In computing, C (/ˈsiː/, like the letter C) is a general-purpose programming language initially developed by Dennis Ritchie at bell labs Its design provides constructs that map efficiently to typical machine instructions

learn more… | top users | synonyms

5
votes
2answers
282 views

Are more passwords breached via dictionary/bf attacks or via packet-sniffers/key-loggers?

This question has always intrigued me whenever the subject of passwords is brought up. Does anyone have direct experience or a reputable source to answer what percentage of password breaches are ...
2
votes
1answer
320 views

Is there a way to identify the client using SSL Handshake Messages?

I have an SSL Server and it can be connected by two types of Clients, one for which Client Authentication is needed and the other for which Client Authentication is not needed. Is there any mechanism ...
2
votes
2answers
370 views

vulnerable getlogin

I was reading "A taxonomy of Coding Errors" and I have a doubt regarding the point mentioned in C/C++ >> API Abuse >> Often Misused: Authentication(getlogin). I fail to understand the attack vector ...
3
votes
1answer
2k views

Why do I get “Cannot find bound of current function” when I overwrite the ret address of a vulnerable program?

I want to exploit a stack based buffer overflow for education purposes.There is a typical function called with a parameter from main which is given as input from the program and a local buffer where ...
5
votes
1answer
2k views

OpenSSL RAND_poll 'good enough'

We are using OpenSSL for generating IV's and other random data. We initialize it using RAND_poll and, on Windows, RAND_screen. The question is though, if the seed generated by those methods is good ...
11
votes
2answers
253 views

security implications of NULL dereference

Suppose we have code like this: struct somedata { int a; int b; }; struct somedata *data; /* ... */ data = malloc(sizeof(struct somedata)); data->a = something; Now, as you can see, NULL ...
16
votes
4answers
875 views

Does compiling from sources “kinda” protects from buffer overflow attacks?

While discussing buffers overflows, somebody told me that compiling your own binary for an application (with specific compilation flags) instead of using the "mainstream binary" makes it more ...
8
votes
1answer
2k views

Howto seed the PRNG in OpenSSL properly?

I am creating an application which runs on a mobile node with Ubuntu, which does not generate enough entropy bytes to the /dev/random, and does not always stay connected on the Internet to use typical ...