Tag Info

Hot answers tagged

17

I'm afraid your compiled binary will differ a lot from the actual malware that can be found in the wild. Different compilers and command-line flags will produce completely different binaries, and the malware binary may be further optimized/obfuscated using additional tools or even manually. Submitting them your compiled binary is likely to be ...


8

The most common solution for dealing with malware files is to compress them (e.g. in a zip file). However, since many AV tools now look inside archives, you may need to thwart attempts at automated inspection -- the simplest solution is to just put a password on the zip file (which encrypts the contents). As a rule, the password is distributed right ...


7

Src attribute could lead to XSS if you allow the user to define the protocol, for example to enter javascript: instead of http: Example: <img src=javascript:alert()> Additionally, you should use proper output encoding for the user controlled variables so that the user cannot escape out of the attribute/tag. For example if you have the following tag: ...


6

Is it possible? Yes. Varying the electromagnetic noise of a device's circuits to transmit data has been used both in and out of laboratory settings. (For example, somebody figured out how to modulate the Raspberry Pi's GPIO pins to turn it into an FM radio transmitter, with the side effect of trashing a wide band of the radio spectrum.) Is it practical? ...


6

In the Internet Protocol Version 4, the address 0.0.0.0 is a non-routable meta-address used to designate an invalid, unknown or non-applicable target. To give a special meaning to an otherwise invalid piece of data is an application of in-band signaling. In the context of servers, 0.0.0.0 means "all IPv4 addresses on the local machine". If a ...


6

I believe they already have if this article is correct: http://community.skype.com/t5/Security-Privacy-Trust-and/How-to-protect-your-IP-from-skype-resolvers/td-p/3874291 Skype uses peer-to-peer instead of traditional client/server connections to make the calls happen though. Since there's no sole middleman the data needs to know where it's going between ...


5

EMET software participates in a defence-in-depth approach of security. It adds an effective supplementary security layer when an attacker manages to successfully exploit a vulnerable software without being blocked by the anti-virus. However, in such domain is an endless race, since while EMET is getting more popular, attackers will try to craft their ...


5

More or less, yes. Some things that might be different: You will not be able to use layer 2 scans (like ARP scans). If I would give you my public IP address, that would be the address of my router, and not my PC. Depending on the port forwarding settings on my router, you will most probably not be able to scan my PC directly, but only my router. That would ...


4

At this point you've achieved the basics of a compromise on the system and you're on to the common phase two of exploitation which is privilege escalation. Exactly how you can achieve that depends very much on the system in question, what code is installed on it and how it's configured. Some options for things to look for to get privilege escalation on a ...


3

It depends if these are security issues of the JVM or the Java libraries. Since the JVM is not used these problems don't affect compiled applications. But issues in the library might affect your application. If these issues are relevant for your program depends on the kind of issues and what your program does. For example problems affecting the validation of ...


3

I think you partially have the idea. This reminds me of when I saw aircrack-ng being released and many criticized that it would be used maliciously and perhaps to some extent it has. However, you can look at the way wireless security has grown and has actually become considerably more secure, simply from the amount of awareness. Another example, is the ...


2

Yes, this has been implemented before. In this blog post, Erin Ptacek briefly mentions how AVR has different program and data memory and how this makes exploitation more difficult. A Harvard Architecture has two distinct memories; there is program memory (imem, typically flash) and data memory (dmem, typically SRAM). They live in two different address ...


2

The problem with most operating systems is that they follow a specific "calling convention." This convention requires putting function parameters on the stack, being some derivative of the C-style calling convention. You must use this convention for ABI (Application Binary Interface) compatibility with that OS. So, without OS support, you could only use this ...


2

The Stagefright attack is simply a delivery method, an insertion vector, a way in. And only a partial delivery method, at that. By itself, it only allows someone to execute code within the sandbox of the MMS app or web app that's trying to play the malicious multimedia file. In order to actually do any damage they have to combine it with some other zero-day ...


1

XSS Even if we assume that your filters work perfectly (which I would not do automatically, filtering is rather complex, and easy to get wrong), this may lead to XSS. Because it hasn't been mentioned yet: a in combination with an unfiltered href is not secure, as JavaScript will be executed. An attacker can load a remote script and then redirect so the ...


1

To add to the existing answer: It might also possible to misuse the class attribute, depending on your code. Just imagine that your web application has some code which binds to any elements of a specific class or any which show a specific behavior (which can be set by the class). In this case this code could be triggered if you allow the user to use any ...


1

Nothing is sure that apple.com website has been the vector attack. The problem could be coming from any tag, window or web pageyou opened using Interet Explorer. Given the warning message you got, I highly suspect your IE browser is vulnerable to a recent (July 2015) critical issue (Microsoft Security Bulletin MS15-065 - Critical) concerning IE versions ...


1

While the alert is alarming, based on the information provided, it does not appear to be of concern. When IE restarted, it attempted to reopen the page it was last on, which was apple.com. res://ieframe.dll/... is how IE reloads the last page it was on. Malware Bytes caught this dll loading and alerted on it.


1

Yes it is possible. If tokens are server generated by creating a cryptographically secure random sequence stored against the account, this token could be refreshed and reissued on a certain interval, invalidating the old one. The token would only be refreshed on active use so it won't invalidate the old one when the client computer is off. This approach ...


1

You can upgrade your shell to a Meterpreter with sessions -u <#> and then run post modules (e.g., post/multi/recon/local_exploit_suggestor) or you can also take an existing session (Meterpreter or not) and run a local privilege escalation exploit, e.g., udev_netlink, sock_sendpage, et al, by setting the SESSION variable. Some modules vary by OS or ...



Only top voted, non community-wiki answers of a minimum length are eligible