Hot answers tagged security-theater
15
Since raw emails are not encrypted, what you can read in an email could have (conceptually) been read by anybody. However, to read the email, the attacker would still have to connect to the HTTPS server, which leaves tracks (the IP from which the attacker connects will be known to that server -- of course, that IP will probably be that of a Tor exit node). ...
10
I think there's something to be said for setting a bar, regardless of how low it is. Can Tripwire be bypassed? Sure. Will it catch things that you wouldn't otherwise? Yes it will.
The main problem I've seen in a Tripwire installation is tuning it to where it isn't false-positive laden to the point of ignoring it. If it blows up every time someone ...
10
I don't rate their security particularly high; but they are more than just security theater. They potentially can make the job of the attacker more difficult and the job of a security forensic experts tracking down anomolies easier.
Let's say there is no security image/phrase or equivalent. Then an man-in-the-middle attacker can construct a fake version ...
10
I'd like to add this to what The Bear has already said
This method adds almost no security at all. Why?
Exposing the email with the link = Exposing the real message
This is almost the same as sending the text in the same email used to send the link. Then why are they doing this? You might ask. Here are some possible reasons:
Delivery and reading ...
10
One area where ZIP files could present a risk to the application the zip bomb attack. this occurs where an archive is constructed in such a way that when it's opened it consumes a large quantity of space on the server potentially causing it to crash.
It might be possible to mitigate this issue by opening zip files on a dedicated filesystem and then ...
8
The biggest risk in any language is to have developers who do not master the said language. Secure development requires thinking of all "corner cases" and it does not work unless the developer knows what he does at all points. A competent C programmer who does not know Java will do more secure code in C than in Java (and vice versa).
A case can be made that ...
7
Self protection:
What you list in your answer sounds pretty good. About my only thought would be to change your long ranty fake security question answers to truly fake answers. Either sentences or more pseudo-random characters. But assuming you get somewhere with trying to change the system, I don't think you want those in there when some guy who is ...
7
Great question! As it happens, I can present experimental data on this question -- and the data is fascinating. (I noticed that some of the answers contain speculation from first principles about how much security these security images offer. However, the data turns out to have some surprises for all of us!)
Experimental methodology.
"Security images" ...
7
The problem with a zip is that you aren't really sure what's inside of them. You would need to unzip the contents, scan for virusses and then you know that there aren't any known virusses in them.
Second of all, when fileuploads are in use, you can only allow a certain amount of file extensions (white list rather than blacklist) and you need to verify that ...
6
Tripwires are very useful for defending against userland rootkits. Kernelland rookits do not need to replace binaries to subvert the behavior of the system, usually these rootkits are just a Linux Kernel Module (LKM). In fact when you control the kernel like this any executable's behavior can be influenced without needing to modify the binary its self. ...
6
One this that hasn't yet been mentioned is that this approach can improve security from a different angle: rather than addressing privacy concerns (which it clearly doesn't), it definitely helps in establishing verifiability.
Anyone can send an email and forge the headers to make it appear to have come from your vendor, but (presuming their systems are ...
6
There are no security threat. At least not any that are specific to zip files.
The major concerns have already been outlined by other users. However, all of these are either not harmful to the application itself or not specific to zip files.
Zip Bomb attacks, as described by Rory McCune. These are only a concern if the files will be unpacked.
Inclusion ...
5
Account for poor backend security
If they're storing your password in plaintext (which is more than reasonable to suspect) then there's really nothing you can do about that. But what you can do is limit the amount of exposure to yourself that a security breach would cause. To the extent that their poor security isn't your problem, you don't really have to ...
5
Legally speaking, a corporation is one of the best "liability shields" you can have. It is its own entity that is, for most purposes, the entity that the rest of the world is interacting with when they interact with anyone empowered to represent it and make decisions on its behalf. It, and not its agents, bears the full brunt of any legal liability for ...
5
I agree with the above comments, plus a relevant business issue: security measures cost money (in the same way that software features cost money) and a business has finite budget for security, usually not enough. The two downsides to ineffective controls are that some budget is being wasted and that the impression the board will get of their security team is ...
