222

I was the one who wrote the comment you quoted. Quick answer: A 0day is burned when the exploit is used too often or haphazardly, resulting it in being discovered and patched. Virtually every time a 0day is used, it risks being burned. Using a 0day more sparingly and cautiously can increase its shelf life. The idiom intends to compare a 0day to a non-...


114

A zero-day is a vulnerability that is unknown by the software manufacturer and for which no patch exists. When using a zero-day vulnerability against a remote server, it may give away how it works. The administrators of the application may notice they have been hacked, look in the logs and discover the vulnerability that was used to hack them. If they then ...


92

From the explanation of in-house in the Cambridge Directory: "Something that is done in-house is done within an organization or business by its employees rather than by other people". Here it means developing your own hash algorithm instead of using a public one. Usually that means that it is developed by only a few people with only limited expertise in ...


84

CTFs (Capture The Flag) are like courses within games. Some website provide easy ones to learn the ropes, with simple challenges of increasing difficulty. For example http://overthewire.org/wargames/ will teach you how to use tools (Hex dump, vi, even the terminal itself) with each challenge. The main goal is usually to find some code, either embedded in a ...


76

We just got reports that 4000 of our systems are infected with ransomeware. 3000 are end users, 800 are non-critical servers, 200 are critical servers. Triage is looking at this mess and deciding which order to start restoring systems in. We can't tackle them all at once, so we have to look at some and say 'Sorry, little Inspiron that couldn't, you get to ...


55

Assuming that you have looked up the official terms and wanted further help: An event is something that has triggered notice. An event need not be an indication of wrongdoing. Someone successfully logging in is an event. An incident is something that indicates a problem, however you define "problem". It carries from an event but has a layer of ...


49

In IEEE 802.1X terminology that would be the supplicant: Authenticator An Authenticator is an entity that requires authentication from the Supplicant. The Authenticator may be connected to the Supplicant at the other end of a point-to-point LAN segment or 802.11 wireless link. Supplicant A Supplicant is ...


46

The exploit is what delivers the payload. Take a missile as an analogy. You have the rocket and fuel and everything else in the rocket, and then you have the warhead that does the actual damage. Without the warhead, the missile doesn't do very much when it hits. Additionally, a warhead isn't much use if it goes off in your bunker without a rocket delivering ...


38

SNI (Server Name Indication) is a TLS (Transport Layer Security) extension in which the client presents the server the domain name for the target it wants to access within the TLS handshake. It is used in cases where there are multiple virtual servers with different certificates on the same IP address, so that the server can present the correct certificate. ...


37

SQL injection most commonly happens when a programmer builds an SQL command by appending together (or interpolating) strings, using user-supplied input. e.g. Imagine this extract from a vulnerable piece of user authentication (login) pseudocode from a fictional web application. username = getPostData( "username" ); password = getPostData( "password" ); ...


35

"We believe the secrecy of your passwords is very important, which is why we have implemented measures that strongly protect them while stored on our servers. Once you submit your password we convert it using a cryptographic function (salted PBKDF2-SHA256 with 64,000 iterations for the tech savvy), so even if attackers are able to breach our site they won't ...


31

A rootkit is a set of tools that you run on a target machine when you somehow gained access to it with root-level privileges. The point of the rootkit is to transform that transient access into an always-open door. An example of a rootkit would be a modification of the sshd binary, so that it always accepts "8gh347vb45" as password for root, regardless of ...


31

Right now, there is no known weakness with MD5 or CBC encryption or 96-bit MAC as they are used in SSH. So there is, stricto sensu, no security benefit in enacting the configuration modifications that your are proposing. It could be argued that removing support for some algorithms might lead to security issues because it may prevent some clients from ...


27

In computer security, they are used interchangeably. In the context of rights, permission implies consent given to any individual or group to perform an action. Privilege is a permission given to an individual or group. Privileges are used to distinguish between different granted permissions (including no permission.) A privilege is a permission to ...


