Tag Info

New answers tagged

0

CMP is a generic protocol which aims at covering most (if not all) network exchanges involving a Certificate Authority; e.g. it includes messages for a CA who wants to announce that it has a new key pair. The protocol is rather complex, and has been around for quite some time (first published version is from 1999). SCEP is a specialized protocol which has a ...


3

As usual, the problem is one of definition. Namely, what makes the device 'D' more "genuine" than a PC run by some ill-intentioned individual ? If you get down to it, you will say something like: device D is genuine because that's the true piece of tangible hardware, the accumulation of atoms which came out from the factory. This is fine as far as definition ...


0

If it's not anything registered it might very well be a UPnP vulnerability. In this case, a device on a LAN is infected (e.g. a "smart" TV), opens port 17275 on the home router via UPnP (see this answer) and waits for a connection. I'd suggest setting up a honeypot on that port and listen for what comes in for a starter. The nice folks at SANS' ISC might ...


1

I think you're asking if a hacker could cause trouble for your home servers if you're using an insecure protocol for data. This is completely dependent on how you handle the data and how you implement parsing the information packets. If you're ONLY using the custom protocol for non-sensitive data and implementing good security practices (like blocking ...


4

You have to make a distinction between the applicative protocol and the transport protocol. SSL/TLS is a transport protocol: it ensures some security-related guarantees (confidentiality, integrity, some authentication) for a a bidirectional stream of bytes. What these bytes mean is what the "applicative protocol" defines. E.g. in HTTPS, HTTP is the ...


5

By definition, if it doesn't matter if someone has access to or modifies your data, then it isn't sensitive and doesn't have to be secure. For things that have to be secure, then it is ill advised to use a custom protocol unless you can invest the huge amounts of time and resources necessary to ensure its security (millions). Note that there is also a ...


4

I suspect you answered your own question already. The mere fact that you want to protect the data implies that it is sensitive and should not be modified or leaked. If this is not the case, why bother with protecting at all? If the opposite is true (the data should be protected) then the "rule" stands that the use of custom protocols and encryption ...



Top 50 recent answers are included