Questions tagged [updates]
The updates tag has no usage guidance.
130
questions
1
vote
1
answer
115
views
Security vulnerabilites in Windows updates from local network
Windows has offered the ability to download updates from machines in the local network for some time. My gut feeling tells me this would be a great attack vector for Windows security vulnerabilites.
...
0
votes
2
answers
2k
views
How to update Ubuntu SSH version to latest version [closed]
I'm trying to update the Ubuntu OpenSSH version to 9.3p2, because of the CVE-2023-38408 vulnerability, but I can't.
The recomendation is update to last version: https://ubuntu.com/security/CVE-2023-...
2
votes
1
answer
782
views
Windows Update installs yandex.ru browser hijacker
I recently created a Windows 10 installation stick via the official media creation tool. Presumably, there was no malware on my host system on which I created the stick. It's a pretty fresh install as ...
1
vote
1
answer
130
views
Security Implications of Automatic Updates?
I have a custom Debian router installation which I'm trying to keep both secure and low-maintenance. I've therefore set some scripts which keep my Docker containers, blocklists, and OS (security ...
1
vote
1
answer
286
views
Windows 10 Update - Man In The Middle Attack - Tamper Update [duplicate]
I am connecting to a wi-fi network and blocked all IP addresses in this network with a regular Windows 10 firewall. The only available IP addresses are:
192.168.1.1 = gateway
192.168.1.102 = my own ...
0
votes
3
answers
109
views
Analyze fixed vulnerabilities in software updates
Developers update their software, sometimes they patch vulnerabilities.
Is it realistically possible to analyze the updated code (even if it's closed source) to find the vulnerability that has been ...
0
votes
1
answer
175
views
What is best practise to send credit card details update emails when the details have expired?
Recently an organization I forgot to update credit card details had my renewal payment fail because I forgot to update details. They sent an email as below which had a direct link to a web form ...
0
votes
0
answers
75
views
How can a service securely update an application even when the computer's current user could be hostile
Keep in mind that I am not a security specialist or a networking specialist. I am a software developer dealing with this kind of software for the first time.
Our software is used to control user ...
3
votes
1
answer
696
views
Secure boot after an OTA update confusion
My understanding is that secure boot works by verifying each stage in the boot process before proceeding. So first, UEFI or booting firmware will validate the signature of the bootloader, then kernel, ...
0
votes
0
answers
102
views
Security precautions during update
When you update a new installation for the first time, or update a long time unmaintained OS, do you just enable a software firewall for all incoming connections (and hope there are no obsolete ...
10
votes
2
answers
3k
views
Are devDependencies in Node.js exploitable?
I am well aware that the best approach is to update any dependency, no matter whether it is a development dependency or a runtime/production dependency.
But from a research prospective, I want to know ...
1
vote
2
answers
212
views
Designing an updater with certificate renewal in mind
A program A downloads signed executables and other signed configuration files. Configuration files have a signature appended at the end. To verify their integrity and creator, it uses the public key ...
1
vote
1
answer
5k
views
How to update Lynis to the latest version?
I'm new with Lynis, the security tool. I installed it with a package manager and check that it is the latest version:
$ sudo apt-get install lynis
...
lynis is already the newest version (2.1.1-1).
...
0
votes
2
answers
246
views
Haven't updated my Windows 10 for more than a year
Almost a year ago, I dual-booted Windows 10 and Linux Mint. And since then, I haven't booted into my Windows 10 OS.
I still remember that the Wi-Fi adapter was off when I shut my Windows 10 down.
Now, ...
0
votes
1
answer
135
views
Old operating system (offline computer) need to come online for a few minutes
OSX El Capitan
I have an offline computer running an old OSX operating system.
I would like to connect that computer to the web for a brief few minutes in order to install HomeBrew and install a newer ...
2
votes
2
answers
229
views
Public registry (database or API) for known security vulnerabilities in open source software?
Is there a reliable, public registry (preferably in the form of an API) that records known security vulnerabilities in open source software?
Why would anyone want this?
I'm trying to emulate github's ...
5
votes
2
answers
1k
views
How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?