25

It depends on whether you are talking about the concepts, the terminology, or the acronym. Concepts of confidentiality, integrity and availability of information have been used by war generals for quite some time; for instance, one can see Julius Caesar operating along these lines during the Gallic Wars and he was certainly not the first to grasp the ...


23

Security researches find exploits. The day they report it is day Zero because developers will start work on patching it. Good Security researchers (as in white hat) will publish the zero day to the developers before they publish it to the rest of the community. In many cases they only publish it to the community because the people in charge of the code ...


22

To say "CTF" is a little like saying "video game". How do you prepare for a video game? Well, it depends on what the game is! Tetris is very different from Skyrim, which is different from Mario Kart. There is very little that you can do to prepare without knowing a LOT more information. In one CTF I needed to understand networking, TCP/IP, web app design, ...


20

Both are same kind of attacks. The difference is Eavesdropping could be in any form (Physical to logical), where the sniffing is more electronics/network related term.


18

It really depends on your point of view. From the outside, the "script kiddie" is, nominally, the wannabe attacker who uses tools written by other people (the "scripts"), without really understanding what is going on. Everybody uses tools written by other people (if only operating systems, C compilers, libraries...), but some people have a certain ...


18

That would still be covered in integrity: creating or deleting data is still a violation of integrity. (This can be seen as a mutation on the overall data set.)


18

I support David's view that if you had to fit your scenario into one of the CIA categories, integrity would be the appropriate one because you're creating an unintended state thus violating integrity. But also have a look at the Parkerian hexad which is a popular extension of the CIA triad. It consists of the attributes confidentiality, possession or ...


18

While schroeder's answer is certainly correct, it might not be formal enough. In the the terms and definitions of the ISO/IEC 27000 you will find the following: threat potential cause of an unwanted incident1, which can result in harm to a system or organization information security event identified occurrence of a system, service or ...


17

Those are called NoSQL Injections instead of SQL injections. You can find more information about NoSQL injections, in the OWASP Testing Guide.


17

What is a CTF? It's a type of computer security competition, called CTF because you capture a "flag", a unique string, and submit it to the scoring infrastructure for points. CTFs are almost always time-limited, often something like 24-48 hours (typically continuous over a weekend, which gives competitors around the world a fair shot regardless of time ...


16

Edit 2: Since this has been migrated to Security.SE, I should probably preface this with with: I'm not a professional cryptographer, and there are many, many reasons why you should never roll your own security. Having said that: It's a form of challenge-response authentication (with different challenges being sent each time). The algorithm to find the ...


16

While Arminius covered the domain of 802.1X, I'd like to add my answer from the perspective of authorization standards/frameworks. OAuth 2.0 Several key terms are defined in section 1.1 of RFC 6749: resource owner An entity capable of granting access to a protected resource. When the resource owner is a person, it is referred to as an end-...


15

The source of your confusion is an historical "explanation" of RSA signatures as being "encryption of the hash with the private key". This explanation is confusing, and flawed in many ways. It works only for RSA. Actually it does not work for RSA either. Let's define things properly: An asymmetric encryption system defines two functions: Encrypt: takes as ...


14

Let's pretend we ordered some movie tickets online, and the process of later acquiring them involves identification in person at the box office before the event. You will be asked to produce your identification document (ID). That's identification. The box office attendee will then verify your identity by visually inspecting your ID - that's identification ...


14

According to this TTP refers to the Tactics, Techniques and Procedures of cyber threats. Edit: Traditional security measures like firewalls, IDS, endpoint protection, and SIEMs are only part of the network security puzzle. Cyber Threat Hunting refers to proactively and iteratively searching through networks or datasets to detect and respond to threats ...


14

In addition to Adonalsium's fine answer regarding prioritization, the triage step will include the initial routing of the event to the people best suited to handle it. A virus or ransomware attack would go to the operations team who would first isolate the computer to minimize collateral damage. A DDoS attack may go to the network team to start sinking the ...


Only top voted, non community-wiki answers of a minimum length are eligible