Tag Info

New answers tagged

0

Remove wp-config.txt, wp-config.php.original, etc. (but not wp-config.php!) If those files don't exist, then it's a bug in the scanner. If the file contains passwords (like a database password), change them immediately. How your Wordpress got hacked and how those files were created is anyone's guess. Each installed Wordpress plugin can be vulnerable, as ...


-1

To start analysing if any mail might contain an attack using HTML code, 1st rule is to read this exact same message in plain text. Plain text will never possibly fire anything. To achieve this analysis, as an example, with Thunderbird (which is BTW a pretty good E_mail client to avoid a lot of attacks), just select your suspicious message, and select: View ...


7

If you ever need to check a suspicious URL, you can use a service like urlquery to check if it has a malicious reputation, the HTTP transactions that take place, any java script that runs, etc etc. Very useful. They also provide a screenshot of what the visited page looks like. http://urlquery.net/


6

%E2%80%8E is percent-encoded UTF-8 for the Unicode character "U+200E". It's used to make the text after it display in left-to-right reading order, such as when displaying an English-language quote in an Arabic text. Unless you've got some seriously broken software, it has no use as an attack. My suspicion is that this was a prank that didn't work out: if ...


0

"Filtering" is a generic term for controlling what inputs that reach a piece of code. A "firewall" is a membrane around a resource that filters inputs. If you surround your sandbox with metal detectors to allow guests without metal weapons from entering the sandbox, and also erect a firewall so that the only way anyone can enter the sandbox is via the ...


1

This "preventing outsiders from interfering" is achieved by sandboxing the outsiders, too. When everyone can't leave their sandbox, no one can enter their neighbour's sandbox. Ideally, the code that maintains the sandboxes is as lean as possible, to reduce the number of "outsiders that can interfere" as much as possible.


0

The simplest way is to check for the X-Requested-With header being set. An alternative is to check the Origin for supported browsers. Alternatively, check out the other solutions on the Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet. Double Submit Cookies might be appropriate here as you will not require server side state, although the ...


0

DOM XSS are as dangerous as reflected XSS. To exploit it the attacker always needs to induce a client to create a request (f.e. by clicking some link that still points to the considered safe site). After this has been done, you can execure JavaScript on the client's browser. This can lead to all sort of attacks on the browser!


1

There is no proof that the message was intended for B. So, intruder I can intercept the message signed by A and redirect it to B, authenticating I as A. But what is a harmful attack? For example in a bank-client interaction scenario? If I understand you correctly, you've just described the first part of a Man In The Middle (MITM) attack.


1

Being disconnected results in an annoyance for legitimate users if we make a mistake coding the "misbehavior detection" With proper code review, mistakes like these can be avoided. Killing the client eliminates the need for "clean up" response code. Although it is important to "kill" a malicious client in order to prevent further issues, personally, ...


1

I agree with the rest of the posts saying that a malware is not dangerous if quarantined and if it stays in the quarantine. But I'd like to add a qualifier - this is only true if the software works as intended. Antivirus software, just like any other software out there, especially software that has loads of code to parse untrusted data is bound to have ...


4

The idea of having the "quarantine" option when an antivirus detects an infected file is to avoid false positives. If by chance the antivirus software wrongly flags a file as "bad" when the file is actually something you need, like a critical program (for example Explorer.exe in Windows) such that deleting it might cause the computer to stop working, ...


4

What are the dangers of sending a file to quarantine? There is a slight possibility that the malware scanner falsely tags a valid system file as infected. Sending that file to quarantine could render your system unusable until the file is restored. This has happened on occasion with some major vendors of antivirus for a specific release of definitions. ...


6

So, users are asked a pretty tough question: Do you want this file or do you want to be safe? It's not even a matter of informed decisions, here... Users don't have a degree in computer science and currently don't have the tools to stay secure. Users don't have time and effort to waste for informed decisions. This point has been debated over and over again. ...


14

I think the authors real point is not the safety of a file once quarantined but rather what happens if the user says "no"? Does the system leave it where it is - a potentially big risk, or does it erase it - a potentially big risk. Without knowing what action will be taken if you don't quarantine, or indeed without explaining what quarantine means, the user ...


46

No Quarantine is nothing but a place to store the infected/suspicious files. When you quarantine a file it is deleted from the actual place and moved to the quarantine location (to the path that your anti-virus program has for them). This is something like keeping a zombie inside a jail. Obviously it is not a threat as long as you don't open the cage. In ...


6

Explanations for weak password rules Well, those are obviously bad rules. But here are some possible explanations (or "explanations") for it: Must not start with a number The site owner might actually think that this is a good rule. To prevent for example 1234546 or just prepending a common phrase with '1' (e.g. 1password) Must not have a special ...


3

One reason for enforcing weaker passwords is that a weaker password is easier to remember for the user. When the user forgets their password, an automatic password retrieval procedure must be used. Such a procedure usually entails that a plaintext password is sent to an email account. This offers a lot of attack surface which is outside of the control of the ...


12

If you use the same password for several distinct sites, then you are doing something wrong. Each password shall be site-specific. Therefore, there shall be no reason why the "weaker standards" would have any impact on "all your passwords". (Similarly, there is no rational reason for changing all your passwords on a regular basis. There is a widespread ...



Top 50 recent answers are included