Tag Info

Hot answers tagged

11

I've found a nice post from a Cisco Support Engineer regarding to the ASA: However, if you are trying to find the OpenSSL version for an ASA (Adaptive Security Appliance), you can determine this version from the ASA release notes. Simply examine the "Open Source" notes that are located in the release notes of the particular ASA image you are concerned ...


6

DD-WRT does use OpenSSL 1.0.1 and is vulnerable. There was an update posted just 22 hours ago to the trac page: http://svn.dd-wrt.com/browser/src/router/openssl You can view the CHANGES file for details.


4

From Cisco Security Advisory on OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products (Advisory ID: cisco-sa-20140409-heartbleed, April 9, 2014): Vulnerable Product The following Cisco products are affected by this vulnerability: Cisco AnyConnect Secure Mobility Client for iOS Cisco Desktop Collaboration Experience DX650 ...


4

On my DD-WRT router, access via ssh First I could see that the version on the /usr/lib/libssl* is 0.9.8 Also running strings on said lib shows v 0.9.8 within $ strings /usr/lib/libssl.so.0.9.8 | grep OpenS OpenSSLDie SSLv2 part of OpenSSL 0.9.8l 5 Nov 2009 SSLv3 part of OpenSSL 0.9.8l 5 Nov 2009 TLSv1 part of OpenSSL 0.9.8l 5 Nov 2009 DTLSv1 part of ...


3

Thanks to Bob Brown's hint and an article on Ars Technica he is probably referring to, we get to know at least some details on the hack rather than just gossip. From the article: And it still remains unclear how the malware was implanted on Sony Pictures’ network in the first place—or how multiple terabytes of data from corporate systems could have been ...


3

They're just as vulnerable as any other software would be to a vulnerability, so to your specific question it would be just as vulnerable. Remember though that in the case of shellshock the honeypot would have to be passing input to a bash shell to be vulnerable. Of course, is another component on the system is vulnerable, the honeypot could still be ...


3

A description from isightpartners (English), and description from Eset's blog (Russian). Embedded OLE object in Power Point document somehow can download and install .inf files and executable files.


3

A zero-day vulnerability is, by definition, one that has not been announced.


3

Setup a port knock daemon which opens the firewall for some time when specific ports are "touched" in some specific order. See for more information Port knocking


2

In the OpenSSL code there are several string definitions related to the heartbeat feature: ./ssl/ssl_err.c:{ERR_FUNC(SSL_F_DTLS1_HEARTBEAT), "DTLS1_HEARTBEAT"}, ./ssl/ssl_err.c:{ERR_FUNC(SSL_F_TLS1_HEARTBEAT), "SSL_F_TLS1_HEARTBEAT"}, ./ssl/ssl_err.c:{ERR_REASON(SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT),"peer does not accept heartbearts"}, ...


2

Most of the information about zero-days, running malware or advanced exploits investigation (marketed as Advanced Persistent Threats) is privately owned by some commerical companies (such as Mandiant for ex.). Apart of that, you can use the traditionnal vulnerability feeds like CERTs or CVE. A feeds list was posted in this related question that might help ...


2

Zero day which is not found anywhere. if you want to find a 0day you need to either research it and find it or buy one from the middle man like vupen or new one that kevin mithnick started


2

as far as DD-WRT goes, it depends on the version. A lot of the "current" DD-WRT releases pre-date the introduction of the heartbeat feature (2012) and associated security vulnerability into openssl. If your DD-WRT was built since 2012 it is vulnerable. The version of DD-WRT I am running on my internal routers is from 11/12 and when I run the heartbleed test ...


2

Synology is affected but is prepping an update for DSM 5 and DSM 4.3 tomorrow. A patch for DSM 4.2 will be delivered in one week. From a release I got from Synology (I'm a journalist): Synology® DSM 5.0 Secured Against OpenSSL Heartbleed Vulnerability Taipei, Taiwan—April 11st, 2014—Synology® Inc. today releases the latest DSM 5.0-4458 Update 2 to ...


1

Unfortunately it is very common with such targeted attacks that you only get aware of the attack once the intruder is already deep in the system, which might even be years after the initial intrusion. In most cases it is no longer possible to reconstruct the whole infection chain up to the original delivery vector at this time, because there are no more ...


1

Any software needs to be maintained. Honeypots are no exception. Because honeypots are designed to be probed and hacked, they need to be placed in a separate and secured environment with the understanding that they may be completely overtaken. Make sure the servers that honeypots are running on are part of your regular patch management process, and make ...


1

I really have no idea what level of technical competency the asker or any/everyone here is coming from so let try to start from the very bottom and work up and do in the simplest language I can. Please don't be offended if you have a masters in computer science or you're some ROP legend or whatever... In order to understand the exploit in question, even at ...



Only top voted, non community-wiki answers of a minimum length are eligible