An attempt by a threat to exploit a weakness in a system.
96
votes
8answers
8k views
Are “man in the middle” attacks extremely rare?
In
http://cdixon.org/2012/02/12/the-iphone-contact-list-controversy-and-app-security/
Chris Dixon makes a statement about web security
Many commentators have suggested that a primary security ...
64
votes
8answers
4k views
How would one crack a weak but unknown encryption protocol?
I was reading this interesting question:
Is my developer's home-brew password security right or wrong, and why?
It shows a weak home-brew algorithm developed by "Dave", and the answers discuss ...
48
votes
7answers
35k views
Can webcams be turned on without the indicator light?
I want to know how secure I am.
I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone.
Recording an end-user's microphone seems to be a ...
48
votes
18answers
3k views
What security resources should a white-hat *developer* follow these days?
What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days?
Do Include:
Late breaking information on new security issues (RSS, Twitter, etc)
A website that ...
43
votes
6answers
3k views
Can anybody explain XSS to an idiot?
That idiot being me, of course.
I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I ...
43
votes
2answers
5k views
What are rainbow tables and how are they used?
Where can I find one? Is there a pot of gold at the end?
How do I protect against them?
From the Area51 proposal
This question was IT Security Question of the Week.
Read the Sep 09, 2011 blog ...
40
votes
6answers
6k views
SQL injection — but why isn't escape quotes safe anymore?
I haven't seen this question asked, and feel it's a valuable bit of information to have, especially because this is a huge source of mystery and confusion.
Raw SQL
When you're writing SQL -- for ...
31
votes
8answers
2k views
Should I bother teaching buffer overflows any more?
The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
30
votes
7answers
21k views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
30
votes
4answers
2k views
New XSS cheatsheet?
There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0).
Is there any other list as good as this, ...
27
votes
19answers
2k views
How can I prevent my kids from bypassing my computer restrictions?
My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions:
Can this damage my computer or corrupt my files? (I have lots of pictures)
Is ...
23
votes
4answers
1k views
Should I change the default SSH port on linux servers?
Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.
If you have a strong password and/or a certificate, is it useful for anything?
...
19
votes
3answers
2k views
How do DoS/DDoS work?
In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
18
votes
7answers
4k views
Can I detect web app attacks by viewing my Apache log file?
I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
18
votes
1answer
1k views
Collision rate for different hash algorithms
Is there any collision rate measure for popular hashing algorithms (md5, crc32, sha-*)?
If that depends only from output size, it's quite trivial to measure, but I suppose that depends also of ...
18
votes
2answers
651 views
A phone call hack
The other day, I got a call from a relative with an email problem. After a bit more discussion, it turns out that two days previously, a man phoned my relative:
stated he was from microsoft;
asked ...
17
votes
7answers
739 views
Are common passwords at particular risk?
The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
15
votes
4answers
862 views
What is the easiest way to search massive, leaked databases for persons and personal information?
This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be!
A while ago a very MASSIVE database was leaked that contained ...
15
votes
4answers
648 views
Rainbow table concept for Prime numbers
Is there a concept where pre-computed tables can be used for prime number factorization ? Is it possible that a computer can generate millions of prime numbers, store it and then effectively determine ...
15
votes
4answers
1k views
Why is using salt more secure?
Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
15
votes
1answer
822 views
Security implications of rooting your android phone
My android smart phone has fancy features that I can get if and only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone has me ...
14
votes
2answers
1k views
How can vending machines be hacked? And how can I prevent it?
I am developing a vending machine and want to make it secure.
In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...
13
votes
6answers
1k views
What security risks does IP spoofing bring?
By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
13
votes
4answers
254 views
What should I look at in the event of a major vendor suffering compromise with unspecified impact?
The specific example I have in mind here is the breach of RSA in March 2011 where attackers got away with critical information which could be the seed information which is used to generate the ...
13
votes
4answers
936 views
Security risks of scanning an unknown QR code
What are the security risks of scanning a QR code from an untrusted source?
If the QR code was constructed by an attacker, what can the attacker do to me? Do widely used QR scanners have any known ...
13
votes
3answers
434 views
What prevents people getting charged over NFC in crowded places?
I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just ...
13
votes
2answers
259 views
Concrete figures on password cracking in the wild
While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs.
It's easy enough to test online password guessing ...
12
votes
5answers
5k views
Security risk of PING?
I have been told that PING presents a security risk, and it's a good idea to disable/block it on production web servers. Some research tells me that there are indeed security risks. Is it common ...
