Tag Info

Hot answers tagged

39

Imagine a shopping mall. By definition, anybody can enter the mall and then browse the shops. It is public. The shops are expecting people to come by, look at the displays, maybe enter and then buy things. In the mall, there is a shopkeeper, who sells, say, computers. Let's call him Jim. He wants people to come by and see the computers and be enticed into ...


20

Introduction I'll try to the best of my knowledge to approach your questions without touching the technical parts of the Bluetooth technology itself. I've learned a lot of the following while I had to write a security report to shape a BYOD policy. Knowing you, I won't have to lecture you on that there's nothing 100% secure, everything we do is just to make ...


15

No, it is not possible, in theory or practice. A well enough distributed DDoS attack is indistinguishable from legitimate traffic. Consider the "slashdot" or "reddit" or "digg" effects, where actual legitimate traffic takes down network services on the target website. Simply posting a link to the target website on slashdot is an effective DDoS in many ...


15

In general: You need to trust the machine on which you are decrypting the files. This trust is usually only warranted if you have full control over this machine which also means that you can install software on it. So if you are really concerned about the contents of your files then use an offline encryption/decryption tool on a trusted machine and upload ...


14

The basics First, I assume you understand the most basic session ID security right: you are using an ID with sufficient entropy, and you use transport level security (HTTPS). Any approach to session ID (URL, cookies, whatever) that does not get those right is vulnerable, your question is specifically about ID in URL, so I will not discuss that further. ...


13

Despite what others are saying, yes you can. Many major corporates have very effective solutions, and even the recent Spamhaus battle, which used DNS DDoS at a scale that hasn't been seen previously was covered rapidly once CloudFlare were brought on board. The solutions I have tested are very effective at transferring DDoS traffic, even when it is a ...


12

Short answer. The benefit is from an unpredictable serial number, not from any old serial number. Indeed, a sequential serial number adds no security, as it is easily predictable. But randomizing the serial number (so it is hard to predict) does make it harder to exploit the known collision attacks on MD5 to get a forged certificate. Let me explain. ...


12

A router misbehaving and trying to act as a fake server with regards to the client, and a fake client with regards to the true server, forwarding data in both directions, is the exact definition of a man-in-the-middle attack. Apart from routers (which act at the IP level), classic practical methods for MitM include: hijacking a HTTP proxy subverting the ...


12

There was a presentation at BlackHat yesterday where they used a Arduino to open hotel rooms that are using a certain kind of lock: http://www.h-online.com/security/news/item/Arduino-used-as-master-key-for-hotel-rooms-1652281.html As devices get smaller and more powerful, that are getting better suited to be used as pentesting drop boxes. Examples are: ...


8

Many phones allow you charge with only power and ground connected. Some phones (looking at you, Apple) use the data lines to determine whether or not the charger is "permitted" to charge your phone. Other phones still (some Android phones in particular) explicitly ask you to decide what to do with the USB connection -- e.g. charge only, or mount as usb ...


7

This answer may be incomplete or incorrect as my knowledge on the topic is limited, but my understanding of Bluetooth is that it is a fairly loose stack on which different protocols (called profiles) can be developed. A lot of the particulars of security are going to depend on the particular Bluetooth stack and profile that you have on your hardware. ...


7

Well, you can scale infrastructure to make it more difficult for a botnet to keep up enough traffic to disable the service, but ultimately, the only counter if a DDoS is using otherwise legit traffic to cause issues, all you can do is increase your bandwidth to be higher than theirs. If you can identify a source as rogue, then you can try to block the ...


6

As a rule, the returns on this type of defense are nearly zero. There are exceptions, but even then this technique may offer only a small amount of security. Exhaustive vulnerability scans of randomly-chosen hosts offer extremely low returns on scanning resources. Instead, successful attackers generally choose one of the following two options to increase ...


6

Your organisation might want to subscribe to Java for Business: With the announcement of Java for Business customers and partners running Java applications on older release families (1.4, 5.0, 6) now have a choice of either migrating to a newer release or subscribing to Java for Business to continue receiving critical reliability, availability and ...


6

Device security is limited to the type of device. What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? Each device provides a level of services. The services provided create the restrictions or limitations to access and exploit. The best protection is to keep Bluetooth turned off (if ...


