A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.
33
votes
5answers
1k views
Why is application crash considered insecure?
If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again.
Crash is a bad behaviour in general and should be avoided, but why are ...
22
votes
6answers
304 views
How to keep an eye on upgrades, patches and security issues for used open-source libraries?
For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
21
votes
3answers
2k views
Should I be disabling Java?
First it was Apple, now it's the US government...
U.S. urges users to disable Java; Apple disables some remotely
New malware exploiting Java 7 in Windows and Unix systems
How serious is this ...
20
votes
2answers
1k views
From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?
I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work?
Please note that I am not looking for ...
18
votes
6answers
844 views
Why are vulnerabilities and lack of security possible in computers?
I have heard about computer vulnerabilities, virus, malware, etc.
Why are these threats possible?
Why doesn't the computer just do the things it is supposed to?
Why do some people write malware, ...
18
votes
4answers
2k views
How secure are my passwords in the hands of Firefox using a Master Password?
I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
18
votes
0answers
568 views
Where can I find a vulnerable operating system to practice pentests on? [duplicate]
I am looking for vulnerable operating systems that are used for practicing pentests. Damn Vulnerable Linux (DVL) is not maintained anymore. Are there any other simillar OS´s to download somewhere that ...
16
votes
8answers
885 views
What cryptographic algorithms are not considered secure?
What cryptographic algorithms are not considered secure, but yet are still widely used and available in standard libraries? If applicable, mention a secure alternative.
16
votes
7answers
422 views
which site do you use to view details of vulnerabilities?
Which site/sites do you guys use to view details of security vulnerabilities?
16
votes
6answers
814 views
is there a guide of general/common IT vulnerabilities?
I'm looking for an updated and comprehensive guide of general/common IT vulnerabilities (general information).
I do not want you to do the job for me, I just want to put me in the right direction: a ...
13
votes
9answers
2k views
Vulnerable OS's?
Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
13
votes
4answers
938 views
Security risks of scanning an unknown QR code
What are the security risks of scanning a QR code from an untrusted source?
If the QR code was constructed by an attacker, what can the attacker do to me? Do widely used QR scanners have any known ...
13
votes
3answers
250 views
Risks of Mullions in High Security Areas
I have a storage space full of information assets. The room itself is sound; there are no windows, the walls go all the ceiling, and there is only a single entrance with two good stout doors and high ...
12
votes
3answers
3k views
Stack Overflows - Defeating Canaries, ASLR, DEP, NX
To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
12
votes
5answers
765 views
Is Google Chrome a better secured browser?
I was amazed that IE 8, Safari, Firefox were hacked so fast. Is it really Chrome so good or it was not tested?
Has anyone other results of independent investigations about security of web browsers?
...
12
votes
2answers
667 views
Can Windows malware harm a Linux computer when it's executed with Wine?
I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables.
I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
12
votes
2answers
313 views
HSM track records?
What are the track records of popular Hardware Security Modules (HSMs)? Have any been found vulnerable to hacking via creative use of the API, timing or power-monitoring attacks, etc?
11
votes
2answers
705 views
Flaw in encryption through pseudorandom number stream (from gpg documentation)
I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity:
When I was in college in the early 70s, I devised what I believed was a brilliant ...
10
votes
1answer
944 views
SSL TLS renegotiation vulnerability - current situation in clients
Reading about the SSL renegotiation problem CVE-2009-3555 one knows that servers supporting old type of renegotiation are vulnerable to data injection. We also have tools to test them (openssl ...
8
votes
3answers
823 views
How can I mitigate the threat that DPAPick poses to my DPAPI protected data?
The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications).
DPAPick was presented at BlackHat ...
8
votes
2answers
360 views
Risks of Using Google Native Client
I was wondering if there were any possible risks in using Google Native Client.
I know it is sandboxed, but the idea still seems risky, and at least leaves another route open for compromising your ...
8
votes
2answers
255 views
Vulnerabilities of Secure Shells
I ssh into my school's engineering computer to submit large programmin projects on a regular basis. Are there any vulnerabilities or worries about using this channel so frequently? What makes a secure ...
8
votes
2answers
473 views
Recent Facebook XSS exploit details
There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a ...
7
votes
4answers
988 views
What kind of attack was this?
So our website was hacked, and these are the things that were done:
Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
7
votes
3answers
4k views
Which webserver is more secure, Apache, nginx or lighttpd?
We are trying to decide which webserver to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?
7
votes
4answers
2k views
OpenBSD vs. NetBSD security
If i search for the two words: OpenBSD and NetBSD on:
http://www.exploit-db.com/
then i get 17 hits regarding security bugs on OpenBSD, and 8 hits regarding security bugs on NetBSD.
So what are ...
7
votes
4answers
7k views
Security issues with allowing Dropbox installations on client PC's in our organisation
Does anyone know if there is any good reasons not to allow Dropbox installations on our client PC's? All the PC's have antivirus installed and running. I know it is an additional attack vector to ...
