Tag Info

Hot answers tagged

191

Hacks that work just by changing the URL One legit and one malicious example Some examples require URL encoding to work (usually done automatically by browser) SQL Injection code: $username = $_POST['username']; $pw = $_GET['password']; mysql_query("SELECT * FROM userTable WHERE username = $username AND password = $pw"); exploit (logs in as ...


64

There's an even easier way to bypass the "execute" permission: copy the program into a directory you own and set the "execute" bit. The "execute" permission isn't a security measure. Security is provided at a lower level, with the operating system restricting specific actions. This is done because, on many Unix-like systems (especially in the days of ...


25

You might have guessed this, but never use the terminals pasting functionality to paste things into vim/emacs. It's like sending a batch of commands to the editor, that can do anything. For these reasons, editors have their own copy-pasting functionality, which cannot be injected. For instance, in vim, you should use the + register to exchange data with the ...


24

The (currently) most common way in is through holes in PHP applications. There are dozens of ways in which this could work, but here's a simple, easy one: Imagine the unsuspecting site owner decides to take a shortcut in his code such that http://example.com/site.php?module=xyz actually first loads some template shell and then run "xyz.php" to fill in the ...


22

You can set the execute bit, but not the read bit, on an executable file. That way, noone will be able to copy the file, but people can execute it anyway. This is quite pointless today, because a) it works for compiled programs only, not with scripts (on most systems); b) these days, with 90% of all unixes being linux, people can copy executables from just ...


21

"Exploiting" an application means making it do, with the privileges under which it is running, some things that it was not meant to do. passwd runs as root because it needs to read and modify files (in particular /etc/shadow) that can be read and written only by root. The normal behavior of passwd is to alter the password of the user who runs it (passwd is ...


14

This is a poorly phrased question. For instance, it does not define what is meant by "secure". That makes it harder to provide a useful answer. Here are three possible security concerns, and how X11 fares: Isolation between apps. X11 does not isolate apps from each other. If one app is malicious, it can grab all keystrokes, tamper with other apps ...


13

The first point I'd make is that the number of hits on a given vulnerability/exploit db is not a reliable indicator of overall security. This could largely be defined by other factors such as the focus of security researcher's efforts or disclosure policies. Even a quick read over the project websites provides an indicator of the likely comparative security ...


12

When you copy a file to a different filesystem, what's going on under the hood is that a you create a new file and copy the contents. Moving a file to a different filesystem is done by copying then removing the source. So you have no more privileges when copying a file than at any other time you're creating a file. When you create a file, it belongs to you. ...


12

Well, it turns out that my current approach to clipboarding is good at mitigating this. When copy pasting snippets between tabs, I just copy paste normally. However, when copy pasting into a terminal/PuTTY session, I (being a bit averse to editing the text in the terminal), usually assemble it in Notepad++ or Emacs (depending on OS) and then copy-paste ...


12

The MySQL root user is an account inside the database only. It is called root because it is the most privileged user on the database server, and has access to everything. The root user on Linux (or any other Unix) is a completely separate thing. The maximum privilege that a MySQL user can have is equal to the privilege that the MySQL daemon runs at. On most ...


11

@rook : you should run a diff on the two kernels, after all those years (17 since the split) of divergence there isn't that much that is still common, however there is still cross-breeding between projects and a really good idea will spread all around. OpenBSD got way more in the way of security architecture, as in compiler support to prevent buffer ...


11

There are 2 ways of looking at it, you could focus on the server itself, or focus on the web application that the server is running. As a server, it can have open ports running services that you can connect to and gain access to the server. By using known exploits, you could gain root access. For example, some FTP servers for Unix have vulnerabilities that ...


11

Very frightening! As a risk, this should be raised to the board - effectively an attacker on the internet only needs to find out that username and password (or an SSH 0-day) and your entire corporate network should be considered compromised. Could the business run without it? Is there anything sensitive on it? This is a bad idea in so many ways: It ...


11

I could claim that any copy&paste of code snippets is a bad habit, but that's side-stepping the issue. I personally type such code elements instead of copying them, but that's because I usually want to change some things in them, or learn how to do the task at hand; or maybe I am just a raving maniac. What you could do is to automatically sanitize ...


