Tag Info

Hot answers tagged

55

It crashed because some input was not processed correctly. An attacker may try to find the code path that leads to the faulty procedure and attempt to execute arbitrary code through potential vulnerabilities. Crashes may give an attacker valuable information about the system and its internal details. Crashes may create temporary vulnerabilities or leave ...


27

As an immediate mitigation, shut down your NTP service until you can get it secured properly. Your computer's clock won't (or at least, shouldn't) drift too much in a day or two. You'll still be seeing the incoming requests, but your server won't be sending replies, so the overall traffic level should drop by 90% or more. Since you're running a home ...


14

The easiest way to test a web server via HTTP request is to inject the bash command through the user agent. Example: $ wget -U '() { :;}; /bin/bash -c "echo vulnerable"' http://example.com/some-cgi-script If a 5XX server error is generated, it means that the server is probably vulnerable to an exploit. For possible attack scenarios, please refer to this ...


13

What is known about possible attack vectors for this exploit? Can it be exploited simply by visiting a website if you haven't applied the update? From [Dailydave] More info on SSLMAGEDON: Our friends at BeyondTrust have a page on the bug now: http://blog.beyondtrust.com/triggering-ms14-066 One thing I think people are missing is that this bug ...


12

This is a great question and one that these organizations have probably put varying amount of thought into. I can think of a few different scenarios regarding systems being out in the open like that. I'll outline them and my thoughts. It's the most expedient thing to do - Placing these computers where they are is efficient for their business processes. ...


12

Well, open port does not necessary mean that anyone can enter. If you have an open port on a router/modem with nothing listening behind, then there is nothing to compromise. Of course, this won't let you work from outside your home either. For this to happen, you have to put the VPN server and make it listen to this open port. What are the ...


11

There are two major attack patterns that can be explored by an attacker armed with an XSS vulnerability that affects an application that uses HTTPOnly cookies. First and foremost an attacker can use an exploitation method similar to the Sammy worm. In this attack pattern the XSS payload uses an XMLHttpRequest to read a CSRF token and perform an action as ...


11

As previous answer have covered most of the scenario in which attacker can get direct benefit by analyzing application crashes. I will recommend read on "Analyze Crashes to Find Security Vulnerabilities in Your Apps". Analyzing crashes for security vulnerabilities may require low level programming skills. As shown in figure 1 every exploit may not lead to ...


10

To generalise Deer Hunter's answer: If an application crashes, it means that what is happening is not expected, and not understood. If it is not expected and not understood, you have no way of knowing whether it is safe. You must therefore assume that it is not safe. Note that simply catching and discarding an unexpected exception is also insecure and ...


10

NTP has one of the highest request to response size ratio, is over UDP, and as such is highly preferred as a method for reflective DNS amplification attacks. Cloudfare was recently the target of the largest attack of this type that exceeded 400Gb/s. They did a good write up on what it's like to be on the receiving end of this attack and how server admins can ...


9

If you ever need to check a suspicious URL, you can use a service like urlquery to check if it has a malicious reputation, the HTTP transactions that take place, any java script that runs, etc etc. Very useful. They also provide a screenshot of what the visited page looks like. http://urlquery.net/


6

I recall hearing there is a range of attacks one can mount against a page which mixes HTTP and HTTPS loaded content Basically the problem is that an HTTP connection can be tampered with. HTTPS is secured, doing three things: Authenticating that the connected server is really the one you want (e.g. google.com). Preventing anyone else from reading the ...


6

%E2%80%8E is percent-encoded UTF-8 for the Unicode character "U+200E". It's used to make the text after it display in left-to-right reading order, such as when displaying an English-language quote in an Arabic text. Unless you've got some seriously broken software, it has no use as an attack. My suspicion is that this was a prank that didn't work out: if ...


6

You're making a lot of assumptions in your question. Without knowing where and how those systems connect into their corporate network you don't have enough information to assess the risk. One possibility is that those systems are connected directly into their inventory and order systems and if you had access to one of those computers you could access or ...


5

This could be evidence of an attempted Poison NULL Byte Attack. PHP and Perl do not use NULL-terminated strings, but most underlying systems (anything C based) do. This can lead to a certain class of attack where the attacker constructs a string that the programmer intended to be impossible. For example, if you were using a C library to include local file ...


