Tag Info

Hot answers tagged

389

This attack is supposed to be presented 10 days from now, but my guess is that they use compression. SSL/TLS optionally supports data compression. In the ClientHello message, the client states the list of compression algorithms that it knows of, and the server responds, in the ServerHello, with the compression algorithm that will be used. Compression ...


57

You don't need to lock your front door unless you're a thief. It's the same idea in all relevant respects. Each person needs to take reasonable measures to protect himself and his property from those who would harm him or his property, in accordance with his best judgment of the risks. You buy a lock and lock your front door if you live in a city, in ...


34

To add to Thomas Pornin's outstanding answer, I wanted to point out some prior work on the subject of compression and cryptography. Take a look at the following research paper: John Kelsey. Compression and Information Leakage of Plaintext. FSE 2002. That paper describes chosen-plaintext attacks against systems that (a) compress data before encrypting ...


30

It depends. Think of your IP address as the same kinda thing as a real address. If a criminal knows the address of a bank, what can they do? It completely depends on what security is in place. If you've got a firewall running (e.g. Windows Firewall) or are behind a NAT router, you're probably safe. Both of these will prevent arbitrary incoming traffic from ...


27

My first thought is to ask, “Do you have anything valuable that you don’t want someone else to have?” If the answer is Yes then follow up with “Are you doing anything to protect it?” From there you can suggest ways to protect what is valuable (do threat modeling, attack modeling, etc.).


24

As the Miranda Rights say: "anything you say can and will be used against you in a court of law". Right after the police finish giving you the Miranda rights, they then say "but if you are innocent, why don't you talk to us?". This leads to many people getting convicted of crimes because it is indeed used against them in a court of law. This is a great video ...


20

Just to add to great Thomas answer, it seems that to successfully leak the cookie value the actual POST body sent should not only be the: Cookie: secret=.... but should contain much more text from the POST header, like so: POST / HTTP/1.1 Host: thebankserver.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 ...


19

The answer is generally it depends. This is really based on the security of your system. Users can create new accounts without restriction If so, it is kind of meaningless to not tell them. You can't have intersecting usernames or email addresses, so you have to inform a new user if their username or email has already been used. An attacker would then be ...


18

In various jurisdictions you are likely to be fined or put out of business if you don't secure your systems. Specific examples: Holding personal customer data. In the UK, if you don't protect this data appropriately you can be fined. If you handle credit card data and don't implement appropriate security you may find that VISA/Mastercard will prohibit you ...


17

MAC addresses are link-local only. Most attacks don't (have to) come from the same subnet, so most rely on higher-layer addressing. Changing your mac address does little to hide you. There are a variety of problems with changing your MAC address often. One, off the top of my head, would be that DHCP reservations wouldn't work. It could be marginally less ...


14

MAC addresses are supposed to be unique worldwide, so that no two devices use the same MAC address. This matters when several devices are on the same link: if two devices have the same MAC address, things do not work well at all, in a hard-to-diagnose way. It is possible to force that by changing your MAC address, but then you did it on purpose; with a ...


14

Here are my recommendations for what users can to defend themselves against SSLstrip, Firesheep, and similar attacks: Install HTTPS Everywhere or ForceTLS. (HTTPS Everywhere is easier to use.) This tells your browser to use the SSL versions of web sites, where possible. If the browser gives you a certificate warning, do not bypass the warning, and do not ...


13

The main ones are: Use SSL sitewide. Don't offer anything over http. Instead, any connection via http should immediately redirect to the main site's landing page via https. Use HTTPS Strict Transport Security. This will tell users' browsers: please, only connect to me over https. This defends against sslstrip and similar man-in-the-middle attacks. Set ...


13

Knowing, or not knowing, an IPv4 address is nothing special. Every publicly addressable host on the Internet will be attacked regardless of who knows it. The entire Internet is scanned by malicious software so frequently that an old OS install without patches will be compromised in minutes or in seconds. In total, unless the people who know the address ...


13

It doesn't guarantee that the code is free of vulnerability. However, if verification is used appropriately, it can increase assurance (confidence) that the application is secure. Speaking from a very broad perspective, there are two aspects of this problem: Verification. Given a mathematical model of the system and a mathematical specification of the ...


