Tag Info

Hot answers tagged

12

An excellent slideshow on this topic (in my opinion) is the one from Marc Rogers. Basically, he says the following: Most fingerprint systems can be hacked Fingerprint security provides convenient security, not military grade security I also like the analogy in his explanation: Door locks have been defeated with increasing elaborate picking techniques as ...


11

No, I don't think photographs or HD camera footage of powerful people waving to cameras is a security flaw for several reasons: It's not trivial to get fingerprint patterns from HD cameras: it's highly unlikely that you could make a workable print from an HD camera. Even if the person in question held their finger up to the camera in perfect lighting ...


5

The best solution would be to implicitly deny, i.e. allow exactly the data you want, but no other. You could write regexps matching all input that's not according to your filter to find any odd input, that might be an exploit. It is also a good way to find valid input you omitted in your regex. A username might be fine with [a-zA-Z0-9]+, rather than ...


4

It could be possible in some cases. For example, imagine that the videoconferencing software has a vulnerability into the file format parser (E.g. buffer overflow)... then it could be exploited by a remote attacker. Look at VLC for example http://www.cvedetails.com/vulnerability-list/vendor_id-5842/opec-1/Videolan.html


4

Google is not hosting ChromeSetup.bat. A requirement for this attack is that a website needs to have an endpoint with a less common Content-Type and preferably a misconfigured Content-Disposition header (namely: no 'filename' attribute). These two headers will cause the browser to download the response as a file, instead of rendering it. In the URL you ...


4

Actually this is very timely as there's a relatively new attack where the data passed in the URL is the attack vector. Reflected File Download abuses non-malicious servers by passing them malicious data and then having it reflected back to users, so it appears to the user to have come from a "trusted" source.


3

HD footage is only around 2 megapixels in resolution. It is not anywhere near sufficient to pull a finger print. To pull a finger print, you would need something more in the 20+ megapixel range, focused on just the hand, and still would need the right angle for the fingerprint to be particularly visible, so in answer to your primary question, no, ...


2

You're looking at the telnet client, not the telnet server. The telnet client is just a tool which you can use to connect to TCP listeners. If you want to know if your server has telnet open, check it by: Verify on the server if a telnet daemon is listening on port TCP/23 using tools like ps, netstat and lsof (assuming this is a Linux/UNIX machine) Test it ...


2

In contrast to all the other buses mentioned, USB does not allow remote DMA; nowhere in the USB on-the-wire protocol are there memory addresses. Only the driver and/or the OS can control from/to which memory addresses USB data is read/written. OTG allows to change the roles of host and device, but does not change the USB protocol. Jodeit/Johns talks only ...


2

The text segment which is also called the code segment, contains the application's static functionality is not randomized by ASLR. An exploit can jump anywhere into this region of memory reliably, which permits an attacker to build a chain of ROP gadgets. The most common goal of a ROP chain is to setup a stable environment to run shell code, but that is ...


2

Popular commercial brands are not going to have the BadUSB exploit "installed" when it comes from the factory. You must understand how the badUSB exploit works. BadUSB is an exploit that can be executed against almost ANY USB drive. It's not something that can be exploited on some vendor drives and not other drives. For your drive to become compromised, ...


2

You can search within metasploit using the search command for example : msf>search ms08-067 you can also search by the name of the program that has a vulnerability using: msf>search name:windows http://www.offensive-security.com/metasploit-unleashed/Msfconsole_Commands#search


1

You've already listed some resources so I will add another that is not a tool per-se, but a write up on how the different browsers are storing data. The write up contains a minimal python script that should help get you started. As for Safari, pre version 6.0 the credentials were only base64 encoded so it was easier to get data then. The difference with ...


1

Regular expressions are of very limited use here as any attack delivered via a HTTP POST request is unlikely to get logged. There are also many examples of header values having an impact while not being logged, ie: shellshock. There will also be alot of noise from automated scanners like Nikto that have no impact unless the visited url exist and is ...



Only top voted, non community-wiki answers of a minimum length are eligible