20

Many crashes aren't exploitable for anything except denial-of-service (DoS). The most common example would be a NULL pointer read; attempting to dereference a pointer to (or anywhere near) 0 will fail, and unless the exception/signal is caught will cause the program to crash. However, just because the program tries to read from zero when given invalid input ...


18

This is a bit old (2006), but may be helpful towards your goal. http://usabilitynews.org/password-security-what-users-know-and-what-they-actually-do/ It is based on a study of 328 undergraduate and graduate level college students from Wichita State University volunteered to participate in the survey, and these students were also regular users of the ...


9

A recent thing to add here which probably is relevant to the question is that Landauer's Principle might not actually hold up: http://phys.org/news/2016-07-refutes-famous-physical.html They measured the amount of energy dissipated during the operation of an "OR" gate (that is clearly a logically irreversible gate) and showed that the logic operation ...


8

Smart phones are not that different from laptops, so building your own mobile lab and attacking the targets there is a good approach. Hosting your target: Use an Android emulator to host your Android target. You can interact with it from the command-line via ADB iOS has the same thing but they call it the iOS Simulator Or you can use physical phones but ...


7

Although I very much like @thomas-pornin's answer, I think there's a problem with the first assumption that must be called out. Laundauer's Principle only applies to irreversible operations. Contrary to what some may assume, reversible computing is already achievable. The operations are common in quantum computers and homomorphic encryption systems. ...


6

Likely helpful: Verizon's Data Breach Investigations Reports Trustwave's Global Security Reports Mandiant's M-Trends


6

Consider a segfault caused by trying to access memory location 0x0 (ie a null pointer de-reference). Maybe one part of the code thought it was done with a variable and set the pointer to null, and maybe under normal operations it really is done with it, but fuzz testing found some edge-case where something tries to read that variable again after it was set ...


5

It doesn't seem like you are asking how to determine if a site is posing as the 'real' site, which would be phishing, but what you are really asking is how to validate the content of a site, which is more of a philosophical question than a technical one. How does one determine, for instance, that The Onion is not a real news site? We can check the 'whois' ...


5

Well there's a couple of aspects to consider here, as has been said there is no clear answer. On the one hand you've correctly identified the risks of public disclosure with no easy remediation, which is that attackers can take advantage of the issue. However there are also risks with not publicly releasing. For example, it's entirely possible that other ...


5

For hiding the data, you use encryption. For making sure it came from a known source, i.e. authentication use a message authentication code (MAC), or authenticated encryption. Note that confidentiality (making sure only the intended recipient can read the message) and authenticity (making sure the message came from a known source) are different! For ...


4

Paraphrasing someone who does this for a living: “Exploiting vulnerabilities is a craft. Researching vulnerabilities is a black art.” A common way of looking for vulnerabilities in software (or hardware or a combination) is fuzzing. Look at some interface and throw all kinds of garbage at it. If it keeps operating correctly (“access denied”, “syntax error”, ...


4

So the underlying question that I see here is: "How do you protect against insider threats?" As I see it, there are two parts to the answer. One is that you protect against insider threats the same way that you protect against external threats, and the other part is that to some degree, you can't. Remember, security is about risk mitigation and ...


4

Security + Distributed Systems narrows down the attack pattern significantly. I can only think of one condition in which these two domain come into play... money. What if finical transactions where backed with an eventually consistent database? Maybe it would net thieves around $1 million USD. Non-relational databases are all the rage, but what if you ...


4

Key List of Resources (2015) Industry Forecast Data Breach Industry Forecast by Experian Industry Survey Global Industry Information Security Survey by PWC Security Personnel Survey by Kaspersky Statistics & Reports Data Breach Statistics by IBM Data Breach Investigation Reports by Verizon Data Breach Statistics and summary by ITRC Security Report ...


4

I happen to collect these type of statistics when I find them mentioned in a study or paper. Here are some recent figures: - 54% 1 to 5 - 28% 6 to 10 - 7% 11 to 15 - 5% 16 to 20 - 6% 20+ Source: CSID Consumer Survey: Password Habits, Sept 2012 Total average minimum number of private passwords = 17 Total average minimum number of work ...


4

These are the valid range for standard encoding of track 2, which is the ABA standard: 0x30 to 0x3f in the ASCII character set 0 1 2 3 4 5 6 7 8 9 : ; < = > ? Sources: http://blog.tehinterweb.com/?p=60 With enough control over the reader/writer, you can encode bits in anyway you choose though, could make up any system you like.


4

You at least need : documents to describe processes involved in certificates life cycles : *request for a new certificate *certificate revocation *certificate renewal both for administrators and users (probably two different documents for each process) a general architecture document, describing CA levels and their purpose That's in my opinion the ...


4

The idea here is to open a TCP connection with a spoofed address (i.e. the IP address seen by the server is not the real IP address of the client), thus bypassing any IP black- or white-listing. It has severe restrictions on what can be done: only one packet can be sent, and it should not depend on anything coming from the server. Practically, it could for ...


4

The main issue is that these tools induce suspicious behaviors (suspicious network activity, suspicious files, suspicious process behavior, etc.). From a network monitoring perspective, how would you then reliably detect an actual attacker if its activity is just blending in background noise of "normal" suspicious behavior affecting your network and systems? ...


4

Ethically, you should be guided by which path does the least damage. That most likely means you should release the information responsibly. Only in a world where you are smarter than everybody else is silence likely to limit damage. My opinion is that releasing the information does the least damage because: You cannot assume that you are the only person ...


4

Only you can decide your fate. Follow what makes you happy, where your passion is, and as you evolve through your career that drive will change multiple times making you a better candidate to employers. Network with others, goto conferences, and keep on learning!


4

Try starting with public spam email messages. For example, some accounts on mailinator.com receive a lot of spam. There is also a lot of public spam available on untroubled.org.


4

Negative rings are false rings. They are not actual privilege levels of the CPU. The way rings work is simple. Some instructions have privilege checks where they verify that the current privilege level, or CPL, is sufficient and if it is not, the instruction fails with a general protection fault. CPL0 is ring 0, CPL1 is ring 1, etc. Some instructions will ...


3

Any bug tracking software is the standard for this tool. Vulnerabilities you find are simply 'bugs'. Assign severity, track the vendor's response and follow-up, and detail the issues all within the tool. Github, bugzilla, Jira, etc. Choose the tool that matches your needs and workflow.


3

Being anonymous, verifiable and reciept-free at the same time is impossible. Of course, there will be kept some records and logs for verification purposes. You have to be seen(logged) for maintaining the rights of one person one vote. If it really is completely anonymous, anyone from anywhere in the network can vote any amount of times without getting caught....


3

Some great approaches already suggested, here's my addition: Given the average security researcher will often have a less typical academic background than researchers in other fields, it's sometimes necessary to use different approaches to getting stuff published, distributed, or otherwise just 'known' of. I haven't published any security research myself, ...


3

Terry Chia had indeed given a good number of options. Just to add something more - if you think what you have researched is indeed something novel, you can try approaching some journal for publishing the data. IEEE Computer Society's Technical Committee on Security and Privacy, ACM Transactions on Information and System Security can be a good some of the ...


3

http://datalossdb.org/statistics - truly opensource and not marketing-driven data.


3

A recent study titled Effect of Grammar on Security of Long Passwords would seem to be relevant if people use phrases which exist in natural language. The authors use Natural Language Processing over some large word corpora to come up "tag-rules", which are sequences like Pronoun, Noun, Adjective or Proper Noun, Verb, Adjective, Adjective. They use the same ...


Only top voted, non community-wiki answers of a minimum length are eligible