5
votes
Kernel level attack?
Someone will hopefully come along with a more complete answer, but this will get you started. I would write more but this is typically a 200 level course in CS, and I’m on mobile. I also may do a poor ...
- 170
2
votes
Accepted
Can a machine learning model contain malicious code?
An ML model is a set of parameters for complex functions (the model architecture). What you run is an actual implementation of these functions. In addition you need code which creates the features for ...
- 198k
2
votes
Accepted
Explain `${jndi:ldap://...}` spam(s)?
This is an attempt to exploit the nearly-two-year-old "Log4Shell" vulnerability, which existed in the popular Log4j server-side logging utility. It's been long patched and only ever affected ...
- 46.4k
2
votes
Can webcams be turned on without the indicator light?
Aside from uvcdynctrl mentioned in other answers, it's also possible to use v4l2-ctl in Linux:
v4l2-ctl --device=/dev/video0 --set-ctrl led1_mode=0
- 131
2
votes
Accepted
Is Certificate Pinning safe and worthwhile for an API server that will only accept requests from an android application?
I don't understand that while Pinning itself might be obsolete ...
It is not. The sources you cite are only about HPKP, which is a very specific type of pinning where the negative impact of doing it ...
- 198k
1
vote
How to prevent attacks on a personal webserver
As an alternative to a firewall, you can (and should) bind the server to only listen on the loopback interface. The http.server script takes -h as a parameter to print out help information, which will ...
- 46.4k
1
vote
Accepted
CVSS3 score for XSS leading to account takeover
This is not an easy question. IMHO CVSS moved on from a generic, catch-all evaluation of all XSS (it used to be more or less rXSS[] + post-auth pXSS[] = Medium, pre-auth pXSS = High). The examples ...
- 29.5k
1
vote
CVSS3 score for XSS leading to account takeover
CVSS3 only takes into consideration the impact to the whole web application, and not just to a single user.
Is that so? Admittedly, it's been some time since I read the full CVSS specs and I could ...
- 1,460
1
vote
Accepted
How to decrypt LockBit encrypted files
What you have is not the decryptor, but a builder. It will not be used to decrypt the files already encrypted, because it don't look like there's a master key or private key on it. If you look at the ...
- 53.5k
1
vote
Does core isolation protect me against malware?
You have a few things confused together. It is possible to create malware that includes a reverse shell that does not require "hacking" the system.
Core isolation helps to isolate high-...
- 128k
1
vote
Accepted
Which attack is more dangerous: Evil Twin or ARP spoofing?
The impact of a successful ARP spoofing and a successful Evil Twin attack can be the same - controlling the network traffic of a client, i.e. both sniffing and modifying. An attacker can also send ...
- 198k
Only top scored, non community-wiki answers of a minimum length are eligible