Tag Info

Hot answers tagged

54

It crashed because some input was not processed correctly. An attacker may try to find the code path that leads to the faulty procedure and attempt to execute arbitrary code through potential vulnerabilities. Crashes may give an attacker valuable information about the system and its internal details. Crashes may create temporary vulnerabilities or leave ...


26

As an immediate mitigation, shut down your NTP service until you can get it secured properly. Your computer's clock won't (or at least, shouldn't) drift too much in a day or two. You'll still be seeing the incoming requests, but your server won't be sending replies, so the overall traffic level should drop by 90% or more. Since you're running a home ...


11

As previous answer have covered most of the scenario in which attacker can get direct benefit by analyzing application crashes. I will recommend read on "Analyze Crashes to Find Security Vulnerabilities in Your Apps". Analyzing crashes for security vulnerabilities may require low level programming skills. As shown in figure 1 every exploit may not lead to ...


10

To generalise Deer Hunter's answer: If an application crashes, it means that what is happening is not expected, and not understood. If it is not expected and not understood, you have no way of knowing whether it is safe. You must therefore assume that it is not safe. Note that simply catching and discarding an unexpected exception is also insecure and ...


9

There are two major attack patterns that can be explored by an attacker armed with an XSS vulnerability that affects an application that uses HTTPOnly cookies. First and foremost an attacker can use an exploitation method similar to the Sammy worm. In this attack pattern the XSS payload uses an XMLHttpRequest to read a CSRF token and perform an action as ...


9

NTP has one of the highest request to response size ratio, is over UDP, and as such is highly preferred as a method for reflective DNS amplification attacks. Cloudfare was recently the target of the largest attack of this type that exceeded 400Gb/s. They did a good write up on what it's like to be on the receiving end of this attack and how server admins can ...


9

If you ever need to check a suspicious URL, you can use a service like urlquery to check if it has a malicious reputation, the HTTP transactions that take place, any java script that runs, etc etc. Very useful. They also provide a screenshot of what the visited page looks like. http://urlquery.net/


6

I recall hearing there is a range of attacks one can mount against a page which mixes HTTP and HTTPS loaded content Basically the problem is that an HTTP connection can be tampered with. HTTPS is secured, doing three things: Authenticating that the connected server is really the one you want (e.g. google.com). Preventing anyone else from reading the ...


6

%E2%80%8E is percent-encoded UTF-8 for the Unicode character "U+200E". It's used to make the text after it display in left-to-right reading order, such as when displaying an English-language quote in an Arabic text. Unless you've got some seriously broken software, it has no use as an attack. My suspicion is that this was a prank that didn't work out: if ...


5

This could be evidence of an attempted Poison NULL Byte Attack. PHP and Perl do not use NULL-terminated strings, but most underlying systems (anything C based) do. This can lead to a certain class of attack where the attacker constructs a string that the programmer intended to be impossible. For example, if you were using a C library to include local file ...


5

One thing you can do in addition to the other answers is to contact the police - where I live, DDoS is just as bad as vandalism and is punishable by jail time, and/or other sanctions. Script kiddies or not, over here the police can requests information about the traffic from the ISP, if it's a script kiddie then its easy, they mostly attack from their ...


4

The risk posed by a weak user password is generally rather low, unless you're being attacked by someone really determined to get in to your wife's system (perhaps to gain access to other computers on the network?). This is for two primary reasons: It's easy to defend against the password's use over a network: While I don't generally work with Macs, it is my ...


3

The Verizon Data Breaches report is useful here ( http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf) I can't view it right now but I seem to recall that the top routes in were social engineering, flash, document macros and pdf functionality. Very few these days are in the OS.


3

Under normal circumstances, your application should solely only handle the parameters you expect. If you use a framework though, there might be additional security problems such as "Mass Assignment" (good -read on Ruby on Rails' -dated- security problem). But, as in your example, if the application is only accepting "number" as a POST argument, it should ...


3

The operating system itself will be recognized by attackers, by analysing subtle details of TCP/IP packets. Nmap can do that easily. The SSH server also has a banner (sent as first element upon connection) which can give a lot of clues. Similarly, the software you use will probably be revealed by its dynamics. What you think of as a single, atomic "HTTP ...