6

This is really a matter of each CA's policies. Most of them require proof of ownership of a domain before issuing a certificate. Even with cheap CAs this usually involves either verifying an e-mail can be received by a WHOIS contact or making entries in the DNS records for the domain.


5

This is going to be an annoyingly trivial answer, BUT... The only way to perform a Response Splitting attack on an updated ASP.NET (or MVC) server, is if the application itself is writing back raw HTTP responses. Yes, of course no programmer in their right mind would do that... but in the case of the 60% of programmers that are not in their right mind, it ...


5

The first GPU-assisted malware is considered to be the Badminer trojan reported by Semantec in 2011. Although its GPU leverage level is pretty low and the risk is low too, this is still the first precedence of using the GPU maliciously in the wild. Another more intrusive example of the same idea is RiskTool.Win32.BitCoinMiner. Then antivirus designers ...


5

In SRP, the server stores a password-derived token, which can be used to guess the password in an offline dictionary attack (attackers tries potential passwords until a match is found). This is not a flaw of SRP: the server necessarily contains some similar password-derived data, regardless of the used authentication protocol. The magic of SRP is that no ...


5

Microsoft SDL v5 is pretty decent and you have to full paper explaining the whole process that can be downloaded from MSKB: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=12285 If you need to get just a general grasp of the process, you can read a short and solid intro @ TechSurface: ...


5

There is no way to no for sure what happens inside the ATM, but most ATMs handle transactions by connecting to a server. There is no reason that it should have to keep any record of transactions internally.


5

The article you quote applies their latency system on SYN packets, the first step of a TCP handshake. For the attacker, SYN flood attacks are attractive because they work well with IP spoofing: since the attacker does not need to see the response packets from the server (the SYN+ACK), then the attacker can use a fake source address, and thus remain "hidden". ...


5

There are two different matters here, Outlook Social Connector LinkedIn integration and LinkedIn Outlook contact import. These are totally different things. Importing contacts from Microsoft Exchange: In this case, LinkedIn has no access to your Inbox at all. LinkedIn could indeed have access to the user's inbox. The whole process is controlled by an API ...


5

First of all, a "linear overwrite" is the most common type of buffer overflow. This is the example given in the slide. Where by starting at some base address you write in a linear fashion and eventually you overwrite the return address: void function(LPCSTR input){ char buffer[256]; strcpy(buffer, input); } An example of a non-linear overwrite ...


5

You can't, really. You can reduce the chances of content-sniffing running HTML by serving files with a X-Content-Type-Options: nosniff header, and try to avoid them being treated as HTML pages by serving with Content-Disposition: attachment, but still you have older browsers to worry about, and browser plugins. (For example Java's broken SOP and Flash's ...


4

As to Response Splitting, vulnerable application allows injection at http response headers level. So there have to be an attack vector in app that allows unfiltered input to be appended to headers section of response. Today frameworks (like .net or J2EE, and probably others) offer programmers an API which can be used to mitigate/eliminate such attacks (in ...


4

It sounds like you are mostly moving the problem around. The CI server used to have the credentials to push new installs to the Heroku server, now it's the deploy server. So the big question from me is - what is the difference in security between the CI service and the deploy server? Is one hosted externally? Is there a reason you trust one more than ...


4

There are in principle ways to stop a DDOS: The simplest way is to just throw more resources at it. Good luck trying to take down amazon.com or google.com. Combine a round-robin DNS entry with tons of cloud servers and it get's really hard to DDOS you. Not everyone can afford such immense resources, but that's what services like CloudFlare are for. If you ...


4

Preventing this kind of issue depends on the type of protocol that's used. Assuming that we're talking about web access (HTTP) here then the main defence against this kind of attack is a well configured SSL setup combined with some user awareness. If you try to intercept access to an SSL encrypted website then you need to present a certificate to the user ...


4

This is what SSL certificates are for. Your browser has a list of trusted certificates and certificate providers, and when a site says I'm PayPal.com your browser knows the certificate is wrong. A man in the middle attack may spoof certificates or persuade you to accept an incorrect certificate, and a successful one could indeed do what you say, and steal ...



Only top voted, non community-wiki answers of a minimum length are eligible