@thelionroars1337 - By 'we' I meant me, you, everyone that read your question and didn't have any additional information, and all the literature that all of us have ever read on the topic (refers to this three-factor authentication paradigm in the same way) yet fails to credit any author for it (which is rare and inexcusable in scientific and other expert publications). Google, or other search engines, are none the wiser either. I think it's fairly safe to ascertain my assumption can be read in the broadest meaning of 'we'. ;) — TildalWave3 mins ago
I've searched round the net. but didn't find any effectiveness!
My question is, what are some good resources like books, docs and other related stuff in order to gain some knowledge about what the underlying infrastructures of ISPs are.
My preferred issues include: how to hack an ISP due to its ...
If you're running a pentest how do you know where to draw the line for physical intrusion? Would most testers count lockpicking to get into a network closet as fair game?
Problem is I'm in a small town and college is the first time I've been in a large network and actually had a few people who understood computers more than word processing
I didn't know/care either way when i did it, then i did it, realised it was actually a joke and someone somewhere's making money out of handing out paper.
@ekaj dropping out of college isn't a smart thing to do as having a degree is often the first step to get into a company, certificates do not really matter at that point. Also you will need the basic knowledge to get a broad understanding how everything works from networks to programming
@ekaj To answer your first question more accurately, there's been one instance where network pen-testing has also included lock-picking for me (which is a shame cause I'm quite a lock-pick :D )
I'd possibly just like another college.. this one has a great CS teacher, but there's only one teacher, lol. and I can lock pick a bit, I'm not too good at it though =p
I can't for example, travel overseas and settle somewhere else without getting a degree for example (well, maybe i could, but it would be luck/word of mouth)
The internet signal overshoots my house.. so we put an engenius router on my brothers house a half mile down the road and one on ours, and we share internet that way now =p
@D3C4FF Zero certs here also... worked for many govt's, gov't contractors, security pass class xzy,.... not a single cert would've ever helped me do my stuff any better (except lose some more time) LOL
@D3C4FF exactly! I'm not of course counting those compulsory tests for internal certification... that's different... but the external booze seanses... that's useless
@D3C4FF all kinds really, even psychological evaluation if needed... depends on what's required... these I'm fine with... the more, the more interesting the project will be... plus you get to laugh about it a lot :)
Or do i study them while they think they're studying me but actually we're both pretending to study eachother and our studying ends up being everyone studying themselves???
@D3C4FF I had it two times, both a total babe... I was drooling, but that was fine it was for some military access class, those are all drooling anyway if they see a woman, regardless how she looks like :)
basically there was a matron in the movie, and her skirt always used to get blown up, and she'd always say double-entendres without knowing what she was saying
and the main guy would say "oooohhhhh maaatron" in a croning voice
Create GMail account with no 2 step authorization (not from friend' laptop).
Log in with you friend' laptop into GMail web interface (type username/pass manually).
Create new mail with subj some reports from %companyname%, attach some dummy .docs and .pdfs, type "dave123@another-company-in-your-...
Is compiled code more of a security risk than interpreted code? I'm under the impression that it is due to the fact that compiled code can hide malicious code from malware scans.
@TerryChia Most of the time, I would. DoS attacks come in many different flavours. Most of these are easily blocked by identifying attack packets manually and adding the source IP addresses to a firewall. The attacker's way around this is to use lots of different IP addresses. But it's still basically the same DoS attack underneath.
E.g. DNS amplification= from my IP address I dump the dns of ripe.org on your server. Might be DoS if you have a bad link (e.g. home broadband). To make that worse, I use a bunch of servers. Probably DDoS.
The only time there's a difference is when the attack packets are exactly the same as legitimate packets. Then, the only way to identify them is by quantity. Using lots of IP addresses makes even the quantity from any one IP address the same as legitimate traffic.
@Ladadadada Well, for that particular question - I think he is asking about malformed packets ala ping of death instead of the common syn flood attacks nowadays.
@TerryChia Oddly he doesn't seem to be interested in the data portion of the TCP packet, which is where most non-bandwidth-exhaustion DoS attacks are these days.
