Hot answers tagged

5

Well there's a couple of aspects to consider here, as has been said there is no clear answer. On the one hand you've correctly identified the risks of public disclosure with no easy remediation, which is that attackers can take advantage of the issue. However there are also risks with not publicly releasing. For example, it's entirely possible that other ...


4

You at least need : documents to describe processes involved in certificates life cycles : *request for a new certificate *certificate revocation *certificate renewal both for administrators and users (probably two different documents for each process) a general architecture document, describing CA levels and their purpose That's in my opinion ...


4

Ethically, you should be guided by which path does the least damage. That most likely means you should release the information responsibly. Only in a world where you are smarter than everybody else is silence likely to limit damage. My opinion is that releasing the information does the least damage because: You cannot assume that you are the only person ...


4

The main issue is that these tools induce suspicious behaviors (suspicious network activity, suspicious files, suspicious process behavior, etc.). From a network monitoring perspective, how would you then reliably detect an actual attacker if its activity is just blending in background noise of "normal" suspicious behavior affecting your network and systems? ...


4

The idea here is to open a TCP connection with a spoofed address (i.e. the IP address seen by the server is not the real IP address of the client), thus bypassing any IP black- or white-listing. It has severe restrictions on what can be done: only one packet can be sent, and it should not depend on anything coming from the server. Practically, it could for ...


2

Everyone has its own method. Bugs come in various species. Be curious and ask yourself questions. Start with the "Five Ws" (https://en.wikipedia.org/wiki/Five_Ws) . Rinse and repeat and soon you will be able to recognize them then to classify them. Then you will be able to spot them. Then you will be able to see the trace they leave. Then, for example, ...


2

PKI-administrator is not really a well defined role, so the scope of his documentation is vague here. As a Chief Information Security Officer I would ensure that the following documents exist: System Administration doc, for a technical audience - sysadmin who need to set up servers and clients (configuration, architecture, ...). Some interesting point ...


2

In answer to your questions about bots, this depends on the bot itself, I mean it is up to its designer to design how the bot itself receives commands. The 'traditional' method is ofcourse to connect to a IRC channel and wait for instruction, P2P is often more difficult to implement (due to NAT/Port Forwarding) and easier to detect (because holes in ...


2

Key List of Resources (2015) Industry Forecast Data Breach Industry Forecast by Experian Industry Survey Global Industry Information Security Survey by PWC Security Personnel Survey by Kaspersky Statistics & Reports Data Breach Statistics by IBM Data Breach Investigation Reports by Verizon Data Breach Statistics and summary by ITRC Security ...


1

First, there's a terminology issue when talking about this stuff. Strictly, 'BIOS' and 'UEFI' are different programming interfaces for the firmware present on PC motherboards. However, in a PC context, 'BIOS' is often used to refer to the firmware irrespective of its API -- that is, "UEFI BIOSes" should strictly read "UEFI firmwares". (Just to be clear: ...


1

Though this is not a research paper it may give you some insight into NPM: A Malicious Module on NPM Just because the package system is "Open Source" does not mean it isn't managed. Take the Apple App Store for example, the most widely used mobile device brand in the world and even they have issues managing the saftey of the downloads they provide.


1

There was a presentation at BlackHat Europe 2015 about weaknesses in Lastpass.


1

There are likely legal and ethical implications in utilizing a botnet's infrastructure to uninstall it remotely on all affected hosts. It may not be legal for even the authorities in a country to access personal or corporate resources. In addition, if the uninstall is not successful or poorly planned it could have further negative consequences. There is also ...


1

What you're asking to do is possible but quite difficult. First of all you need to understand a few ideas so here we go. Firstly, signature schemes. You've no doubt looked at digital signature schemes on the web and you might rightly ask - so why don't you just sign the whole file? Well, the answer to that is that in at least the case of RSA, you open ...


1

It's not clear what your intent is or what kinds of attacks you want to carry out, but it sounds like you simply need programs running that are configured to listen to or poll a configurable Command server, which would be one of your VMs. The commands the bots receive then determine their actions towards the victim. If you are shopping for a source of ...


1

There's a network designed for this purpose called DETER, and they both publish a great deal of information and make their "range" available to other researchers. http://deter-project.org/about_deterlab


1

Botnets are a large and varied class of software, which do a variety of tasks, so it's not necessarily easy to provide exact examples. With that said, if you take a typical task of creating Denial of Service conditions in the target system, then it's relatively easy to replicate the actions of a botnet with standard software. For example say you want to ...


1

Try these links: Timeline of computer viruses and worms Timeline of computer security hacker history Securelist - Descriptions View Recent Malware


1

This sounds like Evernote simultaneous search, I'd say that it will be sending the search queries you enter to the evernote service in order to provide this feature. Whether that's a problem for you will depend on whether you're happy with Evernote seeing that information. Obviously you trust them not to be actively malicious as you've installed their ...


1

Studies show that the deterrent effect of security cameras is minimal. Moreover, the question is whether are you trying to deter crime in the whole neighborhood or just in your house. If it's the latter, it makes sense to put up a CCTV in your home if other people haven't -- this will likely shift the interest of the burglars from your home to your ...


1

Being anonymous, verifiable and reciept-free at the same time is impossible. Of course, there will be kept some records and logs for verification purposes. You have to be seen(logged) for maintaining the rights of one person one vote. If it really is completely anonymous, anyone from anywhere in the network can vote any amount of times without getting ...


1

I'll add to this as I check for relevancy. FireEye + Mandiant Advanced Threat Report (2015): key findings (press release) CrowdStrike Global Threat Intel Report (Feb-2015). Numbers are sparse but charts are estimable. Intelligence reports and data in the adversary lineup section of the site are over these adversaries and target industries. Palo Alto ...



Only top voted, non community-wiki answers of a minimum length are eligible