11

Regardless of whether this should apply specifically to Unix, I would say that it is not safe to assume no access just because there are no open ports. To wit, ICMP is usually listened to, even if no TCP or UDP ports are available. And before you say, "But ICMP is just a simple Ping! It's irrelevant to attack using that!" check these out: Ping of Death ...


10

To answer my own question: It seems that some systems are, or rather were indeed insecure, leaking environment information to other processes. A similar issue to the present one is raised on github by user 'mitchblank' for the 'mosh' application (mobile shell). The author writes: Background: in the process image argv[] and envp[] are stored in the same ...


9

If someone has physical access to the machine they can modify these files to create a new root account or crack existing password hashes which is useful due to the prevalence of password reuse. Renaming or changing the location would be "(in)security though obscurity" and will provide no appreciable protection against this attack pattern. Steps to protect ...


8

It all comes down to the threat model. It depends on the risks and the likelihood of an attack. It depends on what the workstation does. It depends on the clients involved. How is this any different from running SSH on an actual server? If the service account doesn't have permissions to do much then the attack can't get very far. If the service account ...


8

One method which I have seen used: split the password. This was for SSH access to a sensitive server: a number of SSH keys were created, and marked as "authorized" on the server. Each private key was protected with a long passphrase, and every user knew only one half of the passphrase. That's crude but effective as long as there are not too many ...


8

What type of attacks are there that do not use open TCP or open UDP ports? This is way too general of a question. I'm answering this very literally, not to be a jerk, but because in security it's best to assume nothing. Here are some classes of attacks that do not use open TCP or UDP ports: Social engineering: get someone to connect outbound from the ...


8

No, it isn't necessary. With modern (less than 10 year old) hard drives, it is not required to overwrite a disk more than once. There is an often cited paper which says that you need to overwrite data at least 10 times to be sure, but that paper is over 20 years old and thus applies to outdated hard drives. Modern hard drives use much weaker magnetic ...


8

From their own FAQ: Q: Has your secure datagram protocol been audited by experts? A: No. Mosh is actively used and has been read over by security-minded crypto nerds who think its design is reasonable, but any novel datagram protocol is going to have to prove itself, and SSP is no exception. We use the reference implementations of AES-128 and OCB, and we ...


8

No, you can't. You can't ssh to folders, only to accounts. You might be able to mount the /tmp folder on another machine without a password if the server is running NFS or Samba and has fairly relaxed permissions.


7

The Short Answer This might not be the right question. A hacker... ...is a social engineer. They are more interested in their interactions with people than their interactions with computers. A hacker would far rather have you hand him your password, than have to brute force it. ...is seeking knowledge... ...and knows that knowledge is power. A hacker ...


7

Use Samba 3.3.x+ and set server signing = [auto|mandatory|disabled] in the Global section (disabled by default). Share level SMB encryption is auto by default. This has been tested with WinXP/Win7 and AIX 5.3 running Samba 3.6.7. SMB encryption became available in Samba 3.2 but server signing did not appear until 3.3. These are required for Win7 clients ...


7

environ is a pointer to pointer, as it has the type char **environ. You have to try something like: (gdb) x/s *((char **)environ) 0xbffff688: "SSH_AGENT_PID=2107" (gdb) x/s *((char **)environ+1) 0xbffff69b: "SHELL=/bin/bash"


7

This idea is in no way specific to web browsers. You could make the same argument that every application the user runs deserves to have its own segregated user ID under which to run. Yes, some measure of security would arguably be gained by doing this because (for example) the malicious music player running in the same desktop session couldn't access the ...


7

Not out-of-the-box. I know of no Android or iOS device running a bash shell. Some people might, on their rooted devices, but that will be only a few.


6

The first problem is that it's not threadsafe, and the string buffer that is used doesn't contain a trustworthy value; i.e., you can't be sure the value you get back is any good. US-CERT goes into some detail. The results of getlogin() should not be trusted. The getlogin() function returns a pointer to a string that contains the name of the user ...



Only top voted, non community-wiki answers of a minimum length are eligible