Hot answers tagged

5 votes

Kernel level attack?

Someone will hopefully come along with a more complete answer, but this will get you started. I would write more but this is typically a 200 level course in CS, and I’m on mobile. I also may do a poor ...
adam's user avatar
  • 170
2 votes
Accepted

Can a machine learning model contain malicious code?

An ML model is a set of parameters for complex functions (the model architecture). What you run is an actual implementation of these functions. In addition you need code which creates the features for ...
Steffen Ullrich's user avatar
2 votes
Accepted

Explain `${jndi:ldap://...}` spam(s)?

This is an attempt to exploit the nearly-two-year-old "Log4Shell" vulnerability, which existed in the popular Log4j server-side logging utility. It's been long patched and only ever affected ...
CBHacking's user avatar
  • 46.4k
2 votes

Can webcams be turned on without the indicator light?

Aside from uvcdynctrl mentioned in other answers, it's also possible to use v4l2-ctl in Linux: v4l2-ctl --device=/dev/video0 --set-ctrl led1_mode=0
Riot's user avatar
  • 131
2 votes
Accepted

Is Certificate Pinning safe and worthwhile for an API server that will only accept requests from an android application?

I don't understand that while Pinning itself might be obsolete ... It is not. The sources you cite are only about HPKP, which is a very specific type of pinning where the negative impact of doing it ...
Steffen Ullrich's user avatar
1 vote

How to prevent attacks on a personal webserver

As an alternative to a firewall, you can (and should) bind the server to only listen on the loopback interface. The http.server script takes -h as a parameter to print out help information, which will ...
CBHacking's user avatar
  • 46.4k
1 vote
Accepted

CVSS3 score for XSS leading to account takeover

This is not an easy question. IMHO CVSS moved on from a generic, catch-all evaluation of all XSS (it used to be more or less rXSS[] + post-auth pXSS[] = Medium, pre-auth pXSS = High). The examples ...
tim's user avatar
  • 29.5k
1 vote

CVSS3 score for XSS leading to account takeover

CVSS3 only takes into consideration the impact to the whole web application, and not just to a single user. Is that so? Admittedly, it's been some time since I read the full CVSS specs and I could ...
SeeYouInDisneyland's user avatar
1 vote
Accepted

How to decrypt LockBit encrypted files

What you have is not the decryptor, but a builder. It will not be used to decrypt the files already encrypted, because it don't look like there's a master key or private key on it. If you look at the ...
ThoriumBR's user avatar
  • 53.5k
1 vote

Does core isolation protect me against malware?

You have a few things confused together. It is possible to create malware that includes a reverse shell that does not require "hacking" the system. Core isolation helps to isolate high-...
schroeder's user avatar
  • 128k
1 vote
Accepted

Which attack is more dangerous: Evil Twin or ARP spoofing?

The impact of a successful ARP spoofing and a successful Evil Twin attack can be the same - controlling the network traffic of a client, i.e. both sniffing and modifying. An attacker can also send ...
Steffen Ullrich's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible