attack
A company with an SQL injection name
- Albert Zenkoff
- 2017-01-19
- Society, attack, company, fun, prank, security, SQL injection
Finally, someone registered a company that is an SQL injection attack. We saw the license plates on cars doctored to execute SQL injection attacks but this is the first time, I think, that an attempt to crash all business SQL databases in a country is made. The company name is: ; DROP TABLE “COMPANIES”;– LTD ...
Read More
Sony 2014 network breach, the most interesting question remains unanswered
- Albert Zenkoff
- 2014-12-23
- Management, attack, bigger picture, breach, infiltration, information extraction, network, purpose of attack, question, security, Sony
The November 2014 breach of security at Sony Corporation remains the subject of conversation throughout the end of the year. Many interesting details have become known while even more remains hidden. Most claims and discussions only serve to create noise and diversion though. Take the recent discussion of the antivirus software, for example. Sony Corporation ...
Read More
Heartbleed? That’s nothing. Here comes Microsoft SChannel!
- Albert Zenkoff
- 2014-11-13
- Technology, attack, critical, HeartBleed, library, Microsoft Secure Channel, no mitigation, no workaround, patch, remote, remote code execution, SChannel, vulnerability, WinBleed
The lot of hype around the so-called “Heartbleed” vulnerability in open-source cryptographic library OpenSSL was not really justified. Yes, many servers were affected but the vulnerability was quickly patched and it was only an information disclosure vulnerability. It could not be used to break into the servers directly. Now we have Microsoft Secure Channel library ...
Read More
More on WordPress xmlrpc denial of service attacks
- Albert Zenkoff
- 2014-09-08
- Technology, apache, attack, conditions, denial of service, DOS, protection, rewrite, rewrite_mod, rules, service, user agent, WordPress, xmlrpc
The attacks on WordPress using xmlrpc.php service are rather common. I already mentioned that you could filter out unwanted user-agents using the redirect capability of Apache. That would, however, take care only of obvious cases, where you see that this particular user-agent could not possibly be your reader. What do we do if the user-agent ...
Read More
Mitigating Denial of Service attacks to WordPress xmlrpc
- Albert Zenkoff
- 2014-07-14
- Technology, attack, botnet, DDOS, denial of service, htaccess, mitigation, redirect, server, user agent
I have attracted attention, apparently. My website is under a Distributed Denial of Service (DDOS) attack by a botnet for the last week. I am flattered, of course, but I could live without a DDOS, frankly. The requests go to xmlrpc.php every second or two from a different IP address from around the world: POST ...
Read More
Camera and microphone attack on smartphones
- Albert Zenkoff
- 2013-11-13
- Technology, attack, attack path, camera, microphone, mobile, PIN, security, side-channel, smart phone, technology
The researches at the University of Cambridge have published a paper titled “PIN Skimmer: Inferring PINs Through The Camera and Microphone” describing a new approach to recovering PIN codes entered on a mobile on-screen keyboard. We had seen applications use the accelerometer and gyroscope before to infer the buttons pressed. This time, they use the ...
Read More
Google bots subversion
- Albert Zenkoff
- 2013-11-09
- Technology, application security, attack, bots, Development, firewall, Google, philosophy, secure by design, software, software design, software security, subversion, technology, unexpected
There is a lot of truth in saying that every tool can be used by good and by evil. There is no point in blocking the tools themselves as the attacker will turn to new tools and subvert the very familiar tools in unexpected ways. Now Google crawler bots were turned into such a weapon ...
Read MoreAbout the author
Albert Zenkoff
Managing corporate security in both technical and business sense in the context of long-term business strategy and sustainability.
For security consulting, training, certification and audit mail albert@aruberusan.com.
Share and stay updated
