Tag Info

Hot answers tagged

37

A zero-day attack is an attack that relies on an undisclosed vulnerability in the design or implementation of a system in order to violate its security. Most commonly, such attacks consist of using zero-day exploits to access information systems or execute code on privileged systems. Such exploits are called 'zero-day' because security administrators have ...


11

Amazon advisory links to the original XEN advisory on which one can read: Systems running only x86 PV guests are not vulnerable. So no problem for the PV instances. Regarding the HVM ones, Amazon explains that for performance reasons they managed to replace the HVM hardware drivers by the PV ones for storage and network operations (see PV on HVM). ...


4

A zero-day vulnerability is, by definition, one that has not been announced.


4

"Average length of time that an announced vulnerability has widespread exploitation", T "Attractiveness of server as a target", A, on a qualitative scale of 1-5 (higher number representing more attractiveness). "Ease of exploitation", E, using the CVE score as a basis of common comparison (T/A) x E = N Considering that T is now considered to be measured ...


3

This is the slow loris attack of incomplete HTTP GET Requests. How to protect your server: Update your Apache Server, there are many updates for this attack, this attack was discovered in like 2011. Other options are to reduce timeout on your Apache Server, etc. This attack works on timeout. Here tells you how to protect your Apache from DoS/DDoS (slow ...


3

Thanks to Bob Brown's hint and an article on Ars Technica he is probably referring to, we get to know at least some details on the hack rather than just gossip. From the article: And it still remains unclear how the malware was implanted on Sony Pictures’ network in the first place—or how multiple terabytes of data from corporate systems could have been ...


3

Setup a port knock daemon which opens the firewall for some time when specific ports are "touched" in some specific order. See for more information Port knocking


3

They're just as vulnerable as any other software would be to a vulnerability, so to your specific question it would be just as vulnerable. Remember though that in the case of shellshock the honeypot would have to be passing input to a bash shell to be vulnerable. Of course, is another component on the system is vulnerable, the honeypot could still be ...


3

A description from isightpartners (English), and description from Eset's blog (Russian). Embedded OLE object in Power Point document somehow can download and install .inf files and executable files.


2

Zero day which is not found anywhere. if you want to find a 0day you need to either research it and find it or buy one from the middle man like vupen or new one that kevin mithnick started


1

Satisfiability Modulo Theories (SMT) are mathematical concepts that looks at how something can be computed. These theories relates to things that you will find in many programming languages like real and integer numbers, lists, etc and which are essential to computers. SMT solvers (like Z3) are computer programs that automatically generate proofs for ...


1

The problem is that a vulnerable Flash version is a conduit into your system. There will be no way to see if your system was compromised via Flash. At best you will be able to see that you have some kind of infection/corruption in general, but you won't be able to tell how it happened.


1

Unfortunately it is very common with such targeted attacks that you only get aware of the attack once the intruder is already deep in the system, which might even be years after the initial intrusion. In most cases it is no longer possible to reconstruct the whole infection chain up to the original delivery vector at this time, because there are no more ...


1

Any software needs to be maintained. Honeypots are no exception. Because honeypots are designed to be probed and hacked, they need to be placed in a separate and secured environment with the understanding that they may be completely overtaken. Make sure the servers that honeypots are running on are part of your regular patch management process, and make ...



Only top voted, non community-wiki answers of a minimum length are eligible