Hot answers tagged research
46
As a starting point, we will consider that each elementary operation implies a minimal expense of energy; Laundauer's principle sets that limit at 0.0178 eV, which is 2.85*10-21 J. On the other hand, the total mass of the Solar system, if converted in its entirety to energy, would yield about 1.8*1047 J (actually that's what you would get from the mass of ...
28
Stack Exchange has multiple layers of security preventing this. Captchas and email addresses are required. The email check is easy to beat with a script, but the captchas aren't; you'd need a Captcha breaking service to even get this off the ground.
None of your bots can vote at the start, so you can't accumulate rep just by posting questions; human eyes ...
17
So many of the answers here say that the unsolved problem is "the user" or some variant, that I'm forced to conclude the biggest unsolved problem is security practitioners who believe that the user is the enemy.
The underlying cause is security policy or procedure that has no visible benefit, i.e. it takes up user time and effort without the users being ...
13
You can't really solve the end user problem. Well, legally or ethically anyway. My vote goes toward the Home Realm Discovery problem.
EDIT:
The end user problem was in reference to previously posted answers. Home Realm discovery is part of a claims based authentication model, where you can select between multiple services/organizations to provide an ...
12
Internet Voting from home or office computers for high-stakes elections is pretty far off the scale of "unsolved problems". It is particularly important to voters who are overseas and/or in the armed forces and have no fast, reliable way to return a voter-verified paper ballot (think submarines :). It was nominated as worthy of an X-PRIZE at DESSEC: ...
11
Update: I added the link below after a reading a twitter message
"Links and resources for malware samples"
http://contagiodump.blogspot.com/2010/11/links-and-resources-for-malware-samples.html
Malware specific:
If you have money: http://www.frame4.net/home
Free (and paid): http://www.offensivecomputing.net/
Exploits:
...
11
C6C server are often servers that got hacked, not servers rented by the attacker.
Security support contracts
For public organisations there are often CERTs (computer emergency response team) responsible for them. For example there is the DFN Cert for all Germany universities. Large companies tend to have support contracts with companies specialized in ...
11
The basic path for exploiting an overflow-related vulnerability is to find a crash (often by fuzzing), evaluate the crash and whether it presents an attack path, and then build something to exploit it.
Sometimes where one looks can involve knowledge of the architecture, such as when Charlie Miller noted that iOS 4.3 has a section of memory which will run ...
10
This may be seen more as a template than a policy, but I think it's worth mentioning here.
The U.S. National Institute of Standards and Technology has a number of Special Publications (SPs) regarding the security of information systems. These are collectively called the 800 series, as all of them have numeric designations beginning with 800. They are used ...
9
I’m guessing since you asked this question you find it frequently mind-numbing to locate good vulnerability descriptions. I hate it when I get stuck chasing down the details of a single vuln when there are 100s or 1000s of additional vulns in play.
My favorite sources are the vendors that run decent advisory sites, like:
Red Hat: ...
9
May I suggest some honeypots designed for things exactly like what you describe:
WebLabyrinth ( info )
Glastopf
DShield Web Honeypot Project
9
Intrusion Detection Systems indeed are a natural fit for statistics.
An interesting example I've come across:
At host based IDSes, track and statistically analyze the system calls of an application. An interesting approach is to group the system calls in pairs, triples etc. and then observe their behavior when the application encounters an attack.
Have a ...
9
NSA was undergoing a transformation on the subject question during the timeframe you are questioning.
In the previous two decades through the mid 90s NSA advocated for no strong privately controlled public encryption. This position surfaced with their clash with MIT over the work of the famed RSA crew Ron Rivest, Adi Shamir, and Leonard Adleman resulting ...
9
Here are several steps you could take to encourage security researchers to disclose vulnerabilities to you:
Waive liability. Promise not to sue researchers who disclose vulnerabilities to you in a responsible fashion. Currently, many researchers report worrying that reporting a vulnerability to a company could get them sued, and so sometimes they just ...
8
I use primarly
Exploit-DB - Usually I use this for web exploits (like a fresh Joomla hack, or something similar)
Open-Source vulnerability database - Excellent for all kinds of products. I've found some old. but excellent hacks on this page
Secunia - For searching
Microsoft Technet - For some extra reading about the latest Microsoft issues
Google Reader - ...
