An attempt to exploit a weakness in a system, either for nefarious or research reasons. Questions with this tag should be about designing, carrying out, or defending against the attack itself, rather than about the underlying weakness.

learn more… | top users | synonyms

7
votes
6answers
1k views

RDP Attempts From Unknown IPs, How to Protect?

I'm running Windows Server2008 R2, and seeing the following error multiple times with various IPs in the event log: The Terminal Server security layer detected an error in the protocol stream ...
1
vote
3answers
62 views

What security measures can stop an attacker to obtain reverse shell even if a victim clicks and downloads a malicious exe file?

I am doing some hands-on training with Kali linux and one of the exercise I came across was to make an exe file containing malicious payload(say to obtain reverse shell), send it to a victim and hope ...
5
votes
0answers
37 views

Any historical precedent for Open-Source libs as an attack vector?

I'm curious as to whether there are any noteworthy cases historically of people deliberately placing exploits in open-source code libraries used by others, either something relatively obvious with the ...
0
votes
2answers
88 views

What is the likelihood of a NAS getting hacked? [closed]

I'm looking at NAS (network attached storage) to use as one of several backup storage devices to store my data, since I cannot find a DAS (direct attached storage) with RAID functionality (all of the ...
1
vote
2answers
53 views

Why are primes reused in Diffie-Hellman key exchanges?

Reading about the Logjam attack, I learned that Diffie-Hellman exchanges often* rely on the same particular 1024-bit key. I understand that back when DH was invented, even 512-bit keys were considered ...
9
votes
4answers
936 views

How to perform a proper DDoS test in a safe and controlled way?

What is the proper and safe way to perform a DDoS test without crashing the whole infrastructure? What different types of DDoS attacks are there and what things should be considered performing such a ...
0
votes
0answers
29 views

Proper way to document and log brute force attacks when creating a user account

We have the following use case: Users can self register for a business account by filling a validation form with their ID, first name, last name, and DOB. ID is something that only the user knows ...
0
votes
0answers
43 views

How does an attacker compromise a soft switch?

Speaking of soft switches (e.g soft switch in data plane of software defined networking). I've been trying to find a good research paper or article that explains how an attacker can compromise a soft ...
7
votes
4answers
2k views

Adding “Email or Username” in login page, is safe?

Suppose a website has a login page with "Email or Username", and shows the username publicly to every user on that site. Does that make it easy for an attacker to hack other someone's account?
2
votes
3answers
82 views

Necessity of physical access to air-gapped computers

In an intriguing paper Fansmitter: Acoustic Data Exfiltration from (Speakerless) Air-Gapped Computers (also see this summary) the authors demonstrate that they are able to exfiltrate data from an air-...
0
votes
0answers
24 views

PTK Security without Anonce and Snonce

Is the creation of the PTK still secure if it omits the Anonce and Snonce? My guess is, no, it is not secure anymore, it would be vulnerable for "replay" attacks maybe anyone can explain in a few ...
3
votes
0answers
67 views

security of libgcrypt when cross-compiling for windows?

Looking at libgcrypt, specifically secmem.c it seems that it does not account for windows-specific memory handling (e.g. VirtualLock) and in fact there is a very troubling comment: #elif defined (...
0
votes
1answer
49 views

Grabbing ChaCha20 key from ram

There are various other posts which talk about grabbing a key from ram such as http://electronics.stackexchange.com/questions/198274/storing-a-secure-key-in-an-embedded-devices-memory How would you ...
2
votes
1answer
85 views

How to find out if my MBR has Evil Maid code?

If Truecrypt Bootloader will remain visually the same, how can I find out if it was infected?
0
votes
1answer
55 views

Following strategy using DDoS mitigation service - UDP bandwith exhaustion attack from spoofed IPs

I need to defend against receiving a massive spam of UDP packets from random spoofed IP addresses. I would make it this way: In my protocol, every UDP packet contains username and password. Firewall(...
2
votes
1answer
81 views

Control flow integrity and data flow integrity

Many exploits nowadays can be prevented by control flow integrity (CFI). However, there are also data only exploits such as Heartbleed, read arbitrary data/keys which can be prevented by data flow ...
4
votes
0answers
88 views

Attacks on wifi router, don't know what to do or if I should be concerned [closed]

I'm wondering if these attacks are something to worry about, or just my router being a router. [DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:12:...
75
votes
1answer
9k views

What is this kind of low-intensity, non-hacking attack on a web service?

