Tag Info

Hot answers tagged

11

Regardless of whether this should apply specifically to Unix, I would say that it is not safe to assume no access just because there are no open ports. To wit, ICMP is usually listened to, even if no TCP or UDP ports are available. And before you say, "But ICMP is just a simple Ping! It's irrelevant to attack using that!" check these out: Ping of Death ...


9

The backdoor that you are describing can be installed if you have code execution on the ATM. This research, as well as methods of obtaining code execution on an ATM where pioneered by Barnaby Jack and are detailed in his BlackHat (and defcon) 2010 Jackpotting ATMs talk.


9

Even if such a statistic existed, it would be meaningless because these attacks don't occur as a result of random chance. Your chances of being "hacked" rise dramatically if: You don't secure the application properly (SQL Injection being the most obvious, and sadly still commonplace vulnerability; others include plain-text passwords, XSS/XSRF, and not ...


9

PHP: allow_url_fopen needs to be Off. I think this is how you got owned. A big mistake! display_errors needs to be Off. I use these all of the time to find path disclosures. file_uploads needs to be Off. This could have been another way you got owned. expose_php needs to be Off safe_mode needs to be On magic_quotes_gpc should probably be set to On These ...


8

Basic: using off the shelf tools, scripts, exploits, etc. to compromise systems. No deeper knowledge of what you are exploiting or how. Limited to public-facing internet attacks. Commonly referred to as script kiddies. Advanced: creating your own tools to exploit holes you have discovered and/or bought. Understanding exactly how you are overflowing those ...


8

what defines a advanced kind of attack? Advanced for who and how? Ultimately, an attack is an attack. It doesn't matter if they used social engineering techniques to get an unsuspecting user to divulge their credentials, brute-force methods, obtained a copy of the software and performed reverse engineering or used the system in methods other than ...


8

What type of attacks are there that do not use open TCP or open UDP ports? This is way too general of a question. I'm answering this very literally, not to be a jerk, but because in security it's best to assume nothing. Here are some classes of attacks that do not use open TCP or UDP ports: Social engineering: get someone to connect outbound from the ...


6

WireShark is a free tool you can use to monitor network traffic. Excellent tool to see if a hidden keylogger is trying to email and /or FTP logs because it usually has the address and password in the wireshark log.


6

The fundamental problem of these classes of attacks is not within TCP or UDP protocols themselves, it is with the requirement of applications to process data from an untrusted (or less trusted) source, and faulty design and/or QA within said applications. If your server is running any applications which process input from a source which does not have the ...


6

For a definitive answer, you'll want to look at three sources. This is all set out in the act itself. The Defence Department will be in touch with cleared defence contractors to provide their detailed requirements. As ever, if you need to know if something is legal or not, don't ask random people on the Internet: ask a suitably qualified lawyer who ...


6

Knowing of an attacker and not disconnecting them will allow you gather evidence on the attacker such as determining the motive for the attack, determining the tools the attacker is using, determining the mode of operation of the attacker and maybe... just maybe, but not likely, being able to trace the connection back to the attacker. You could then try to ...


6

Using a laptop effectively prevents this. You could glue the keyboard into the USB socket. Not ideal, but hey :-) Another is to use a Bluetooth keyboard, with integrated Bluetooth on the computer. But these are all kludges really; in general I agree with the other comments that if an attacker has physical access, most bets are off. This is quite a good ...


6

Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. For example, using TrueCrypt can't protect you from a determined attacker who has installed a hardware key logger and is reading everything you type.


6

It depends on what exactly you were using. Direct inspection computer: if you're using a public (library, etc.) computer, you can check its usage history - browser history, and so on. Keep in mind that most such systems ought to use, and often do use, virtual/sandbox systems such as SteadyState, that erase all traces after you log out. So eye-keeping at ...


5

Most of the time it does get blocked. Not in the sense of blocking off the account, but blocking the IP that tried to connect. I use OSSEC. If someone tries to log in on ANY account wrongly more than 5 times, the connecting IP will be blocked and I will get an email containing what IP tried to log in. To prevent from locking yourself out you can ...