To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page.
Sometimes, at least here, the hashsum are made part ...
7
votes
1
answer
4k
views
Is `gpg --refresh-keys` secure and where is this documented?
From the gpg manual:
--refresh-keys
Request updates from a keyserver for keys that already exist on the local keyring.
This is useful for updating a key with the latest signatures, user IDs, etc.
...
0
votes
1
answer
139
views
Update URL over HTTP
I saw VLC (Windows) gets updates from an unencrypted URL: HTTP, not HTTPS!
Do you think there's a risk for a man-in-the-middle attack?
1
vote
1
answer
1k
views
Firefox pretending to update itself, but actually not doing it, and thus being a risk for security - what am I missing?
I am a long-time Firefox user and remember that usually the UAC prompt popped up when Firefox updated itself. Some months ago (or is it years?), Firefox obviously changed the way it updates itself: I ...
0
votes
1
answer
110
views
Secured Software Update from an unauthenticated entity
Let's suppose we have a software update D, that is encrypted and signed and delivered to some component C. Further we suppose that the receiving entity C can validate the signature and decrypt the ...
0
votes
1
answer
139
views
Software update process (dependencies) in organization
Wondering how other organizations manage software update process.
We are a startup, were we try to define components owners, which should update them (security updates etc).
This does not to seem to ...
0
votes
2
answers
823
views
Do you need to update a router that is set in bridge mode?
Since a router in bridge mode works like a modem, do you need to even update it?
1
vote
1
answer
244
views
Sufficient to only install security updates on Debian?
On my Debian, I only do security updates:
deb http://security.debian.org/debian-security/ buster/updates main
deb-src http://security.debian.org/debian-security/ buster/updates main
For example, ...
0
votes
1
answer
118
views
Do corporate systems need to be updated immediately after updates are available? [duplicate]
I lived under impression that timely updates were very important. Even a home user wouldn't like their computer to demand ransom for their data. However, the less home and the more corporate our ...
0
votes
2
answers
162
views
Update fresh installation of Linux OS
It seems to me that there's some sort of "race condition" when you install a new Linux OS (this applies to every OS, but I'll restrict this question to Linux only). When you download the OS for a ...
0
votes
0
answers
37
views
Updating Ubuntu [duplicate]
How can I make sure in the terminal that my Ubuntu updates are from the real source?
I am asking because I know that one download was fake. It was rkhunter. The update was malware. Done from Bangkok....
0
votes
1
answer
156
views
How does Burp update XSS/vulnerability scanning rules/payloads?
The first point, that it updates with new release. So if somebody discovered new payload for popular frameworks, it will be in burp only with new release. Does Burp app load payloads from Internet ...
-2
votes
1
answer
190
views
Upgrading Software Version: risk of an unknown vs known vulnerabilities
Is there any evidence or research into the likelihood, as well as damage, via vulnerabilities in previous versions compared to following iterations of software?
For example, with every software ...
2
votes
1
answer
333
views
How to ensure Windows 10 is safe from critical security hole reported by NSA on 2020-01-14?
All over the news today (2020-01-14) is the story that the NSA and Microsoft have reported a critical security vulnerability in Windows 10.
But I haven't been able to find clear instructions about ...
3
votes
3
answers
390
views
Why is a fully-patched OS less important than AV?
How to explain to traditional people why they should upgrade their old Windows XP device? <- The interesting point made in the highest upvoted answer to this Q is that a fully patched OS is largely ...
103
votes
19
answers
16k
views
How to explain to traditional people why they should upgrade their old Windows XP device?
This is an issue I'm recurringly facing: older people from my family (or people who my family members know) can be surprisingly reluctant to apply most basic security measures when they're using their ...
0
votes
1
answer
11k
views
Recon-ng v5 - How to add domains?
I just started with recon-ng today, I was following tutorials but every tutorial is outdated with most of them describing the functions of v4.
I was able to update myself with simple additions like ...
0
votes
1
answer
104
views
Debating between architecture options for offline updating of Linux machines in a vertically segregated network
My coworker and I are discussing the pros/cons between two potential architecture options, and I would like to gather feedback on which option is better and why.
