Tag Info

New answers tagged

1

I doubt the speaker was "hacked" :) It could either be a defect or broken speaker, or if you ordered it used from Ebay, it could already be paired. I don't think that your neighbors even know you bought a speaker, and looking online aren't any security problems with that specific speaker.


52

This is most likely a blind SQL injection, testing whether you're vulnerable to SQL Injection by checking whether your server takes the specified time or more to reply to the request. This is not actually doing any data edit nor exposing anything; it's just checking whether you're vulnerable. It's also worth noting that this specifically targets MySQL ...


7

The data you've posted there appears to be similar to what an attacker might use for finding blind SQL Injection issues. A common technique for finding these issues is to have a conditional test which, if true, causes a timeout or sleep function to run. That way the attacker can tell whether it was successful by obvserving how long it takes the site to ...


4

Here are some issues about static resources (SR) that I can think of: SR that are not served via HTTPS in combination with cookies that don't have the Secure flag will leak the respective sensitive cookies and also cause browser warnings JS resources that are not served via HTTPS can be modified by an attacker with a privileged network position and can be ...


2

I used the same password on a couple of other (trusted) sites. Maybe you do not want to reuse the same password for important sites, like Email See also this Dropbox story. And XKCD at the bottom of the answer. Email can be easily forged. If one of your friends let you look at the mails "from you", there are certain headers that should indicate ...


0

It seems like the spammers are using a mail server, or perhaps more simply PHP's sendmail function; this has the ability to send an email whilst appearing to be anyone from any specified address. Mostly emails sent with this technique can be caught out by looking at the 'Sent By' field in many email clients: Some email clients include security, to check ...


3

If you made your content malicious, and you have enticed a user to visit your blog then you have already succeeded with your attack. This is just the same as hosting your own website containing malicious content and enticing a user to visit it. The only advantage may be if your target user is likely to trust a *.blogspot.com domain more than any other ...


1

Keyloggers in JavaScript... BeEF injection string (a JavaScript string to allow BeEF to "hook" the browser..." Also.... you can redirect them to www.myevilsite.org (we're an organization ya know.. we've incorporated...) and do whatever they want to you SOP or not and return you right back to the google site w/the end user being none-the-wiser. Google can ...


0

The other answers are great, but I thought I'd share one additional story I remember -- http://www.zdnet.com/article/strongwebmail-ceos-mail-account-hacked-via-xss/ Lance James and crew found an XSS when facing a challenge brought about by StrongWebMail's CEO (in the style of LifeLock). They were able to successfully win the challenge through the use of the ...


0

As a quick and straightfarward answer, you can look to these famous JS worms achieved by exploiting XSS vulnerabilities: Justin.tv worm The cross-site scripting vulnerability that was exploited was that the "Location" profile field was not properly sanitized before its inclusion in a profile page. Orkut "Bom Sabado" worm Orkut, a social ...


3

The most famous has got to be the Samy worm: Samy (also known as JS.Spacehero) is a XSS worm that was designed to propagate across the MySpace social-networking site written by Samy Kamkar. Within just 20 hours of its October 4, 2005 release, over one million users had run the payload making Samy the fastest spreading virus of all time. The ...


0

Here you are: List of 20 famous websites vunerable to XSS 20 Famous websites vulnerable to Cross Site Scripting (XSS) attack including famous newspapers, federal agencies and the biggest fast food restaurant in the world. Notable attacks in 2011 Basically the same question but answered back in 2011. Also Y! got pwned Popular webmail provider ...


1

Technically: Solid understanding of CAN-bus (most important IMHO), and maybe LIN bus - error handling, isolation techniques, message structure, HLPs. Working knowledge of ECU, sensor electronics and control modules Advanced reverse engineering skills (sniffing, protocol analysis, cryptography)


3

Virtually all new connected cars have IT security issues. First of all, when we talk about connected cars, we refer to wireless connection. So having a good knowledge of how 802.1 protocol list and technologies such as LAN function is a must. Also there is a wide range of software that connected cars may use, including operating systems such as Microsoft ...


0

"However, some hours ago, the hacker managed to place a fake order in xt-commerce." Placing a fake order does not amount to hacking. Seems to me thats a normal usage of the site. If they are logging in as an admin, what account are they using? Change the password. If this is because of access to the admin account, then do not discount the fact that ...


19

The commands themselves don't seem particularly concerning - they're a few random-looking searches for particular substrings. However, if your shell history has unexplainable entries, that's a sign that you've been hacked. At this point, what I would recommend is to check your SSH logs to find out when this occurred (and from what IP), and secure your ...


