Tag Info

Hot answers tagged

52

Zero-days are found in exactly the same ways as any other kind of hole. What makes a security hole a "zero day" relies exclusively on who is aware of the existence of the hole, not on any other technical characteristic. Holes are found, usually, by inquisitive people who notice a funky behaviour, or imagine a possible bug and then try out to see if the ...


33

Apple apparently takes this seriously, since they "disabled Java" in users' computers, which is a rather drastic move. This actually smells like a pretext to kill off the technology, as part of a wider strategy. For this specific hole, there are a few details there. It is all about the Java applet model. To understand: Java is a programming language and a ...


14

First, I'm not a lawyer. Second, this completely depends on your local laws. I can only speak for my limited experience with UK and US law. In most countries, you're covered by free speech laws, assuming the information you're releasing isn't protected by some form of non-disclosure agreement, and isn't classified as a military secret. If you found the 0day ...


12

Holistic SDL. By definition, you can't defend against a specific attack that you don't know about beforehand. However, if you implemented a complete, Secure Development Lifecycle through all the phases, including appropriate Threat Modeling, and you mitigate the threats (not the attacks) - then you should be relatively okay.


12

To add to the excellent answer of Thomas Pornin, usually zero-day vulnerabilities are found through source code auditing, reverse engineering, and fuzzing (or fuzz testing). The choice of the technique usually depends upon the information available at hand. For example, if the software is open source, then sifting through the source code and looking for ...


11

If you can find the offending executable or dll, one thing you can do is to upload it at https://www.virustotal.com. Try even the svchost file if you feel it's suspicious. It will show you how many antivirus engines detect it out of a huge list, and will also forward your sample, if it fails to be detected, to antivirus companies for further processing and ...


11

I've found a nice post from a Cisco Support Engineer regarding to the ASA: However, if you are trying to find the OpenSSL version for an ASA (Adaptive Security Appliance), you can determine this version from the ASA release notes. Simply examine the "Open Source" notes that are located in the release notes of the particular ASA image you are concerned ...


10

User education & training is huge. Get the users to help you play good defense. I always like to see the security programs that award spot bonuses to employees for challenging a person in a secured area without a badge. You can be creative and extend this idea to phishing attacks, pretexting, etc; for example, send out a mock phishing attack and ...


9

This is such a massive question that I think the only answer is going to be to practice a defence in depth approach to security. Start at the first point of contact and build up protection down the the very core. In order to see what those type of kits are doing make sure you are logging and monitoring everything, this should give you some idea of what is ...


9

Here are several steps you could take to encourage security researchers to disclose vulnerabilities to you: Waive liability. Promise not to sue researchers who disclose vulnerabilities to you in a responsible fashion. Currently, many researchers report worrying that reporting a vulnerability to a company could get them sued, and so sometimes they just ...


9

I defend myself by not running any of the apps targeted by any of those exploits. I suggest elinks(1) on grsecurity Linux. If you mean, "How do you defend a large organization filled with many users and systems running some, if not all, of the apps targeted by a massive list of exploit packs and crimepacks?", then the correct answer is to implement an ...


9

The best way to mitigate zero day exploits is to prevent zero day exploit writers from writing zero day exploits. The best way to prevent zero day exploit writers from writing zero day exploits is to encourage them to find other ways of making money or gaining fame, which would require making data exfiltration less easy and less profitable, as well as ...


8

This just brings into the public eye something which has been happening for ages: everything is vulnerable. SCADA kit used to be safer as it generally wasn't connected directly to public networks and was considered obscure, however the targets are juicy, and the security levels generally pitifully low so attackers have always researched ways to exploit them. ...


8

There is this JBoss Application Server Remote Exploit (CVE-2010-0738) that was published recently. The exploit works for JBoss running on both Linux and Windows platforms, when the exploit is successful it will return a command prompt or a shell to the attacker.


7

I think the most likely outcome would be delayed patches to fixes at the behest of friendly governments. Consider: Deliberately introducing flaws is not an easy thing. Anyone from the organization could look at the code and see the flaw - so the details might leak. Continuing point one, if the flaw causes an issue for customers, that would be bad rep for ...