Incidentally, I did have a DDoS a while back and for a few hours, the traffic switched to be all coming from port 1234. That made it quite easy to block.
Apart from that, there were about 100,000 IP addresses hitting us at about 1 per second each, so putting together a blocklist of 100,000 was the general strategy.
@LucasKauffman Two questions: 1) What is your primary language, I see three listed for your country, and I've got it narrowed down to two. 2) Was that tweet of yours actually that language? Because I have to say, it looked like what someone might mockingly say in a sitcom to spoof German.
@TerryChia A DDoS is a sub-category of DoS, namely a DoS which works (better, or at all) thanks to the use of a lot of remote clients. The distinction between DoS and DDoS is about the same that the distinction between "computing" and "distributed computing": relevant... where it matters.
@TerryChia Well, when you think about "DoS through malformed packets", you instinctively think "ping of death", not "TCP of death".
I am not aware of a DoS attack using malformed TCP packets which would be as famous as the "ping of death" (which has been fixed 15 years ago).
Anyone heard of the "InfoSecurity Europe" conference? I vaguely remember seeing a flyer for it last year but then deciding it was just vendors pushing "solutions" at CSOs.
I'm looking at the signup form and their opt-out process is one of the sneakiest I've ever seen and the fine print says that attending any session or by having your visitor badge scanned by an exhibitor (or an exhibitor stand) is opting in to receiving communications from them.
@lynks SSL provides message integrity (almost the same thing).
roughly speaking, SSL guarantees that the all data bytes received by the server (resp. the client) have been sent, in that order and with no missing byte, by the same client (resp. server) all along.
@Ladadadada yeah know it well.. its a vendor-fest :).. i go sometimes to keep an eye on whats happening in the industry.. Of course nearby is the Portcullis arms where I expect @Polynomial will be spending some "quality" time
require is used to specify that a specific version of perl
So, for instances, if you had a program that required a special weird version of perl installed in, say, /opt/versions/polynomial/perlduggery/perl-4.1 you could do the following
use lib '/opt/versions/polynomial/perlduggery/';
require v4.1;
And then your script would, effectively, run everything out of your special directory.
@Polynomial I assume you're looking at someone else's code and ran into that?
I always considered it that '*str is a pointer to a char" which I think is the same meaning as what @Thomas said. I never really considered how the compiler worked it out.
@lynks I always use char* thing for the reason @Poly says - it's part of the type. Actually, technically, all pointers are the same thing, but the bit before the * is what it will (try to) dereference it as (which does affect what asm gets generated).
By contrast, the name bit does not affect the asm in any way whatsoever.
@AntonyVennard Technically, all pointers need not be the same thing, and in particular were not the same thing on 16-bit x86 (back in the days of MsDos).
So I have a semi legit reason for visiting -- I've been seeing the Shodan search engine getting a ton of press lately. It made the front page of CNN yesterday. There's not much on Sec.SE about Shodan at all. Could we ask a question like, "How can I prevent devices on my network from being accessed by a search engine like Shodan?" Or would such a question be NC?
@ScottPack I'm not a parent. Though I am always reminded of a scene in Wimbledon (the Paul Bettany film) where Jon Favreau's character says, "That's like asking me which of my kids I love more. Which of my kids do I love more? My daughter."
you can actually mitigate the risk of shodan. Basically remove all sensitve information from headers and banners and there's no real risk beyond the disclosure of the service running
if you really really don't want to be found restrict the service to specific source IP address ranges :)
One other thing if you're feeling mega sneeky would be to try and find the netblock for shodan's scanners and block that, but that's probably more security by obscurity....
@TerryChia anyway for that SSD I'd at least wait for the Anandtech review to see what he reckons to it. If it's slim enough it would be awesome to put something like that in a laptop. mmmm laptop with 1TB SSD
Is compiled code more of a security risk than interpreted code? I'm under the impression that it is due to the fact that compiled code can hide malicious code from malware scans.
a normal tcp packet shown in figure
How a TCP packet that causes dos attack different from normal Tcp Packet?
