Tag Info

New answers tagged

11

There have been some discussions about mitigating issues with some record splitting. Namely, what makes Poodle efficient is that padding may use up to a full block (8 bytes with 3DES or RC2, 16 bytes with AES). When this happens, only the last byte of the block is checked by the recipient, which is why the alteration from the attacker gets through with ...


8

SSLv3 protocol is flawed. This cannot be fixed. Generally, an attacker would exploit this by forcing the victim to connect to a server using SSLv3 by forcing connections using higher protocols to fail. TLS_FALLBACK_SCSV attempts to stop the browser/server from falling all the way back to SSLv3 if a higher protocol has already been tried. As you can ...


1

The techniques are the same of random, untargeted attacks. What IMHO really differentiate these kind of attacks are: available time available money to buy undisclosed exploit effort spent attacked attack surface post-exploitation works Generally with a random, untargeted attacks: its effort in terms of time will be limited mostly to a single ...


10

This is because SMTP does not offer great spoofing protection, so typically you can connect to a server and claim to be someone else. The best way to fix this would be to set up an SPF record with a hard fail, which is expressed using a- and typically is at the end of the record as -all. You would have to be certain of where your emails are coming from. You ...


1

If you don't want to give away your site's name to these other websites, you can also test it with... openssl s_client -ssl3 -host <your host name> -port 443 If it doesn't connect then you're ok. But also make sure that your openssl is working properly with your site... openssl s_client -host <your host name> -port 443 Disabling sslv3 also ...


5

There are secure non-POODLE-vulnerable ciphers which you can use with SSLv3 - POODLE only impacts variants with CBC. The RC4 ciphers, for example, are not vulnerable to POODLE. Now, RC4 is a tricky thing. It's considered breakable (but not really actively broken), but since it's the best workaround for things like BEAST and POODLE, it's heavily used and ...


3

I see where you are going with this, and it's good, out of the box thinking. Unfortunately it isn't likely to work in many cases - if a browser supports SSLv3 chances are it supports bad ciphers too. My advice would be to put this system behind a web proxy where you can control the ciphers and protocols, and let the client connections terminate there. The ...


22

If your server does not support SSLv3, then it does not support SSLv3. "Protocol downgrade attacks" are methods to force a client and server to use a protocol version that they both support even though they both know at least one newer version that they would have wished to use, given the choice. Anecdote: I am French. Back in 2005, I was walking in the ...


20

I've published a blog on how to disable SSLv3 in some of the most common bowsers and server platforms (https://scotthelme.co.uk/sslv3-goes-to-the-dogs-poodle-kills-off-protocol/). This should at least help answer the question on how to fully mitigate POODLE be you a client or a server. Below are the key details. How to protect your server The easiest and ...


26

To disable SSL v3.0 support: In Clients: Mozilla Firefox Either Install the Mozilla add-on called "SSL Version Control" Or Type about:config into the navigation bar and press [Enter] Accept the warning and proceed Search for tls Change the value of security.tls.version.min from 0 to 1 (0 = SSL 3.0; 1 = TLS 1.0) Chrome Run Chrome with the ...


203

What is the Poodle vulnerability ? The "Poodle" vulnerability, released on October 14th, 2014, is an attack on the SSL 3.0 protocol. It is a protocol flaw, not an implementation issue; every implementation of SSL 3.0 suffers from it. Please note that we are talking about the old SSL 3.0, not TLS 1.0 or later. The TLS versions are not affected (neither is ...


2

Hacking is a serious crime, and gets you in even a more of a problem. It seems you have some details, try to gather logs, screenshots etc. and get to the nearest police station and report the crime. Commiting a crime in awnser to a crime is NOT a solution.


3

A description from isightpartners (English), and description from Eset's blog (Russian). Embedded OLE object in Power Point document somehow can download and install .inf files and executable files.


3

Another angle I haven't found in the answers. http://lasec.epfl.ch/keyboard/ We found 4 different ways (including the Kuhn attack) to fully or partially recover keystrokes from wired keyboards at a distance up to 20 meters, even through walls. We tested 12 different wired and wireless keyboard models bought between 2001 and 2008 (PS/2, USB and laptop). ...


16

This is a local attack and is an attack on the cryptographic algorithm itself. Basically, it is making use of the fact that at low voltage, it is hard to distinguish between a 0 and a 1 in order to fuzz the encryption algorithms in to leaking information about the key. This is of limited use since it requires a system that is securely loading and running ...


