Tag Info

Hot answers tagged

19

These kinds of back-doors are polymorphic, that is they are designed to look different every time - in practice it's a waste of time trying to decipher them because they all do exactly the same thing. They take external input and they execute it. It might take input from a cookie or a post variable, and it might try and set some PHP options to prevent ...


11

Regardless of whether this should apply specifically to Unix, I would say that it is not safe to assume no access just because there are no open ports. To wit, ICMP is usually listened to, even if no TCP or UDP ports are available. And before you say, "But ICMP is just a simple Ping! It's irrelevant to attack using that!" check these out: Ping of Death ...


9

The backdoor that you are describing can be installed if you have code execution on the ATM. This research, as well as methods of obtaining code execution on an ATM where pioneered by Barnaby Jack and are detailed in his BlackHat (and defcon) 2010 Jackpotting ATMs talk.


9

Even if such a statistic existed, it would be meaningless because these attacks don't occur as a result of random chance. Your chances of being "hacked" rise dramatically if: You don't secure the application properly (SQL Injection being the most obvious, and sadly still commonplace vulnerability; others include plain-text passwords, XSS/XSRF, and not ...


9

PHP: allow_url_fopen needs to be Off. I think this is how you got owned. A big mistake! display_errors needs to be Off. I use these all of the time to find path disclosures. file_uploads needs to be Off. This could have been another way you got owned. expose_php needs to be Off safe_mode needs to be On magic_quotes_gpc should probably be set to On These ...


9

I can understand why your IT Manager is upset. How would you feel if some one, without your consent, bridged an unknown network with your home network? You arguably bypassed any controls they had in place and bridged a completely foreign network with that of (what I can only assume is) a multi million dollar corporation. What are the security risks of ...


8

Basic: using off the shelf tools, scripts, exploits, etc. to compromise systems. No deeper knowledge of what you are exploiting or how. Limited to public-facing internet attacks. Commonly referred to as script kiddies. Advanced: creating your own tools to exploit holes you have discovered and/or bought. Understanding exactly how you are overflowing those ...


8

what defines a advanced kind of attack? Advanced for who and how? Ultimately, an attack is an attack. It doesn't matter if they used social engineering techniques to get an unsuspecting user to divulge their credentials, brute-force methods, obtained a copy of the software and performed reverse engineering or used the system in methods other than ...


8

What type of attacks are there that do not use open TCP or open UDP ports? This is way too general of a question. I'm answering this very literally, not to be a jerk, but because in security it's best to assume nothing. Here are some classes of attacks that do not use open TCP or UDP ports: Social engineering: get someone to connect outbound from the ...


7

Using a laptop effectively prevents this. You could glue the keyboard into the USB socket. Not ideal, but hey :-) Another is to use a Bluetooth keyboard, with integrated Bluetooth on the computer. But these are all kludges really; in general I agree with the other comments that if an attacker has physical access, most bets are off. This is quite a good ...


6

WireShark is a free tool you can use to monitor network traffic. Excellent tool to see if a hidden keylogger is trying to email and /or FTP logs because it usually has the address and password in the wireshark log.


6

The fundamental problem of these classes of attacks is not within TCP or UDP protocols themselves, it is with the requirement of applications to process data from an untrusted (or less trusted) source, and faulty design and/or QA within said applications. If your server is running any applications which process input from a source which does not have the ...


6

For a definitive answer, you'll want to look at three sources. This is all set out in the act itself. The Defence Department will be in touch with cleared defence contractors to provide their detailed requirements. As ever, if you need to know if something is legal or not, don't ask random people on the Internet: ask a suitably qualified lawyer who ...


6

Knowing of an attacker and not disconnecting them will allow you gather evidence on the attacker such as determining the motive for the attack, determining the tools the attacker is using, determining the mode of operation of the attacker and maybe... just maybe, but not likely, being able to trace the connection back to the attacker. You could then try to ...


6

Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. For example, using TrueCrypt can't protect you from a determined attacker who has installed a hardware key logger and is reading everything you type.


6

It depends on what exactly you were using. Direct inspection computer: if you're using a public (library, etc.) computer, you can check its usage history - browser history, and so on. Keep in mind that most such systems ought to use, and often do use, virtual/sandbox systems such as SteadyState, that erase all traces after you log out. So eye-keeping at ...


