In computer security, there are three main axes for consideration - confidentiality, integrity, and availability (CIA). These are commonly thought of as things you desire out of a secure system. You want your communications to only be available to the intended agents, you want them to remain unchanged except when you intend them to change, and you want them to be available when you need them. Preferably, you want your communications to have all of those properties.…
It looks like https://github.com/nixawk/labs/issues/19 is being exploited like crazy right now. I was getting hits trying to exploit it every 4 hours or so, then the rate sped up for a time. Each hit was trying to download drupal.php from http://51.254.219.134.
Somebody has nulled out that file now, so infection rate will probably drop.…
I’ve wanted to have a VPN setup for a while - I’ve never been entirely comfortable when using public wifi, even secured public wifi… Open wifi? I feel a little crazy every time I connect. But I usually console myself that I’m not a target, I can make sure important connections are encrypted, and I can just avoid doing some things while on public wifi.
A VPN though, that could make things much easier!…
Every now and then when I’m at a coffee shop I wonder what ports I’ve got open on my home network. Normally I don’t have any ports open within Nmap’s default port list.
Starting Nmap 6.01 Initiating SYN Stealth Scan at 16:41 Scanning myRouter [1000 ports] Discovered open port 1111/tcp on myRouter Completed SYN Stealth Scan (1000 total ports) Not shown: 999 filtered ports PORT STATE SERVICE 1111/tcp open lmsocialserver Read data files from: /usr/local/bin/.…
Ok, here’s a great blog post by Chris Shiflett about a crazy-creative SQL injection technique: http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string
Very cool. His technique relies on tricking addslashes into breaking up a two byte character with a slash, creating a valid two byte character followed by a valid one byte character. He mentions that this (specific attack) is impossible with UTF-8 because all two (or more) byte characters have continuation bytes that start with 0b10.…