16

It's several text searches. The first one searches for update.creditcard (the dot is a any-single-character wildcard) across all subfolders. (More detail about grep -rnw on StackOverflow.) And if you or another admin didn't run these commands then I'd be very worried and wipe and reinstall that server. The searches themselves are harmless. But if anybody ...


0

I'm not sure what quote you are referring to in the article but I can answer in generally. You certainly could pop the case to remove the battery so phones with fixed batteries don't seem much safer than phones with removable batteries. But a bricked phone is probably safe from the warranty techs. The attack only works if you chill the phone while it is ...


5

You should already be rate-limiting login attempts after a few requests (temporary lockout, CAPTCHA, Clippy popping up and berating you, etc.). This is a common way to stop brute-force attacks, and it will also seriously cripple those trying to do timing attacks. Edit: Also, if you're hashing passwords and looking them up in a database, timing attacks ...


8

When checking strings for equality you need to check that every character matches. Most programming languages will take a short-cut and return False - or Not Equal - as soon as they find a single character that doesn't match. For example, str1 = "1111111111111111" str2 = "1101111111111111" You know that they are not equal as soon as you hit that 0, why ...


1

They r feasibly safe in the sense that in order to compute 2^160 hash computations which r technologically infeasible. And you don't need to worry of downloading an .iso of windows while u can create an .iso from install.esd files from some1's Genuine windows copy(if u r little bit paranoid).


0

Can't we, as a web owner, resolve issue by ourselves? No, simply because you have less bandwidth than your upstream provider... who may have less than a DDoS mitigation service. The attackers throw lots of bandwidth-consuming traffic at you - if you're paying for a 100 Mbps Internet connection, and they throw 1 Gbps traffic at you, you'll be overloaded ...


-3

You can mitigate 99% of the DDOS attacks yourself with a front end load balancer


2

CloudFlare works very well. You can learn more about what they actually do to protect your site from this talk: https://www.youtube.com/watch?v=w04ZAXftQ_Y It's not really possible to deal with such attacks on your own. Maybe in the earlier times, when such attacks were not very sophisticated, you could block off some traffic with your firewall, but now ...


3

Distributed Denial of Service attacks work because they use multiple (sometimes thousands) of hosts sending traffic to your site to overwhelm your resources. This is not something you, as the target, can remedy. Cloud services, like the ones you mentioned, modify and limit the traffic to your site, and to do that, they need access along the path between your ...


-3

Yes, they work. No you cannot generally solve this yourself, but there are things you can do to mitigate SOME of the problem.


4

For a malicious attacker who tries to alter an ISO file while keeping its hash value identical to the hash value of the "genuine" file, the problem is known as a second preimage attack. No such attack is known for SHA-1 right now; if somebody wanted to compute such a second preimage, he would have to pay a cost of about 2160 hash function computations, which ...


3

Using a strong password and 2FA should be sufficient to prevent those who knew your password from succeeding again. Yes, it is very possible that an attacker would have access to servers around the world to try and log into your account, so that's not surprising at all. It is also possible that your account credentials were sold, posted on a public forum. ...


1

This might be best explained by an example: patching of servers. In any decently sized network you're likely to have a myriad of servers. Some running applications, others serving as network infrastructure such as firewalls, routers and so on. All of these run a lot of software. This software is bound to have bugs from time to time. If you don't know which ...


5

If your network is undocumented, then you don't know what all the parts are, how they are set up, or how they interoperate. That in turn means you can't reliably do any of these crucial things: do a full risk assessment identify required controls implement those controls fully measure the controls to confirm they are working monitor the network so you can ...


2

Email is certainly the most common method of pushing malware to a network, but it is not the only one. Also, while malicious files can be delivered as attachments to emails, they can also be presented as links that end users click on, resulting in a drive-by download or perhaps a more traditional virus that the user then has to download and execute ...


2

Email is sent over SMTP. Normally speaking your email client sends the message to a configured SMTP server. That server then uses DNS to resolve the MX (mail exchanger) record for the destination domain (the part after the @ sign). It then sends the message on to that server. If your SMTP server or the DNS it uses were compromised it could send to a ...


0

Have you considered instrumenting OpenSSH to log password attempts. Its common to log thousands of attempts every day for an internet connected host. That will give you a list of several thousand common passwords that have some track record of success AND hint at users other than root which are common targets (e.g. nagios, db admins etc). Once you have a ...



Top 50 recent answers are included