Tag Info

Hot answers tagged

148

Is there such a thing? Absolutely. Feeding malicious input to a parser is one of the most common ways of creating an exploit (and, for a JPEG, "decompression" is "parsing"). Is this description based on some real exploit? It might be based on the Microsoft Windows GDI+ buffer overflow vulnerability: There is a buffer overflow vulnerability ...


44

Assuming that you are coming from a BT connection, it's possible that this is part of the BT parental controls program. There is a discussion of a similar looking pop-up here , which seems to tie into what you're seeing, and also a thread here on the BT site which has a link to a process to turn off that setting. To test this theory you could log into ...


38

Agreeing with others to say yes this is totally possible, but also to add an interesting anecdote: Joshua Drake (@jduck), discovered a bug based on a very similar concept (images being interpreted by the OS) which ended up being named "Stagefright", and affected a ridiculous number of Android devices. He also discovered a similar image based bug in libpng ...


13

Wikipedia and big popular sites are mostly safe, as any security holes are found quickly, usually long before the site gets its momentum. Smaller blogs/forums which allow user content are more vulnerable. I used to visit a Russian tech blog several years ago, and the posting form allowed some HTML formatting. Someone managed to include JavaScript code from ...


8

Unrealistic? There was recent critical bug in font definition parsing: https://technet.microsoft.com/en-us/library/security/ms15-078.aspx and libjpeg changenotes are full of security advisories. Parsing files[1] is hard: overflows, underflows, out of bounds access. Recently there were many fuzzing tools developed for semi-automatic detection of input that ...


7

You got the report from your hosting provider. They would be able to tell whether the traffic originated from your server or if it was spoofed. So if your hosting provider is competent, then the report is most likely correct. If I was in your shoes, there are two things I would do. I would ask the hosting provider if they can send a packet capture of some ...


5

To keep you up-to date, you can read about the freshly MFSA2015-78 where Firefox sandboxing mechanism is bypassed by violating the same origin policy. The problem fixed by Mozilla Firefox on the 6th of August 2015. This vulnerability allows attackers to bypass the same-origin policy and execute malicious JS code remotely that will be interpreted in the ...


4

Boot Camp allows you to make two operating systems coexist on the same hard drive (but in distinct areas, called "partitions"), and to choose which one is started when you power up the machine. However, each OS, once started, sees and can access the whole machine. In particular, Windows, once started, is aware of the existence of both partitions, and can ...


4

Your website has been compromised. Any request that includes a URL component listed by you leads to a 301 permanent redirect to a random porn site serving advertisements. GET /phxyy/whatever HTTP/1.1 Host: stratigery.com Accept: */* HTTP/1.1 301 Moved Permanently Date: Sat, 22 Aug 2015 02:17:04 GMT Server: Apache/2.4.16 (Unix) PHP/5.6.12 X-Powered-By: ...


3

IP Fragmented Packets are a form of evasion against network devices. It consists of submitting the payload through smaller pieces to make it more difficult for firewalls and IPS to identify the scan or even an attack. Networking scanning is pretty normal and you have to get prepared to it. Important is to have a firewall well configured in place, limit the ...


3

I don't have any advanced knowledge of security Thats the problem here. Do you have an outbound-filtering iptables/packetfilter (vulgo: firewall) installed? Is the information from my webhost strong evidence that my machine has been compromised and that I need to have them do a reinstall? Probably: yes (reinstall). Your server must be considered ...


2

A script or bot is probably probing for an Unvalidated Redirects and Forwards vulnerability. The reason I say this over SSRF is because the target domain is pastbin.com, and not a domain under control of the attacker. The attacker will have no way of knowing if a SSRF attack worked without validating that the server-side request was made, therefore this is ...


2

A mature wiki software like Wikimedia usually does not allow normal users to embed any scripts in wiki articles. But still, wikis are prime targets for search engine spammers. The structure of wikis is very search-engine friendly which means that wikis often get quite a lot of page rank which in turn exends to any websites linked from them. Also, anything ...


2

I've never before seen anything like this. Is this the only case or has this been known to happen? The scenario you experienced could be innocuous as highlighted in @RоryMcCune' answer as well as it can be a nefarious attempt/attack. Let me explain this last scenario. There is one interesting scenario about your question: as @RоryMcCune said, what ...


1

As others have pointed out, such attacks usually exploit buffer overflows. Regarding the nuts-and-bolts of how, it's called a stack-smashing atack. It involves corrupting the call stack, and overwriting an address to legitimate code to be executed with an address to attacker-supplied code, which gets executed instead. You can find details at ...


1

It's very hard or impossible to exploit this vulnerability over the network as Nic Barker already stated. I want to mention that it's best practice to define a lockout threshold for authentication mechanisms. For example: If a client authentication fails for the 7th time, further authentication for this client is blocked for at least 5 minutes. If a lockout ...


1

While this is certainly a very interesting idea, in practise I think it's pretty much impossible to exploit. We're on a fiber connection here, and even the response time direct to our ISP is all over the place: If the difference you're looking for is a few nanoseconds, you'd literally have to already have access to the local machine to even begin to hope ...


1

If attackers had administrator/system/root level privileges on your computer, they have a lot of possibilities to permanently backdoor your computer. Not many attackers can do this kind of persistence, but it is possible. MBR bootkit - can be cleaned via formatting from live cd BIOS/UEFI malware - see Computrace rootkit HDD firmware - GrayFish malware ...


1

The tool NoSQLMap includes a lot of functionality that directly targets MongoDB. https://github.com/tcstool/NoSQLMap There is an even-better video available that shows all sorts of attacks. You will also find that NoSQLMap calls out to the metasploit-framework, e.g., exploit/linux/misc/mongod_native_helper The project also suggests a viewing of this DEF ...


1

To cite the relevant part from the article: Nonetheless, I later found out that the email contained a tiny image (just one pixel by one pixel). This was the hackers' first attempt to 'fingerprint' my computer. This looks like simply embedding an image located at the attackers server into a mail in the hope that the mail client will do a HTTP request to ...


1

The real AS to feed a false route is any AS along the AS path: 7908 --> 20080 --> 1251 --> |28571| |52888| --> 6447 you see in the 2 wrong announces of route to: 8.8.8.8/32 Hence all traffic toward 8.8.8.8/32 shoud be routed since this attack through ASes: |28571| |52888| --> 1251 --> 20080 --> 7908 ...


1

In theory: Partitions are really just logical divisions of space. There is no security boundary between partitions at all. Any virus running under your credentials could manipulate files. Even if you can't manipulate the files when you're logged on (through NTFS security permissions), a virus that manages to escalate to Administrator privileges can probably ...



Only top voted, non community-wiki answers of a minimum length are eligible