Questions tagged [updates]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
115 views

Security vulnerabilites in Windows updates from local network

Windows has offered the ability to download updates from machines in the local network for some time. My gut feeling tells me this would be a great attack vector for Windows security vulnerabilites. ...
J Heschl's user avatar
  • 123
0 votes
2 answers
2k views

How to update Ubuntu SSH version to latest version [closed]

I'm trying to update the Ubuntu OpenSSH version to 9.3p2, because of the CVE-2023-38408 vulnerability, but I can't. The recomendation is update to last version: https://ubuntu.com/security/CVE-2023-...
Jhon Laurence's user avatar
2 votes
1 answer
782 views

Windows Update installs yandex.ru browser hijacker

I recently created a Windows 10 installation stick via the official media creation tool. Presumably, there was no malware on my host system on which I created the stick. It's a pretty fresh install as ...
curious_weather's user avatar
1 vote
1 answer
130 views

Security Implications of Automatic Updates?

I have a custom Debian router installation which I'm trying to keep both secure and low-maintenance. I've therefore set some scripts which keep my Docker containers, blocklists, and OS (security ...
Synthetic Ascension's user avatar
1 vote
1 answer
286 views

Windows 10 Update - Man In The Middle Attack - Tamper Update [duplicate]

I am connecting to a wi-fi network and blocked all IP addresses in this network with a regular Windows 10 firewall. The only available IP addresses are: 192.168.1.1 = gateway 192.168.1.102 = my own ...
Minerva Developer's user avatar
0 votes
3 answers
109 views

Analyze fixed vulnerabilities in software updates

Developers update their software, sometimes they patch vulnerabilities. Is it realistically possible to analyze the updated code (even if it's closed source) to find the vulnerability that has been ...
VineLeav's user avatar
0 votes
1 answer
175 views

What is best practise to send credit card details update emails when the details have expired?

Recently an organization I forgot to update credit card details had my renewal payment fail because I forgot to update details. They sent an email as below which had a direct link to a web form ...
Darryn Brisdaz's user avatar
0 votes
0 answers
75 views

How can a service securely update an application even when the computer's current user could be hostile

Keep in mind that I am not a security specialist or a networking specialist. I am a software developer dealing with this kind of software for the first time. Our software is used to control user ...
InLibrolivier's user avatar
3 votes
1 answer
696 views

Secure boot after an OTA update confusion

My understanding is that secure boot works by verifying each stage in the boot process before proceeding. So first, UEFI or booting firmware will validate the signature of the bootloader, then kernel, ...
Engineer999's user avatar
0 votes
0 answers
102 views

Security precautions during update

When you update a new installation for the first time, or update a long time unmaintained OS, do you just enable a software firewall for all incoming connections (and hope there are no obsolete ...
M_Ryan's user avatar
  • 33
10 votes
2 answers
3k views

Are devDependencies in Node.js exploitable?

I am well aware that the best approach is to update any dependency, no matter whether it is a development dependency or a runtime/production dependency. But from a research prospective, I want to know ...
LGDGODV's user avatar
  • 173
1 vote
2 answers
212 views

Designing an updater with certificate renewal in mind

A program A downloads signed executables and other signed configuration files. Configuration files have a signature appended at the end. To verify their integrity and creator, it uses the public key ...
sanjihan's user avatar
  • 639
1 vote
1 answer
5k views

How to update Lynis to the latest version?

I'm new with Lynis, the security tool. I installed it with a package manager and check that it is the latest version: $ sudo apt-get install lynis ... lynis is already the newest version (2.1.1-1). ...
miguelmorin's user avatar
0 votes
2 answers
246 views

Haven't updated my Windows 10 for more than a year

Almost a year ago, I dual-booted Windows 10 and Linux Mint. And since then, I haven't booted into my Windows 10 OS. I still remember that the Wi-Fi adapter was off when I shut my Windows 10 down. Now, ...
Wade Wayne's user avatar
0 votes
1 answer
135 views

Old operating system (offline computer) need to come online for a few minutes

OSX El Capitan I have an offline computer running an old OSX operating system. I would like to connect that computer to the web for a brief few minutes in order to install HomeBrew and install a newer ...
whitelightning's user avatar
2 votes
2 answers
229 views

Public registry (database or API) for known security vulnerabilities in open source software?

Is there a reliable, public registry (preferably in the form of an API) that records known security vulnerabilities in open source software? Why would anyone want this? I'm trying to emulate github's ...
stevec's user avatar
  • 1,270
5 votes
2 answers
1k views

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here, the hashsum are made part ...
mYnDstrEAm's user avatar
7 votes
1 answer
4k views

Is `gpg --refresh-keys` secure and where is this documented?