5

First of all, the 777 permission means that the configuration file you are talking about can be edited by any other user on the system. So basically, a hacker who compromises your server and gets operating system access has the required permissions to tamper that file. A hacker can compromise your server and get system access simply by exploiting a ...


5

Here are some research papers that tackle this sort of problem and might interest you: Ripley: automatically securing web 2.0 applications through replicated execution. K. Vikram, Abhishek Prateek, Benjamin Livshits. ACM CCS 2009. Eliminating navigation errors in web applications via model checking and runtime enforcement of navigation state machines. ...


5

In the ideal situation you would put together a list of all assets and threat vectors on your network, including but not limited to: Operating system flavors and versions Applications Network infrastructure Anything else plugged into the network With that you could plow through all of the signatures that are available and include only the ones that apply ...


5

Even if your operating system is completely secure, your hardware may be vulnerable. Many network cards respond to various remote administration protocols (Wake-on-LAN, Alert-on-LAN, ASF, …). In practice, an actual vulnerability has many requirements: at least one of these features must be supported; the feature must be enabled at least at some level ...


5

This occurs because you're viewing an email that contains images and other resources served over HTTP, whilst the connection to the gmail site itself is HTTPS. This is known as mixed-mode, and it's risky in cases where an attacker can perform a man-in-the-middle attack. In this case, I don't think you should worry about it - it's completely normal to get ...


5

Monitoring for records from the DB to be posted are really all you can do without direct access to the server. You could try penetration testing the site yourself to look for holes, but that is probably unwise and possibly illegal depending on jurisdiction and the Terms of Use of the site and any contractual obligations you might have from when you wrote ...


5

A very new Reuters release notes that: Former U.S. National Security Agency contractor Edward Snowden used login credentials and passwords provided unwittingly by colleagues at a spy base in Hawaii to access some of the classified material he leaked to the media, sources said. A handful of agency employees who gave their login details to ...


4

How often do websites (and their databases) get hacked? It is generally unknown, and potentially unknowable. Many countries do not have computer crime laws[1]. In the United States the laws vary from state to state. 48 states have passed computer crime legislation.[2] Even in locations that have computer crime law, the victims don't often report it. ...


4

After experiencing a similar (but more serious) compromise myself, I can tell you that atdre is exactly right. There are four basic steps to handling any security compromise: Shut down: Shut down all compromised systems. Do not wipe them at this point. Analyze: Use data from the compromised systems in a sterile environment to try to determine proximate ...


4

A couple questions first: what do you mean by "the same big internet company"? Is it MyProgram.exe or MyProgram.vshost.exe trying to connect? What happens when you run the application in release mode without the debugger? It could be that the Visual Studio debugger is trying to download debug files for CLR assemblies and the firewall is mistaking the ...


4

It could very easily be a false claim - and it sounds like you have done the right things regarding checking logs, database etc - and you can perform in-depth forensic analysis (either yourself or contract one of the many companies that do this) but if you are in any doubt you should plan for the worst - a rootkit. If you have a well concealed rootkit, the ...


4

If they are already in your network, just adding a honeypot may or may not be effective - you don't know what they already know of your network. Do they know the IP ranges for HR, finance, data storage systems etc? Do they have access to your change management system and would spot a new addition to the network? Have they already backdoored the servers ...


4

I'll answer this as best I can, since some of it is subjective or subject to change. As I mentioned in a comment, the barrier to entry in terms of development is higher for layer 2 than it is layer 3, and cables are easier to interface with than radio waves. Most wireless technology involves firmware on a hardware device in order to translate the RF signals ...


4

While I haven't done it - haven't been contracting as much as I used to - I was planning to get a bunch of small $25 - $50 prepaid visa cards and use them on sites I was involved with. One card per site. Keep the card number and if it gets used you know with reasonable certainty that there has been a breach on their system.



Only top voted, non community-wiki answers of a minimum length are eligible