Category Archives: intrusion

Is this event a security concern: Windows 10: Event 360, User Device Registration?

Posted on by

My computer just froze, and I ended up having to reboot. It appears Windows Defender was coming up with a notification, but that froze as well. I was trying to see what went wrong in the event viewer, and noticed several application hang… Continue reading Is this event a security concern: Windows 10: Event 360, User Device Registration?→

This Way to the Ingress: Keeping Stuff Dry and Clean with IP and NEMA

Posted on by

When designing a piece of hardware that has even the faintest chance of being exposed to the elements, it’s best to repeat this mantra: water finds a way. No matter how much you try to shield a project from rain, splashing, or even just humid air, if you haven’t taken precautions to seal your enclosure, I’ll bet you find evidence of water when you open it up. Water always wins, and while that might not be a death knell for your project, it’s probably not going to help. And water isn’t the only problem that outdoor or rough-service installations face. …read more

Continue reading This Way to the Ingress: Keeping Stuff Dry and Clean with IP and NEMA→

What is the IDS overlapping fragmentation attack trying to accomplish? [on hold]

Posted on by

An IDS sensor has been deployed in a Linux system and it is used to monitor a Windows. An attacker likes to avoid detection of the following 24 character string at the IDS while still targeting the Windows system : “thisattackisprettybad”. How this can be done by string fragmentation(3 packets). For simplification purposes, it is possible to fragment datagrams anywhere one may like and also one can specify absolute offers (no 8 – boundary limitation). For each fragments, I need to give the content and the offset. If it is not possible to conduct this attack, then is it possible to explain why not it is possible?

What I know about IDS is that an intrusion detection system (IDS) monitors network traffic and monitors for suspicious activity and alerts the system or network administrator. In some cases the IDS may also respond to anomalous or malicious traffic by taking action such as blocking the user or source IP address from accessing the network.IP fragmentation is the process of breaking up a single Internet Protocol (IP) datagram into multiple packets of smaller size.The IP fragment overlapped exploit occurs when two fragments contained within the same IP datagram have offsets that indicate that they overlap each other in positioning within the datagram. This could mean that either fragment A is being completely overwritten by fragment B, or that fragment A is partially being overwritten by fragment B. Some operating systems do not properly handle fragments that overlap in this manner and may throw exceptions or behave in other undesirable ways upon receipt of overlapping fragments. This is the basis for the teardrop attack. Overlapping fragments may also be used in an attempt to bypass Intrusion Detection Systems. In this exploit, part of an attack is sent in fragments along with additional random data; future fragments may overwrite the random data with the remainder of the attack. I also know that Linux favors new data and Windows favors old data when dealing with the overlapping part of the segment. Based on this on my knowledge I want to find the answer of the following question and what is the explanation for it?

Continue reading What is the IDS overlapping fragmentation attack trying to accomplish? [on hold]→

Can anyone explain me this IDS overlapping fragmentation attack?

Posted on by

An IDS sensor has been deployed in a Linux system and it is used to monitor a Windows. An attacker likes to avoid detection of the following 24 character string at the IDS while still targeting the Windows system : “thisattackisprettybad”. How this can be done by string fragmentation(3 packets). For further simplification , we can fragment datagrams anywhere we like and we can specify absolute offsets (no 8 -boundary limitation). For each fragment, We need to give the content and the offset and if it is not possible to conduct the attack, is there any explanation for that?

Continue reading Can anyone explain me this IDS overlapping fragmentation attack?→

Manufacturing companies got wrecked by cyber-spies last year, Verizon report says

Posted on by

Cyber-spies backed by nation-states were behind a majority of data breaches experienced by manufacturing companies in 2016, according to Verizon’s newly published 2017 Data Breach Investigations Report. Verizon identified 620 data breach incidents in the manufacturing sector last year — of which 94 percent could be defined as “espionage” driven and attributable to “state-affiliated” actors. Roughly 91 percent of material stolen in these breaches had been categorized as “secret,” relating to proprietary information owned solely by the victim. Cybersecurity experts say hackers largely target the manufacturing industry in order to steal trade secrets, business plans and valuable intellectual property. Verizon defines cyber-espionage as incidents that include “unauthorized network or system access linked to state-affiliated actors and/or exhibiting the motive of espionage.” “When you make stuff, there is always someone else who wants to make it better, or at least cheaper. A great way to make something cheaper is to let […]

The post Manufacturing companies got wrecked by cyber-spies last year, Verizon report says appeared first on Cyberscoop.

Continue reading Manufacturing companies got wrecked by cyber-spies last year, Verizon report says→