Questions tagged [attacks]

An attempt to exploit a weakness in a system, either for nefarious or research reasons. Questions with this tag should be about designing, carrying out, or defending against the attack itself, rather than about the underlying weakness.

Filter by
Sorted by
Tagged with
0
votes
1answer
118 views

Is Bluetooth low energy (BLE) still secure?

Some time ago, Bluetooth was hit by a severe exploit (KNOB attack) that rendered its encryption pretty much useless. Publishers like the German Heise summarized it in an article* as an issue in the ...
0
votes
0answers
3 views

Chosen Ciphertext Attack textbook RSA [migrated]

I'm trying to perform a chosen ciphertext attack against an RSA oracle. I have c as the ciphertext I want to decrypt, e and n. I already know that I could choose a number r, compute r^e * c, make the ...
0
votes
0answers
43 views

Why does Mitre T1203 technique includes macros as software vulnerabilities?

I was reading a recent report about an APT and jumped into this Technique: https://attack.mitre.org/techniques/T1203/ This technique is called: Exploitation for Client Execution And that might match ...
1
vote
1answer
237 views

Received a strange text message. What is it? [closed]

This morning I received the following text message from a Gmail account: v3s5f3rs4f3gs3.nf5j4k8j4k3o.solar?G$1?V&?KL?O=$HO?&S?K0?$1T A couple of my friends got it too. I have an iPhone and it ...
1
vote
1answer
85 views

Layer7 DDoS Protection vs WAF, which should I use?

I have Layer3 ddos protection, but I want to upgrade it to Layer7 ddos protection. But when i look about Layer7 Ddos attacks, I see that they are usually HTTP/HTTPS based attacks. I have 3 questions; ...
0
votes
0answers
35 views

I got a call from a contact on What'sApp and that person says they didn't call me even by accident. Should I be worried about using What'sApp?

I got a call from a contact on What'sApp, and when I picked up there was no audio. The person says they weren't even holding their phone when it happened, and it even took a minute for the call to ...
1
vote
0answers
33 views

How does one label malicious traffic in generated workloads?

I have been writing on some code that automatically puts together differently parameterized attacks of common pen testing tools, i.e. sqlmap, nmap, patator etc. These attacks are then launched against ...
3
votes
0answers
349 views

How plausible is this article on how SciHub acquires its papers? [closed]

Sci-Hub is a piracy website that provides free access to usually-paywalled academic papers & books. Sci-Hub's owner Alexandra Elbakyan says that many people with legitimate access to the papers/...
0
votes
1answer
92 views

Can a hacker install known-vulnerable software on a machine in order to control the PC and elude antivirus?

I recently discovered that on one of my PCs the SolarWinds software was installed. I didn't install this software on my machine. I also saw that SolarWinds was cracked by Russian hackers and also ...
1
vote
1answer
58 views

How to exploit open redirect vulnerability which must contain the original url

Let's say I have the following url: https://secure.sub.domain.com/?continue=https://sub.domain.com I found out that I can put anything I want before sub.domain.com in the continue parameter as long as ...
11
votes
1answer
600 views

Why are water treatment facilities or similar connected to the internet? [closed]

I have a (sensitive) background in security, in short, I believe that the infrastructures MUST NOT connect to the internet. If you connect to the internet, it is a matter of time before it is breached....
0
votes
2answers
54 views

Regarding Dictionary Attack

Since most websites will let user retry their password, lets say 3 times in a row, in case of mistype or forgotten password. Exceeding the set number of retry the account will be locked or timed out. ...
1
vote
2answers
40 views

What is a reasonable timeframe that should be defined and enforced for access token expiry to reduce the risk of unauthorised access? [duplicate]

What is a reasonable timeframe that should be defined and enforced for access token expiry to reduce the risk of unauthorized access?
2
votes
2answers
58 views

Are polyglot microservices (multiple technologies) more secure than using a single technology framework?

As a full-stack cloud-native (AWS, Azure, and GCP) polyglot (Rust, Golang, Python, and Java) microservices developer, the nagging question that I have is if the use of multiple technology frameworks ...
0
votes
1answer
92 views

How does one detect and deter golden SAML attacks?

