sucuri2

25 ms·

241.
WordPress 2.8.3 Remote admin reset password(blog.sucuri.net)
32 points by sucuri2 17y ago|20 comments
242.
by sucuri2 17y ago
In our case, we audited and were very careful with the data... Who knows what other sites are doing. A funny note is that since I published that article, the number of attempts increased :)
243.
by sucuri2 17y ago
PHP magic_quotes proved that doing that by default for every application is a bad idea. Plus, lots of developers weren't even aware of that... In the case of our specific tools (with some limited user input), it worked great.
244.
Twitter suffering DOS attack(blog.sucuri.net)
1 points by sucuri2 17y ago|0 comments
245.
Cisco leaking private IP addresses via DNS(blog.sucuri.net)
2 points by sucuri2 17y ago|0 comments
246.
Multiple top-security sites hacked (zf05)(blog.sucuri.net)
32 points by sucuri2 17y ago|4 comments
247.
by sucuri2 17y ago
kiddies with brains and technical knowledge to actually write their own exploits are not script kiddies... This term is used for kiddies without brains that just learned to run a few scripts to attack others. Just clarifying the term.
248.
by sucuri2 17y ago
Technically it is a 0-day exploit (not published and unknown) but that only works on older versions of SSH. However, the default version on RHEL, Fedora are vulnerable. So, it is a big issue if there is no patch from your distribution (unle
249.
by sucuri2 17y ago
No one knows yet. But the versions included on RHEL, Fedora, etc are all old (no one is on 5.3). So we have to wait and see...
250.
by sucuri2 17y ago
Some info here: http://secer.org/hacktools/0day-openssh-remote-exploit.html
251.
SSH server 0-day exploit(isc.sans.org)
95 points by sucuri2 17y ago|60 comments
252.
by sucuri2 17y ago
The idea in the paper is not to encrypt every packet, but every DNS packet. Something like a (better) substitute to DNSSEC... Good read.
253.
by sucuri2 17y ago
I will check that.. On FF/Ubuntu it is working well. I should have tested it on multiple browsers before. As for the disabled buttons, that exactly what i did, but on Gimp :) For the snapshots, you get alerts on intentional and unintentiona
254.
by sucuri2 17y ago
We are going to use the "freemium" model. What is now free, will continue free, but additional modules/features are going to be added only for the paid accounts. The call back idea is very good and we will put it in our todo/research list.
255.
by sucuri2 17y ago
The WIGS is an additional service to try to get traction to the site, since it is a one scan tool that people might try to see if their site is secure. I will probably move that to the "tools" page to avoid too much noise. It is going to be
256.
by sucuri2 17y ago
Thanks for the suggestions.. lots to work for on Monday :) That's exactly what I wanted... Also, on the page having too many characters, I agree with you. I spend hours adding and removing messages from there trying to make it clean, but at
257.
by sucuri2 17y ago
You are the second person that says that. You don't like it because it is from scribd or the layout/design itself? I was between the slide show and a video, but thought the slide would be more accessible.
258.
by sucuri2 17y ago
Thanks, just fixed it. I don't know how my auto-corrector let is slip...
259.
by sucuri2 17y ago
Thanks for the response. Not looking for compliments, but comparing to most sites around (specially from startups that I see here) I couldn't get to a design that I really liked. -Good point on the animated graphic. I will see how to add it
260.
by sucuri2 17y ago
Just a bit of feedback on it. I submitted it for review a few months ago when it was on early alpha and didn't get much feedback. Now we improve the app/site a lot and would love to hear what you think. There is a demo account available too
261.
Please review my web app (network integrity monitoring)(sucuri.net)
13 points by sucuri2 17y ago|19 comments
262.
by sucuri2 17y ago
I am getting this error when I try to access: " The Google Maps API server rejected your request. This could be because the API key used on this site was registered for a different web site. You can generate a new key for this web site at
263.
by sucuri2 17y ago
Hey, I just played with the site for a while and really enjoyed it. The design is simple and easy to use.. you did a good job. Some comments: -The about button at the bottom doesn't work (at least not on FF on Ubuntu). I was trying to figur
264.
Online app to transform your site into an ascii art(sucuri.net)
8 points by sucuri2 17y ago|1 comments
265.
My Top 6 Honeytokens(blogs.sans.org)
21 points by sucuri2 17y ago|10 comments
266.
by sucuri2 17y ago
I believe they probably found a way to inject some data that wasn't properly escaped. When the CEO (or anyone else) would receive the alerts that someone was trying to break into their accounts, the XSS or javascript (or whatever) would be
267.
Is Amazon Going to Open Source its Web Services and Cloud APIs?(ostatic.com)
2 points by sucuri2 17y ago|0 comments
268.
by sucuri2 17y ago
That's a good idea too. Will see how this can be integrated with them.
269.
by sucuri2 17y ago
You made some very good points. But we also take into consideration the number of followers, so if sites like slashdot or Brightkite broadcast their info and have lots of followers, the spam count will go down too. Lots of variables in ther
270.
by sucuri2 17y ago
This is the direct link: http://sucuri.net/?page=docs&title=twitter

More ›