Tag Info

New answers tagged

1

The answer depends on different factors. A few that may or may not apply: What protocol is it? (For example UDP is more prone to security issues in this case as it works statelessly and you might achieve something with a single spoofed packet). Do you consider attacks or only data access. (See above: you might be able to do a DoS attack for a faulty UDP ...


1

Also consider that the hostname localhost is not exactly the same as the IP 127.0.0.1 (it naturally needs to be resolved first), and in most situations relies on either an entry in the hosts file or a resolver/dns server capable of resolving 127.0.0.1. So, be sure you can strictly specify 127.0.0.1 instead of localhost when implementing security measures, ...


6

If the service provides a web interface it might be vulnerable to CSRF attacks, XSS attacks or "same site" scripting. All of these can be triggered by just visiting the attackers external website, which by itself might be caused by malvertising or phishing. For these attacks it does not matter if the service is listening only on localhost, because it is only ...


6

A potential vulnerability would be to compromise a low-privilege account/service and use that as a pivot to access the localhost-bound service. I usually prefer UNIX sockets for that purpose as you can apply user/group permissions on them (that will be transparently handled by the OS, the user won't have to keep yet another password). Plus, they're also a ...


14

The first and main thing is to ensure that the firewall on your host is configured to properly drop incoming packets with source or destination address set to 127.0.0.1. Under normal circumstances, there should be no packet coming from the network and showing such addresses. However an attacker may attempt to forge such packets in order to reach your local ...


0

You may also want to look in ~/Library/LaunchAgents as well as ~Library/LaunchDaemons for a file consisting of a series of numbers and letters. The sequence of these characters will be the same in both directories. Send them both to the trash (you will be asked to login), then empty trash on restart. Another method to unhijack the browser is to Force-Quit ...


5

The concern is less to do with money, and more to do with the number of points of failure, and the potential for being identified. Getting hold of an IP to abuse is easy - just compromise an internet connected system. Setting up a domain name requires money to change hands, which means they need a real way of paying, allowing the authorities to track who ...


0

Depending on where the pentest is being launched, one should be able to determine the DC by querying the SRV records for LDAP, Kerberos, GC, etc. This Microsoft TechNet link has some examples.


0

Jumping on the NMAP bandwagon: also look for machines that have TCP port 389 (LDAP), 636 (LDAPS), 3268 (LDAP Global Catalog), or 3269 (LDAPS Global Catalog). The last two are particularly juicy, since only a DC can be a Global Catalog server.


2

Phishing is mostly a social attack, i.e. you might setup up a site which looks like a trusted one (i.e. copy of Paypal), give it a hostname which might fool the user (e.g. https-paypal.encrypted.whatever) so that the URL and links look trustable, put it together with some story ("detected hacking attempt, needs verification..") in a mail and wait for ...


2

Phishing is a way of getting credentials by manipulating the victim in some way to give his credentials. An example will be a fake login page. DNS spoofing is a method to alter the DNS information and bringing victim to your personalized server or not letting him access the website completely. It's one application is used in a variant of evil twin attack.


1

This sounds like a component of a broader targeted attack involving spear phishing. You might send a link to the victim for Banking.Example.com and begin your DNS reply spam for that domain. That way, you know which domain they are trying to resolve with DNS.


2

It appears that secure DNSSec recursive queries are not possible to enforce. According to the notes in this IETF draft: DNSSEC is not an enforcement mechanism, it's a resource. When I see folks voice opinions that DNSSEC's recommended operation has to strictly followed, my gut reaction is that these folks have forgotten the purpose of all of our ...


0

You could try a service such as cloudflare, with multi next hop locations in each country region, they're able to correlate bad source to geolocation ip packets and drop them before they hit your servers.


1

Well, DANE can, in conjunction with Public Key Pinning' (HPKP), protect your current users from malicous use (even if the DANE record changed, the browsers will still remember the HPKP headers and fail to connect). This does not protect new connections. But since HPKP has a life of at least 1 month it adds reasonably safety to your 'stack'.


3

Given that the VPN headers around each packet will take up space and then disappear, they could be looking at packet size vs MTU to come up with a way of guessing (it would be a wild guess) that the user is behind a VPN because their packets are consistently smaller than other streams. An even wilder guess would be that they are looking at round trip time ...


5

Finding out that a user is using a VPN service provider isn't that difficult. Most of them have static IP addresses for their exit gateways, so it could just be using a list of known IP addresses to identify VPNs. And even when they don't have a list, a simple reverse DNS lookup might tell them that the IP has a hostname which is obviously a VPN provider and ...


0

There are lots of ways besides editing the hosts file: Your web browser got hijacked by some malware to request a different domain than you entered. Your router got hacked. Remotely exploitable vulnerabilities in consumer-grade routers are not unheard of. Or you are using a public network which isn't trustworthy. Your DNS server might be compromised. You ...


1

I think the linked Wikipedia article covers it quite simply. Consider how many home users like to use a Dynamic DNS service to be able to reach their computer no matter what IP it has. The one computer reports its IP address on a regular basis, to a service which updates the DNS entry whenever the address changes. That way the DNS entry will always point to ...



Top 50 recent answers are included