Tag Info

Hot answers tagged

55

It crashed because some input was not processed correctly. An attacker may try to find the code path that leads to the faulty procedure and attempt to execute arbitrary code through potential vulnerabilities. Crashes may give an attacker valuable information about the system and its internal details. Crashes may create temporary vulnerabilities or leave ...


27

As an immediate mitigation, shut down your NTP service until you can get it secured properly. Your computer's clock won't (or at least, shouldn't) drift too much in a day or two. You'll still be seeing the incoming requests, but your server won't be sending replies, so the overall traffic level should drop by 90% or more. Since you're running a home ...


13

The easiest way to test a web server via HTTP request is to inject the bash command through the user agent. Example: $ wget -U '() { :;}; /bin/bash -c "echo vulnerable"' http://example.com/some-cgi-script If a 5XX server error is generated, it means that the server is probably vulnerable to an exploit. For possible attack scenarios, please refer to this ...


13

What is known about possible attack vectors for this exploit? Can it be exploited simply by visiting a website if you haven't applied the update? From [Dailydave] More info on SSLMAGEDON: Our friends at BeyondTrust have a page on the bug now: http://blog.beyondtrust.com/triggering-ms14-066 One thing I think people are missing is that this bug ...


11

As previous answer have covered most of the scenario in which attacker can get direct benefit by analyzing application crashes. I will recommend read on "Analyze Crashes to Find Security Vulnerabilities in Your Apps". Analyzing crashes for security vulnerabilities may require low level programming skills. As shown in figure 1 every exploit may not lead to ...


10

To generalise Deer Hunter's answer: If an application crashes, it means that what is happening is not expected, and not understood. If it is not expected and not understood, you have no way of knowing whether it is safe. You must therefore assume that it is not safe. Note that simply catching and discarding an unexpected exception is also insecure and ...


10

NTP has one of the highest request to response size ratio, is over UDP, and as such is highly preferred as a method for reflective DNS amplification attacks. Cloudfare was recently the target of the largest attack of this type that exceeded 400Gb/s. They did a good write up on what it's like to be on the receiving end of this attack and how server admins can ...


9

There are two major attack patterns that can be explored by an attacker armed with an XSS vulnerability that affects an application that uses HTTPOnly cookies. First and foremost an attacker can use an exploitation method similar to the Sammy worm. In this attack pattern the XSS payload uses an XMLHttpRequest to read a CSRF token and perform an action as ...


9

If you ever need to check a suspicious URL, you can use a service like urlquery to check if it has a malicious reputation, the HTTP transactions that take place, any java script that runs, etc etc. Very useful. They also provide a screenshot of what the visited page looks like. http://urlquery.net/


6

I recall hearing there is a range of attacks one can mount against a page which mixes HTTP and HTTPS loaded content Basically the problem is that an HTTP connection can be tampered with. HTTPS is secured, doing three things: Authenticating that the connected server is really the one you want (e.g. google.com). Preventing anyone else from reading the ...


6

%E2%80%8E is percent-encoded UTF-8 for the Unicode character "U+200E". It's used to make the text after it display in left-to-right reading order, such as when displaying an English-language quote in an Arabic text. Unless you've got some seriously broken software, it has no use as an attack. My suspicion is that this was a prank that didn't work out: if ...


5

This could be evidence of an attempted Poison NULL Byte Attack. PHP and Perl do not use NULL-terminated strings, but most underlying systems (anything C based) do. This can lead to a certain class of attack where the attacker constructs a string that the programmer intended to be impossible. For example, if you were using a C library to include local file ...


5

One thing you can do in addition to the other answers is to contact the police - where I live, DDoS is just as bad as vandalism and is punishable by jail time, and/or other sanctions. Script kiddies or not, over here the police can requests information about the traffic from the ISP, if it's a script kiddie then its easy, they mostly attack from their ...


5

The best solution would be to implicitly deny, i.e. allow exactly the data you want, but no other. You could write regexps matching all input that's not according to your filter to find any odd input, that might be an exploit. It is also a good way to find valid input you omitted in your regex. A username might be fine with [a-zA-Z0-9]+, rather than ...