4
In addition to the answers from Rook and Jeff, Tripwire and similar solutions also have real time alerting value. To subvert a Tripwire system that is also monitoring its own files you need to prevent it alerting during the subversion process.
Not as straightforward an attack any more.
So in summary - you can get around any controls given enough ...
4
There are a bunch of potential ways for an attacker on your network to break into it:
Bruteforce the password.
Sniff traffic on the network, wait for you to log in via HTTP (not HTTPS) and steal the login details.
Use ARP spoofing (a.k.a. poison routing) to perform a man-in-the-middle attack and steal credentials that way.
Run sslstrip to perform an SSL ...
4
The OWASP top ten is an important list to get under control, but it is necessarily a little vague and make be difficult to translate the generalized best-practices into coding suggestions.
A good rule to keep in mind is always assume your input is malicious, no matter where it comes from, as it can be difficult to imagine just how malicious input can be ...
4
This is exactly what you want, I googled: only allow root ssh lan
First hit...
http://drsavoye.blogspot.com/2010/06/enable-root-login-from-lan-only.html
On Linux, edit /etc/ssh/sshd_config. On Macs, edit /etc/sshd_config.
Locate the line that defines PermitRootLogin, uncomment if it is
commented out, and change its value to yes.
On a separate ...
4
The problem the sender of the email is trying to solve is data in transit and data at rest, specifically, a copy of their email and the path it takes to get to it's destination. When you log into one of these "secure" solutions, Tumbleweed is an example, you are simply logging into a server on the sender's network. The data never left the sender's network ...
3
In the general case I would agree with you that cloud services are no more inherently risky than e-mail providers. Any time you store data with a 3rd party there are security risks, especially if you're using a consumer grade service which doesn't have things like contracts in place where you can specify security/audit requirements.
I'd say that there's a ...
3
If this is the case, security images seem to provide no additional security,
Instead of pulling a static copy of the login page, now the phishers have to make a page capable of interacting with the original website.
An extreme hypothesis is that they are extremely dumb, and will retrieve the custom images with their own IP, or an IP that can be linked ...
3
A RAT generally consists of two programs: A client and a server.
The server is the program that's intended to be executed on the victim, the client is the program that is used to control the server.
In order to infect the victim, it must be executed somehow. It could be either exploiting some known vulnerability that allows code to be executed from an ...
3
As Rook said, Tripwire does help for userland compromises. It also requires that some kernel attacks factor this detection method in, raising the bar a bit. We see plenty of cases here where websites are compromised, but likely not entire systems. Tripwire would provide a method of detection and faster recovery there as well.
Offline comparisons are the ...
3
Usually, when a page requires the same password to be entered twice, it is in order to detect typing errors -- which are more common with passwords because of the "blind entry" thing. In particular with registration pages, because a wrongly entered password implies a recovery procedure later on, procedure which necessarily has a non-zero cost. Stating that ...
3
No, it's the same with software features.
If you produce something that does not add value it's waste. When it comes to redundant security the waste is even bigger since each wasted second in an IT system is multiplied by every user. That is assuming that the extra security "feature" takes user time.
Even If it doesn't affect users directly, such as double ...
3
usually as Peter Stone said, it increases the attack surface. well the point is since it is not used, it will be forgotten and hence it shall remain not considered for any patch in case needed. therefore, the attacker can focus on these unpatched security or functional feature to do the attack, that can for instance be escalation of privilege...
3
What I have done in the past when porting something between languages or working on something that will need to work really closely with a different language is to look up specific language issues on the OWASP website.
C / C++ is: https://www.owasp.org/index.php/Category:C
Java is: https://www.owasp.org/index.php/Category:Java
Hopefully that helps as a ...
3
One trick I've seen before is a single-use download link. If you visit the link, you cannot download the file after the first attempt. If you get there and the file has already been downloaded before you try it, then you have detected a compromise. Hopefully this site records the address and time of downloaders at a minimum.
2
It may or may not be directly causing a reduction in the security of your system, you need to look at your threat model to decide that. It may be annoying your users, and you need to investigate that. It certainly cost you money to deploy and perhaps to maintain, and that's definitely wasted resource.
However, it may also be that this (mis)feature ...
Only top voted, non community-wiki answers of a minimum length are eligible