41

"Fault attacks" are something you do on some hardware: that is in your physical hands, but is shielded against intrusion ("tamper resistant"), and does computations with values that you don't know but would like to ("cryptographic keys"). Example of such hardware are smart cards. A classic scenario would be: you have a smart card for a satellite-TV ...


-1

Addslashes you will fall in the all mighty encoding... Its basicly a skill war in terms the one that knows more.... Thruth is we say it like that because its sopose to make ppl like you do what your doing unfortunatly in the incorrect place lol. Since the point is to you to learn how to write decent code and not just copy a recepie i will leave some hints, ...


3

I will just answer in a quote from Jacob Appelbaum, about whom I probably don't have to talk. During the first Congress on Privacy & Surveillance held at EPFL in Switzerland, Applebaum said (I am transcribing): "If the NSA wants to get into any machine or system in the world, we must assume that they are in."


1

To keep it as short and sweet as possible: (though I can add detail later if the community demands) Random attacks Generally target a specific vulnerability in a specific version of a specific software. The goal here is to try it against every machine possible and not every machine will have the vulnerability, and IDS/IPS solutions will not let the same ...


3

"Hacking" is easy. There are tools out there that'll provide a beautiful GUI for you to run any one of a library of exploits, tools that'll break into WiFi, run MiTM, etc. This, along with clumsy, generalized attempts at phishing and other social engineering, makes up a large part of non-targeted attacks. In short, they're unoriginal. This means that most ...


2

FWs, antivirus and other defenses geared around prevention can only effectively block attacks that are proven bad. IE if a certain type of traffic or a certain file is bad 100% of the time, it can effectively be blocked. While prevention tools may not help with more advanced threats, they have a use in blocking known bad traffic. There's a lot of bad ...


85

Disclaimer: I work at a company developing security software to mitigate against targeted attacks. Some of the methods we use are similar to those used by attackers (when clients want to test their systems). For example, one client asked us to test their security by doing targeted [spear] phishing attacks. We emailed only the IT department with a ...


2

It is technically possible to put enough controls in place to guarantee you won't be compromised from a IT perspective. The extreme case is to shut off and remove all computer equipment. See? No computers means no computers will be compromised. OK, so how about we allow computers, but no networks: everything air-gapped. We're not guaranteed invulnerable, ...


24

The difference between a random attack and a targeted attack can be summarized nicely: The attacker want N number of remote nodes for DDoSing / Spamming / Phishing / etc. or The attacker wants XYZ data on user2174870's machine specifically. If the attacker is just looking to build a botnet (>>99% of attacks) then simply being harder to crack than the ...


9

Usually the most annoying place to try penetrating is a completely custom system on a completely custom kernel (no familiar commands, io paradigms, process management infrastructure, etc. -- these things exist in some form, of course, but only on the one system/target and you have no insight). Lucky for penetrators there are very few of those in the wild. ...


18

It would be totally different if you are targeted by state sponsored actors. If you are a high value target, they can employ not just hacking resources like zero-day malware, but also video surveillance, wire-tapping, bribing your friends, email spear phishing, keylogging, breaking into your house, or even kidnapping and torturing you just to obtain some ...


53

All of security can be boiled down to threat modeling, risk assessment, risk management, and risk mitigation. So no, defenses designed to protect against non-targeted attacks are not likely to do well against targeted attacks. What makes a targeted attacker (or what you call a "professional attacker") different? Simply the intelligence and money they're ...


0

Perhaps you are being hack via man in the middle? Scan for mac adresses on your network. With cain and abel you can see who is on it, and then if they are on it, you can report it to the feds.


2

Unfortunately your question is lacking some details, but I can give you some food for thought on this that will help put this in context. First of all there are different protocols that could be used for an attack such as ICMP, or UDP or TCP. Without knowing more about the target or type of traffic generated it's hard to truly predict what impact it would ...


1

I think you're putting two encryption forms together and getting confused. First you need to look at encryption in two ways encrypting data and encrypting a tunnel. Encryption of data is done at the endpoint before the information is send over the wire. This can be done using Symmetric or Asymmetric encryption. Symmetric encryption is an exchange of the ...


1

A man-in-the-middle attack, by definition, involves impersonation. The basic idea is something like this: Alice wants to have a conversation with Bob. Mallory tricks Alice into sending the first message to him instead of Bob (exactly how can vary greatly). Mallory contacts Bob, pretending to be Alice, and passes on Alice's message. Bob replies to ...


