Tag Info

Hot answers tagged

204

What is the Poodle vulnerability ? The "Poodle" vulnerability, released on October 14th, 2014, is an attack on the SSL 3.0 protocol. It is a protocol flaw, not an implementation issue; every implementation of SSL 3.0 suffers from it. Please note that we are talking about the old SSL 3.0, not TLS 1.0 or later. The TLS versions are not affected (neither is ...


85

Disclaimer: I work at a company developing security software to mitigate against targeted attacks. Some of the methods we use are similar to those used by attackers (when clients want to test their systems). For example, one client asked us to test their security by doing targeted [spear] phishing attacks. We emailed only the IT department with a ...


53

All of security can be boiled down to threat modeling, risk assessment, risk management, and risk mitigation. So no, defenses designed to protect against non-targeted attacks are not likely to do well against targeted attacks. What makes a targeted attacker (or what you call a "professional attacker") different? Simply the intelligence and money they're ...


41

"Fault attacks" are something you do on some hardware: that is in your physical hands, but is shielded against intrusion ("tamper resistant"), and does computations with values that you don't know but would like to ("cryptographic keys"). Example of such hardware are smart cards. A classic scenario would be: you have a smart card for a satellite-TV ...


26

To disable SSL v3.0 support: In Clients: Mozilla Firefox Either Install the Mozilla add-on called "SSL Version Control" Or Type about:config into the navigation bar and press [Enter] Accept the warning and proceed Search for tls Change the value of security.tls.version.min from 0 to 1 (0 = SSL 3.0; 1 = TLS 1.0) Chrome Run Chrome with the ...


24

The difference between a random attack and a targeted attack can be summarized nicely: The attacker want N number of remote nodes for DDoSing / Spamming / Phishing / etc. or The attacker wants XYZ data on user2174870's machine specifically. If the attacker is just looking to build a botnet (>>99% of attacks) then simply being harder to crack than the ...


22

If your server does not support SSLv3, then it does not support SSLv3. "Protocol downgrade attacks" are methods to force a client and server to use a protocol version that they both support even though they both know at least one newer version that they would have wished to use, given the choice. Anecdote: I am French. Back in 2005, I was walking in the ...


20

The fragment AND 1=0 always evaluates to false and therefore the query always returns an empty set, e.g. if the SQL fragment in the application is SELECT * FROM users WHERE username = '<placeholder>' then I can turn this query to SELECT * FROM users WHERE username = 'admin' AND 1=0 --' when using admin' AND 1=0 -- as value for the placeholder. ...


20

I've published a blog on how to disable SSLv3 in some of the most common bowsers and server platforms (https://scotthelme.co.uk/sslv3-goes-to-the-dogs-poodle-kills-off-protocol/). This should at least help answer the question on how to fully mitigate POODLE be you a client or a server. Below are the key details. How to protect your server The easiest and ...


18

It would be totally different if you are targeted by state sponsored actors. If you are a high value target, they can employ not just hacking resources like zero-day malware, but also video surveillance, wire-tapping, bribing your friends, email spear phishing, keylogging, breaking into your house, or even kidnapping and torturing you just to obtain some ...


16

This is a local attack and is an attack on the cryptographic algorithm itself. Basically, it is making use of the fact that at low voltage, it is hard to distinguish between a 0 and a 1 in order to fuzz the encryption algorithms in to leaking information about the key. This is of limited use since it requires a system that is securely loading and running ...


11

There have been some discussions about mitigating issues with some record splitting. Namely, what makes Poodle efficient is that padding may use up to a full block (8 bytes with 3DES or RC2, 16 bytes with AES). When this happens, only the last byte of the block is checked by the recipient, which is why the alteration from the attacker gets through with ...


10

This is because SMTP does not offer great spoofing protection, so typically you can connect to a server and claim to be someone else. The best way to fix this would be to set up an SPF record with a hard fail, which is expressed using a- and typically is at the end of the record as -all. You would have to be certain of where your emails are coming from. You ...


9

Usually the most annoying place to try penetrating is a completely custom system on a completely custom kernel (no familiar commands, io paradigms, process management infrastructure, etc. -- these things exist in some form, of course, but only on the one system/target and you have no insight). Lucky for penetrators there are very few of those in the wild. ...


8

SSLv3 protocol is flawed. This cannot be fixed. Generally, an attacker would exploit this by forcing the victim to connect to a server using SSLv3 by forcing connections using higher protocols to fail. TLS_FALLBACK_SCSV attempts to stop the browser/server from falling all the way back to SSLv3 if a higher protocol has already been tried. As you can ...


