New answers tagged

0

One example is Apple iOS with iCloud Lock. You have to setup your iPhone with iCloud and FindMyiPhone ahead of time but if it is lost and beyond recovery you are able to lock and erase the device. Afterwards it will prompt the thief for your iCloud Credentials (it will not show the full email address making the attack harder). The iPhone will stay bricked ...


2

Barcodes can be to exploited because of fact that most barcodes contain not only numeric and alphanumeric characters, but also full ASCII characters (special ones included) depending on the protocol being used. Barcode scanners are essentially keyboard emulators and if they support protocols such as Code128 (which supports ASCII control characters), an ...


8

After going through the code, I'm not sure that it is supposed to exploit or attack anything. It looks like its only purpose is to encode a payload using barcodes. It would be a nice way to import code into a system using a barcode reader when all other routes may be blocked. After you locate a vulnerability in a system, you can "upload" a payload using one ...


7

This is remarkably similar to attacks like SQLi, and the remediation is the same. Wherever you allow a barcode to be scanned as input, validate it in the scanner and only allow input that matches the requirements. If you expect a field of 20 digits, only allow 20 digits and strip off anything after 20. If you expect 8 alphanumerics, limit it to that. ...


2

Since it depends on your situation (e.g. connecting from work to home or vice-verse, how much you can trust your IT team or people at home, your ISP, your operating system), I'll just give a list for the most paranoid setup: Use the most secure implementation you can - First, check the list here: https://en.wikipedia.org/wiki/...


0

First of all, with VNC you have no security. While your password isn't directly transferred in plain text, it still uses a homebrew authentication protocol which DES-encrypts a challenge sent by the server using the password as a key. The password is limited to 8 characters. Now, even if we ignore the password bit, the actual frames are transferred in the ...


2

Is there a way to mitigate or minimize this security risk? Sure. Only use trusted remote-desktop software. Some operating systems come with a default one, though it may not always be the ideal piece of software. This software need not be proprietary, there are open-source options to choose fome. Use strong authentication, never short or simple passwords. ...



Top 50 recent answers are included