Hot answers tagged

491

This attack is supposed to be presented 10 days from now, but my guess is that they use compression. SSL/TLS optionally supports data compression. In the ClientHello message, the client states the list of compression algorithms that it knows of, and the server responds, in the ServerHello, with the compression algorithm that will be used. Compression ...


94

Disclaimer: I work at a company developing security software to mitigate against targeted attacks. Some of the methods we use are similar to those used by attackers (when clients want to test their systems). For example, one client asked us to test their security by doing targeted [spear] phishing attacks. We emailed only the IT department with a ...


77

The potential impact of this is not low, regardless of how much information the thin client stores. Specifically the risk is that an attacker installs something like a rootkit or software keylogger in the operating system of the thin client, which you are unlikely to be able to discover by inspection. (This is a variant of the Evil Maid attack). Should ...


61

You don't need to lock your front door unless you're a thief. It's the same idea in all relevant respects. Each person needs to take reasonable measures to protect himself and his property from those who would harm him or his property, in accordance with his best judgment of the risks. You buy a lock and lock your front door if you live in a city, in ...


55

All of security can be boiled down to threat modeling, risk assessment, risk management, and risk mitigation. So no, defenses designed to protect against non-targeted attacks are not likely to do well against targeted attacks. What makes a targeted attacker (or what you call a "professional attacker") different? Simply the intelligence and money they're ...


43

To add to Thomas Pornin's outstanding answer, I wanted to point out some prior work on the subject of compression and cryptography. Take a look at the following research paper: John Kelsey. Compression and Information Leakage of Plaintext. FSE 2002. That paper describes chosen-plaintext attacks against systems that (a) compress data before encrypting ...


43

I recently took a business trip to China. Our IT department told me I could not take my normal machine, and instead gave me a loaner. That may not have helped you at all. The reason I'm saying this is because you connected that laptop to the corporate network after you brought it back to your country. This loaner had MS Outlook and was linked to my ...


42

As for anything attached to public networks: Reduce your attack surface - can you remove the NAS from the Internet? Can you limit the IPs that are allowed to connect? Increase cost of attack - lockouts are great, but also make sure that you have a complex password and that you change it regularly Monitor access - keep your eye on who successfully logs in ...


37

It depends. Think of your IP address as the same kinda thing as a real address. If a criminal knows the address of a bank, what can they do? It completely depends on what security is in place. If you've got a firewall running (e.g. Windows Firewall) or are behind a NAT router, you're probably safe. Both of these will prevent arbitrary incoming traffic from ...


33

There's a great short essay written by Bruce Schneier on the right of privacy: The most common retort against privacy advocates -- by those in favor of ID checks, cameras, databases, data mining and other wholesale surveillance measures -- is this line: "If you aren't doing anything wrong, what do you have to hide?" Some clever answers: "If ...


31

A few years ago (2003), there was this worm called "Blaster" (or MSBlast, Lovesan etc. - read more on https://en.wikipedia.org/wiki/Blaster_(computer_worm)). It spread by using a vulnerability in an RPC service, running on Windows XP and 2000. At the time where it was "worst", you could get infected within minutes, if you didn't have a firewall set up. I ...


28

My first thought is to ask, “Do you have anything valuable that you don’t want someone else to have?” If the answer is Yes then follow up with “Are you doing anything to protect it?” From there you can suggest ways to protect what is valuable (do threat modeling, attack modeling, etc.).


26

The difference between a random attack and a targeted attack can be summarized nicely: The attacker want N number of remote nodes for DDoSing / Spamming / Phishing / etc. or The attacker wants XYZ data on user2174870's machine specifically. If the attacker is just looking to build a botnet (>>99% of attacks) then simply being harder to crack than the ...


26

Positive reasons Instead of a beach holiday, we joined a Christian Mission this summer in Malawi. We're keeping quiet about it in case the children are teased at school. I leapt into the road and saved a toddler's life. I just walked away because I don't want any fuss. Controlling dissemination My wife is pregnant, great news! We want to tell close ...


25

It's a lot of work. Not only that, but it's a lot of work that your (legitimate) users will never see or benefit from. Most people would be willing to trade off the nebulous risk of deterring a small subset of hackers (realize that APT hackers, in particular, wouldn't be dissuaded and might even find an extra way into your system if you do something wrong ...


