Search results

The purpose of this paper is to identify the importance of the factors that influence the success rate of remote arbitrary code execution attacks. In other words, attacks which use software vulnerabilities to execute the attacker's own code on targeted machines. Both attacks against servers and attacks against clients are studied.

The success rates of attacks are assessed for 24 scenarios: 16 scenarios for server‐side attacks and eight for client‐side attacks. The assessment is made through domain experts and is synthesized using Cooke's classical method, an established method for weighting experts' judgments. The variables included in the study were selected based on the literature, a pilot study, and interviews with domain experts.

Depending on the scenario in question, the expected success rate varies between 15 and 67 percent for server‐side attacks and between 43 and 67 percent for client‐side attacks. Based on these scenarios, the influence of different protective measures is identified.

The results of this study offer guidance to decision makers on how to best secure their assets against remote code execution attacks. These results also indicate the overall risk posed by this type of attack.

Attacks that use software vulnerabilities to execute code on targeted machines are common and pose a serious risk to most enterprises. However, there are no quantitative data on how difficult such attacks are to execute or on how effective security measures are against them. The paper provides such data using a structured technique to combine expert judgments.

IOS firmware diversity, the unintended consequence of a complex firmware compilation process, has historically made reliable exploitation of Cisco routers difficult. With approximately 300,000 unique IOS images in existence, a new class of version‐agnostic shellcode is needed in order to make the large‐scale exploitation of Cisco IOS possible. The purpose of this paper is to show that such attacks are now feasible by demonstrating two different reliable shellcodes that will operate correctly over many Cisco hardware platforms and all known IOS versions.

The paper examines prior work in the area of Cisco IOS rootkits and constructs a novel IOS version‐agnostic rootkit called the interrupt‐hijack rootkit.

As the experimental results show, the techniques proposed in this paper can reliably inject command and control capabilities into arbitrary IOS images in a version‐agnostic manner.

The authors believe that the technique presented in this paper overcomes an important hurdle in the large‐scale, reliable rootkit execution within Cisco IOS. Thus, effective host‐based defence for such routers is imperative for maintaining the integrity of our global communication infrastructures.

The purpose of this paper is to describe the improvements achieved in automating post‐exploit activities

Based on existing frameworks such as Metasploit and Meterpreter the paper develops a prototype and uses this to automate typical post‐exploitation activities.

Using a multi‐step approach of pivoting this paper can automate the cascaded attacks on computers not directly routable.

Based on the findings and developed prototypes penetration tests can be made more efficient since many manual exploitation activities can now be scripted.

The main contribution of the paper is to extend Metapreter‐scripts so that post‐exploitation can be scripted. Moreover, using a multi‐step approach (pivoting), it can automatically exploit machines that are not directly routable

It is often argued that the increased automation and availability of offensive cyber tools has decreased the skill and knowledge required by attackers. Some say that all it takes to succeed with an attack is to follow some instructions and push some buttons. This paper aims to tests this idea empirically through live exploits and vulnerable machines in a cyber range.

The experiment involved 204 vulnerable machines in a cyber range. Exploits were chosen based on the results of automated vulnerability scanning. Each exploit was executed following a set of carefully planned actions that enabled reliable tests. A total of 1,223 exploitation attempts were performed.

A mere eight exploitation attempts succeeded. All these involved the same exploit module (ms08_067_netapi). It is concluded that server-side attacks still are too complicated for novices who lack the skill or knowledge to tune their attacks.

This paper presents the largest conducted test of exploit effectiveness to date. It also presents a sound method for reliable tests of exploit effectiveness (or system vulnerability).

Compiled by K.G.B. Bakewell covering the following journals published by MCB University Press: Facilities Volumes 8‐18; Journal of Property Investment & Finance Volumes 8‐18; Property Management Volumes 8‐18; Structural Survey Volumes 8‐18.

Index by subjects, compiled by K.G.B. Bakewell covering the following journals: Facilities Volumes 8‐18; Journal of Property Investment & Finance Volumes 8‐18; Property Management Volumes 8‐18; Structural Survey Volumes 8‐18.

Compiled by K.G.B. Bakewell covering the following journals published by MCB University Press: Facilities Volumes 8‐18; Journal of Property Investment & Finance Volumes 8‐18; Property Management Volumes 8‐18; Structural Survey Volumes 8‐18.

Compiled by K.G.B. Bakewell covering the following journals published by MCB University Press: Facilities Volumes 8‐18; Journal of Property Investment & Finance Volumes 8‐18; Property Management Volumes 8‐18; Structural Survey Volumes 8‐18.

Aim of the present monograph is the economic analysis of the role of MNEs regarding globalisation and digital economy and in parallel there is a reference and examination of some legal aspects concerning MNEs, cyberspace and e‐commerce as the means of expression of the digital economy. The whole effort of the author is focused on the examination of various aspects of MNEs and their impact upon globalisation and vice versa and how and if we are moving towards a global digital economy.

Home networks enable, potentially, an increased level of integration among appliances present in the house, enabling an ubiquitous control of devices and simplifying man/machine interactions. This paper aims to present the home network interoperability (HoNeY) platform.

Home networks and their challenges are analyzed, then the technology that constitutes the base for the present implementation is briefly revised. The HoNeY platform is presented, in terms of its architecture, implementation, and constraints.

The HoNeY platform is an multimedia home platform (MHP)‐based, low‐complex, cost‐effective architecture for automatic discovery, configuration, and dynamic access to distributed services in home environments.

This paper describes HoNeY, a mechanism of service discovery and code mobility designed for interoperability of devices connected to home networks, compatible with the MHP standard.