I am seeing for about 10 days now a bunch of EC2 machines (about 30, distributed in all regions) which are attacking a server of mine. The interesting (or uninteresting, I do not know yet) fact is ...
3
votes
1answer
109 views

Why POODLE vulnerability has for each byte a probability of 1/256 to get it in plaintext?

I read the Google paper about POODLE vulnerability (https://www.openssl.org/~bodo/ssl-poodle.pdf) and a lot of other articles. Each paper/article wrote about that you have to try it in average 256 ...
0
votes
2answers
125 views

How to deal with UDP bandwidth exhaustion DDoS attacks?

I am building a service, which will use UDP. It will run on Amazon AWS - in the firewall they provide, I can block everything except that one UDP port my service will run. The only thing I'm ...
1
vote
2answers
133 views

XSS vectors in img src and background-image url

I'm a little confused about XSS vulnerabilities when serving img.src and background url. From what I understand, the only way to execute javascript in this case, is to use javascript protocol. Let's ...
30
votes
1answer
3k views

Server attack with \x01

I notice from my server logs that there have been a number of requests like [01/Jun/2016:07:47:58 +0000] "\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\...
1
vote
0answers
35 views

Simulation vs Formal Analysis of Authentication Protocols

I received a review for my journal paper in which we proposed WOOlim or nspk kind of authentication protocols. We proved the strength of our protocol with rigorous formal methods using CSP and rank ...
0
votes
0answers
60 views

Why isn't ettercap working

I am working on an ARP poisoning/browser redirection project with Ettercap but even if I follow all the steps right it still doesn't work. I tried disabling firewalls too. What I do is: Start ...
0
votes
1answer
108 views

Is Qt framework is under attack or it has something suspicious (only in free version)

I was trying to download Qt framework. I went to its Official site (I'm sure, I checked in Wikipedia) for Visual Studio. But when attempting to download Qt for Windows, my Firefox shows this message: ...
5
votes
1answer
82 views

Is rowhammer comparable to faults caused by radiation?

As far as I know, both rowhammer and radiation based fault injection, can cause arbitrary bit flips in the memory. Are there any differences in matters of possible outcomes of both "attacks" on ...
3
votes
0answers
80 views

Security of the shared secret key for a smart meter (Linky) [closed]

Reading the specs of a new electricity smart meter (called Linky in France), I was surprised about the chosen encryption method (128 bits symmetric key AES), based on a single secret key (called CCC ...
0
votes
2answers
113 views

Repeated “Dos Attack” from remote IPs

I've been having some weird issues with a home network, and it seems to me like I have some vulnerability I don't know about. To be honest, though, I'm not a big network/security guy and I kind of ...
1
vote
1answer
95 views

s this an exploit attempt and where can I analyse it?

Edited: Never mind the MinGW or .bash_history, I can see that is unlikely. Somebody attacking me and those bytes ending up in the frequently used file .bash_history by accident is not that unlikely ...
0
votes
0answers
11 views

stopping router attack script using foreign addresses [duplicate]

I'm not a security expert but I've got someone using a script to attack my router. Sometimes it's every 10 minutes, but since I called the person out, it has increased in frequency. They are blocking ...
1
vote
1answer
35 views

Does this case fit the definition of a replay attack?

I read the definition of a replay attack on Wikipedia. However I don't know if the following case fits the description: An attacker captures a HTTP request sent to a web server, modifies the request ...
25
votes
3answers
3k views

Does using a live CD make you more vulnerable to remote attacks?

Some people recommend the use of a Linux live CD for online banking, but doesn't that make you more vulnerable to network attacks since it's not updated? I tried installing updates and it required me ...
0
votes
2answers
245 views

What can I do about being heavily port scanned?