4

The risk posed by a weak user password is generally rather low, unless you're being attacked by someone really determined to get in to your wife's system (perhaps to gain access to other computers on the network?). This is for two primary reasons: It's easy to defend against the password's use over a network: While I don't generally work with Macs, it is my ...


4

Actually this is very timely as there's a relatively new attack where the data passed in the URL is the attack vector. Reflected File Download abuses non-malicious servers by passing them malicious data and then having it reflected back to users, so it appears to the user to have come from a "trusted" source.


3

The Verizon Data Breaches report is useful here ( http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf) I can't view it right now but I seem to recall that the top routes in were social engineering, flash, document macros and pdf functionality. Very few these days are in the OS.


3

Under normal circumstances, your application should solely only handle the parameters you expect. If you use a framework though, there might be additional security problems such as "Mass Assignment" (good -read on Ruby on Rails' -dated- security problem). But, as in your example, if the application is only accepting "number" as a POST argument, it should ...


3

The operating system itself will be recognized by attackers, by analysing subtle details of TCP/IP packets. Nmap can do that easily. The SSH server also has a banner (sent as first element upon connection) which can give a lot of clues. Similarly, the software you use will probably be revealed by its dynamics. What you think of as a single, atomic "HTTP ...


3

BREACH and CRIME don't compromise sites, because they are attacks on clients, not on servers. The server is still involved in that, for instance, TLS compression won't be used unless the server agrees; so that, even if the CRIME attack targets the client, the server can refuse to use compression and this indirectly protects vulnerable clients. Both attacks ...


3

First, start by reading the answer to this question-> https://crypto.stackexchange.com/questions/18311/how-does-a-rolling-code-work This answers your first two questions. Also, the transmitter does not periodically send an RF signal, as what starts the authentication conversation is a key fob, not the car. The only way to break out of the sequence would be ...


2

An application crash is the result of an unexpected and unhandled behaviour. This means there is a bug in the application that crashed, and numerous bugs leads to vulnerabilities. One of the most dangerous kind of crash is ths crash due to memory corruption (Segmentation fault). This kind of bugs can often be exploited to make the vulnerable application ...


2

Essentially all BROWSER vulnerabilities (ie. not vulns. in plugins like java or flash) involve and rely on JavaScript (JS) running. This is because JS is incredibly powerful. When visiting a web page with JS you're running someone's program in your computer. It is your browser that interprets JS and decides what to do. Since it's such a large, powerful, and ...


2

Even with just Html,CSS, and javascript an attacker or malicious site could still attempt to exploit bugs in the browser that would allow them to exploit a machine. Or create dialogs and attempt to trick a user into allowing permission to install malware. This was one example I found by googling javascript and malware install. If anything plugins create a ...


2

Edit (11/14): As far as I know, there are no significant risks to having both a wired and a wireless network connections open at the same time, beyond the risks implied by each one individually. There are risks with having a machine connected to both an internal-only network and to the Internet: it partly defeats the purpose of having a firewall to separate ...


2

The goal of a CSRF attack isn't usually to steal credentials, or to log in though stolen details, but to get a valid account to perform an action chosen by the attacker. For example, if an administrator of a target site were victim of an CSRF attack, they may elevate a non-admin account to an admin account without realizing it. This can either happen though ...


2

There are are two possible explanations that are very likely: It might just be a very simple botnet client that uses a hardcoded string as username. There is a number of press reports saying that botnets owner offer there services to third parties. So while creating a botnet requires a lot of knowledge, the person using the botnet might not have much ...


2

There are 2 ways you can do this, the first is simply writing a script in a text file and saving it as a jpg. This is obviously not an image, but it will work. If you want a real image, you can take your image and use a hexeditor to add your script to the image metadata. This works because the browsers interpret the code as they try to render the image into ...


2

In the article you linked to, the Javascript code is not being included inside the image file itself per se, it's manifesting within the HTML page that references the image. Untrusted input is being returned inside the image tag without sufficient validation or sanitisation. This is persistent cross-site scripting since the malicious input is being returned ...


2

An advanced printer could certainly theoretically be used as a platform for trying to launch an attack over USB, but I'm not sure if there are any proof of concept attacks out there. Many printers basically run their own embedded OS though, so a compromise of the printer should allow for pretty much any connection it has to be able to be used by the ...



Only top voted, non community-wiki answers of a minimum length are eligible