Tagged Questions

The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
43 views

Should one worry about using an outdated version of Firefox? [duplicate]

I have access (and the general public) to a computer lab with many workstations. Each workstation is identical in terms of software, hardware and the version of firefox. The version that is installed ...
2
votes
3answers
429 views

Is it more secure to apply updates as soon as they get released? [closed]

Is it more secure to apply updates as soon as they are released, or wait to make sure the updates are not causing problems to the system. It might sound stupid but in the last few years I heard about ...
31
votes
9answers
4k views

Why is it a security problem not to update one's browser?

Is it in general a security problem not to update your browser. Firefox constantly prompts me to update my browser, but how dangerous is it to not update? As part of this question, I would like to ...
1
vote
3answers
314 views

Computer hasn't been connected to internet for 2 weeks

A computer hasn't been connected to the internet for 2 weeks but has still been used. It's running Windows 8 and various notices are complaining about virus definitions and updates not being current. ...
2
votes
1answer
58 views

How do you back up cardholder data remotely without a network connection?

In the PCI DSS version 3 it says: 1.3.3 Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment. But in the event of hard ...
7
votes
4answers
196 views

DNS spoofing of linux distribution repositories

Question(s) Is it possible to "redirect" linux-update-repos via DNS spoofing (e.g. DNS cache poisoning) to a malicious website, so that harmful software (updates) will be installed, when running the ...
1
vote
3answers
44 views

How do to keep programs updated

We all know we should keep our programs up to date, after all each of them could have an unlatched security hole that was fixed in the latest update. However the average computer easily contains 200+ ...
2
votes
1answer
28 views

Vulnerabilities by adding an untrustworthy package repository

Often, users will install additional package repositories to their Linux distributions to be able to follow "bleeding-edge" versions of software that hasn't been/will never be backported to their ...
-2
votes
1answer
56 views

Does using a non Nexus/Google Play Editon Android device have a higher security risk? [closed]

The fact that carriers deploy the latest security updates to Android devices much later than Google does to Google Play Edition and Nexus devices, should we avoid using those devices altogether?
1
vote
3answers
76 views

List of upgradable softwares vulnerable to MitM attacks

I was wondering, a lot of software nowadays automatically connect to a server at launch to check for updates, even basic software, and, to my knowledge, this is a new trend. Before you had to download ...
0
votes
1answer
55 views

How can a critical Adobe Acrobat security update, only available as an unsigned executable over plain HTTP, be verified?

A critical security update for Adobe Acrobat Pro and Standard 9 on Mac OSX is only available over HTTP, and is unsigned code. Is there any out-of-band way to verify the download is authentically from ...
-4
votes
2answers
89 views

Is it possible to create your own security updates on Ubuntu 12.04? [closed]

My main Question is: Is it possible to create your own security packages? [ NOTE: I enjoy teaching myself new skills for many different things. So please give me an answer in a 4th grade reading ...
2
votes
0answers
240 views

What is going on with my download of the recent Apple security update?

The update in question is the Mavericks combined update which, among other things, claims to fix the recent SSL vulnerability/gaping hole. This issue really annoyed me, so I decided to procure ...
0
votes
1answer
39 views

programs or methods to review Internet browser applications for security [closed]

I've been tasked with doing a security review on a Firefox update, but we don't have any utilities that we can find. How would we go about running a security review on Firefox before pushing it to ...
0
votes
4answers
96 views

Securing an automatic updater

Scenario You have a launcher for some software, it allows you to execute the software but it will also allow you to switch versions and upgrade to newer versions. When the launcher is executed, it ...
1
vote
3answers
175 views

USGCB on a non-networked computer

We will be getting some data that needs to be kept in accordance with USGCB regulations. Our intent was to keep it secure by storing and using it on a non-networked computer, but the regulations seem ...
3
votes
1answer
181 views

Does Apple maintain the security of the built-in Ruby?

Does Apple maintain the security of the Ruby implementation that comes by default in OS X? I recently heard about CVE-2013-4073, but when I ran "Software Update..." on my OS X Lion box, it didn't ...
2
votes
3answers
534 views

How important is patch management?

Problem I'm trying to sell the idea of organizational patch/update management and antivirus management to my superiors. Thus far, my proposition has been met with two responses: We haven't had any ...
5
votes
6answers
704 views

Best source(s) for security related news? [closed]

What is the best place to go for security news? I am looking for everything from news updates to editorials to guides and research. Anywhere considered more reliable or particularly hard-hitting? ...
7
votes
3answers
287 views

How can I circumvent the lack of Java updates?

Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start ...
2
votes
1answer
852 views

Windows Update - Interception

I'm trying to monitor the HTTP requests/responses made when performing a Windows Update. I have a Windows 8 machine configured with a proxy in IE. I've also imported via netsh for winhttp: netsh ...
1
vote
1answer
287 views

Padding oracle - Vulnerable Version of ASP.NET

I would like to install the vulnerable version of ASP.NET for testing purposes. I've thought about it and I guess the best way would be to delete/disable some security updates to make that possible. ...
0
votes
1answer
447 views

Best practice to manage user's java/browsers/flash player/adobe reader auto-update

We are specially concerned about if our users keep updating their browsers, flash player, adobe reader, java( feel free to let me know some others that are also important). These applications usually ...
0
votes
5answers
5k views

How to list missing security updates for Windows servers?

I have a list of applied security patches and updates, exported from Windows server 2003. The exported list is in CSV format, but converting it is not a problem for me. Is there any tool/site/script ...
3
votes
2answers
2k views

Using Window Servers 2003 after security updates are discontinued

Let's say that Microsoft has stopped supporting Windows Server 2003 now so there is no any security updates and I use that system for Domain Controller (Windows XP/7 Professional Clients) and File ...
4
votes
2answers
227 views

Are Windows Updates susceptible to tampering, eg. using a MiTM attack.

My real question is how are patches and updates authenticated in general. But for example how does windows know a windows update is really a windows update, does it just trust the URL or is there some ...
-1
votes
1answer
187 views

What was Microsoft trying to do when they had Windows Updates over their website? [closed]

What was Microsoft trying to do when they had Windows Updates over their website? Now it's completely integrated into the operating system and it seems much smoother. The Linux and Mac I've used got ...
-1
votes
1answer
109 views

How come FireFox came out with another release a week latter? Was a threat discovered? [closed]

I updated to FireFox 13 last week and today I got a message about there being a security update and upgrading to FireFox 14. Was a major security threat found? What justified the release of version 14 ...
2
votes
3answers
1k views

Is OpenSSL secure enough?

We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries. It appears that OpenSSL has vulnerabilities resolved on a regular basis. ...
4
votes
1answer
568 views

CDNs used by Windows Update

My question is about CDNs (Content Delivery Networks) and their simultaneous use for legal and questionnable stuff. One specific example is the following. I'm noticing taffic from our network to the ...
0
votes
1answer
594 views

Mod_security rules-updater.pl fails to pull new release

Mod_security has a rules updater distributed with their release packages on sourceforge: http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/ Usually, you can run the script ...
14
votes
3answers
406 views

Android security without updates

I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
1
vote
1answer
544 views

Is there any way to use Nuget securely?

Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget" The problem I have is that anyone can pretend to be ...
5
votes
6answers
1k views

Where to download OpenBSD release ISO's over HTTPS?

OpenBSD claims to be highly secure. So why doesn't it allow downloading the release iso's over HTTPS? Or I'm missing something? Can someone please explain this to me?