An attempt by a threat to exploit a weakness in a system.

learn more… | top users | synonyms

204
votes
4answers
86k views

SSL3 “POODLE” Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What ...
120
votes
8answers
13k views

Are “man in the middle” attacks extremely rare?

In "Some thoughts on the iPhone contact list controversy and app security", cdixon blog Chris Dixon makes a statement about web security Many commentators have suggested that a primary security ...
90
votes
8answers
104k views

Can webcams be turned on without the indicator light?

I've made a series of penetration tests in my network and one of the things I've tried was to record webcam and microphone. Recording an end-user's microphone seems to be a stealth thing, but what ...
79
votes
9answers
139k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
78
votes
12answers
11k views

What is different about being targeted by a professional attacker?

It is often said that security tools such as firewalls, antivirus programs, etc. are only effective against random, untargeted attacks. If you are specifically targeted by an intentional, professional ...
78
votes
8answers
10k views

How would one crack a weak but unknown encryption protocol?

I was reading this interesting question: Is my developer's home-brew password security right or wrong, and why? It shows a weak home-brew algorithm developed by "Dave", and the answers discuss ...
74
votes
2answers
19k views

What are rainbow tables and how are they used?

Where can I find one? Is there a pot of gold at the end? How do I protect against them? From the Area51 proposal This question was IT Security Question of the Week. Read the Sep 09, 2011 blog ...
66
votes
4answers
9k views

Can anybody explain XSS? [closed]

I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I never fully understand how XSS ...
60
votes
18answers
4k views

What security resources should a white-hat *developer* follow these days?

What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days? Do Include: Late breaking information on new security issues (RSS, Twitter, etc) A website that ...
53
votes
7answers
19k views

SQL injection — why isn't escape quotes safe anymore?

Raw SQL When you're writing SQL -- for anything that takes human input really, a lot of things have been done to avoid the injection. Everyone that's heard of SQL injection knows that (I'm going to ...
42
votes
7answers
9k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
42
votes
5answers
6k views

New XSS cheatsheet? [closed]

There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0). Is there any other list as good as this, ...
36
votes
8answers
3k views

Should I bother teaching buffer overflows any more?

The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
29
votes
20answers
4k views

How can I prevent my kids from bypassing my computer restrictions?

My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions: Can this damage my computer or corrupt my files? (I have lots of pictures) Is ...
29
votes
2answers
3k views

What actually happens in “low voltage fault attacks”

I understand they are an attack on crypto algorithms as implemented on various processors, but how do they work? The online papers are too complex for me to understand.
26
votes
1answer
3k views

What is an n-day security attack?

There are several attacks types in computer security. For instance, zero-day attacks consist of attacks that use undisclosed exploits. In contrast, what is an n-day attack? Is it a security concern?
26
votes
3answers
2k views

How can an attacker use a leaked private key?

I admit that while I'm a programmer, my crypto/security knowledge is fairly basic. I understand that the potential of leaking private SSL keys is cited as one of the most serious effects of the ...
25
votes
4answers
4k views

Why is using salt more secure?

Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
25
votes
4answers
6k views

Security of passphrase-protected private key

If an attacker obtains a private key that was created with no passphrase, he obviously gains access to everything protected with that key. How secure are private keys set up with a passphrase? If an ...
24
votes
6answers
23k views

Security risk of PING?

I have been told that PING presents a security risk, and it's a good idea to disable/block it on production web servers. Some research tells me that there are indeed security risks. Is it common ...
23
votes
3answers
5k views

How do DoS/DDoS work?

In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
22
votes
8answers
14k views

Can I detect web app attacks by viewing my Apache log file? [closed]

I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
22
votes
2answers
1k views

A phone call hack

The other day, I got a call from a relative with an email problem. After a bit more discussion, it turns out that two days previously, a man phoned my relative: stated he was from microsoft; asked ...
22
votes
2answers
20k views

How to exploit HTTP Methods

Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack. What do ...
22
votes
2answers
2k views

Security implications of rooting Android

My Android smart phone has fancy features that I can get only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone makes me ...
20
votes
5answers
18k views

How to simulate DDoS attacks from the Internet?

The idea behind security tests is easy. You want to know what a hacker can do - you hire a security expert who acts like a hacker to see how far he can get. You want to know what an evil admin can do ...
20
votes
1answer
10k views

Are SSL encrypted requests vulnerable to Replay Attacks?