From the gpg manual: --refresh-keys Request updates from a keyserver for keys that already exist on the local keyring. This is useful for updating a key with the latest signatures, user IDs, etc. ...
Tino's user avatar
  • 221
0 votes
1 answer
139 views

Update URL over HTTP

I saw VLC (Windows) gets updates from an unencrypted URL: HTTP, not HTTPS! Do you think there's a risk for a man-in-the-middle attack?
Seraphim's host's user avatar
1 vote
1 answer
1k views

Firefox pretending to update itself, but actually not doing it, and thus being a risk for security - what am I missing?

I am a long-time Firefox user and remember that usually the UAC prompt popped up when Firefox updated itself. Some months ago (or is it years?), Firefox obviously changed the way it updates itself: I ...
Binarus's user avatar
  • 567
0 votes
1 answer
110 views

Secured Software Update from an unauthenticated entity

Let's suppose we have a software update D, that is encrypted and signed and delivered to some component C. Further we suppose that the receiving entity C can validate the signature and decrypt the ...
Marm's user avatar
  • 101
0 votes
1 answer
139 views

Software update process (dependencies) in organization

Wondering how other organizations manage software update process. We are a startup, were we try to define components owners, which should update them (security updates etc). This does not to seem to ...
dev's user avatar
  • 997
0 votes
2 answers
823 views

Do you need to update a router that is set in bridge mode?

Since a router in bridge mode works like a modem, do you need to even update it?
user235166's user avatar
1 vote
1 answer
244 views

Sufficient to only install security updates on Debian?

On my Debian, I only do security updates: deb http://security.debian.org/debian-security/ buster/updates main deb-src http://security.debian.org/debian-security/ buster/updates main For example, ...
Groml's user avatar
  • 11
0 votes
1 answer
118 views

Do corporate systems need to be updated immediately after updates are available? [duplicate]

I lived under impression that timely updates were very important. Even a home user wouldn't like their computer to demand ransom for their data. However, the less home and the more corporate our ...
gaazkam's user avatar
  • 5,955
0 votes
2 answers
162 views

Update fresh installation of Linux OS

It seems to me that there's some sort of "race condition" when you install a new Linux OS (this applies to every OS, but I'll restrict this question to Linux only). When you download the OS for a ...
reed's user avatar
  • 15.8k
0 votes
0 answers
37 views

Updating Ubuntu [duplicate]

How can I make sure in the terminal that my Ubuntu updates are from the real source? I am asking because I know that one download was fake. It was rkhunter. The update was malware. Done from Bangkok....
Napasakorn Sriwonkeed's user avatar
0 votes
1 answer
156 views

How does Burp update XSS/vulnerability scanning rules/payloads?

The first point, that it updates with new release. So if somebody discovered new payload for popular frameworks, it will be in burp only with new release. Does Burp app load payloads from Internet ...
Nikita Ermolaev's user avatar
-2 votes
1 answer
190 views

Upgrading Software Version: risk of an unknown vs known vulnerabilities

Is there any evidence or research into the likelihood, as well as damage, via vulnerabilities in previous versions compared to following iterations of software? For example, with every software ...
8protons's user avatar
  • 218
2 votes
1 answer
333 views

How to ensure Windows 10 is safe from critical security hole reported by NSA on 2020-01-14?

All over the news today (2020-01-14) is the story that the NSA and Microsoft have reported a critical security vulnerability in Windows 10. But I haven't been able to find clear instructions about ...
Ryan's user avatar
  • 325
3 votes
3 answers
390 views

Why is a fully-patched OS less important than AV?

How to explain to traditional people why they should upgrade their old Windows XP device? <- The interesting point made in the highest upvoted answer to this Q is that a fully patched OS is largely ...
gaazkam's user avatar
  • 5,955
103 votes
19 answers
16k views

How to explain to traditional people why they should upgrade their old Windows XP device?

This is an issue I'm recurringly facing: older people from my family (or people who my family members know) can be surprisingly reluctant to apply most basic security measures when they're using their ...
gaazkam's user avatar
  • 5,955
0 votes
1 answer
11k views

Recon-ng v5 - How to add domains?

I just started with recon-ng today, I was following tutorials but every tutorial is outdated with most of them describing the functions of v4. I was able to update myself with simple additions like ...
s h a a n's user avatar
  • 325
0 votes
1 answer
104 views

Debating between architecture options for offline updating of Linux machines in a vertically segregated network

My coworker and I are discussing the pros/cons between two potential architecture options, and I would like to gather feedback on which option is better and why. First, a description of the ...
Peter Adamson's user avatar
1 vote
2 answers
367 views

Does it really improve security to update PHP interpreter version without any code changes at all?

