Collaborate Disseminate
As I learn more about cyber security, I’m seeing a greater number of ambiguous acronyms (within the same field of cyber security) for various attacks. I was confused when reading articles that refer to MITM in differing manners. Besides th… Continue reading MITM/MTM – Vague Acronym Meanings in Cyber Security [closed]
Im currently studying and I stumbled over the term "coercive adversary".
I’m not a native English speaker and the term seems to be exclusively used by security and privacy related topics.
Can someone give me a definition/explanat… Continue reading Definition of "coercive adversary" [closed]
Not strictly a security question, but one that everyone using SSH will need at some point… This has been annoying me for some time, and I wondered if there is an official line on how "ed25519" should be pronounced. For example:… Continue reading How should you pronounce ed25519? [closed]
Is there a name for this kind of attack against Multi-Factor Authentication:
Attacker is in possession of a user login and password, and is able to trigger a transaction or login which requires MFA authentication by the legitimate user. M… Continue reading Attack against MFA: attacker triggering MFA prompt at the same time user is doing a legitimate transaction requiring MFA
In authentication, the term ‘claim’ is used to describe elements like user identity that has not yet been challenged and verified. My understanding is that a ‘claim’ typically refers to something that has not yet been verified as either tr… Continue reading Why are JWT claims called claims?
I’m a Cybersecurity enthusiast who recently started learning the ATT&CK Framework tactics
I came across two different terms, Collection and Exfiltration, which I think generally refers to the act of data breaching.
Unfortunately, I can… Continue reading What is the difference between the terms "data collection" and "data exfiltration" in adversary tactics? [closed]
Is there a term for when you a particular system design might prove to have some advantages, but doesn’t actually qualitatively change the potential attacks on the system and thus ends up as redundant, excessive, misleading, costly, and/or… Continue reading What is a term for ineffective security measures that don’t prevent any realistic attack?
On the Wikipedia page of threat (in textbooks too) various definitions are given where almost all agree in defining a threat as a "circumstance or event".
I’m having trouble understanding the subtle difference between event and c… Continue reading Difference between "circumstance" and "event" in the definitions of threat
Something you know (password), something you are (biometrics), something you have (key card/security key) are the typical authentication factors.
Several years ago I’ve seen a paper in which the users authenticated via interaction. In that… Continue reading Authentication via User Interaction (Game play, using ML)
ATT&CK defines process injection sub-technique 012 Process Hollowing different from sub-technique 008 Ptrace system calls.
With this in mind, if I write some fancy shellcode into the .text segment in a suspended process, which, unless … Continue reading Is it wrong to refer to ptrace process injection as process hollowing