First, a description of the ...
1
vote
2
answers
367
views
Does it really improve security to update PHP interpreter version without any code changes at all?
Our hosting provider wants to update our legacy application server (Plesk).
We usually place older PHP projects (PHP 5.3 - 5.6) there, so they can sit in a stable environment until their unknown EOL.
...
0
votes
1
answer
252
views
Quantifying risk of not upgrading Android (ie Android 8.1 to newer version)
I am running an Android One (ie vanilla Android supported by Google) phone which has Android 8.1. I have unlocked the bootloader and rooted my device.
Because I've rooted my device I have not been ...
2
votes
1
answer
253
views
Is Dell SupportAssist insecure?
On an OEM Windows install on a Dell XPS 13, when I navigate to the Dell support website, it offers to download and install updates (even firmware updates!) on the spot, in the browser, flaunting all ...
52
votes
10
answers
20k
views
Replacing Windows 7 security updates with anti-virus?
Microsoft has announced Windows 7 will no longer be receiving updates after January 14, 2020: Here.
I hate windows 10's forced updates and telemetry so I have always stuck with Windows 7, but it may ...
5
votes
3
answers
314
views
Avoiding the race condition between time of release and time of update
There is a kind of race condition between the time when a developer releases a security update and the time when the security update is actually applied by the user. In the meantime, an attacker will ...
2
votes
3
answers
628
views
Would an Ubuntu server accessible from the internet be hacked within days?
I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this:
18 packages can be updated.
7 updates are security updates.
I install ...
1
vote
1
answer
105
views
Can my machine be compromised if I use an outdated application and the input data is trusted?
Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don'...
2
votes
1
answer
594
views
Is there a multi-layered DoS protection which can be tightly integrated with cloud hosting services?
I know that one can deny services (DoS) in any of the 7 layers of the OSI model and that in principle, a denial can be done by a single entity (human or machine) or from 2 or more such entities ("...
0
votes
2
answers
310
views
What consequences could there be to the continued use of an operating system without updating?
As it is well known, the extended support of Windows 7 (Service Pack 1) ends on January 14, 2020. Due to the short time that remains, I raise this question.
What consequences could an outdated ...
98
votes
5
answers
25k
views
How do services with high uptime apply patches without rebooting?
How are critical security updates installed on systems which you cannot afford to reboot but the update requires a reboot. For example, services/businesses that are required to run 24x7 with zero ...
0
votes
0
answers
101
views
Why would IPS vendor provider refuse to publish SLAs to fix the published highly ranked CVEs?
One of the biggest IPS providers (top of Gartner graph for its category) is not providing SLAs for all the 7+ ranking CVEs published last year. I don't really understand why would they refuse to ...
3
votes
2
answers
3k
views
Is it OK to not update devdependencies?
When checking third party libraries used in package.json and build.gradle files with tools such as Snyk, they allow the option to check for devdependencies. A lot of the time there is vulnerabilities ...
0
votes
2
answers
528
views
Risk of infecting the host OS if the guest OS is out of date [duplicate]
I'd like to know how much the risk changes if I don't update the software on the guest OS in a VM (applications and the guest operating system itself), compared to the risk in case it's all kept up-to-...
-4
votes
1
answer
241
views
About router vulnerabilities that could lead to MITM attacks [duplicate]
I recently read an answer on this stackexchange that informed me that, if a person knows my IP, it can try to hack into my router and change the DNS in order to perform a MITM attack.
Now, this is ...
4
votes
1
answer
2k
views
Can I trust a ubuntu repo mirror in a less 'free' country?
For example, if I install Ubuntu in Dubai or in Saudi Arabia, I'll probably get a local mirror. Is there a way I can make sure that the ubuntu packages I get when I do apt-get update are the 'real' ...
5
votes
4
answers
407
views
If I want a more secure and up-to-date Linux, in what cases should I avoid the official repositories?
The problem is this: Linux repositories (depending on the distribution) provide software and updates, but usually that software is not the latest official version, but it's an old version or branch ...