to get the username and password we enter into sites like facebook using proxy server?
The scenario is like this :
1.My laptop is connected to a network.
2.It is configured to use a ...
1
vote
1answer
72 views
Bypass va_randomize_space and stack-protector
Is a program compiled with the GCC -fstack-protector option and running in a Linux environment with the va_randomize_space kernel variable set to 1, totally protected against buffer overflow attacks?
...
15
votes
4answers
887 views
What is the easiest way to search massive, leaked databases for persons and personal information?
This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be!
A while ago a very MASSIVE database was leaked that contained ...
0
votes
2answers
154 views
WPS vulnerability scanning for handshakes to detect the attack
I was able to sniff the EAP packets from the attacker machine with a wireless card on p-mode, however i was not able to sniff this data off the user using the same card under windows.
Wireshark, did ...
3
votes
1answer
73 views
Voice Call Safety
When i was dealing with an assistant of my bank through mobile call, she asked me to insert my bank login code after a beep.
I was wondering if this procedure is secure against a malicious agent who ...
3
votes
1answer
241 views
secure website against the ping of death attacks
Any programmer is interested in securing his website. So I found this
http://www.youtube.com/watch?v=DB4eMFrQYiY&feature=youtube_gdata_player
which talks about crashing a website using cmd only. ...
0
votes
1answer
262 views
Sanitizing JavaScript to prevent XSS
I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
2
votes
1answer
182 views
How does Binding Images with Malicious Patches happen?
Well I don't know if this technique is still used, but about 5-7 years ago it was a popular way to deliver a malicious patch (Sub-7 , bifrost etc ..) to a victim.
There used to be a program that ...
0
votes
0answers
40 views
Where can I obtain publicly available data about security attacks in Asia and Pacific? [closed]
I am trying to run an analysis of trends of security attacks with respect to world events (i.e. oil price hike induces an increased amount of attacks on oil companies).
The scope of my project is ...
63
votes
8answers
4k views
How would one crack a weak but unknown encryption protocol?
I was reading this interesting question:
Is my developer's home-brew password security right or wrong, and why?
It shows a weak home-brew algorithm developed by "Dave", and the answers discuss ...
13
votes
2answers
267 views
Concrete figures on password cracking in the wild
While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs.
It's easy enough to test online password guessing ...
4
votes
3answers
127 views
Does allowing everyone know when a server process was started pose a security risk?
I recently found that in Microsoft .NET framework an impersonated thread is not allowed to request "time at which the current process was started". This could be done intentionally or this could be ...
0
votes
0answers
21 views
CRIME attack clarrification [duplicate]
I am not understanding CRIME attack completealy..
First an attacker runs a script to caputure the encrypted cookies later using the captured value an attacker try to bruteforce the next cookie ...
3
votes
2answers
418 views
Is this an example of XSS attack?
A scripter sees on certain web pages it's technically possible to include markup like HTML and CSS/JS. It's technically possible to submit a javascript or iframe and have it display to the visitor ...
23
votes
4answers
1k views
Should I change the default SSH port on linux servers?
Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.
If you have a strong password and/or a certificate, is it useful for anything?
...
4
votes
4answers
184 views
What kind of attacks result in an attacker only being able to leak a site's database?
Of the public disclosures I've seen from recently compromised sites, it seems common for only the database to be leaked, rather than the application code, or rather than a complete takeover. Is this ...
13
votes
5answers
5k views
Security risk of PING?
I have been told that PING presents a security risk, and it's a good idea to disable/block it on production web servers. Some research tells me that there are indeed security risks. Is it common ...
9
votes
8answers
4k views
Is it possible to steal money directly from the systems of a big bank?
Sometimes I imagine: My money in the bank is just a floating point number in a mainframe's memory... So, if I just change 1 bit, I will win a lot of money...
The most common way to steal money in ...
0
votes
1answer
287 views
Can active attacks really decrypt a particular AES-256, CBC, PKCS#7 encrypted file?
I recently found out that active attacks are a threat against AES-256, CBC mode, padded with PKCS#7 (the CBC mode in particular. I should supposedly change to EAX to guard against these attacks).
...
0
votes
1answer
134 views
How to conduct a disguised LSA attack against OSPF?
I want to do disguised LSA attacks on OSPF network and be able to more analyze, so I do not know how it works in practice. This is a penetration test.
The attack is described in the address [+]. I ...
0
votes
2answers
138 views
How can I encrypt something user provided without risk of the key being exposed?
So, let's say I have a theoretical service. User has some text they want to encrypt. They pass it to me, and I encrypt it. Then, only I should be able to decrypt it afterwards. Another kicker, it must ...
4
votes
2answers
249 views
How can I find out who owns a block of IPs?
I'm currently going through the logs on my apache install for potential intrustions, and I'm finding a lot of hits for SQL injections and exploit testing, from 173.212.195.* . I'm now trying to find ...