11

Cyber Pearl Harbor is a really stupid term used by people who don't know the first thing about IT security, or those who do but want to get in the newspapers. "Cyber warfare" and "Cyber terrorism" are also examples of terms being bandied about by those looking to get sound bites or a higher IT security budget. It's all complete, total nonsense, and using ...


10

Security is not about doing something illegal, it's about someone else doing something illegal (that will impact you). If you don't encrypt your phone calls, someone could know about what all your salesman are doing and can try to steal your clients. If you don't shred your documents, someone could use all this information to mount a social engineering ...


10

No, it is not true. Being able to recover the key, while knowing the original message (the "plaintext") and the encrypted message (the "ciphertext") and the algorithm, is called a known plaintext attack. If the attacker not only knows the plaintext and the ciphertext, but actually gets to choose either, then this becomes a Chosen-Plaintext Attack or a ...


9

To focus on your individual cases: Absolutely anything he wants. Malware, rootkits, backdoors, keyloggers, the whole shebang. Again, absolutely anything. It's exactly the same as having the USB disk, because he can set up a site where he can download the files he needs, or just download them from existing sites. Wipe the disk, delete system files, write ...


9

There is a training ground just for your purpose: Nebula 2 is a complete linux distribution (virtual machine) for learning purposes to perform many Privilege Escalation vulnerabilities. Nebula takes the participant through a variety of common (and less than common) weaknesses and vulnerabilities in Linux. It takes a look at •SUID files •Permissions ...


8

According to this Web page, SIPRNet and NIPRNet are supposed to be air gapped (both from each other, and from the rest of the World). However, they are also accessible from various locations around the World, under control of several countries (it is documented that some services from a pool of countries, which includes Australia, New Zealand, Canada and ...


8

You've hit on the basic premise of IT Security: you can't predict or stop everything, and to try might cost more than what you are trying to protect. Your character is concerned with Mastery of skill to overcome higher-level obstacles, but the race to create obstacles that are higher than other people's skills is foolish in reality. In reality, you need to ...


8

Whenever anyone brings that statement I always reply with - "You can't trust all the people in the world are following laws". Indeed, if everyone in the world is a law abiding citizen you can leave your front door open, but as we know there are criminals and whole lot of other people who may enter your front/back door with various motives - who knows what ...


7

Whilst at the moment (as mentioned in other answers) MAC addresses are generally link local (although there are some protocols which leak that information to remote networks), it's interesting to note that when IPv6 becomes more prevalent MAC addresses are likely to be more important. A common way of constructing an IPv6 host address is to include the MAC ...


7

You could install a site advisor plugin like for example McAfee's site advisor. By doing this you can easier search the domain for any reported maliciousness. For example I search a domain which a big newspaper is getting their adds from I get report back saying generally OK, but community reports say "Adware, spyware, or viruses (1)". I'm sure there ...


7

Modern day security holds the belief that you cannot make a network infinitely secure - build a better mousetrap and you'll encourage the evolution of mice. Any security system will have to be bounded by the expected capabilities of the attackers, and will have to employ a threat based risk remediation strategy that puts the greatest investment on the ...


7

There is an old tradition of not distinguishing between "that username does not exist" and "that username exists but the password is wrong". It comes from older times, when both attackers and defenders were new at the job, and the context was different. At that time, the attacker was "outside" and he wanted to guess a username+password pair in order to enter ...


6

As discussed in the comments section, password based security is very minimal for banking, as it is worth the effort for a thief to try to steal your password. They basically only have to infiltrate your browser and log your entries. Furthermore, if this is achieved, they have full access. Approaches such as hashing or other algorithms do not really matter, ...


6

It has a downside in enterprise environments - switches optimise traffic flow by various methods, including remembering which port traffic from a particular MAC address comes in - so that traffic back to that MAC is only sent out that port. MAC tables are updated in switches as new data comes in, but changing MAC addresses all the time would add ...



Only top voted, non community-wiki answers of a minimum length are eligible