はてなブックマーク

Timing Attacks in the Modern WebThe Clock is Still Ticking 1 August 2016 Before you explore all the details of these browser-based timing attacks, head over to my laboratories to play around with these attacks yourself! Timing attacks have been known for a long time. One of the earliest, and possibly the most well-known attacks that leverage timing as side-channel information, are those reported b

WordPress < 3.6.1 PHP Object InjectionUpdate WordPress to avoid Remote Code Execution attacks 11 September 2013 After reading a blog post about a “PHP object injection” vulnerability in Joomla, I dug a bit deeper and found Stefan Esser’s slides of the 2010 BlackHat conference, which showed that PHP’s unserialize() function can give rise to vulnerabilities when supplied user-generated content. So b