1

The answer to your question is: no. MiTM is done to steal information that the user THINKS they are sending to a legitimate site. HOW it accomplishes this usually involves "impersonating" whatever party you're trying to send your data to, and sometimes involves traffic decryption (although most of the time, decryption isn't feasible without some sort of ...


1

It depends. With some ciphers, it is possible to passively eavesdrop the communication once you have the private key. It may be done even for connections wiretapped before you obtained a copy of the private key used. However, for another class of ciphers, those providing forward secrecy (PFS), the client and server generate a new ephemeral key for the ...


2

Generally the main use for MitM at the moment is for the attacker to impersonate the website to the victim. The aim being, usually, to get hold of the victim's credentials in order to impersonate them, authenticate correctly to the website and make off with the contents of their bank account, data store, intellectual property etc. This is done, typically, ...


2

They may only have access to the Apache user account, but there may be another exploit or misconfiguration on your particular system that would enable an attacker to elevate their privileges to those of root. Local privilege escalation happens when one user acquires the system rights of another user. Network intruders have many techniques for increasing ...


4

You are right that you gain access to the UID of the process/script you exploited. In the case of the Apache identity with no mandatory access control and no proper separation of developer and apache roles, you can: destroy or deface the websites run by your Apache change websites' code to leak all the user database at a fixed URL that you can then consult ...


3

MySQL uses /* */ as a block comment and no code will be executed within this block. What you are looking at is three injections, and only one will execute depending on the query that is augmented with this SQL injection attack. This is an efficiency hack to speed up the process of fuzzing a website for SQL Injection. If the injection point doesn't use ...


2

Even though noSQL databases are on the rise, the vast majority of web applications still use some kind of SQL database. The basic SQL features are standardized, so many simple SQL queries work on any SQL database. I doubt there is any database which calls itself SQL and doesn't understand password = '' OR '1'='1'. So in many cases it isn't even required to ...


1

Not trivially. What you're talking about is Public Key Infrastructure (PKI). The current implementation of it for SSL/TLS works in a hierarchical trust model. Your browser (and your OS) has a set of Certificate Authority (CA) certificates baked into it, which it trusts. Each certificate contains a CA's public key. When an SSL certificate is created for a ...


20

The fragment AND 1=0 always evaluates to false and therefore the query always returns an empty set, e.g. if the SQL fragment in the application is SELECT * FROM users WHERE username = '<placeholder>' then I can turn this query to SELECT * FROM users WHERE username = 'admin' AND 1=0 --' when using admin' AND 1=0 -- as value for the placeholder. ...


6

1=0 is always false, so a clause containing AND 1=0 will also always be false. This, like the always-true OR 1=1, can be used to bypass the conditions in a WHERE clause. The OR 1=1 variant is more generally useful (eg. SELECT username WHERE userid=173 to get your username becomes SELECT username WHERE userid=173 OR 1=1 to get every username on the system), ...


0

well it depends on so many things i will be "including some" . 1 web application most web attack are based on scanning lets take the Wordpress as an example you are trying to inject the database of an Wordpress based website .. & wordpress is not sql-I vulnerable but perhaps the plug-ins are vulnerable . you make a scan for the plug-ins installed on the ...


5

There are three common ways to deal with the variety of databases out there: Many web applications are tied to a specific database backend, rather than being able to use a variety of backends. For example, if someone's using MediaWiki, you know they're using either MySQL or MariaDB. An attacker can attempt to generate an error condition, then look at the ...


3

The url encodes a Windows Codepage 1251 encoded string, containing (harmless) russian error messages. The transcoded url is: /767/browser-wars-side-show-how-natty-handles-the-load/+++++++++[+Активация+]+Result: использован никнейм "azazalolxd"; вошли; не нашлось формы для отправки; Google translator gives: [ activation ] Result: used the nickname ...


0

If you have coded your application to properly sanitize user input, encode special characters before they get to the back-end, and reject data that is unexpected, you should have nothing to worry about.


1

You seem a bit confused about the concept. An open redirect is just a redirect. You browse to http://google.net/redirect?http://stackexchange.com and it tells your browser: please go to http://stackexchange.com. That it is an open redirect means that I can make it send you to anywhere (like an attacker web page), usually by embedding in the link the page ...


0

There are already loads of great answers already on CSRF here so I thought I would extend on them by offering an alternative approach to protecting against such attacks. If you are using Apache I would recommend using mod_evasive as this will protect against brute force attacks and also DOS attacks. If you are running IIS you can use the Dynamic IP ...



Top 50 recent answers are included