Tag Info

Hot answers tagged

405

This attack is supposed to be presented 10 days from now, but my guess is that they use compression. SSL/TLS optionally supports data compression. In the ClientHello message, the client states the list of compression algorithms that it knows of, and the server responds, in the ServerHello, with the compression algorithm that will be used. Compression ...


89

Disclaimer: I work at a company developing security software to mitigate against targeted attacks. Some of the methods we use are similar to those used by attackers (when clients want to test their systems). For example, one client asked us to test their security by doing targeted [spear] phishing attacks. We emailed only the IT department with a ...


57

You don't need to lock your front door unless you're a thief. It's the same idea in all relevant respects. Each person needs to take reasonable measures to protect himself and his property from those who would harm him or his property, in accordance with his best judgment of the risks. You buy a lock and lock your front door if you live in a city, in ...


55

All of security can be boiled down to threat modeling, risk assessment, risk management, and risk mitigation. So no, defenses designed to protect against non-targeted attacks are not likely to do well against targeted attacks. What makes a targeted attacker (or what you call a "professional attacker") different? Simply the intelligence and money they're ...


37

As for anything attached to public networks: Reduce your attack surface - can you remove the NAS from the Internet? Can you limit the IPs that are allowed to connect? Increase cost of attack - lockouts are great, but also make sure that you have a complex password and that you change it regularly Monitor access - keep your eye on who successfully logs in ...


35

To add to Thomas Pornin's outstanding answer, I wanted to point out some prior work on the subject of compression and cryptography. Take a look at the following research paper: John Kelsey. Compression and Information Leakage of Plaintext. FSE 2002. That paper describes chosen-plaintext attacks against systems that (a) compress data before encrypting ...


31

It depends. Think of your IP address as the same kinda thing as a real address. If a criminal knows the address of a bank, what can they do? It completely depends on what security is in place. If you've got a firewall running (e.g. Windows Firewall) or are behind a NAT router, you're probably safe. Both of these will prevent arbitrary incoming traffic from ...


27

My first thought is to ask, “Do you have anything valuable that you don’t want someone else to have?” If the answer is Yes then follow up with “Are you doing anything to protect it?” From there you can suggest ways to protect what is valuable (do threat modeling, attack modeling, etc.).


25

The difference between a random attack and a targeted attack can be summarized nicely: The attacker want N number of remote nodes for DDoSing / Spamming / Phishing / etc. or The attacker wants XYZ data on user2174870's machine specifically. If the attacker is just looking to build a botnet (>>99% of attacks) then simply being harder to crack than the ...


24

As the Miranda Rights say: "anything you say can and will be used against you in a court of law". Right after the police finish giving you the Miranda rights, they then say "but if you are innocent, why don't you talk to us?". This leads to many people getting convicted of crimes because it is indeed used against them in a court of law. This is a great video ...


21

Just to add to great Thomas answer, it seems that to successfully leak the cookie value the actual POST body sent should not only be the: Cookie: secret=.... but should contain much more text from the POST header, like so: POST / HTTP/1.1 Host: thebankserver.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 ...


19

The answer is generally it depends. This is really based on the security of your system. Users can create new accounts without restriction If so, it is kind of meaningless to not tell them. You can't have intersecting usernames or email addresses, so you have to inform a new user if their username or email has already been used. An attacker would then be ...


19

It would be totally different if you are targeted by state sponsored actors. If you are a high value target, they can employ not just hacking resources like zero-day malware, but also video surveillance, wire-tapping, bribing your friends, email spear phishing, keylogging, breaking into your house, or even kidnapping and torturing you just to obtain some ...


18

In various jurisdictions you are likely to be fined or put out of business if you don't secure your systems. Specific examples: Holding personal customer data. In the UK, if you don't protect this data appropriately you can be fined. If you handle credit card data and don't implement appropriate security you may find that VISA/Mastercard will prohibit you ...


17

MAC addresses are link-local only. Most attacks don't (have to) come from the same subnet, so most rely on higher-layer addressing. Changing your mac address does little to hide you. There are a variety of problems with changing your MAC address often. One, off the top of my head, would be that DHCP reservations wouldn't work. It could be marginally less ...