How does one defend, detect and deter golden SAML attacks?
0
votes
1answer
57 views

Attacking VPN server's outgoing connections

Due to increasing concerns about privacy online I recently started researching technologies that are supposed to hide our activities from unwanted watchers. I've been learning about workings of VPN ...
0
votes
0answers
64 views

Why is noreferrer recommended to prevent reverse tab nabbing attacks?

I just read about reverse tab nabbing. Why is noreferrer recommended in addition to noopener? Isn't it enough to have noopener? I assume if neither are sent, there could be Javascript code on the bad ...
0
votes
2answers
81 views

Defending against Wiegand sniffing (ESPKey) attacks in RFID card readers

It's known that card readers, which use the Wiegand format, can be attacked by installing a sniffer, such as an ESPKey. After the sniffer is installed, whenever anyone uses the reader, their ...
31
votes
3answers
6k views

How does one defend against software supply chain attacks?

In reference to the Solarwinds attack, since many organisations have no access to the source codes of the software vendors from whom they just consume the services, how can organisations defend ...
1
vote
0answers
59 views

Question on stack overflow

I am preparing for an exam in Computer Security and doing a past-exam without soluions, so I wanted to check if my reasoning holds on a question about stack overflow. Below is the C code in question. ...
1
vote
0answers
40 views

Problems understanding the use of Distance Bounding against Man-In-The-Middle attacks

I currently have to write a paper for university in my Network Security lecture about methods of secure location verification. Therefore, I chose to write about several distance bounding protocols, e....
1
vote
2answers
126 views

SQL injection using brute force?

I am studying about cyber defense lately for fun and found about a proposed method that as I understand it performs automated SQL injection using brute force by training a model. At some point it says ...
0
votes
1answer
41 views

Does limiting size of images prevents buffer overflow?

I am writing an app that serves images to clients. The app is written mostly in python. I store the images in AWS s3 and serve the clients them directly from there. Am I vulnerable to buffer overflow ...
0
votes
1answer
62 views

How plausible are cyber attack attributions between states? [duplicate]

When an attack on IT systems of a state is discovered, often another state is publicly blamed for it within a few days. I wonder whether these attributions are plausible from a technical point of view....
2
votes
1answer
52 views

CSRF payload delivery

If an attacker successfully delivers a CSRF payload by any means, what response can he can see once a victim clicks the link?
0
votes
2answers
88 views

Basic questions about a buffer overflow attack example

People say buffer overflows are serious security bugs that can usually be exploited. Here is an artificial buffer overflow #include <stdio.h> int main(){ int a[3]={0,1,2}; printf("...
0
votes
2answers
203 views

Does a hacker know which IP they hacked?

Suppose someone hacks my computer (by any means, say a virus or trojan like RAT), will they be able to know my IP address in real time? This is about dynamic IP addresses.
3
votes
1answer
455 views

What is the Plundervolt attack?

CVE-2019-11157 exposes a vulnerability in the undervolting API from Intel processors, that became known as the Plundervolt attack. What is the Plundervolt attack? Should domestic users be afraid of ...
0
votes
0answers
28 views

Commercial VPN Connected Devices Security [duplicate]

Would clients of a commercial VPN service be able to see each other's devices with NMap or a similar tool? What potential security consequences may transpire because of this threat? TIA
3
votes
0answers
84 views

Can/should I automatically report network break-in attempts?

For the last 15 years I've been using SpamCop to report the spam I receive. I do this because it sometimes results in spammers and the third-party machines they compromise getting shut down, at ...
2
votes
0answers
48 views

How good can X-Frame-Options HTTP header do against click-jacking?

X-Frame-Options HTTP header is used to tell if a webpage is allowed to be used in a frame/iframe. Frames can be used for click-jacking/UI-redress attacks. It is advised to set X-Frame-Options to '...
2
votes
1answer
189 views

Attack scenario when using split tunnel VPN

Background As many others I am working from home and we use a VPN to access services from the company intranet (SMB fileshares, git repo, project management etc). To improve things like video calls I ...
0
votes
1answer
128 views

Security implications of a fixed vs relative pathname

What would be some security implications of a fixed pathname (although probably in a system directory when it would be deployed as a system service) rather than a relative (out of current directory)? ...
4
votes
1answer
300 views

INTEL-SA-00086 extracting the secret key used to encrypt Intel CPU code: is the digital signature bypassed?

