Collaborate Disseminate
I was just wondering how I could build a private network where it is physically impossible to gain access from outside but still have the option to publish data to some remote server. As an example: Let’s say I have a network… Continue reading How can I publish data from a private network without adding a bidirectional link to another network
Wikipedia lists five software packages for creating/editing/analysing attack trees.
These software packages do not seem to have settled, between them, upon an agreed file format for attack trees. This lack of standardisation… Continue reading Attack tree file format?
A power bank has some sort of circuitry, but I am not sure if there is any software on a power bank or if they are only pure batteries, but people are connecting their mobile phones and laptops to them by USB and historically… Continue reading can a power bank be used to plant malware?
I was reading this question about Session ID Hijacking
and it gave a lot of answers about stealing Session IDs. I have been thinking about this for awhile, but is there a benefit to using Session IDs over re-logging in with… Continue reading Is there any benefit to keep sending UN/PW to the server over Session ID ( i.e., Stateless vs Stateful)
I was reading this question about Session ID Hijacking
and it gave a lot of answers about stealing Session IDs. I have been thinking about this for awhile, but is there a benefit to using Session IDs over re-logging in with… Continue reading Is there any benefit to keep sending UN/PW to the server over Session ID ( i.e., Stateless vs Stateful)
I was reading this question about Session ID Hijacking
and it gave a lot of answers about stealing Session IDs. I have been thinking about this for awhile, but is there a benefit to using Session IDs over re-logging in with a UN/PW combo… Continue reading Is there any benefit to keep sending UN/PW to the server over Session ID ( i.e., Stateless vs Stateful)
The way that we hash passwords and the strength of password is important because if someone gets access to the hashed passwords, it’s possible to try lots and lots of passwords in a surprisingly short amount of time and crack… Continue reading How does an attacker get access to hashed passwords?
I would like to hear your opinions and how effective would my proposed defense is against power analysis. It is one of the nastiest side channel attacks because it’s undetectable and passive, but assuming that your power strip can be trust… Continue reading Simple defense against power analysis?
In CVSS version 3, there are four different attack vectors. I am not able to differentiate between local and physical.
Say, if I want to report “absence of logout button” I will use physical as access vector.
In which cases… Continue reading Difference between local and physical attack vector in CVSS version 3?
So, whenever you hear of the mean little hackers who hack websites you hear of “port scanning”. I understand what it is (looking for all open ports / services on a remote machine), however that begs the question:
Why would a… Continue reading Why do hackers scan for open ports?