15

Here are my recommendations for what users can to defend themselves against SSLstrip, Firesheep, and similar attacks: Install HTTPS Everywhere or ForceTLS. (HTTPS Everywhere is easier to use.) This tells your browser to use the SSL versions of web sites, where possible. If the browser gives you a certificate warning, do not bypass the warning, and do not ...


14

The main ones are: Use SSL sitewide. Don't offer anything over http. Instead, any connection via http should immediately redirect to the main site's landing page via https. Use HTTPS Strict Transport Security. This will tell users' browsers: please, only connect to me over https. This defends against sslstrip and similar man-in-the-middle attacks. Set ...


14

MAC addresses are supposed to be unique worldwide, so that no two devices use the same MAC address. This matters when several devices are on the same link: if two devices have the same MAC address, things do not work well at all, in a hard-to-diagnose way. It is possible to force that by changing your MAC address, but then you did it on purpose; with a ...


14

Knowing, or not knowing, an IPv4 address is nothing special. Every publicly addressable host on the Internet will be attacked regardless of who knows it. The entire Internet is scanned by malicious software so frequently that an old OS install without patches will be compromised in minutes or in seconds. In total, unless the people who know the address ...


13

It doesn't guarantee that the code is free of vulnerability. However, if verification is used appropriately, it can increase assurance (confidence) that the application is secure. Speaking from a very broad perspective, there are two aspects of this problem: Verification. Given a mathematical model of the system and a mathematical specification of the ...


11

Cyber Pearl Harbor is a really stupid term used by people who don't know the first thing about IT security, or those who do but want to get in the newspapers. "Cyber warfare" and "Cyber terrorism" are also examples of terms being bandied about by those looking to get sound bites or a higher IT security budget. It's all complete, total nonsense, and using ...


10

According to this Web page, SIPRNet and NIPRNet are supposed to be air gapped (both from each other, and from the rest of the World). However, they are also accessible from various locations around the World, under control of several countries (it is documented that some services from a pool of countries, which includes Australia, New Zealand, Canada and ...


10

To focus on your individual cases: Absolutely anything he wants. Malware, rootkits, backdoors, keyloggers, the whole shebang. Again, absolutely anything. It's exactly the same as having the USB disk, because he can set up a site where he can download the files he needs, or just download them from existing sites. Wipe the disk, delete system files, write ...


10

Security is not about doing something illegal, it's about someone else doing something illegal (that will impact you). If you don't encrypt your phone calls, someone could know about what all your salesman are doing and can try to steal your clients. If you don't shred your documents, someone could use all this information to mount a social engineering ...


10

While Polynomial has a good answer, I think it may be better to illustrate how hacking actually works to put your mind at ease. Keep in mind for this I'm talking about WAN (internet) IP's. Firstly as has been pointed out there are IP addresses, which is simply a way to look at your router. Everyone on the internet has one, and you can imagine that if ...


10

No, it is not true. Being able to recover the key, while knowing the original message (the "plaintext") and the encrypted message (the "ciphertext") and the algorithm, is called a known plaintext attack. If the attacker not only knows the plaintext and the ciphertext, but actually gets to choose either, then this becomes a Chosen-Plaintext Attack or a ...


10

Usually the most annoying place to try penetrating is a completely custom system on a completely custom kernel (no familiar commands, io paradigms, process management infrastructure, etc. -- these things exist in some form, of course, but only on the one system/target and you have no insight). Lucky for penetrators there are very few of those in the wild. ...


9

There is a training ground just for your purpose: Nebula 2 is a complete linux distribution (virtual machine) for learning purposes to perform many Privilege Escalation vulnerabilities. Nebula takes the participant through a variety of common (and less than common) weaknesses and vulnerabilities in Linux. It takes a look at •SUID files •Permissions ...


8

You could install a site advisor plugin like for example McAfee's site advisor. By doing this you can easier search the domain for any reported maliciousness. For example I search a domain which a big newspaper is getting their adds from I get report back saying generally OK, but community reports say "Adware, spyware, or viruses (1)". I'm sure there ...



Only top voted, non community-wiki answers of a minimum length are eligible