Are SSL encrypted requests vulnerable to Replay Attacks? If so, what are good options to prevent this?
19
votes
2answers
4k views

How can vending machines be hacked? And how can I prevent it?

I am developing a vending machine and want to make it secure. In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...
19
votes
5answers
19k views

Can I detect a MITM attack?

Based on this question here: Are "man in the middle" attacks extremely rare? Is it possible to detect man-in-the-middle attacks, and if so, how would one go about it? In addition, what if ...
18
votes
2answers
4k views

JavaScript Injection using Man in the Middle Attack

Suppose I am connected to a wifi-hotspot hosted by a malicious attacker. Further, suppose that I am accessing a login page of an fictitious email site tmail.com over insecure HTTP connection. My ...
18
votes
7answers
894 views

Are common passwords at particular risk?

The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
18
votes
5answers
3k views

The Perfect Mousetrap - Can a sandbox system be designed such that it's identical to an actual computer? [duplicate]

In testing suspicious files for malware, the typical method is to search for known malicious code. This is why zero-day malware attacks can be so dangerous — their malicious code is previously unknown ...
18
votes
1answer
3k views

Collision rate for different hash algorithms

Is there any collision rate measure for popular hashing algorithms (md5, crc32, sha-*)? If that depends only from output size, it's quite trivial to measure, but I suppose that depends also of ...
17
votes
5answers
1k views

Rainbow table concept for Prime numbers

Is there a concept where pre-computed tables can be used for prime number factorization ? Is it possible that a computer can generate millions of prime numbers, store it and then effectively determine ...
17
votes
5answers
1k views

How to best defend against Targeted Attacks?

We have seen this attack method grow as part of Advanced Persistent Threats (operation Aurora against Google or the G20 French Finance ministry attacks come to mind) but I have no doubt that even ...
17
votes
6answers
2k views

What security risks does IP spoofing bring?

By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
17
votes
4answers
2k views

Security risks of scanning an unknown QR code

What are the security risks of scanning a QR code from an untrusted source? If the QR code was constructed by an attacker, what can the attacker do to me? Do widely used QR scanners have any known ...
16
votes
3answers
2k views

NTP DDoS Attack on Home Servers

After some half-good script kiddies found out about this exploit or DDoS method, they have been doing it like crazy to websites, game servers, and now my home servers which allows me to work on some ...
16
votes
4answers
2k views

What is the easiest way to search massive, leaked databases for persons and personal information?

This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be! A while ago a very MASSIVE database was leaked that contained ...
15
votes
7answers
3k views

Can hackers detect my operating system?

I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
15
votes
2answers
918 views

Distance between two passwords

It is known that people reuse their passwords across different sites. The reuse can be done in two ways: using exactly same password for two different sites, slight modifying the password of one ...
15
votes
3answers
3k views

Example of a backdoor submitted to an open source project?

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself. I'm researching some source modeling techniques, and we're ...
15
votes
3answers
706 views

What prevents people getting charged over NFC in crowded places?

I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just ...
14
votes
4answers
343 views

What should I look at in the event of a major vendor suffering compromise with unspecified impact?

The specific example I have in mind here is the breach of RSA in March 2011 where attackers got away with critical information which could be the seed information which is used to generate the ...
14
votes
2answers
766 views

Does it make sense to hash a session id before passing it to an advertisement partner?

My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
14
votes
2answers
527 views

Concrete figures on password cracking in the wild

While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs. It's easy enough to test online password guessing ...
13
votes
5answers
3k views

Access to a router's GUI

During a recent visit to a coffee shop, I noticed that they hadn't bothered changing their default user name and password for their router. I realise that someone could log on and be annoying to ...
13
votes
4answers
835 views

How to react when under attack

Just this week someone has been trying to attack the server of the company where I work. I have noticed that they have been trying to brute force root via ssh. fail2ban is handling that well and I ...
12
votes
8answers
1k views

Randomizing MAC addresses on bootup

Since it is possible to set custom MAC addresses, wouldn't it make sense to have a new one as often as possible/convenient (i.e. on bootup)? It would seem that is useful to both attacker and victim ...
12
votes
7answers
504 views

UNIX Servers: Possible intrusions or attacks that do not use any of the open listen sockets

What type of attacks are there that do not use open TCP or open UDP ports? Is it safe to assume that no open ports means no remote access? (Excluding the possibility that there is a badware already ...