7
votes
3answers
618 views
Exploit-db like websites, where people can search for security bugs
If someone has to decide between 2 very similar server programs, or operating systems, then it searches on sites like:
http://www.exploit-db.com/search/
so that there he could get enough ...
7
votes
1answer
391 views
Is MediaWiki viable for sensitive information?
I was under the impression that MediaWiki, due to its nature as "open for all Wiki platform", is not tailored towards managing sensitive information.
I found some warnings about this on the MediaWiki ...
7
votes
2answers
547 views
How should one prepare himself for a job interview for penetration testing?
So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this.
Should it revolve around the ability to verbally explain ...
6
votes
4answers
314 views
Worst case scenario of having the ability to remotely write files to disk as admin
I'm working on creating a program ("My Program") that will communicate with another program ("Their Program") via XML commands over a raw TCP/IP connection. Their program allows files to be written to ...
6
votes
2answers
368 views
What risks are inherent with connecting to an untrusted public key server?
Thomas Pornin brought up a good point about PGP key servers in an answer to a recent question, here:
Shouldn't GPG key fetching use a secure connection?
...you should not trust the key ...
6
votes
4answers
256 views
How big is the risk, to enable scripting in the Web browser?
While browsing the web, many websites executes scripts (mainly javascript) that are executed without the user noticing. How big is the risk, to get Malware unnoticed while surfing with scripting ...
6
votes
2answers
337 views
SQL Injection: Drop All Tables
I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
6
votes
2answers
398 views
Where can I find a list of un-patched CVEs for a specific piece of software?
Is there a database of vulnerabilities somewhere, that can be queried in such a way as to return results for all non-patched vulnerabilities for a specific piece of software?
For example, I would ...
6
votes
5answers
441 views
Naming convention based exploits
The book Web Hacking Exposed has a number of instances where the attacker would essentially use patterns in naming conventions to design attacks.
Can any one point me to any study on ...
6
votes
2answers
1k views
Known security vulnerabilities in JBoss 4.x.x?
We just had a breach of one of our servers, where an intruder got access using the JBoss account and started running exploit scripts. The server has been taken offline and is being investigated, but ...
6
votes
2answers
2k views
Implications of Trace/Track Methods on Apache
When performing vulnerability scans using Nessus, against a host running Apache, one expected result is always "HTTP TRACE / TRACK Methods Allowed". While this result only has a base CVSS of 4.3, I ...
6
votes
3answers
191 views
I work on an open source project. Is there a “standard” to reporting security vulnerabilities that we can use?
I work on an (intentionally undisclosed) open source project. To the best of my knowledge, we do not have a discoverable policy on reporting security vulnerabilities.
Rails has their own policy ...
6
votes
2answers
341 views
Videos and visual tutorials on Format String Vulnerabilities
Anyone know of good format string vulnerability tutorials/videos that demo how to test on a web app, such as modifying the URL. I've watched Vivek's videos from securitytube and another from ...
5
votes
6answers
383 views
Determining vulnerable software on client machines
I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as ...
5
votes
2answers
189 views
Software security V.S Hardware security
In theory, perfect software applications are possible but in real life, they don't exist. When attackers know the software, they can send payloads to exploit vulnerabilities and run any arbitrary code ...
5
votes
2answers
326 views
Dangerous hardware ports?
Using Passware Forensic Toolkit you can extract the bitlocker key using live memory dumping through Firewire (either by using an existing Firewire port, or by inserting an pcmcia/expresscard ...
5
votes
3answers
136 views
Disclosure in potential loss-of-life situations, with an uncooperative vendor
I recently discovered a publicly accessible web interface to a highly sensitive bit of lab equipment, the malfunction of which would result in potential loss of life or serious health concerns to a ...
5
votes
1answer
221 views
.JPEG File upload shell via EXIF comments
I came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability.
I don't understand how to actually exploit this condition (or even why ...
5
votes
1answer
89 views
Does every security patch get back ported to every .NET framework? Are there exceptions to the rule?
I can imagine a scenario where Microsoft will create a security patch for some versions of .NET and not others. This might occur in occasions it's too expensive to regression test and back port all ...
5
votes
2answers
228 views
Advice for writing my first application security review
I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...
4
votes
2answers
311 views
Could the bcrypt-ruby binding be vulnerable?
While developing a Ruby on Rails application using a commonly used authentication library named devise, I noticed from the prefix $2a$ of the produced password hashes in the application database that ...
4
votes
1answer
345 views
Hubs, Switches, and Bridges - Flaws and Security Superiority
It just isn't clear to me which choice is good for creating small/intermediate networks.
I know one of flaws of Hubs is that they send all packets to all nodes connected to it, in contrast to Switch ...
4
votes
3answers
311 views
VGA/HDMI Based Attack
Can I attack a PC via the VGA port? Is VGA one way or does it accept data from the other side?
How about HDMI or DVI?
And if so, are there known malware or PoCs to do that? or is it theoretically ...