8
Many companies are very nervous about publishing their policies for obvious reasons. The merit of those reasons, however, is beside the point. On the other hand, I have had great luck finding such policies at educational sites.
Because of the specific environment within an educational institution standards and policies are typically made publicly available. ...
8
Several areas use statistical means and probability theory.
Intrusion Detection was mentioned already
You mention SSH fingerprinting, which concerns the very large field of traffic analysis. There was a paper at Oakland Security & Privacy this year where they use this to decrypt encrypted VoIP.
Another aspect is side-channel analysis, where you probe a ...
8
To look at your assumptions:
many attack groups have resources vastly bigger than that of companies
in a typical company security is a cost centre, so they never have enough staff or money
in the black hat world, finding security flaws is a revenue stream
fuzzing is done by security engineers and black hats
fuzzing is by its very nature fallible. So ...
8
#infosec and #security are the two main hashtags I'm aware of.
Depending on what you're interested in there are other less popular hashtags. For example:
#websecurity
#privacy
#cybercrime
#cyberwar
#hacker and #hackers
#cybersecurity
#malware
#spam
There's also the option to use multiple hashtags in your search. If, for example, you are interested in ...
7
Smartphone Security
There are a wide number of smartphones that are targets for viruses and leaking corporate information. It's tough to find a uniform way to address these security vulnerabilities, and still provide a flexible user environment.
Currently I'm looking at Goodlink to provide email security across multiple devices. Please comment if you ...
7
According to McAfee Labs Threat Predictions for 2011:
Exploiting Social Media: URL-shortening services
Social media sites such as Twitter and Facebook have created the movement toward an “instant” form of communication, a shift that will completely alter the threat landscape in 2011. Of the social media sites that will be most riddled with cybercriminal ...
7
Ones I tend to draw on:
Verizon Data Breach Report - this is generally considered THE source on data breaches
Krebs Java Security Report - Krebs is very well respected - various studies, of which this is a grand example
WHID Security Report - also very useful
These are all freely available online, and updated versions available annually (or more often in ...
7
I don't know how "state-of-the-art" this is, but the password recovery software Passcape uses a dictionary attack against passphrases. This is very similar to a simple brute force character-permutation attack against a password, except permutations of dictionary words are used instead (once common phrases and quotes from movies, books, and poems are ...
6
For specific analysis of a particular attack in this space you should read the Symantec Stuxnet paper - gives good background as to just how badly a SCADA attack can compromise an industrial system.
6
Have a look at Major Malfunction's (Adam Laurie) work in this area:
http://hackaday.com/2007/03/25/rfidiot-rfid-io-tools/
http://www.youtube.com/watch?v=3vAvesYoHeo
and many others - good fun stuff, not too expensive to get started
edit: Just spotted this post on Proxclone that you might also be interested in
6
I was just recently looking at Yammer's the other day: pdf
A couple others I have seen:
MIT
University of MI
6
Check out The Core Group http://enterthecore.net/
They offer training sessions at the Black Hat conference (and other conferences):
"PHYSICAL PENETRATION TESTING"
https://www.blackhat.com/html/bh-us-11/training/core-pentest-intro.html
https://www.blackhat.com/html/bh-us-11/training/core-pentest-advanced.html
Those who attend this session will leave ...
6
what NSA suggested for use in commercial systems in past times. 90's and early 2000's.
NSA did not publicize their involvement in national standards. So, the exact role NSA played in algorithms and documents may be difficult to determine.
In 1987 the U.S. Congress passed the "Computer Security Act" which was intended to limit the role of the National ...
6
If you follow Full Disclosure (http://seclists.org/fulldisclosure/) and bugtraq (http://www.securityfocus.com/archive/1) mailing lists you can see that there are lots of security research by individuals or non-commercial entities.
You should join full disclosure and bugtraq mailing lists and also follow exploits and papers published by ...
6
There are a gazillion independent organizations and people that publish information on computer security. The problem is not finding them; the problem is keeping track of all of these sources of information. Two example starting places include Bruce Schneier's blog and Krebs on Security.
If you think that all computer security research comes from ...
Only top voted, non community-wiki answers of a minimum length are eligible
