Tag Info

Hot answers tagged

56

It crashed because some input was not processed correctly. An attacker may try to find the code path that leads to the faulty procedure and attempt to execute arbitrary code through potential vulnerabilities. Crashes may give an attacker valuable information about the system and its internal details. Crashes may create temporary vulnerabilities or leave ...


30

The "Code" is "patching" your WordPress installation (wp-comments-post.php) and sending some information to several servers (probably c&c). Also, it is removing itself from the database. In other words, it is a hack. The email that you get is not from Google Official. It is from a Gmail account. The decoded sources are here: ...


27

As an immediate mitigation, shut down your NTP service until you can get it secured properly. Your computer's clock won't (or at least, shouldn't) drift too much in a day or two. You'll still be seeing the incoming requests, but your server won't be sending replies, so the overall traffic level should drop by 90% or more. Since you're running a home ...


23

eval() executes a string of characters as code. You use eval() precisely because the string contents are not known in advance, or even generated server-side; basically, you need eval() because the JavaScript itself will generate the string from data which is available only dynamically, in the client. Thus, eval() makes sense in situations where the ...


16

This is a hacking attempt that contains a special combination of characters that hides the malicious payload code using Base64 encoding. The hidden code relies on an older version of WordPress being used, like version 3.5 for example. In these older versions, there are tricks that have been found. These tricks fool the safeguards that try to prevent scripts ...


14

The easiest way to test a web server via HTTP request is to inject the bash command through the user agent. Example: $ wget -U '() { :;}; /bin/bash -c "echo vulnerable"' http://example.com/some-cgi-script If a 5XX server error is generated, it means that the server is probably vulnerable to an exploit. For possible attack scenarios, please refer to this ...


13

What is known about possible attack vectors for this exploit? Can it be exploited simply by visiting a website if you haven't applied the update? From [Dailydave] More info on SSLMAGEDON: Our friends at BeyondTrust have a page on the bug now: http://blog.beyondtrust.com/triggering-ms14-066 One thing I think people are missing is that this bug ...


12

There are two major attack patterns that can be explored by an attacker armed with an XSS vulnerability that affects an application that uses HTTPOnly cookies. First and foremost an attacker can use an exploitation method similar to the Sammy worm. In this attack pattern the XSS payload uses an XMLHttpRequest to read a CSRF token and perform an action as ...


12

This is a great question and one that these organizations have probably put varying amount of thought into. I can think of a few different scenarios regarding systems being out in the open like that. I'll outline them and my thoughts. It's the most expedient thing to do - Placing these computers where they are is efficient for their business processes. ...


12

Well, open port does not necessary mean that anyone can enter. If you have an open port on a router/modem with nothing listening behind, then there is nothing to compromise. Of course, this won't let you work from outside your home either. For this to happen, you have to put the VPN server and make it listen to this open port. What are the ...


11

As previous answer have covered most of the scenario in which attacker can get direct benefit by analyzing application crashes. I will recommend read on "Analyze Crashes to Find Security Vulnerabilities in Your Apps". Analyzing crashes for security vulnerabilities may require low level programming skills. As shown in figure 1 every exploit may not lead to ...


10

To generalise Deer Hunter's answer: If an application crashes, it means that what is happening is not expected, and not understood. If it is not expected and not understood, you have no way of knowing whether it is safe. You must therefore assume that it is not safe. Note that simply catching and discarding an unexpected exception is also insecure and ...


10

NTP has one of the highest request to response size ratio, is over UDP, and as such is highly preferred as a method for reflective DNS amplification attacks. Cloudfare was recently the target of the largest attack of this type that exceeded 400Gb/s. They did a good write up on what it's like to be on the receiving end of this attack and how server admins can ...


10

eval() is a possible vector for cross-site scripting. Under normal circumstances, an attacker attempting XSS might want to get script <script></script> tags past whatever encoding, filters or firewalls might be in place. If eval() is there operating on user input, it eliminates the need for script tags. Eval is present in many malicious scripts ...


