Hot answers tagged

268 votes
Accepted

SSL3 "POODLE" Vulnerability

What is the Poodle vulnerability ? The "Poodle" vulnerability, released on October 14th, 2014, is an attack on the SSL 3.0 protocol. It is a protocol flaw, not an implementation issue; every ...
184 votes
Accepted

Can simply decompressing a JPEG image trigger an exploit?

Is there such a thing? Absolutely. Feeding malicious input to a parser is one of the most common ways of creating an exploit (and, for a JPEG, "decompression" is "parsing"). Is this description ...
  • 72k
148 votes
Accepted

Someone is trying to brute-force(?) my private mail server... very... slowly... and with changing IPs

What's the point of this kind of "attack"? The rate is much too slow to do any efficient brute-forcing, and I really doubt that someone would specifically target my tiny personal server. ...
  • 64.7k
145 votes
Accepted

What is this kind of low-intensity, non-hacking attack on a web service?

This sounds like the behaviour of an uptime service. These connect from multiple locations at a regular interval, and are designed to alert the server owner in the event of problems. In this case, it ...
  • 27.2k
138 votes

Found suspicious, obfuscated PHP file. Is this a hack attempt on my website?

What will this code actually will do? You have a backdoor that allows Remote Code Execution Credit to borjab for the inital decode <?php preg_replace("#(.+)#ie", "@include_once(base64_decode("\1"...
  • 22.5k
137 votes

Does it make sense to consider a triggerable server software crash a DOS attack?

Yes. Any attack which has as a goal to deny the normal usage of a service by legitimate users is by definition a DoS (Denial of Service).
  • 2,671
136 votes
Accepted

Script Kiddies - how do they find my server IP?

You can't hide your IP address on the internet. They aren't secret. Pretty much what @DeerHunter said. It's trivial to scan the entire internet. If they want, they can target all-known digital ocean ...
  • 22.5k
107 votes

How hard should I try to prevent a user from XSSing themselves?

This is actually a real concept, "Self XSS" which is sufficiently common that if you open https://facebook.com and then open the developer tools, they warn you about it Obviously Facebook is a ...
  • 60.9k
106 votes
Accepted

Is divide-by-zero a security vulnerability?

At issue is that an exception handler will be invoked to handle the division by zero. In general, attackers know that exception handlers are not as well-tested as regular code flows. Your main logic ...
  • 33.7k
100 votes

What is different about being targeted by a professional attacker?

Disclaimer: I work at a company developing security software to mitigate against targeted attacks. Some of the methods we use are similar to those used by attackers (when clients want to test their ...
  • 1,190
100 votes
Accepted

Can malicious code fit in 14 bytes?

Yes, it can. It could be just the trigger vulnerability which would load data on specific areas of the movie in memory and execute. The malicious part can be pretty small, and the payload could be ...
  • 50.7k
99 votes
Accepted

How can ISPs handle DDoS attacks?

There are a number of strategies, each having their own costs and benefits. Here are a few (there are more, and variations): blackholing By blackholing traffic, you discard all traffic towards the ...
  • 6,788
98 votes

My email address is being used to enroll for online services. Should I be concerned?

Should I be concerned about this? Yes. This should be of concern to you because an attacker was able to obtain the valid password for your Gmail account. From the details of warning you have ...
  • 3,861
94 votes
Accepted

HTTPS web service switched to HTTP. What can go wrong?

You are right, the regression to HTTP is pointless. Note that all your points apply to one particular kind of attack, where the adversary is able to access the data transport between client and ...
  • 43.9k
92 votes
Accepted

Unusual mail headers show evidence of MTA attack. Have I been pwned?

This is an attempt to exploit the current remote code execution issue in the EXIM mail server, i.e. CVE-2019-10149. See The Return of the WIZard: RCE in Exim for details and also the kind of exploit ...
80 votes

Found suspicious, obfuscated PHP file. Is this a hack attempt on my website?

The short answer is: if the code was added by someone you don't know, then it's malicious, doesn't really matter what it does. Your server has been compromised and you need to perform a full clean ...
  • 124k
76 votes

How do attackers use compromised computers to do things over the internet?

They can do a heck of a lot One of the most common misconceptions I hear people say about cyber security is, "Well, hackers have no reason to come after me/this." As long as you have some ...
  • 1,799
72 votes

What kind of attack is prevented by Apache2's error code AH02032 ("Hostname provided via SNI and hostname provided via HTTP are different")?

Server Name Indication (SNI) is a TLS extension which allows a TLS client to indicate which host it is trying to reach. This is important for web servers with virtual hosts (i.e. multiple domains ...
  • 132k
69 votes
Accepted

How to secure a mobile app against its user?

You cannot. As soon as the user has the mobile device and your application, nothing stops him from decompiling your application, understanding how it works & what data it sends, and replicating ...
  • 50.7k
66 votes

I detected someone probing my site for weaknesses, what can I do about it?

Welcome to the internet! This is the normal situation, business as usual. You don't have to do anything, but to harden your website. Probes like that occurs all the time, on every site, day and night....
  • 50.7k
64 votes
Accepted

What kind of attack is prevented by Apache2's error code AH02032 ("Hostname provided via SNI and hostname provided via HTTP are different")?

What kind of vulnerability or attack vector is prevented by the error? The attack is called "virtual host confusion" and in 2014 several CDN were found vulnerable against it. The main idea is that a ...
62 votes

Is this an attempted SQL injection?

This is most likely a blind SQL injection, testing whether you're vulnerable to SQL Injection by checking whether your server takes the specified time or more to reply to the request. This is not ...
  • 1,941
60 votes

Does it make sense to consider a triggerable server software crash a DOS attack?

DDoS (Distributed DoS) is characterised by floods creating a DoS (in all available definitions). A single node causing a flood successfully is kind of rare. But DoS can be caused by a broad range of ...
  • 124k
58 votes

Script Kiddies - how do they find my server IP?

The IPv4 address space is limited to only 4,294,967,296 addresses.[note 1] Given enough bandwidth, it becomes trivial to scan every single IP address out there, especially if you're the owner of a ...
  • 2,768
57 votes

What is different about being targeted by a professional attacker?

All of security can be boiled down to threat modeling, risk assessment, risk management, and risk mitigation. So no, defenses designed to protect against non-targeted attacks are not likely to do ...
  • 35.5k
56 votes
Accepted

How are GPUs used in brute force attacks?

I'm choosing to assume you're asking why it's a risk rather than how to hack. GPUs are very good at parallelising mathematical operations, which is the basis of both computer graphics and ...
  • 1,122
55 votes

How do you deal with massive port scans?

I ignore them. And if you have a reasonable security posture, you should too. Your servers should have no ports open to the general public other than those that you use to serve the general public. ...
  • 82.3k
54 votes
Accepted

Why do hackers scan for open ports?

To run an exploit, an attacker needs a vulnerability. To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs ...
  • 48.9k
54 votes
Accepted

What is the difference between "Incident", "Attack" and "event"?

Assuming that you have looked up the official terms and wanted further help: An event is something that has triggered notice. An event need not be an indication of wrongdoing. Someone successfully ...
  • 124k
53 votes

Can simply decompressing a JPEG image trigger an exploit?

Agreeing with others to say yes this is totally possible, but also to add an interesting anecdote: Joshua Drake (@jduck), discovered a bug based on a very similar concept (images being interpreted by ...
  • 1,170

Only top scored, non community-wiki answers of a minimum length are eligible