Tag Info

Hot answers tagged

38

A zero-day attack is an attack that relies on an undisclosed vulnerability in the design or implementation of a system in order to violate its security. Most commonly, such attacks consist of using zero-day exploits to access information systems or execute code on privileged systems. Such exploits are called 'zero-day' because security administrators have ...


12

Amazon advisory links to the original XEN advisory on which one can read: Systems running only x86 PV guests are not vulnerable. So no problem for the PV instances. Regarding the HVM ones, Amazon explains that for performance reasons they managed to replace the HVM hardware drivers by the PV ones for storage and network operations (see PV on HVM). ...


5

EMET software participates in a defence-in-depth approach of security. It adds an effective supplementary security layer when an attacker manages to successfully exploit a vulnerable software without being blocked by the anti-virus. However, in such domain is an endless race, since while EMET is getting more popular, attackers will try to craft their ...


5

Flash has been a high-value target for exploit developers for years, particularly because of its near-ubiquitous installation base and the fact that (historically) it will generally run automatically whenever a page with Flash content is loaded. This makes it very easy for a large number of systems to be targeted and compromised with a single exploit. As it ...


5

ESET released a report about the vulnerability here. Their key findings are: Linux/Moose targets consumer routers and modems including the hardware provided by Internet Service Providers (ISPs) to consumers The threat is built for deep network penetration spreading past firewalls It can eavesdrop on communications to and from devices connected ...


4

A zero-day vulnerability is, by definition, one that has not been announced.


4

"Average length of time that an announced vulnerability has widespread exploitation", T "Attractiveness of server as a target", A, on a qualitative scale of 1-5 (higher number representing more attractiveness). "Ease of exploitation", E, using the CVE score as a basis of common comparison (T/A) x E = N Considering that T is now considered to be measured ...


4

The answer is to take responsibility for your own security. If you rely only on software vendors for your security your trust is arguably misplaced and you might be disappointed quite often. You are in control of your system as an individual and it is therefore your responsibility to take the necessary measures to protect what is important to you. Most ...


3

This is the slow loris attack of incomplete HTTP GET Requests. How to protect your server: Update your Apache Server, there are many updates for this attack, this attack was discovered in like 2011. Other options are to reduce timeout on your Apache Server, etc. This attack works on timeout. Here tells you how to protect your Apache from DoS/DDoS (slow ...


3

Thanks to Bob Brown's hint and an article on Ars Technica he is probably referring to, we get to know at least some details on the hack rather than just gossip. From the article: And it still remains unclear how the malware was implanted on Sony Pictures’ network in the first place—or how multiple terabytes of data from corporate systems could have been ...


3

They're just as vulnerable as any other software would be to a vulnerability, so to your specific question it would be just as vulnerable. Remember though that in the case of shellshock the honeypot would have to be passing input to a bash shell to be vulnerable. Of course, is another component on the system is vulnerable, the honeypot could still be ...


3

A description from isightpartners (English), and description from Eset's blog (Russian). Embedded OLE object in Power Point document somehow can download and install .inf files and executable files.


2

Zero day which is not found anywhere. if you want to find a 0day you need to either research it and find it or buy one from the middle man like vupen or new one that kevin mithnick started


2

The most reliable way is to stop using the product or service that has the vulnerability until it is patched. Obviously this is often very inconvenient. You must make a risk assessment of your own situation to decide if it is worth it.


2

Email is certainly the most common method of pushing malware to a network, but it is not the only one. Also, while malicious files can be delivered as attachments to emails, they can also be presented as links that end users click on, resulting in a drive-by download or perhaps a more traditional virus that the user then has to download and execute ...


1

The short answer to your question is: Leave Flash enabled on your mother's computer - but check the option for only running Flash content when the user (your mother) tells it to run. That way, when she's at a known page and she needs to run the plugin, all she has to do is right click and click "run this plugin". Firefox may even do this by default now. You ...


1

Use Google Chrome - it has "PepperFlash" built in, and it's always up to date (as long as you reboot every day). She can use the sites you need, and you can uninstall the regular flash so that she doesn't get tricked into opening a website that will infect her computer. I did this a year ago with my parents, and haven't had any issues since.


1

Well inadequacy is relative, in that you don’t know what they’re doing, but if you’re willing to do the research then you can find out i guess? Sandbox the browser using something like Sandboxie, which will then tell you what its trying to access, you could also install Wireshark on a machine and point all traffic going out from that machine to the machine ...


1

Unfortunately it is very common with such targeted attacks that you only get aware of the attack once the intruder is already deep in the system, which might even be years after the initial intrusion. In most cases it is no longer possible to reconstruct the whole infection chain up to the original delivery vector at this time, because there are no more ...


1

Satisfiability Modulo Theories (SMT) are mathematical concepts that looks at how something can be computed. These theories relates to things that you will find in many programming languages like real and integer numbers, lists, etc and which are essential to computers. SMT solvers (like Z3) are computer programs that automatically generate proofs for ...


1

Any software needs to be maintained. Honeypots are no exception. Because honeypots are designed to be probed and hacked, they need to be placed in a separate and secured environment with the understanding that they may be completely overtaken. Make sure the servers that honeypots are running on are part of your regular patch management process, and make ...



Only top voted, non community-wiki answers of a minimum length are eligible