In a recent attack to INTEL-SA-00086, the researchers are able to extract the secret key that encrypts updates to various Intel CPUs. In the arstechnica blog it is mentioned as The key may also allow ...
1
vote
1answer
60 views

Getting an abnormal amount of firewall warnings on web server

I just had a look at the firewall status and saw it had blocked over 300 requests from TOR, Python Urllib, and some script called aabbccdd.xss.ht/pigeonburger.xyz (pigeonburger.xyz being my website). ...
26
votes
5answers
9k views

Can a website steal passwords saved in my browser?

Today I was on Steam and someone sent me a link and asked me to vote for him in some online gaming league. I clicked on it and the browser told me that this could be an unsafe link so I didn't proceed ...
1
vote
1answer
160 views

Are there any contactless (RFID/NFC) card vulnerabilities that are still unsolved? even minor ones

The title is pretty self explanatory. The market is pretty secretive about these kinds of matter since companies won't give out vulnerabilities for attackers to abuse and will give out vulnerabilities ...
-3
votes
1answer
85 views

If an attacker can inject any code into an email client on a users computer, how can he compromise confidentiality, integrity and availability?

I have an upcoming exam for a Security course. The following question has come up a couple times in past exams and I could use some help formulating an answer. Suppose a user downloads an unsigned ...
1
vote
1answer
122 views

Based on these HTTPS requests what type of attack is this?

I'm seeing over 1000 attempts to hit my API endpoints with many 500 responses. It seems clear that the would-be attacker is attempting to poke around the APIs, but it isn't clear to me what type of ...
0
votes
0answers
57 views

Difference between Attack Pattern and Attack Vector

I am learning about InfoSec and I always found these two terms Attack Pattern an attack pattern is an abstraction mechanism for describing how a type of observed attack is executed Attack Vector a ...
1
vote
0answers
73 views

Attack while using a VPN? [closed]

While I was using a VPN, suddenly all websites refused to connect in HTTPS, and Firefox warned me since I enabled HTTPS-only mode. Is there a chance that this was an HTTPS downgrade attack? Should I ...
0
votes
0answers
84 views

How to obtain PRGA file using aireplay-ng chopchop or fragmentation attack

I am running Kali linux 2020.3 on VBox on Windows 10. I put my wireless card AWUS036ACH chipset Realtek RTL8812AU in monitor mode using airmon-ng start wlan0 X (by x i mean the number of channel AP is ...
0
votes
0answers
52 views

When MAC flooding, why would an attacker specify IP addresses and/or TCP ports?

I'm specifically referring to the macof tool (part of the dsniff package). As I understand it, MAC flooding is meant to overload a switch's CAM table, which maps MAC addresses to switch ports. Where ...
1
vote
1answer
334 views

Can ISP deanonymize Telegram public channel creators?

In a Telegram public channel, all messages are public, send by the channel creators and contain a timestamp. Suppose I am an ISP. Can I analyse the traffic of all my clients and decide if they are ...
1
vote
1answer
118 views

What could be recovered after an interrupted ransomware attack?

Four days ago my PC got phobos ransomware. I didn’t notice until three days ago, and the reason is that the attack stopped midway, leaving some of my data as it is and not leaving behind any ransom ...
0
votes
2answers
152 views

How to understand a single packet embedded with multiple requests?

When I read Multi VERB Single Request: This Attack is also a variation of the Excessive Verb Attack strategy. The attacking BOT creates multiple HTTP requests, not by issuing them one after another ...
0
votes
1answer
102 views

Insider threats vs. insider attacks

I understand that a threat is a possible security violation that might exploit the vulnerability of a system, and a attack is an action on a system that harms the organisation in some way. Therefore, ...
0
votes
1answer
53 views

Booting 'live' form the hard disk

I use VeraCrypt for file-container level encryption for all of my files. But being very paranoid, I am always worried about the OS1, Primary applications and non-primary applications leaking the data....
0
votes
1answer
1k views

How to prevent XSS attack on selected window.location in javascript

This is my code where i have a userId in a method SwitchUser_Click. I need to prevent or somehow encode the return value from the switchUser_Click as it includes the UserId of a user vulnerable to ...
1
vote
0answers
72 views

How are accountgenerators with captchas still possible?

I was asking myself, how there are still account generators (e.g. for Steam) wide available for everyone. With account generators I mean programs, that are automatically creating a huge amount of ...

1
2 3 4 5
24