2013 may be remembered as the “year of the retailer breach”. This statement was reported in the last Verizon Data Breach Investigation Report 2014, and reminds us that last year was considered by security experts as one of the worst years due the impressive number of data breaches […]
Obfuscation is a distinctive mechanism equivalent to hiding, often applied by security developers, to harden or protect the source code (which is deemed as intellectual property of the vendor) from reversing. The goal of such an approach is to transform the source code into new encrypted byzantine source code […]
In today’s electronic world where everything is done online, “trust” is hard to come by. Conversations can be snooped on, credit card numbers can be stolen, identities can be exchanged and unseen eyes are everywhere. Imagine business emails being maliciously read by competitors, company’s proposals being leaked and even […]
Have you ever stopped to consider the sensitivity and potential value of the information you have distributed using the many widely available file sharing websites?
These types of sites have seen considerable uptake in recent years, as users struggle to share large files whilst battling standard email file size and […]
In the previous articles, we have seen how applications like Snoop-it can trace method calls specific to the application at runtime. This is very important in deducing the flow of the application. The same process can be performed by using a perl script named Logify.pl that comes installed with […]
Portspoof is meant to be a lightweight, fast, portable, and secure addition to any firewall system or security system. The general goal of the program is to make the information-gathering phase slow and bothersome for your attackers as much as possible. This is quite a change to the standard […]
Android Hacking and Security, Part 4: Exploiting Unintended Data Leakage (Side Channel Data Leakage)
In the previous articles, we discussed attacks associated with activity components, content providers, broadcast receivers, and ways to secure them. In this article, we will discuss “Unintended Data Leakage”, which was formerly known as “Side Channel Data Leakage”.
What is Unintended Data Leakage?
When an application processes sensitive information taken as […]
This paper is designed to demonstrate the common IIS web server security specifications in the form of a checklist that aids web masters or penetration testers to implement a secure web server infrastructure swiftly. It is mandatory for a web application to be duly full proof from vicious attacks […]
Preface: Modern Medical Devices and their Software
Contemporary healthcare relies heavily on medical devices to help patients lead normal and healthy lives. Yet there are security problems ranging from cyber exploitation to common bugs in the software. This article focuses more on implantable medical devices (IMDs) — insulin pumps and […]
Fortunately fashion is not key to helping us win the Cyber-War because sartorial elegance has never been a strong suit of the IT profession, but David and Goliath certainly teaches us some classic lessons. Growing up, many of us learned the famous story of David and Goliath, and even […]
In December, Amazon.com, the world’s largest online retailer, announced that it is testing unmanned drones to deliver products ordered by its customers. The service was experimental, and it could probably take up to five years to start. In discussion is the possibility to adopt unmanned aerial vehicles (UAV) for […]
Remote Access Tool is a piece of software used to remotely access or control a computer. This tool can be used legitimately by system administrators for accessing the client computers. Remote Access tools, when used for malicious purposes, are known as a Remote Access Trojan (RAT). They can be […]
In the first two articles, we discussed attacks associated with Activity Components, content provider leakage and ways to secure them. In this article, we will discuss attacks on broadcast receivers.
What are Broadcast Receivers?
A broadcast receiver is another important component of the Android system. Broadcast receivers are registered for specific […]
This paper attempts to explain one of the critical buffer overﬂow vulnerabilities and its detection approaches that check the referenced buffers at run time, moreover suggesting other protection mechanics applied during software deployment configuration. Programs typically written in C or C++ language are inherently susceptible to buffer overflow attacks, […]
API hooking is a technique by which we can instrument and modify the behavior and flow of API calls. API hooking can be done using various methods on Windows. Techniques include memory break point and .DEP and JMP instruction insertion. We will briefly discuss the trampoline insertion techniques.
Hooking can […]
Surfing the internet through untrustworthy public networks whether wired or wireless has been known to be risky for a long time now. We all think twice before logging into our bank account or accessing any kind of sensitive information, but what about simply browsing our favourite site?
A Man in […]
Attention Retailers and Restaurants: Three Simple Ways to Avoid What Happened to Michaels, Target and Neiman Marcus
I feel like I’m stuck in Bill Murray’s Groundhog Day. Yet again, it came to my attention that a major American retailer has been hit with POS (point-of-sale) malware. This time, it’s hobby shop giant Michaels.
I hear that Target’s POS malware crisis, which made international headlines last December and […]
In some of the previous articles in this series, we have looked at how we can modify the behaviour of an application by patching it using IDA Pro, Hopper etc. However, doing this hasn’t been quite straightforward always. We can also use Cycript to modify the behaviour of an […]
This article explains the Heartbleed bug and shows how it can be exploited.
Heartbleed is a flaw in implementing the Heartbeat extension of OpenSSL. It is just an extension of OpenSSL which keeps the session alive for HTTPS connections, much like the Keep-Alive header in HTTP.
As per RFC, the formal […]
In this article I am going to discuss a few of the most important vulnerabilities which exist in almost all applications in the world. They are cracking the authentication mechanism, poor session handling, and accessing different paths of the operating system via exploiting the path traversal vulnerability.
Cause of the […]