There are quite a few sql injection tools around, Pangolin is one of the most sophisticated blind SQL injetion tool I have come across, you can find it here :Pangolin Enjoy
What was theoretically feasible has been practically tested : "BIND used fully randomized source port range, i.e. around 64000 ports. Two attacking servers, connected to the attacked one via GigE link, were used, each one attacked 1-2 ports with full ID range. Usually attacking server is able to send about 40-50 thousands fake replies before remote server returns the correct one, so if port was matched probability of the successful poisoning is more than 60%. Attack took about half of the day, i.e. a bit less than 10 hours."
Here is the white paper and the slides to Mark Dowd & Alexander Sotirov Talk "How to Impress Girls with Browser Memory Protection Bypasses" - a must read :
Especially the whitepaper has some interesting details.
Who am I to disagree : I think the lack of quality only partially has to be accounted to the prices being paid for 0day, 0day in terms of bugs are rarely being presented at conferences. I think the security market has become crowded and noisy, press is jumping more and more on it security over the last 5 years and have not been helping to increase quality but sensationalism. See DNS bug vs. SNMPv3 bug. I also think that time is increasingly getting spare to prepare for such conferences (this implies research) for every researcher there are 5+n consultants. Anyways that's the reason I have not been at BH or Defcon this year - last year really sucked.
PS. The 100k price tag for an SSH 0day is too low by the way.
After the dns + evilgrade fiasco I hope that insecure auto update functions are taken as serious as they should always have been Back in 2006 I warned about it when reporting that Zango Adware was downloading and executing udaptes without checking for authenticity. Zango fixed it eventually, my scenario I illustrated back then however was seen as unlikely event. Fast Forward 2 years - oops.
What is of more concern is that adware update process seems to be more "secure" in 2006 than adobe acrobat is in 2008. ouch.
Disclaimer: The views and opinions expressed on this blog are my personal views and are not intended to reflect the views of my employer or any other entity.
Drones and the US Air Force
-
Fascinating analysis of the use of drones on a modern battlefield—that is,
Ukraine—and the inability of the US Air Force to react to this change.
The F-3...
Weekly Update 391
-
I'm in Japan! Without tripod, without mic and having almost completely
forgotten to do this vid, simply because I'm enjoying being on holidays too
much ...
Attack of the week: Airdrop tracing
-
It’s been a while since I wrote an “attack of the week” post, and the fault
for is entirely mine. I’ve been much too busy writing boring posts about
Schnor...
Gépi Tanulás & Adatbiztonsági Védekezések
-
Ez a blogposzt a második egy két részes sorozatból mely a gépi tanulás
adatbiztonsági kockázatairól kíván közérthető nyelven egy átfogó képet
nyújtani. Ez ...
My Last Email with W. Richard Stevens
-
In the fall of 1998 I joined the AFCERT. I became acquainted with the
amazing book *TCP/IP Illustrated, Volume 1: The Protocols* by W. Richard
Stevens...
What a lovely sunset
-
Oh, hi. Long time no blog, eh?
Well, it is time to sunset this blog, I will be deleting it in the next few
weeks.
So long, and thanks for all the fis...
Rebooting
-
I’ve recently had some time to catch up on reading and research. I’ve
decided to start writing again here about cryptography, embedded systems,
and securit...
Satori Updates
-
I've continued to update Satori little by little out there on github.
Both updating the underlying code and fingerprints. Always happy to have
new id...
The Future of the FTC: Part II
-
A previous blog post discussed FTC Chairwoman Slaughter’s first priority as
the newly designated chairwoman – the COVID-19 pandemic. The FTC’s second
prior...
WeirdAAL update - get EC2 snapshots
-
I watched a good DEF CON video on abusing public AWS Snapshots
https://www.youtube.com/watch?v=-LGR63yCTts
I, of course, wanted to check this out. There a...
SSTIC 2018
-
Nous sommes en 2018. Fuites de données, attaques massives, failles
structurelles, le monde constate chaque jour un peu plus à quel point la
sécurité est ...
En français svp?
-
Mir stelle fest, datt graff vereinfacht, zu Lëtzebuerg 100.000 Lëtzebuerger
schaffen, 100.000 net-Lëtzebuerger Residenten an 200.000 Frontalieren. Datt
ënn...
Rogue One Sequel already being filmed!
-
There’s some really interesting leaked photos and analysis by Charles
Goodman. “Leaked photos from the Rogue One sequel (Mainly Speculation –
Possible Spoi...
VulnHub Stapler 1 Solution 2
-
You can find Solution 1 here.
After spending a night on this, I finally managed to solve the 2nd way to
get limited shell on this box. Let's see how this ...
McAfee SiteList.xml password decryption
-
Recently, a very good friend of mine (@Sn0rkY) pointed me out the story of
a pentester who recovered the encrypted passwords from a McAfee
SiteList.xml fil...
Learning SDR
-
I recently launched Software Defined Radio with HackRF, an instructional
video series that I hope will make it easier than ever for people to learn
the bas...
USENIX Security Symposium Slides
-
We're very happy to present the paper
Revisiting SSL/TLS Implementations - New Bleichenbacher Side Channels and
Attacks
by Christopher Meyer, Juraj Somo...
New Insights into Email Spam Operations
-
Our group has been studying spamming botnets for a while, and our efforts
in developing mitigation techniques and taking down botnets have
contributed in d...
RSA Announces End of RSA Security Conference
-
Aims to bring clarity to cloudy marketing messages through exhibit hall
chotskies Bedford, MA., – April 1, 2014 – RSA, the security division of
EMC, today ...
Samsung Galaxy S5 could be cheaper than Galaxy S4
-
Good news for would-be Samsung Galaxy S5 customers - the main smartphone
may end up being more economical as opposed to Galaxy S4 was when it
established. ...
Why I _am_ Speaking At RSA 2014
-
There’s been quite a bit of drama with regards to whether or not to boycott
the RSA conference over a deal that the RSA security vendor had made with
the N...
Router backdoor reloaded...
-
S i vous avez aimé l'histoire de la backdoor D-Link, vous allez A-DO-RER
celle-ci. C'est encore sur /dev/ttyS0 que ça se passe, où on apprend que
les route...
One year after, end of Magnificent 7 project !
-
It has been a year already since the start of the Magnificient 7 program !
So what happened during this year ? We added some features to enhance your
analy...
Mobile Device Forensics - Course Update
-
It's been a few weeks since the last update, but things have been busy. The
Fall 2012 term is now in Week 5 (wow, the semester is flying by). We've
covered...
NWScript JIT engine: Wrap-up (for now)
-
Yesterday, I provided a brief performance overview of the MSIL JIT backend
versus my implementation of an interpretive VM for various workloads.
Today, I’l...