12
votes
3answers
730 views
Bypassing Address Space Layout Randomization
How effective is ASLR in preventing arbitrary code execution in a buffer overflow type exploit? How hard is it for an attacker to bypass this without simply guessing where the addresses are?
12
votes
6answers
2k views
Can I detect a MITM attack?
Based on this question here:
Are "man in the middle" attacks extremely rare?
Is it possible to detect man-in-the-middle attacks, and if so, how would one go about it?
In addition, what if ...
12
votes
2answers
2k views
How to exploit HTTP Methods
Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack.
What do ...
11
votes
5answers
2k views
Index page has been compromised, suspicious files are showing up
My website has been hacked lately and it has been defaced. Now I have weird files, don't know where they coming from. I just want to know, what of these files are harmful or can cause that I get ...
11
votes
1answer
712 views
How to make a report after a ddos attack? what information do I need to write on the report?
In my company, after a DDOS against a server, my employer asked me to make an analysis of the attack and to write down some stuff.
What do you think I need to write down in my report?
Is there any ...
11
votes
4answers
1k views
Security of passphrase-protected private key
If an attacker obtains a private key that was created with no passphrase, he obviously gains access to everything protected with that key. How secure are private keys set up with a passphrase? If an ...
10
votes
8answers
700 views
Randomizing MAC addresses on bootup
Since it is possible to set custom MAC addresses, wouldn't it make sense to have a new one as often as possible/convenient (i.e. on bootup)?
It would seem that is useful to both attacker and victim ...
10
votes
7answers
338 views
UNIX Servers: Possible intrusions or attacks that do not use any of the open listen sockets
What type of attacks are there that do not use open TCP or open UDP ports?
Is it safe to assume that no open ports means no remote access?
(Excluding the possibility that there is a badware already ...
10
votes
2answers
733 views
Security of Log Files - Injecting malicious code in Log files
As part of my course project I'm trying to understand various security frameworks and best practices.
One of the very popular approach is to maintain Logs. My question is about the security of the ...
10
votes
5answers
823 views
SQL Injection in a Non-Web Application
Does someone know of a good example of a SQL Injection vulnerability that isn't in a web application? What is the user input for this attack? I am looking for a real vulnerability, not speculation. ...
10
votes
5answers
464 views
How to best defend against Targeted Attacks?
We have seen this attack method grow as part of Advanced Persistent Threats (operation Aurora against Google or the G20 French Finance ministry attacks come to mind) but I have no doubt that even ...
10
votes
4answers
301 views
Resources for data on security incidents
What resources exist to research data on actual security incidents?
I would prefer an online resource but offline resources are acceptable. The cost of access should be less than $100 (US) for ...
10
votes
2answers
812 views
10
votes
4answers
536 views
What is the risk of a packet being sniffed when travelling over the internet without SSL/TLS?
We all know to use SSL/TLS to stop people eavesdropping on our connection, but how likely is it that an attacker will actually sniff your unencrypted password or cookie if you don't?
If we exclude ...
10
votes
1answer
331 views
Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks?
Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related ...
10
votes
3answers
435 views
Are there valid reasons for spoofing an address?
This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?.
Are there valid reasons to spoof an address?
10
votes
2answers
191 views
security implications of NULL dereference
Suppose we have code like this:
struct somedata {
int a;
int b;
};
struct somedata *data;
/* ... */
data = malloc(sizeof(struct somedata));
data->a = something;
Now, as you can see, NULL ...
10
votes
2answers
427 views
What is a “pre-play” attack?
I understand what a replay attack is, but I keep reading about a pre-play attack. What is it? Is it when someone intercepts an unused message and blocks the sender so they can't finish using it, and ...
9
votes
8answers
4k views
Is it possible to steal money directly from the systems of a big bank?
Sometimes I imagine: My money in the bank is just a floating point number in a mainframe's memory... So, if I just change 1 bit, I will win a lot of money...
The most common way to steal money in ...
9
votes
2answers
550 views
In the recent DKIM vulnerability, how did someone determine key length by looking at headers?
Having read this recent article : Wired-DKIM vulnerability, I have a couple of questions.
How can one determine the key length that is being used simply by looking at the headers ?
And I'm assuming ...
9
votes
4answers
884 views
Real life examples of web site attacks
I've been put in charge of educating developers on web application security. One way I will be doing this is through an explanation of various web attacks (e.g., OWASP top ten).
In addition to an ...
8
votes
5answers
1k views
Access to a router's GUI
During a recent visit to a coffee shop, I noticed that they hadn't bothered changing their default user name and password for their router.
I realise that someone could log on and be annoying to ...