6

No. Secure coding is the main area. A patching and secure update system is important for feature upgrade, quality, metrics, and security reasons -- it may be a strong requirement for many end-user devices in addition to secure coding. I avoid using and recommending firewalls and anti-virus agents at all costs. They make you less secure, and not just because ...


6

You are almost correct - .lnk files should be a shortcut to a file, but here the .lnk itself is crafted to effectively autorun an exploit rather than calculate the shortcut to the intended file. The Microsoft Security Advisory from 2010 gives more information along with the fix in MS10-046 so this is not a zero day.


6

The linked CNET article refers to CVE-2013-0422 "Oracle Java 7 Security Manager Bypass Vulnerability" (Oracle, US-CERT, NVD/NIST). From the Oracle link: "Affected product releases and versions: JDK and JRE 7 Update 10 and earlier". "The vulnerability on the Java sandbox exists in both 7u10 and 7u11" is incorrect. 7u10 is vulnerable. 7u11 is not. The update ...


6

Your organisation might want to subscribe to Java for Business: With the announcement of Java for Business customers and partners running Java applications on older release families (1.4, 5.0, 6) now have a choice of either migrating to a newer release or subscribing to Java for Business to continue receiving critical reliability, availability and ...


6

If you just want to know if one DLL supports ASLR, then load it into CFF Explorer, go to the Optional Header section, then click on the DllCharacteristics row. If "DLL can move" is checked, then it's ASLR-enabled, otherwise it's not. If you want to do a lot of them, I would write a Python script that enumerates all DLLs in a target directory, then checks ...


6

DD-WRT does use OpenSSL 1.0.1 and is vulnerable. There was an update posted just 22 hours ago to the trac page: http://svn.dd-wrt.com/browser/src/router/openssl You can view the CHANGES file for details.


5

Interesting question. There's a couple of areas that are possible controls for this. The obvious first place is patching things like Java. It's commonly overlooked in patching processes but with the level of attacks need to get patched as soon as possible. The next one is hardening. Java applet functionality (which it likely what was exploited here) ...


5

Go to CVE Details' Product or Vendor pages. There is "Vulnerability Feeds & Widgets" link there. It allows you to subscribe to CVEs about selected vendor/product.


5

Targeting sandboxed platforms like Flash and Java will be excessively difficult if you're just starting out, so I suggest you learn to walk before you try to run. Some stuff you'll want to know: How to code in a low level language like C. What the stack, registers, heap, etc. do, and what happens when you overflow them in various ways. At least basic x86 ...


5

A 0-day exploit is a vulnerability not known to the public and more particular, the programmers of a particular application. You don't want to get that confused with bad coding. If someone created a button that said "Click here for admin access", and it would grant admin access, this would not be a 0-day vulnerability. Most programmers would agree that ...


5

Thanks to @Polynomial for that excellent pefile module suggestion. I threw together a quick python script to do this. There is probably room for improvements but it seems to work decently enough. import argparse import os import pefile class DllCharacteristics(): def __init__(self): self.IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = False ...


4

If your talking about Zero Day attacks against any application within your network. I would suggest: Using Ingress filtering at the network firewall and also use Egress filtering so to limit what traffic can travel outbound from your system meaning that if a machine was to be affected by a Zero Day exploit hopefully it would not be able to communicate ...


4

The file /include/formvars.php is used by WebCalendar. About 2 days ago, (April 23rd 2012) a remote code execution exploit for WebCalendar was released. Although /include/formvars.php isn't the actual vulnerable file, its a good way of verifying that WebCalendar is installed. Its looks like the attacker needs install/index.php and ...


4

If you are looking for the vulnerability reports and databases, I've already answered this in this stackoverflow answer. Copy-pasting again for easy reference: Common Vulnerabilities and Exposures project (CVE) http://seclists.org/fulldisclosure http://packetstormsecurity.org/ http://www.securityfocus.com/bid/ (BugTraq) http://www.exploit-db.com/ ...



Only top voted, non community-wiki answers of a minimum length are eligible