Our hosting provider wants to update our legacy application server (Plesk). We usually place older PHP projects (PHP 5.3 - 5.6) there, so they can sit in a stable environment until their unknown EOL. ...
user avatar
0 votes
1 answer
252 views

Quantifying risk of not upgrading Android (ie Android 8.1 to newer version)

I am running an Android One (ie vanilla Android supported by Google) phone which has Android 8.1. I have unlocked the bootloader and rooted my device. Because I've rooted my device I have not been ...
davidgo's user avatar
  • 611
2 votes
1 answer
253 views

Is Dell SupportAssist insecure?

On an OEM Windows install on a Dell XPS 13, when I navigate to the Dell support website, it offers to download and install updates (even firmware updates!) on the spot, in the browser, flaunting all ...
mm201's user avatar
  • 123
52 votes
10 answers
20k views

Replacing Windows 7 security updates with anti-virus?

Microsoft has announced Windows 7 will no longer be receiving updates after January 14, 2020: Here. I hate windows 10's forced updates and telemetry so I have always stuck with Windows 7, but it may ...
TritiumCat's user avatar
5 votes
3 answers
314 views

Avoiding the race condition between time of release and time of update

There is a kind of race condition between the time when a developer releases a security update and the time when the security update is actually applied by the user. In the meantime, an attacker will ...
reed's user avatar
  • 15.8k
2 votes
3 answers
628 views

Would an Ubuntu server accessible from the internet be hacked within days?

I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this: 18 packages can be updated. 7 updates are security updates. I install ...
George's user avatar
  • 131
1 vote
1 answer
105 views

Can my machine be compromised if I use an outdated application and the input data is trusted?

Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don'...
reed's user avatar
  • 15.8k
2 votes
1 answer
594 views

Is there a multi-layered DoS protection which can be tightly integrated with cloud hosting services?

I know that one can deny services (DoS) in any of the 7 layers of the OSI model and that in principle, a denial can be done by a single entity (human or machine) or from 2 or more such entities ("...
user avatar
0 votes
2 answers
310 views

What consequences could there be to the continued use of an operating system without updating?

As it is well known, the extended support of Windows 7 (Service Pack 1) ends on January 14, 2020. Due to the short time that remains, I raise this question. What consequences could an outdated ...
MarianoM's user avatar
  • 125
98 votes
5 answers
25k views

How do services with high uptime apply patches without rebooting?

How are critical security updates installed on systems which you cannot afford to reboot but the update requires a reboot. For example, services/businesses that are required to run 24x7 with zero ...
secureninja's user avatar
0 votes
0 answers
101 views

Why would IPS vendor provider refuse to publish SLAs to fix the published highly ranked CVEs?

One of the biggest IPS providers (top of Gartner graph for its category) is not providing SLAs for all the 7+ ranking CVEs published last year. I don't really understand why would they refuse to ...
Filipon's user avatar
  • 1,264
3 votes
2 answers
3k views

Is it OK to not update devdependencies?

When checking third party libraries used in package.json and build.gradle files with tools such as Snyk, they allow the option to check for devdependencies. A lot of the time there is vulnerabilities ...
vegedezozu's user avatar
0 votes
2 answers
528 views

Risk of infecting the host OS if the guest OS is out of date [duplicate]

I'd like to know how much the risk changes if I don't update the software on the guest OS in a VM (applications and the guest operating system itself), compared to the risk in case it's all kept up-to-...
reed's user avatar
  • 15.8k
-4 votes
1 answer
241 views

About router vulnerabilities that could lead to MITM attacks [duplicate]

I recently read an answer on this stackexchange that informed me that, if a person knows my IP, it can try to hack into my router and change the DNS in order to perform a MITM attack. Now, this is ...
AnalysisStudent0414's user avatar
4 votes
1 answer
2k views

Can I trust a ubuntu repo mirror in a less 'free' country?

For example, if I install Ubuntu in Dubai or in Saudi Arabia, I'll probably get a local mirror. Is there a way I can make sure that the ubuntu packages I get when I do apt-get update are the 'real' ...
user230910's user avatar
  • 1,025
5 votes
4 answers
407 views

If I want a more secure and up-to-date Linux, in what cases should I avoid the official repositories?

The problem is this: Linux repositories (depending on the distribution) provide software and updates, but usually that software is not the latest official version, but it's an old version or branch ...
reed's user avatar
  • 15.8k