2

An application crash is the result of an unexpected and unhandled behaviour. This means there is a bug in the application that crashed, and numerous bugs leads to vulnerabilities. One of the most dangerous kind of crash is ths crash due to memory corruption (Segmentation fault). This kind of bugs can often be exploited to make the vulnerable application ...


2

Essentially all BROWSER vulnerabilities (ie. not vulns. in plugins like java or flash) involve and rely on JavaScript (JS) running. This is because JS is incredibly powerful. When visiting a web page with JS you're running someone's program in your computer. It is your browser that interprets JS and decides what to do. Since it's such a large, powerful, and ...


2

Even with just Html,CSS, and javascript an attacker or malicious site could still attempt to exploit bugs in the browser that would allow them to exploit a machine. Or create dialogs and attempt to trick a user into allowing permission to install malware. This was one example I found by googling javascript and malware install. If anything plugins create a ...


2

Edit (11/14): As far as I know, there are no significant risks to having both a wired and a wireless network connections open at the same time, beyond the risks implied by each one individually. There are risks with having a machine connected to both an internal-only network and to the Internet: it partly defeats the purpose of having a firewall to separate ...


2

The goal of a CSRF attack isn't usually to steal credentials, or to log in though stolen details, but to get a valid account to perform an action chosen by the attacker. For example, if an administrator of a target site were victim of an CSRF attack, they may elevate a non-admin account to an admin account without realizing it. This can either happen though ...


2

There are are two possible explanations that are very likely: It might just be a very simple botnet client that uses a hardcoded string as username. There is a number of press reports saying that botnets owner offer there services to third parties. So while creating a botnet requires a lot of knowledge, the person using the botnet might not have much ...


2

There are 2 ways you can do this, the first is simply writing a script in a text file and saving it as a jpg. This is obviously not an image, but it will work. If you want a real image, you can take your image and use a hexeditor to add your script to the image metadata. This works because the browsers interpret the code as they try to render the image into ...


2

In the article you linked to, the Javascript code is not being included inside the image file itself per se, it's manifesting within the HTML page that references the image. Untrusted input is being returned inside the image tag without sufficient validation or sanitisation. This is persistent cross-site scripting since the malicious input is being returned ...


2

An advanced printer could certainly theoretically be used as a platform for trying to launch an attack over USB, but I'm not sure if there are any proof of concept attacks out there. Many printers basically run their own embedded OS though, so a compromise of the printer should allow for pretty much any connection it has to be able to be used by the ...


1

There is a Linux version of Skype however, I wouldn't recommend running it on bare metal. Have you considered running a virtual machine on your main Linux system (either Windows or Linux) and running Skype inside that? This way the software inside the virtual machine cannot access the ram of the host. I assume that in such a case the RAM is still ...


1

Yes, certainly. There's Insecure Object Mapping, which is a more general term for "Mass Assignment" in @m1ke's answer. In your case it may be possible to exploit the application by including two number parameters. e.g. https://www.example.com?number=1&number=2 (this is a GET, but the same applies for POST). it all depends on how the application ...


1

There are some cases where this can be exploited. One example I've seen is where the application echoes an entire GET request into the body of the resulting page, for example in a link field or some tracking code. If this is done and the URL isn't encoded properly there could be an XSS issue from a parameter that your application doesn't use.


1

Internet speed test is not an attack vector per se. Flash vulnerabilities might be an attack vector. If Speed test is downloading data from untrusted source - that might be attack vector as well. XSS, SQLi, other web app vulnerabilities, that can be used on the speed test website, could also be further used to attack it's users.


1

If it is turned off in software, it isn't listening for anything and may very well even be powered off. There would be no way for someone to attack it since it wouldn't respond to any attempt to connect with it. It wouldn't even be listening.


1

Oh, it's high risk, but not necessarily for the reasons you think. If an attacker gains access to your emails, the easiest attack vector is to find every email address possible, then email them pretending to be you, and attach some malware to the email. Malware-attached-to-emails is the oldest trick in the book, and still one of the most effective. It's ...



Only top voted, non community-wiki answers of a minimum length are eligible