24

As the Miranda Rights say: "anything you say can and will be used against you in a court of law". Right after the police finish giving you the Miranda rights, they then say "but if you are innocent, why don't you talk to us?". This leads to many people getting convicted of crimes because it is indeed used against them in a court of law. This is a great video ...


24

Just to add to great Thomas answer, it seems that to successfully leak the cookie value the actual POST body sent should not only be the: Cookie: secret=.... but should contain much more text from the POST header, like so: POST / HTTP/1.1 Host: thebankserver.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 ...


24

You're confusing several things. First, pretty much every standard protocol (save for FTP which you should avoid like plague) has only a handful of standard ports. Since these ports are standards, they will not change often and therefore will not need to be updated. Now, some applications will require specific ports to be opened, Typically, that's handled ...


23

Note: I like honeypots a lot but to answer your question some negative aspects include: You are not reducing your workload. You are increasing the amount of signals you have to process. You are increasing your operating costs. You are taking time away from other security activities which may otherwise help protect actual data & services. You may be ...


22

Industrial espionage is unfortunately very common in China. There are cases where spyware was installed on computing devices (allegedly by hotel staff) and in some cases even hardware spying devices were put into notebooks. Wiping every loaned notebook is a good way to get rid of any spyware. Some advisories suggest to weight any hardware before and after ...


21

Costs are the basis to evaluate risks and their mitigations. If the costs (monetary costs, operational costs, ease-of-use costs etc.) to implement a defence (best practice, etc.) exceed the damage caused by the risk being realized, then you are justified in choosing the accept the risk. This is pretty basic concept in risk management.


20

The answer is generally it depends. This is really based on the security of your system. Users can create new accounts without restriction If so, it is kind of meaningless to not tell them. You can't have intersecting usernames or email addresses, so you have to inform a new user if their username or email has already been used. An attacker would then be ...


20

It would be totally different if you are targeted by state sponsored actors. If you are a high value target, they can employ not just hacking resources like zero-day malware, but also video surveillance, wire-tapping, bribing your friends, email spear phishing, keylogging, breaking into your house, or even kidnapping and torturing you just to obtain some ...


20

I ignore them. There will always be compromised systems continually scanning the entire Internet for arbitrary vulnerabilities. Trying to block them is no more effective than spitting into the wind. You'll get far more value out of focusing on the security of your servers and applications, and keeping an eye out for attackers who seem to specifically ...


19

In various jurisdictions you are likely to be fined or put out of business if you don't secure your systems. Specific examples: Holding personal customer data. In the UK, if you don't protect this data appropriately you can be fined. If you handle credit card data and don't implement appropriate security you may find that VISA/Mastercard will prohibit you ...


19

7-zip (or any other similar utilities) encryption is designed to protect archived files. So, as long as the tool designers did their job well, you are safe for the second case (somebody getting his hand on the encrypted file and trying to crack it). However, such utility are not designed to protect you against your first mentioned case (someone getting ...


18

MAC addresses are link-local only. Most attacks don't (have to) come from the same subnet, so most rely on higher-layer addressing. Changing your mac address does little to hide you. There are a variety of problems with changing your MAC address often. One, off the top of my head, would be that DHCP reservations wouldn't work. It could be marginally less ...


18

Knowing, or not knowing, an IPv4 address is nothing special. Every publicly addressable host on the Internet will be attacked regardless of who knows it. The entire Internet is scanned by malicious software so frequently that an old OS install without patches will be compromised in minutes or in seconds. In total, unless the people who know the address ...


17

The main ones are: Use SSL sitewide. Don't offer anything over http. Instead, any connection via http should immediately redirect to the main site's landing page via https. Use HTTPS Strict Transport Security. This will tell users' browsers: please, only connect to me over https. This defends against sslstrip and similar man-in-the-middle attacks. Set ...


16

Here are my recommendations for what users can to defend themselves against SSLstrip, Firesheep, and similar attacks: Install HTTPS Everywhere or ForceTLS. (HTTPS Everywhere is easier to use.) This tells your browser to use the SSL versions of web sites, where possible. If the browser gives you a certificate warning, do not bypass the warning, and do not ...



Only top voted, non community-wiki answers of a minimum length are eligible