Hot answers tagged exploit
320
This attack is supposed to be presented 10 days from now, but my guess is that they use compression.
SSL/TLS optionally supports data compression. In the ClientHello message, the client states the list of compression algorithms that it knows of, and the server responds, in the ServerHello, with the compression algorithm that will be used. Compression ...
29
Option 1 may introduce a number of non-security related issues anyway:
The resulting URL may be cached by the browser, or bookmarked, causing users to resubmit.
The resulting URL may be shared by users, causing third parties to submit.
The URL may be sent to your browser vendor, who may hit the site.
But this is about security, and it introduces a few ...
28
To add to Thomas Pornin's outstanding answer, I wanted to point out some prior work on the subject of compression and cryptography. Take a look at the following research paper:
John Kelsey. Compression and Information Leakage of Plaintext. FSE 2002.
That paper describes chosen-plaintext attacks against systems that (a) compress data before encrypting ...
28
Here is what I do...
I assume my data is out there... I don't bother looking for it. Somebody will run across my SSN eventually and it will get scraped up into a database and sold around the world.
As far as I'm concerned, searching for my data has little value and certainly won't put the horse back into the barn. In fact, even searching for my SSN or ...
27
The exploit is what delivers the payload.
Take a missile as an analogy. You have the rocket and fuel and everything else in the rocket, and then you have the warhead that does the actual damage. Without the warhead, the missile doesn't do very much when it hits. Additionally, a warhead isn't much use if it goes off in your bunker without a rocket delivering ...
26
Address Space Layout Randomisation (ASLR) is a technology used to help prevent shellcode from being successful. It does this by randomly offsetting the location of modules and certain in-memory structures. Data Execution Prevention (DEP) prevents certain memory sectors, e.g. the stack, from being executed. When combined it becomes exceedingly difficult to ...
23
There is quite a lot of them:
Metasploitable: Currently there are 2 versions.
Kioptrix: Currently 4 challenges.
Hackademic: Apparently 2 VM, check 1 and 2.
pWnOS: Currently 2 challenges.
Standalone which you can install directly without VM, this is to hone your Webattack-Fu:
OWASP WebGoat
Damn Vulnerable Web Application
Mutillidae
20
"Exploiting" an application means making it do, with the privileges under which it is running, some things that it was not meant to do. passwd runs as root because it needs to read and modify files (in particular /etc/shadow) that can be read and written only by root. The normal behavior of passwd is to alter the password of the user who runs it (passwd is ...
18
Im not sure about built-in webcams, but I think it is most likely possible.
I've found info on Logitech Webcams, where you can turn off the LED in the registry keys..
For QuickCam versions 11.5.0.1169 thru 11.9.0.1263, LVUVC_LEDControl is located in the following registry key:
...
17
Just to add to great Thomas answer, it seems that to successfully leak the cookie value the actual POST body sent should not only be the:
Cookie: secret=....
but should contain much more text from the POST header, like so:
POST / HTTP/1.1
Host: thebankserver.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 ...
14
In PHP you cannot stack querys with a semicolon. However you can nest a query into another with parentheses (commonly called subqueries), e.g.:
SELECT * FROM vulnerable_table WHERE id = (SELECT number from other_table)
Using this technique (disregarding whether you output your SQL result or not) a keen attacker may extract all data from your database.
...
14
It's nothing fundamental. It's just a historical convention, like using foo as the name of a variable when you have no clue what to name it.
In more detail: The simplest way to test for a buffer overflow is to type a long string of A's (AAAAAAAA...) into a text field, and see what happens. If the program crashes, it might be vulnerable. If the program ...
13
ASLR is a defense-in-depth mechanism. It is effective, but can be bypassed (the 2010 PWN2OWN contest break included an ASLR bypass).
ASLR's primary purpose is to defeat "ret-to-libc" attacks which are a mechanism of bypassing DEP. IMHO ASLR is only really effective when bundled with other protection mechanisms like DEP (ASLR without DEP can typically be ...
12
The content of that array, is low level machine code that will execute the shell /bin/sh, if executed on the correct architecture. An attacker may be able to feed it as data to a program which will execute it as code because of a bug.
It's commonly used to exploit buffer overflows.
One of the core principle of software programming is the concept of sub ...
12
Who's to say that the phone is really off? If someone controls the firmware of the device then the off functionality could be replaced with state in which the phone appears to be "off" but is in fact maintaining a line of communication to a remote user.