I have two devices connected wirelessly to my Linksys router while running Symantec Endpoint Protection on my computer. A few days ago I started using the internet by connecting the cable directly to ...
4
votes
1answer
175 views

How to automate sending messages about abused internet hosts

I have just looked into the error logs of our web server and I have observed a great increase of SQL injection attacks this year. Those attacks, more than 3000 in 2016, usually look like this: ...
1
vote
1answer
84 views

Attack Challenge/Response Authentication by requesting challenges

If a client/server application uses a challenge/response pattern for authentication, e.g. SCRAM or alike, it often involves the usage of nonces (client nonce and server nonce) for preventing replay ...
63
votes
5answers
10k views

HTTPS web service switched to HTTP. What can go wrong?

I recently visited a website which used to have an HTTPS connection. Now it has just a plain HTTP connection, and the authentication method has changed from user+password to "authenticate with Google ...
2
votes
2answers
64 views

What can a user do in order to protect against CSRF attacks?

If I'm browsing while I'm logged in into my hosting panel or router or any other application, there is a chance of being hacked by a CSRF exploit. So, the question here is about user or client-side ...
11
votes
5answers
3k views

Why do hackers scan for open ports?

So, whenever you hear of the mean little hackers who hack websites you hear of "port scanning". I understand what it is (looking for all open ports / services on a remote machine), however that begs ...
3
votes
3answers
139 views

Is SFTP vulnerable to brute force, bounce, spoof, sniffing and port stealing?

I have been researching FTP and noted that using FTP means you are vulnerable to these types of attacks. I have been looking for an safer alternative and came across SFTP. Is SFTP still vulnerable to ...
1
vote
2answers
48 views

Random autofill [closed]

I was trying to pay for something just now, and when I put my name in the chrome autofill came up and I clicked it. The address that showed up was wrong though but corresponded to the postcode of one ...
1
vote
1answer
33 views

How can you spoof a TCP connection to a device that uses the same initial sequence number for each run of a TCP handshake?

So supposing the TCP implementation on a device always uses the same initial sequence number how could you as an off path attacker exploit this to spoof a connection to this device? So in order to do ...
8
votes
3answers
125 views

Can a TCP connection be terminated by an attacker if SSL/TLS has been used to protect data in the TCP segment?

I understand that SSL/TLS is built on top of TCP. That is after a TCP connection is established, an SSL handshake can be started. When it is completed, all communication will be encrypted and ...
-2
votes
1answer
81 views

Clicking a lot of website links in Google Maps, then sent through multiple URL redirects, and lastly to a page that made my laptop start beeping?

I was in Google maps clicking on all the website links listed in the side panel, looking at every website really fast. Note, they were all tattoo parlors. One of the links I clicked bounced me through ...
1
vote
1answer
116 views

man in the middle attack over internet

I've performed some man in the middle attacks (arp poisoning) using ettercap, stuffs on kali linux and i know how exactly it is working. but i was wondering if this attack could be even performed ...
1
vote
2answers
51 views

Dynamic, Randomized Protocols to Deter Attackers

Imagine a protocol that changed periodically. What if the order of these fields were changed a lot? One point in time the protocol might be { Payload, Checksum, Length, Flags, ID } The next point ...
4
votes
1answer
110 views

“Hacking” account when someone uses your email?

I have, on multiple occasions, received this email from Twitter: Since I have received it multiple times either this person clearly thinks the email is theirs or it's spelled similarly, something to ...
1
vote
1answer
37 views

a sent message for an unknown number without me sending it

there is a message sent from my iPhone to an international number. but i didn't send it and it doesn't appear in my message history. is this possible? how can it happen?
-1
votes
2answers
86 views

How is it possible to receive port scans with destination IP 0.0.0.0?

In my Amazon EC2 I installed a snort to prevent the attacks. I observed some logs TCP Port Scan Source IP is ISP and destination IP is 0.0.0.0. I think 0.0.0.0 is used for in a local network (routing, ...
2
votes
3answers
75 views

Should it considered a risk if an organization's server OS and version information is leaked? [duplicate]

I am assuming that it should be considered a risk because there may be several security issues of various OSes known to hackers. If a hacker gets access into the victim's network, the extra knowledge ...
4
votes
2answers
65 views

Can an attack that does not change the server state be considered a CSRF attack?

From Wikipedia: A real CSRF vulnerability in uTorrent (CVE-2008-6586) exploited the fact that its web console accessible at localhost:8080 allowed mission-critical actions to be executed as a ...