5

One thing you can do in addition to the other answers is to contact the police - where I live, DDoS is just as bad as vandalism and is punishable by jail time, and/or other sanctions. Script kiddies or not, over here the police can requests information about the traffic from the ISP, if it's a script kiddie then its easy, they mostly attack from their ...


5

The best solution would be to implicitly deny, i.e. allow exactly the data you want, but no other. You could write regexps matching all input that's not according to your filter to find any odd input, that might be an exploit. It is also a good way to find valid input you omitted in your regex. A username might be fine with [a-zA-Z0-9]+, rather than ...


4

The risk posed by a weak user password is generally rather low, unless you're being attacked by someone really determined to get in to your wife's system (perhaps to gain access to other computers on the network?). This is for two primary reasons: It's easy to defend against the password's use over a network: While I don't generally work with Macs, it is my ...


4

Actually this is very timely as there's a relatively new attack where the data passed in the URL is the attack vector. Reflected File Download abuses non-malicious servers by passing them malicious data and then having it reflected back to users, so it appears to the user to have come from a "trusted" source.


4

According to OWASP: Although it is trivial to spoof the referer header on your own browser, it is impossible to do so in a CSRF attack. Checking the referer is a commonly used method of preventing CSRF on embedded network devices because it does not require a per-user state. This makes a referer a useful method of CSRF prevention when memory is scarce. ...


3

The Verizon Data Breaches report is useful here ( http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf) I can't view it right now but I seem to recall that the top routes in were social engineering, flash, document macros and pdf functionality. Very few these days are in the OS.


3

Under normal circumstances, your application should solely only handle the parameters you expect. If you use a framework though, there might be additional security problems such as "Mass Assignment" (good -read on Ruby on Rails' -dated- security problem). But, as in your example, if the application is only accepting "number" as a POST argument, it should ...


3

The operating system itself will be recognized by attackers, by analysing subtle details of TCP/IP packets. Nmap can do that easily. The SSH server also has a banner (sent as first element upon connection) which can give a lot of clues. Similarly, the software you use will probably be revealed by its dynamics. What you think of as a single, atomic "HTTP ...


3

In the article you linked to, the Javascript code is not being included inside the image file itself per se, it's manifesting within the HTML page that references the image. Untrusted input is being returned inside the image tag without sufficient validation or sanitisation. This is persistent cross-site scripting since the malicious input is being returned ...


3

BREACH and CRIME don't compromise sites, because they are attacks on clients, not on servers. The server is still involved in that, for instance, TLS compression won't be used unless the server agrees; so that, even if the CRIME attack targets the client, the server can refuse to use compression and this indirectly protects vulnerable clients. Both attacks ...


3

First, start by reading the answer to this question-> https://crypto.stackexchange.com/questions/18311/how-does-a-rolling-code-work This answers your first two questions. Also, the transmitter does not periodically send an RF signal, as what starts the authentication conversation is a key fob, not the car. The only way to break out of the sequence would be ...


3

Generally, most drive by browsing attacks are through browser vulnerabilities, which redirect you etc., but some are through PDF render engines, or in fact any input or display functionality. These do not have to be zero-days. Many browsers have vulnerabilities - some that have been known for years and have fixes out.


3

The vulnerability is about hash collisions and not necessary about the size of the request. So yes setting the directive to a higher value is probably not a smart idea (even when you are limiting the post_max_size or any of the other related directives). Also if you need to set it to something like 100000 you should really reconsider what you are doing in ...


2

An application crash is the result of an unexpected and unhandled behaviour. This means there is a bug in the application that crashed, and numerous bugs leads to vulnerabilities. One of the most dangerous kind of crash is ths crash due to memory corruption (Segmentation fault). This kind of bugs can often be exploited to make the vulnerable application ...


2

Essentially all BROWSER vulnerabilities (ie. not vulns. in plugins like java or flash) involve and rely on JavaScript (JS) running. This is because JS is incredibly powerful. When visiting a web page with JS you're running someone's program in your computer. It is your browser that interprets JS and decides what to do. Since it's such a large, powerful, and ...



Only top voted, non community-wiki answers of a minimum length are eligible