5

Most of the time it does get blocked. Not in the sense of blocking off the account, but blocking the IP that tried to connect. I use OSSEC. If someone tries to log in on ANY account wrongly more than 5 times, the connecting IP will be blocked and I will get an email containing what IP tried to log in. To prevent from locking yourself out you can ...


5

First of all, the 777 permission means that the configuration file you are talking about can be edited by any other user on the system. So basically, a hacker who compromises your server and gets operating system access has the required permissions to tamper that file. A hacker can compromise your server and get system access simply by exploiting a ...


5

Here are some research papers that tackle this sort of problem and might interest you: Ripley: automatically securing web 2.0 applications through replicated execution. K. Vikram, Abhishek Prateek, Benjamin Livshits. ACM CCS 2009. Eliminating navigation errors in web applications via model checking and runtime enforcement of navigation state machines. ...


5

In the ideal situation you would put together a list of all assets and threat vectors on your network, including but not limited to: Operating system flavors and versions Applications Network infrastructure Anything else plugged into the network With that you could plow through all of the signatures that are available and include only the ones that apply ...


5

Even if your operating system is completely secure, your hardware may be vulnerable. Many network cards respond to various remote administration protocols (Wake-on-LAN, Alert-on-LAN, ASF, …). In practice, an actual vulnerability has many requirements: at least one of these features must be supported; the feature must be enabled at least at some level ...


5

This occurs because you're viewing an email that contains images and other resources served over HTTP, whilst the connection to the gmail site itself is HTTPS. This is known as mixed-mode, and it's risky in cases where an attacker can perform a man-in-the-middle attack. In this case, I don't think you should worry about it - it's completely normal to get ...


5

Monitoring for records from the DB to be posted are really all you can do without direct access to the server. You could try penetration testing the site yourself to look for holes, but that is probably unwise and possibly illegal depending on jurisdiction and the Terms of Use of the site and any contractual obligations you might have from when you wrote ...


5

Functionally, they are two different applications, but they are often meshed together because the monitoring process tends to be at the edge off the network. Many times you see UTM (Unified Threat Management) which are firewalls with IPS/IDS services integrated as a subscription. Firewalls serve to control the inbound/outbound connections into an ...


5

No, it is not possible. The hypervisor controls everything your VM does. The isolation between your VM and other people's VMs relies on the hypervisor. If the hypervisor maps the memory of your VM for its own use, or if it allows other VMs to map it, your VM won't know about it, because of the same isolation mechanisms that don't allow other VMs to access ...


5

Being hit hundreds or thousands of times per day is completely normal, and I wouldn't worry about it at all. There are a few major sources of suspicious traffic: Automated scanners. A number of organizations "map" the Internet and produce a ton of traffic. They do so more or less randomly. I've gotten a lot of traffic on ports 80 and 443 despite not ...


4

Between two endpoints of a VPN connection that uses a properly-negotiated secure algorithm, one cannot decipher the encrypted traffic. Some things that can keep that from working right (in order of likelyhood): Your attacker got between you and your VPN or between your VPN and your destination allowing them access to the cleartext. Your VPN system didn't ...


4

After experiencing a similar (but more serious) compromise myself, I can tell you that atdre is exactly right. There are four basic steps to handling any security compromise: Shut down: Shut down all compromised systems. Do not wipe them at this point. Analyze: Use data from the compromised systems in a sterile environment to try to determine proximate ...


4

How often do websites (and their databases) get hacked? It is generally unknown, and potentially unknowable. Many countries do not have computer crime laws[1]. In the United States the laws vary from state to state. 48 states have passed computer crime legislation.[2] Even in locations that have computer crime law, the victims don't often report it. ...


4

A couple questions first: what do you mean by "the same big internet company"? Is it MyProgram.exe or MyProgram.vshost.exe trying to connect? What happens when you run the application in release mode without the debugger? It could be that the Visual Studio debugger is trying to download debug files for CLR assemblies and the firewall is mistaking the ...



Only top voted, non community-wiki answers of a minimum length are eligible