9

If you ever need to check a suspicious URL, you can use a service like urlquery to check if it has a malicious reputation, the HTTP transactions that take place, any java script that runs, etc etc. Very useful. They also provide a screenshot of what the visited page looks like. http://urlquery.net/


8

I recall hearing there is a range of attacks one can mount against a page which mixes HTTP and HTTPS loaded content Basically the problem is that an HTTP connection can be tampered with. HTTPS is secured, doing three things: Authenticating that the connected server is really the one you want (e.g. google.com). Preventing anyone else from reading the ...


6

%E2%80%8E is percent-encoded UTF-8 for the Unicode character "U+200E". It's used to make the text after it display in left-to-right reading order, such as when displaying an English-language quote in an Arabic text. Unless you've got some seriously broken software, it has no use as an attack. My suspicion is that this was a prank that didn't work out: if ...


6

You're making a lot of assumptions in your question. Without knowing where and how those systems connect into their corporate network you don't have enough information to assess the risk. One possibility is that those systems are connected directly into their inventory and order systems and if you had access to one of those computers you could access or ...


5

This could be evidence of an attempted Poison NULL Byte Attack. PHP and Perl do not use NULL-terminated strings, but most underlying systems (anything C based) do. This can lead to a certain class of attack where the attacker constructs a string that the programmer intended to be impossible. For example, if you were using a C library to include local file ...


5

One thing you can do in addition to the other answers is to contact the police - where I live, DDoS is just as bad as vandalism and is punishable by jail time, and/or other sanctions. Script kiddies or not, over here the police can requests information about the traffic from the ISP, if it's a script kiddie then its easy, they mostly attack from their ...


5

The best solution would be to implicitly deny, i.e. allow exactly the data you want, but no other. You could write regexps matching all input that's not according to your filter to find any odd input, that might be an exploit. It is also a good way to find valid input you omitted in your regex. A username might be fine with [a-zA-Z0-9]+, rather than ...


4

The risk posed by a weak user password is generally rather low, unless you're being attacked by someone really determined to get in to your wife's system (perhaps to gain access to other computers on the network?). This is for two primary reasons: It's easy to defend against the password's use over a network: While I don't generally work with Macs, it is my ...


4

Actually this is very timely as there's a relatively new attack where the data passed in the URL is the attack vector. Reflected File Download abuses non-malicious servers by passing them malicious data and then having it reflected back to users, so it appears to the user to have come from a "trusted" source.


4

According to OWASP: Although it is trivial to spoof the referer header on your own browser, it is impossible to do so in a CSRF attack. Checking the referer is a commonly used method of preventing CSRF on embedded network devices because it does not require a per-user state. This makes a referer a useful method of CSRF prevention when memory is scarce. ...


4

There are a few possible scenarios, even after assuming Man in the Middle is not happening. Missing patches: If your system is missing a patch that allows RCE, that is an easy win. There are plenty of remote exploits that exist, and new ones every so often. Mitigation: Patch your system! Are you on a domain? You didn't mention Windows 7 Home or ...


4

It certainly was in the past. See http://blog.ontoillogical.com/blog/2014/07/28/how-to-take-over-any-java-developer/ Maven Central supports HTTPS, as of July 2014. Maven Central requires PGP signatures for artifacts. There's a plugin to verify the signatures: http://www.simplify4u.org/pgpverify-maven-plugin/index.html Now, badguy can write a malicious ...


3

The Verizon Data Breaches report is useful here ( http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf) I can't view it right now but I seem to recall that the top routes in were social engineering, flash, document macros and pdf functionality. Very few these days are in the OS.


3

Under normal circumstances, your application should solely only handle the parameters you expect. If you use a framework though, there might be additional security problems such as "Mass Assignment" (good -read on Ruby on Rails' -dated- security problem). But, as in your example, if the application is only accepting "number" as a POST argument, it should ...


3

The operating system itself will be recognized by attackers, by analysing subtle details of TCP/IP packets. Nmap can do that easily. The SSH server also has a banner (sent as first element upon connection) which can give a lot of clues. Similarly, the software you use will probably be revealed by its dynamics. What you think of as a single, atomic "HTTP ...


3

There are are two possible explanations that are very likely: It might just be a very simple botnet client that uses a hardcoded string as username. There is a number of press reports saying that botnets owner offer there services to third parties. So while creating a botnet requires a lot of knowledge, the person using the botnet might not have much ...



Only top voted, non community-wiki answers of a minimum length are eligible