Every once in a while (when I think out loud and people overhear me) I am forced to explain what a buffer overflow is. Because I can’t really think of a good metaphor, I end up spending about 10 minutes explaining how (vulnerable) programs…
I live in a country that the government blocks most ways of accessing to the uncensored Internet (like blocking VPN pptp, l2tp), Luckily there are some very fast services still available like Kerio VPN.
But as I found out, It does not see…
FireEye recently observed a targeted attack on a U.S.-based financial
institution via a spear-phishing email. The payload used in this
campaign is a tool called WinSpy, which is sold by the author as a
spying and monitoring tool. The features in …
FireEye recently observed a targeted attack on a U.S.-based financial
institution via a spear-phishing email. The payload used in this
campaign is a tool called WinSpy, which is sold by the author as a
spying and monitoring tool. The features in …
We wrote several times in this blog about the importance of enabling Address Space Layout Randomization mitigation (ASLR) in modern software because it’s a very important defense mechanism that can increase the cost of writing exploits for attackers an…
Today we released five security bulletins addressing 23 unique CVE’s. Two bulletins have a maximum severity rating of Critical while the other three have a maximum severity rating of Important. We hope that the table below helps you prioritize the depl…
Page 183 of Secrets & Lies on countering denial-of-service attacks:
Some researchers have proposed defenses that force the client to
perform an expensive calculation to make a connection. The idea is
that if the client has to s…
I am looking for a way to isolate two different networks from each other. Suppose we have 2 different networks (public and private). I am looking for a way to connect to these two networks via a single network wire in a trusted way.
I di…
If all html in a site is generated in client side (attributes, urls, styles everything will be concatenated in javascript and set as innerHTML), is it doing only html escape enough for mitigating all xss attacks mentioned here?https://www….
FireEye has just released its 2013 Advanced Threat Report (ATR),
which provides a high-level overview of the computer network attacks
that FireEye discovered last year.
In this ATR, we focused almost exclusively on a small, but very
important su…