6

1=0 is always false, so a clause containing AND 1=0 will also always be false. This, like the always-true OR 1=1, can be used to bypass the conditions in a WHERE clause. The OR 1=1 variant is more generally useful (eg. SELECT username WHERE userid=173 to get your username becomes SELECT username WHERE userid=173 OR 1=1 to get every username on the system), ...


5

There are three common ways to deal with the variety of databases out there: Many web applications are tied to a specific database backend, rather than being able to use a variety of backends. For example, if someone's using MediaWiki, you know they're using either MySQL or MariaDB. An attacker can attempt to generate an error condition, then look at the ...


5

There are secure non-POODLE-vulnerable ciphers which you can use with SSLv3 - POODLE only impacts variants with CBC. The RC4 ciphers, for example, are not vulnerable to POODLE. Now, RC4 is a tricky thing. It's considered breakable (but not really actively broken), but since it's the best workaround for things like BEAST and POODLE, it's heavily used and ...


4

You are right that you gain access to the UID of the process/script you exploited. In the case of the Apache identity with no mandatory access control and no proper separation of developer and apache roles, you can: destroy or deface the websites run by your Apache change websites' code to leak all the user database at a fixed URL that you can then consult ...


3

I will just answer in a quote from Jacob Appelbaum, about whom I probably don't have to talk. During the first Congress on Privacy & Surveillance held at EPFL in Switzerland, Applebaum said (I am transcribing): "If the NSA wants to get into any machine or system in the world, we must assume that they are in."


3

"Hacking" is easy. There are tools out there that'll provide a beautiful GUI for you to run any one of a library of exploits, tools that'll break into WiFi, run MiTM, etc. This, along with clumsy, generalized attempts at phishing and other social engineering, makes up a large part of non-targeted attacks. In short, they're unoriginal. This means that most ...


3

A description from isightpartners (English), and description from Eset's blog (Russian). Embedded OLE object in Power Point document somehow can download and install .inf files and executable files.


3

Another angle I haven't found in the answers. http://lasec.epfl.ch/keyboard/ We found 4 different ways (including the Kuhn attack) to fully or partially recover keystrokes from wired keyboards at a distance up to 20 meters, even through walls. We tested 12 different wired and wireless keyboard models bought between 2001 and 2008 (PS/2, USB and laptop). ...


3

The url encodes a Windows Codepage 1251 encoded string, containing (harmless) russian error messages. The transcoded url is: /767/browser-wars-side-show-how-natty-handles-the-load/+++++++++[+Активация+]+Result: использован никнейм "azazalolxd"; вошли; не нашлось формы для отправки; Google translator gives: [ activation ] Result: used the nickname ...


3

MySQL uses /* */ as a block comment and no code will be executed within this block. What you are looking at is three injections, and only one will execute depending on the query that is augmented with this SQL injection attack. This is an efficiency hack to speed up the process of fuzzing a website for SQL Injection. If the injection point doesn't use ...


3

I see where you are going with this, and it's good, out of the box thinking. Unfortunately it isn't likely to work in many cases - if a browser supports SSLv3 chances are it supports bad ciphers too. My advice would be to put this system behind a web proxy where you can control the ciphers and protocols, and let the client connections terminate there. The ...


2

Even though noSQL databases are on the rise, the vast majority of web applications still use some kind of SQL database. The basic SQL features are standardized, so many simple SQL queries work on any SQL database. I doubt there is any database which calls itself SQL and doesn't understand password = '' OR '1'='1'. So in many cases it isn't even required to ...


2

Generally the main use for MitM at the moment is for the attacker to impersonate the website to the victim. The aim being, usually, to get hold of the victim's credentials in order to impersonate them, authenticate correctly to the website and make off with the contents of their bank account, data store, intellectual property etc. This is done, typically, ...


2

They may only have access to the Apache user account, but there may be another exploit or misconfiguration on your particular system that would enable an attacker to elevate their privileges to those of root. Local privilege escalation happens when one user acquires the system rights of another user. Network intruders have many techniques for increasing ...


2

Unfortunately your question is lacking some details, but I can give you some food for thought on this that will help put this in context. First of all there are different protocols that could be used for an attack such as ICMP, or UDP or TCP. Without knowing more about the target or type of traffic generated it's hard to truly predict what impact it would ...



Only top voted, non community-wiki answers of a minimum length are eligible