However firmware cannot stop you from introducing a hardware switch to disconnect the microphone. A ...
12
The vast majority of web applications do not allow query stacking. With PHP/MySQL application can allow for query stacking if you use the mysqli::multi_query()or mysqli_multi_query() functions.
You can exploit these systems using sub-select, union-selects, blind sql injection, into outfile, or loadfile(). Sqlmap is a great tool for automating these ...
11
If you want to do a good turn, you can report the malicious site to several centralized sources. There are some companies that maintain centralized lists of malicious web sites, and you can report the web sites to those companies. Here are some places you can report phishing sites:
Report a phishing site to Google
Report a phishing site to Symantec
...
11
Yes it can be done. Many web-camera control programs give you the ability to turn off the light. So it's definitely possible.
So as to know if the camera is active at a given time, I guess the best thing you have to do to ensure it stay disable, is to turn it off in the device manager. Off-course, you have to trust the Operating System to obey your ...
11
What you're looking at is called shellcode. It is meant to be interpreted as the hexadecimal values shown and is specific to a given processor architecture and will only work with known memory addresses, so also specific to a certain OS or program. This is below assembly language -- you are looking at the actual machine code itself.
For example, 0xEB is an ...
11
I have some suggestions:
Use a separate domain. Host the images on a separate domain that is used only to host user-provided images.
This will ensure that many browser-level attacks can have only limited effects. For instance, suppose the user's browser is vulnerable to content-type sniffing attacks, so it is possible to upload an image that some ...
11
To complement @Polynomial's self-answer: DEP can actually be enforced on older x86 machines (which predate the NX bit), but at a price.
The easy but limited way to do DEP on old x86 hardware is to use segment registers. With current operating systems on such systems, addresses are 32-bit values in a flat 4 GB address space, but internally each memory access ...
11
Canaries and other volatiles do not prevent the overflow; they just try to cope with the consequences of an overflow which has happened. The canary tries to detect the case of an overflow which overwrote the return address in a stack frame. DEP is one step further, it assumes that the return address has been overwritten and followed, and it restricts the ...
11
The statement, as you show it, is not vulnerable to anything. However, fprintf() is indeed an interpreter in its own right: what it takes as format string is not just a sequence of characters; it is source code for a specific language with directives beginning with a '%' sign.
When you use your fprintf() function like that, sooner or later, some developer ...
10
There's a couple of good ones in addition to DVL, that I've come across
Metasploitable is designed for testing out some of Metasploits functionality. There's some good information on using it in the free Metasploit Unleashed course.
There's also DVWA from a web applications perspective
EDIT:
Another good list I came across on a blog recently, has quite ...
10
I think the biggest impacts will be on the public relations side.
On the plus side (from OpenBSD maintainers point of view), the idea that the FBI deemed OpenBSD important enough, back in 2000, to warrant money-backed insertion of backdoors, is a sure ego inflater. This alone could be a motive for public allegations of backdoors, whether they exist or not. ...
10
It needs to read the content of the HTTP transactions between the victim's computer and the remote server. SSL features point-to-point encryption using a key that's negotiated by the two systems, so a third system passively eavesdropping cannot read the content.
Note that it is possible to inspect SSL content by interposing the attacking system between the ...
10
Canary
Stack canaries work by modifying every function's prologue and epilogue regions to place and check a value on the stack respectively. As such, if a stack buffer is overwritten during a memory copy operation, the error is noticed before execution returns from the copy function. When this happens, an exception is raised, which is passed back up the ...
10
@ewanm89 is entirely correct. Securing the connection between ground control and a plane should be no different from securing any regular connection.
The main issue is that the protocol designers are relying on security by obscurity. Obscurity through the relatively unknown protocol being used. Obscurity through what used to be relatively difficult to ...
9
It really depends on the type of camera, and how it is built. On Apple MacBook Pros (at least recent ones), the camera light is directly connected via the power supply to the camera module, so the light can't be circumvented even via a firmware hack. Older (really old) Logitech cameras had a similar design.
But just to be safe, I'm one of those guys with a ...
9
The answer is: it depends.
Suppose we found a O(n^4)-time algorithm for a NP-complete problem like SAT, where the constant hidden by the big-O notation isn't too large. That would kill pretty much all of modern cryptography, including symmetric-key cryptography and public-key cryptography. The only things left standing would be information-theoretically ...
Only top voted, non community-wiki answers of a minimum length are eligible
