Tag Info

New answers tagged

0

When requested this script sends data about requester to another server (errorcontent.com) wich decides what to do with request. If response from errocontent.com has src at the begining it is sent back to original requester (it might be zombie in botnet). It could be encoded executable script for zombie to execute. So basically this script is middle tier ...


0

just for your information, its a exploit tracker code. it reports to a C&C server that the exploit worked. its probably part of a multistage infection where 1 criminal gains access, sells that access for money and others use it for criminal intend. My assessment is based on the code presented and other examples of hacked servers I have come across ...


-1

Disclaimer: this answer is provided with no warranty :) It looks to me like it's getting a file from errorcontent.com. I don't see it doing anything with the file unless the first 3 letters of the file are scr in which case it echos it's contents.


37

A zero-day attack is an attack that relies on an undisclosed vulnerability in the design or implementation of a system in order to violate its security. Most commonly, such attacks consist of using zero-day exploits to access information systems or execute code on privileged systems. Such exploits are called 'zero-day' because security administrators have ...


2

Very odd that the attacks came from secureserver.net Being a previous customer of GoDaddy in the past I have only seen that domain name used for mail services. Reference: https://login.secureserver.net/?app=wbe I would preform a whois on the offending ip and report the issue to tech support/abuse consultant. This information is located in the whois report. ...


0

Yes, it is very possible to gain remote code execution (RCE) via programs such as Skype. For example, there was a notorious exploit in the FreePBX client provided with the Elastix 2.2 platform which triggered by merely accepting a call, as can be seen here on youtube, which gives full code exeuction. Also looking through www.exploit-db.com shows you that ...


1

Tor provides you anonymity, but it will not protect you at all from malwares or any other security threats. All recommendation regarding network security must therefore be scrupulously respected in order to ensure your network safety. You do not mention it in your description, but be aware that your setup matches Whonix project, so if you do not want to ...


0

I'm setting up a physically isolated Tor system (with one computer serving as the workstation and another as a Tor gateway), ... I don't know what your "physically isolated" refers to, but since you have a work station connected to a Tor gateway I would assume that you plan to use the workstation to access the internet through the Tor gateway. In this ...


0

(B, C, D, R), which ones can attack if the target is A? B and R. Both B and R can spoof the IP address of E and can see the SYN-ACK reply packet from A to get the sequence number for the final ACK. C cannot because the ACK will be sent via R that will route the packet out onto the internet. D cannot because it will not see the SYN-ACKs over the ...


2

Your protocol is not safe by any means! Example for MitM: A sends random nonce G1 to B C intercepts and sends nonce G1c to B B sends back hash_k(G1c) and random nonce G2 C intercepts and sends hash_k(G1) and nonce G2c to A A verifies hash_k(G1) (is OK), then sends back hash_k(G1 | G2c) C intercepts and sends back hash_k(G1c | G2) B verifies and a ...


1

No. Stick to known protocols such as TLS, Kerberos, SSH & IPSec for key exchanges. Try researching Diffie-Hellman key exchanges and ECDH (Elliptical Curve Diffie-Hellman, the new method of key exchanges like your example).


0

Any CA can emit (and use) a valid certificate for any domain. It doesn't mean it won't be detectable, as the certificate won't be identical to the genuine one, as they would need the private key (presumably securely held by the site being impersonated). Certificate pinning will detect it (either built-in the browser, as some do for select sites, or with an ...


1

There are some news articles about existing backdoors on CAs for use by Security Agencies, but the trustworthiness of these news must be checked, New NSA Leak Shows MITM Attacks Against Major Internet Services There is no evidence that shows the trusted CAs use their certificates for MITM attacks, because sooner or later will be identified or disclosed ...


2

All this is just a matter of definition and vocabulary. I have the impression that in your question you are confusing "exploit" and "threat". A vulnerability is a weakness in a system. This weakness may or may not be addressed by some security measures, may or may not be known. A threat can be anything endangering the system by exploiting or triggering the ...


3

You need to determine what flash controller your device has. Different devices may have different controllers even if they have the same manufacturer - it seems to only depend on what the factory had at the time. One way is to disassemble the device and read the label on the controller chip Another (non-invasive) way is to use software such as ChipGenius. ...


1

As others said, putting SSH on a port other than 22 will make more unlikely to be hit with a random scan. You will be targetted if the attacker is trying to get your server, not any server. I have a server with ssh bound to a random high port. And I have a ssh honeypot on port 22, that will reply to any and every login attempt with a 'access denied' ...


1

This is something of a philosophical question: "is control X helpful?" And as the best answer pointed out, you should also consider "what are the costs (client support, doc exemptions, system support, monitoring support, and I'd throw in direct costs, licensing costs, etc) of control X?" Anything is helpful in certain contexts. It is a good idea to ask ...


0

As others have already noted, changing the default SSH port doesn't gain you much from a security perspective. However, it can still be of advantage to do so if you intend to connect to the machine from a network where the administrators have locked down port 22. (Many schools, workplaces, and free WiFi hotspots block all outgoing traffic except that on ...


0

I have the same requests in my log. All those requests came from Kazakhstan. And all requests has no referrer, or refer the same page as request. Also, there is no requests for other static resources, like images, JS- or CSS-resources. As really paranoid, I think, that this work of some type of vulnerability scanner. Possible, it try to detect version of ...


0

Those URLs look a lot like a buggy crawler and very little like an exploit attempt. A properly formatted hyperlink will start something like <a href="some-url">. The interesting part is what is between the " characters. A lazy coder might just look for pairs of " characters and not pay attention to the context at all. Depending on the structure of ...


-2

The lack of SSL opens the door for MiTM attacks. So getting spyware on a router seems to be the benefit you'd get from the lack of SSL. Otherwise, I think the lack of SSL doesn't help you. You need to find an application attack, get malware in the browser or on the client computer, etc...



Top 50 recent answers are included