Tag Info

Hot answers tagged

52

Zero-days are found in exactly the same ways as any other kind of hole. What makes a security hole a "zero day" relies exclusively on who is aware of the existence of the hole, not on any other technical characteristic. Holes are found, usually, by inquisitive people who notice a funky behaviour, or imagine a possible bug and then try out to see if the ...


12

To add to the excellent answer of Thomas Pornin, usually zero-day vulnerabilities are found through source code auditing, reverse engineering, and fuzzing (or fuzz testing). The choice of the technique usually depends upon the information available at hand. For example, if the software is open source, then sifting through the source code and looking for ...


11

I've found a nice post from a Cisco Support Engineer regarding to the ASA: However, if you are trying to find the OpenSSL version for an ASA (Adaptive Security Appliance), you can determine this version from the ASA release notes. Simply examine the "Open Source" notes that are located in the release notes of the particular ASA image you are concerned ...


6

DD-WRT does use OpenSSL 1.0.1 and is vulnerable. There was an update posted just 22 hours ago to the trac page: http://svn.dd-wrt.com/browser/src/router/openssl You can view the CHANGES file for details.


5

If you just want to know if one DLL supports ASLR, then load it into CFF Explorer, go to the Optional Header section, then click on the DllCharacteristics row. If "DLL can move" is checked, then it's ASLR-enabled, otherwise it's not. If you want to do a lot of them, I would write a Python script that enumerates all DLLs in a target directory, then checks ...


4

Thanks to @Polynomial for that excellent pefile module suggestion. I threw together a quick python script to do this. There is probably room for improvements but it seems to work decently enough. import argparse import os import pefile class DllCharacteristics(): def __init__(self): self.IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = False ...


4

On my DD-WRT router, access via ssh First I could see that the version on the /usr/lib/libssl* is 0.9.8 Also running strings on said lib shows v 0.9.8 within $ strings /usr/lib/libssl.so.0.9.8 | grep OpenS OpenSSLDie SSLv2 part of OpenSSL 0.9.8l 5 Nov 2009 SSLv3 part of OpenSSL 0.9.8l 5 Nov 2009 TLSv1 part of OpenSSL 0.9.8l 5 Nov 2009 DTLSv1 part of ...


4

From Cisco Security Advisory on OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products (Advisory ID: cisco-sa-20140409-heartbleed, April 9, 2014): Vulnerable Product The following Cisco products are affected by this vulnerability: Cisco AnyConnect Secure Mobility Client for iOS Cisco Desktop Collaboration Experience DX650 ...


3

Setup a port knock daemon which opens the firewall for some time when specific ports are "touched" in some specific order. See for more information Port knocking


3

For as long as software is written by people, who are inherently imperfect and can make mistakes, there will be bugs in code that can be exploited. Servers need to expose themselves to the outside world in order to provide their services, which are definitely provided by software written by people installed on the server. For client computers, they need to ...


2

In the OpenSSL code there are several string definitions related to the heartbeat feature: ./ssl/ssl_err.c:{ERR_FUNC(SSL_F_DTLS1_HEARTBEAT), "DTLS1_HEARTBEAT"}, ./ssl/ssl_err.c:{ERR_FUNC(SSL_F_TLS1_HEARTBEAT), "SSL_F_TLS1_HEARTBEAT"}, ./ssl/ssl_err.c:{ERR_REASON(SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT),"peer does not accept heartbearts"}, ...


2

Synology is affected but is prepping an update for DSM 5 and DSM 4.3 tomorrow. A patch for DSM 4.2 will be delivered in one week. From a release I got from Synology (I'm a journalist): Synology® DSM 5.0 Secured Against OpenSSL Heartbleed Vulnerability Taipei, Taiwan—April 11st, 2014—Synology® Inc. today releases the latest DSM 5.0-4458 Update 2 to ...


2

as far as DD-WRT goes, it depends on the version. A lot of the "current" DD-WRT releases pre-date the introduction of the heartbeat feature (2012) and associated security vulnerability into openssl. If your DD-WRT was built since 2012 it is vulnerable. The version of DD-WRT I am running on my internal routers is from 11/12 and when I run the heartbleed test ...


2

Most of the information about zero-days, running malware or advanced exploits investigation (marketed as Advanced Persistent Threats) is privately owned by some commerical companies (such as Mandiant for ex.). Apart of that, you can use the traditionnal vulnerability feeds like CERTs or CVE. A feeds list was posted in this related question that might help ...


1

I really have no idea what level of technical competency the asker or any/everyone here is coming from so let try to start from the very bottom and work up and do in the simplest language I can. Please don't be offended if you have a masters in computer science or you're some ROP legend or whatever... In order to understand the exploit in question, even at ...


1

It's a bit like asking "How much does a car sell for?" in that there will be intrinsic differences between each exploit, dramatically altering the value. On top of that, the chosen way of monetization will dramatically affect the value also (White hat, black hat, etc). In general I'd suggest black hat methods would probably be more valuable in an absolute ...



Only top voted, non community-wiki answers of a minimum length are eligible