Tag Info

Hot answers tagged

23

As an immediate mitigation, shut down your NTP service until you can get it secured properly. Your computer's clock won't (or at least, shouldn't) drift too much in a day or two. You'll still be seeing the incoming requests, but your server won't be sending replies, so the overall traffic level should drop by 90% or more. Since you're running a home ...


20

Here is an example: My dad started getting browser certificate warnings when he went to Gmail. I looked in his hosts (C:\Windows\System32\drivers\etc\hosts ) file and some malware had edited it to redirect requests to gmail and a bunch of other sites to bad IP addresses that I assume the attacker controlled. His browser warned him because those bad IP ...


9

This is a timing attack and the idea (including defenses against it) has been the subject of several academic papers. The short answer to your question of "will this work and has it been used?" is "yes". Some anonymity tools / networks (not sure if TOR does this) introduce their own latency and fake packets to make it harder (see "dependent link padding"). ...


8

So, perhaps a different way to phrase it: if I, as an end user, type in https://someorotherdomain.tld into a browser's address bar (and there's no certificate problem), how likely am I to be talking to someone else due to someorotherdomain's private key having been heartbled? You rightfully ask how likely, which does not demand a clear answer ...


7

NTP has one of the highest request to response size ratio, is over UDP, and as such is highly preferred as a method for reflective DNS amplification attacks. Cloudfare was recently the target of the largest attack of this type that exceeded 400Gb/s. They did a good write up on what it's like to be on the receiving end of this attack and how server admins can ...


5

One thing you can do in addition to the other answers is to contact the police - where I live, DDoS is just as bad as vandalism and is punishable by jail time, and/or other sanctions. Script kiddies or not, over here the police can requests information about the traffic from the ISP, if it's a script kiddie then its easy, they mostly attack from their ...


3

Due to the use of the Diffie-Hellman key exchange, knowing the server's private key does not help a passive-only attacker. If the attacker wants to learn the data, then he must go active. If the attacker knows the server private key, then he can impersonate the server, i.e. run a fake server and let users connect to it. For a full Man-in-the-Middle attack, ...


2

Since I use php as an Apache module instead of CGI, and the http code was 404, I think nothing bad happened, right? right What was the attacker trying to do (or, if he was successful, what did he do) to my system? it was probably the first stage in a multi-stage-attacke(script); this is just the first scan, if you system is vulnerable or not.


2

very simple: the request-method is not GET, but XGET which is not known, thus you server reports error 501 do you run tomcat/jboss or a similar app-serever? i guess, not. this looks like a simple scan from some random skiddo who tries to find vulnerable app-servers but fails with the simple task of generating valid requests; the XGET looks interesting ...


2

fuzzdb contains a collection of web backdoor programs which if they were present on a live server would be a good indication that it had been compromised. This is likely why the A-V tool is reacting to those files. It is a common issue with penetration testing tools that A-V software regards them as malicious. However just downloading them is not going to ...


2

Within a cooperate environment the attacker could have been sniffing from a network switch however that network may employ anti-arp spoofing prevent the attacker from using tools such as SSL strip.. However now the attacker holds the encryption keys he would be able to decrypt all the traffic he had gathered previously.


1

If the client initially starts a connection with the correct server, then no, the attacker can't do anything against that connection, but if the attacker can get the user to attach to them instead, then they can play the middle man and make a connection with the client and a separate connection with the server as long as client certificates are not being ...


1

Yes! If your server is a recursive server, block ALL queries from unknown/untrusted sources, regardless of source port. You should also block queries, even from trusted sources, with a source port of 53. If your server is an authoritative server, yes, you should still block queries with a source port of 53. In fact, you should block queries with any ...


1

Edit: itscooper's answer is the correct interpretation of the vulnerability in the THN article that the question linked to, in my opinion. The answer below is for the general question of how to hide js and have it be executed inside an image object. Historically, you could XSS some browsers by inserting "javascript:" URLs as image sources, because they ...


1

In the article you linked to, the Javascript code is not being included inside the image file itself per se, it's manifesting within the HTML page that references the image. Untrusted input is being returned inside the image tag without sufficient validation or sanitisation. This is persistent cross-site scripting since the malicious input is being returned ...


1

There are 2 ways you can do this, the first is simply writing a script in a text file and saving it as a jpg. This is obviously not an image, but it will work. If you want a real image, you can take your image and use a hexeditor to add your script to the image metadata. This works because the browsers interpret the code as they try to render the image into ...



Only top voted, non community-wiki answers of a minimum length are eligible