Tag Info

New answers tagged

0

I had an extremely similar homework problem that I had in a security class. The reliability of your exploit depends on how large the buffer is. If you are overflowing a particularly large buffer, then your exploit will have a larger chance of working. Here is how your exploit sandwich should be structured: [NOPS][Shellcode (usually about ~60 bytes)][FP ...


0

History has shown that Theo de Raadt is somewhat of an asshole. I wouldn't read too much into what he has to say. If you're concerned, check the version of OpenSSH on FreeBSD and the OpenSSH on OpenBSD, diff the two, and analyze the differences.


2

Vulnerable clients are less of a problem than vulnerable servers. The major web browsers don't use OpenSSL for security, and most non-browser clients (eg. database interfaces or email programs) are rather picky about which servers they connect to.


0

dublicate actually good answers here and here I have tested my self firefox and google chrome on my systems - looks like not affected tested wget - affected - but probability that someone will use wget not high. So for clients side all looks not so bad, because general user tools looks like not affected.


7

Modern OSes use virtual memory spaces for each process that leads to process isolation. So it is impossible for a webserver using the flawed OpenSSL library to read memory allocated to other processes (not explicitly shared with the process), at best attempts to do so would result in a segmentation fault. The truth is heartbleed is a simple overread of a ...


2

From what I understand, it's the luck of the draw. You may get sensitive information or nothing at all. It all depends what happens to reside in the memory the exploit is pushing out to you. This can include private keys as the server process will cache this for quick access during SSL transmissions, but from my limited testing I was able to fetch HTTP ...


3

Note that if you're using a cloud based provider or content distribution network, and they are vulnerable, your website's leaking content will be mixed with content of all other websites using this provider. I've just just seen that with Incapsula, where a bank website's content was leaked along cryptocurrency website. They're fixed now fortunately.


3

Jspenguin wrote an offline tool to check if a server has the flaw. Download it, audit it, and run it. I also wrote ssl-heartbleed-check.pl (also an offline tool) to check if the OpenSSL used by your Perl stack (which on *n*x is often the openssl used by the whole system) is affected. This can help you to determine if you are affected on the client side. ...


62

There is more to consider than just new certificates (or rather, new key pairs) for every affected server. It also means: Patching affected systems to OpenSSL 1.0.1g Revocation of the old keypairs that were just supersceded Changing all passwords Invalidating all session keys and cookies Evaluating the actual content handled by the vulnerable servers that ...


9

[edited] I made a tool to check the status of your SSL and see if heartbeat is enabled and vulnerable. Tool at: http://rehmann.co/projects/heartbeat/ There's another one at http://filippo.io/Heartbleed/ If you're vulnerable, please upgrade your OpenSSL packages & renew your certs!


20

Directly copied from OpenSSL site OpenSSL Security Advisory [07 Apr 2014] TLS heartbeat read overrun (CVE-2014-0160) A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server. Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1. ...


0

Run the connect version of Windows, trace your code with a debugger. Analyse the exploit. BinDiff the patch and have patience.


0

In addition to Bob's answer, there is another security disadvantage when making use of GET requests with sensitive parameters. The URL, which includes the sensitive information, is sent to third-party web servers hosting resources referenced by the resulting HTML page. Example: First request: GET /someCode/pages/somePage.jsf?pin=MzAwMDY3MDI2OQ HTTP/1.0 ...


1

You can do this a few different ways. First, if your exploit is an EXE-dropping exploit (like psexec), you can set the EXE::Custom advanced option. Otherwise you can use one of the payloads that allows you to upload (windows/upexec/*) or download (windows/download_exec) a custom executable.


3

...because what's going on is that you're compromising your own system. If you read the Old/New Thing blog, the author calls it "being on the other side of an airtight hatchway". It's like asking what's preventing people from entering your house - all your friends would ask "yes, but you lock your doors, don't you?"; you can "break into" your own house ...


0

These kind of scans are more or less normal nowadays. I sometimes get dozens of them a day. Just make sure your server is hardened, especially the php installation. If you want to be on the safe side you may want to use a web application firewall like http://www.modsecurity.org/


-1

Kernel security measures. I don't know a lot about the memory security model of Windows, because I don't use Windows and am not interested in it, but I would bet you anything that there are parts of memory that you are not allowed to modify, no matter what. Ever. Even as the administrator. Why? Here are three reasons I can think of off the top of my head: ...


2

Since I use php as an Apache module instead of CGI, and the http code was 404, I think nothing bad happened, right? right What was the attacker trying to do (or, if he was successful, what did he do) to my system? it was probably the first stage in a multi-stage-attacke(script); this is just the first scan, if you system is vulnerable or not.


0

Nothing. The only problem you may encounter is getting the execution or the download. But that can be trivial at times.


1

No - it does not mean you are not vulnerable. The patches you have installed may have fixed the particular vulnerability, but failure of a test does not automatically mean you are safe - it could just be the case that your test version is misconfigured, failed due to a local configuration or bug, or has had some other problem. The usual way to gain ...


0

Private exploits exist for many famous software out there, and the fact that a software is open-source, popular or many years old doesn't change a thing. A vanilla Wordpress installation without additional modules is less likely to be exposed, but again, it is very possible that exploits exist for it. Now, the question is more: does your friend have the ...


-2

First of all he's a script kiddie since WordPress isn't a webapp launched yesterday. The whole community is working to make it better. Now the only point is that WordPress sites get compromised because of misconfigured servers wherein an attackers might be able to carry out a SymLink Attack and then take it down.


3

Obviously allowing users to upload any file types is very dangerous Anything a user uploads is just 0s and 1s until you actually decide to do something with it. Executing such files would be a bad idea, yes. Executable programs don't automatically run unless you tell them to, though. If you are wondering about the autorun behavior of certain storage ...


0

Creating reliable exploits requires time and patience and lots of debugging. I think what you are looking for is a NOP Sled or NOP Slide. When you execute the short jump you need to land it in the middle of the NOP Slide, so the execution then slides through the NOPs to your shellcode. Check out this site for a detailed breakdown of exploit writing.


1

Return address encryption prevents ROP gadgets from being used because the attacker won't be able to predict the value of the key, so the attacker won't know what to write on the stack to cause the return instruction at the end of one gadget to transfer control to the next gadget. Remember how ROP attacks work. The attack involves executing a sequence of ...


0

It's not uncommon for ATM to be in the same ethernet segment as the local PCs. They often use 802.1X/port security to "protect" the network, but it's easily to circumvent by adding a simple hub to the port (at least the most deployed setups). So here is an attack scenario: You could sneak into the bank and install a hub and a tiny/embeedded system + GSM ...


1

"Limited physical interfaces" aren't much of a limitation. For example, this video shows someone completely re-programming a console video game (Super Mario World) using only the game controller.



Top 50 recent answers are included