New answers tagged

0

(your system uses systemd if entering the ps -A command shows systemd with PID 1) If your operating system uses systemd: tty1 was instantiated by the command /sbin/agetty --noclear --keep-baud console 115200 38400 9600 vt102 as your ps -A extract shows. tty1 is always started on startup. Why? See Lennart Poettering's post "systemd for Administrators, ...


-1

Before going brief ,I have noted the following things from your question : You were visiting the mirror site of some malicious website The official link differs from the url which you have downloaded I was able to reproduce the problem while analysing the mirror site and it was flagged as malware as per the virustotal report Now as you haven't ...


0

In simple terms, a DNS server has (at least) three areas of relevance if compromised: It converts domains to IP addresses, it may also act as a database/administrator for DNS administration, and it also has a generic role as a networked device. If DNS functionality or data can be compromised, then the effect would be that the attacker controls who you ...


0

hypothetically the best attack would be to poison the DNS server to redirect to a malicious site, worms then infect more and more. DNS exploitation would effect traffic and cause all certifications to be revoked. Also Cache poisoning, SYN flood attacks(floodguard would protect),DNS tunneling, DNS highjacking, and there are many others also as some companies ...


0

to clarify, this activity is normal, I see these on other routers as well. Had similar fear, did research. It is a false positive generated by over-broad rulesets.


0

Disconnect the "192.168.1.6" IP address from your router. If your router gateway is "192.168.1.1" then the dos attack log from 192.168.1.6 is another computer connected to your router. If you don't know how to disable it in the router settings, configure a rule in your firewall to block traffic from 192.168.1.6. IF you are in fact experiencing a DoS ...


0

NOPs are just padding. Your best bet is to perform a file analysis, or behavioral analysis (what does it call, what files does it load, etc) of the binary if you are that concerned. You could search the md5/sha1 checksums on sites like Virustotal, ThreatConnect, ThreatCrowd, etc. Since you mentioned you are compiling into Windows, my guess is, the NOPs are ...


1

A replay attack is sending the same packet more than once. Ie: charging your visa 10 times or resending authentication from a different source. What you describe is session hijacking or more specifically "sidejacking".


0

Finally, I got it! Dnsspoof can't modify DNS packet, it can only send another prepared packet with spoofed address. But the real packet comes to victim as first and victim's computer take into consideration only it. The solve our problem is blocking the real packet. I made this using iptables with specific address in hex: # iptables --append FORWARD ...


0

https://www.reddit.com/r/netsec/wiki/meetups/citysec This is ULtimate Resouces you will find in infosec field Period https://www.reddit.com/r/netsec/wiki/start


3

If you used a LiveCD and never/rarely went out of your way to get a new one, yes it would eventually contain old and buggy software. However, the point of the LiveCD is that there is nothing saved in a nonvolatile way, so even if you do manage to luck out on your "risky click of the day" and the browser downloads some malware, all you have to do is hit the ...


6

There is a potential risk in using old versions, but in many cases this risk is less significant than the risk of using reasonably patched system which has all sorts of dubious software installed, and may possibly contain malware. There are of course distributions dedicated for use as a live OS dedicated for doing such things as banking. They are hardened by ...


16

Potentially, yes. That said, many distributions (e.g. Debian, Ubuntu) run package versions which are extremely out of date (years) with few backported security patches, and most people do just fine. You're also usually only exposed on the network you're immediately connected to, so if you're only using a trusted LAN then it's not so much of a concern. ...



Top 50 recent answers are included