Tag Info

Hot answers tagged

16

I think it's fair to say that the idea that any large organisation is entirely impervious to attack has been proven false over the last five years or so. Everyone from nation states through large corporations, security consultancies and other security minded companies have had breaches. One reason that a bank hasn't been thrown into "complete chaos" as you ...


8

To turn a quick profit, It is easier to go after end users. This is why there are so many phishing attacks and password stealing Trojans. Banks internet-facing operations tend to be well secured. The internal office environments less so, although they tend to have good AV. This stops casual metasploit users, although an advanced attacker with zero day ...


6

It depends on what exactly you were using. Direct inspection computer: if you're using a public (library, etc.) computer, you can check its usage history - browser history, and so on. Keep in mind that most such systems ought to use, and often do use, virtual/sandbox systems such as SteadyState, that erase all traces after you log out. So eye-keeping at ...


6

When one secure a box, he puts several defenses layer so, would some "hacker" defeat a protection, the immediate consequences will be limited, and by the time a defeats the next following protection layers his action will hopefully be detected and neutralized. This is for a simple box. Now with a bank which is one of the largest international institution, ...


5

Focus less on giving a detailed security report and more on answering the user's potential questions. If your app uses TLS to communicate with the servers, then that's a bullet point for your security page. If you hash your passwords with pbkdf2, there's another. If you store a backup copy of user credentials on a server hosted with Amazon in zone ...


5

I'd recommend describing some of the measures you use without going into precise detail. Definitely avoid any mentions of semi-snakeoil topics such as "military grade encryption". A statement of PCI compliance would likely provide a level of comfort that you've at least looked at the basics, but might not satisfy very security sensitive customers. To an ...


4

To answer your first question: As far as I know, there is no way to circumvent this. It's a security feature. To answer your second question: Yes, non-default trusted root certs are definitely potentially problematic. They are often abused. They are sometimes used for workplace or traffic monitoring (which is potentially OK if adequately disclosed, ...


3

You can't secure FTP. Remove it and replace with a secure alternative like SFTP if you need file transfer. The way in which you've asked the question implies that you don't have a valid need for it, that it's probably just on by default. Depending on what you're running, 'rpm -e pure-ftpd' or 'dpkg -r pure-ftpd' might do for you.


3

It depends on how they implement it, but the most secure would be to use that with a password. They are probably using a certificate based system which wouldn't be able to be guessed and they are turning the phone in to a "what you have" token that can pass the information to the authentication system when you prove you have it by knocking on it. The exact ...


3

While it sounds odd to someone who is focused only on the technical aspects of hacking into a bank, one reason banks are more secure than many organizations is that they have a comprehensive set of information security policies. These policies guide the organization through many areas that help protect their customers. A good example is a policy that ...


3

Let's debunk a misconception: banks do get hacked, they are just (way) more controlled then the average company. From my experience as a penetration tester, it is not unusual for banks and financial firms to have vulnerable systems, but there are elements that make them harder to succesfully attack. First of all, banks usually respect the minimum privilege ...


2

The critical resource assuring the security of banks is, surprisingly, not technical at all. :) Most importantly, banks maintain large internal security departments staffed with considerable number of security specialists. Banks are more or less the only organizations who are capable of footing the bill for this sort of operation. The rest is rather ...


2

I presume the idea is that if you're sitting in Starbucks, no-one can learn your password by you tapping on your phone (& that you're unlikely to leave you phone down somewhere). See "Shoulder surfing".


2

A bit of background as to what Yubikey is first: Yubikey is a variation on a common type of device known as a One Time Password generator. Basically a mini-computer that generates an essentially unlimited stream of passwords, usually one per minute from a deterministic algorithm embedded in the device. The trick is that next password is predictable if you ...


1

One-factor authentication is no more or less secure than existing methods in itself because the password itself is not the main weakness; The flavor of the moment in security circles is man-in-the-middle. Adding two factor authentication, in use by Google products like Gmail, Outlook online, or RSA tokens was another layer of security, but here's an example ...


1

It is not a bad idea, but the key point here is not just having a separate e-mail but to enforce compartimentalisation of access. Here's a scenario: you have your regular e-mail on @gmail you have your "secure" e-mail on @hotmail (oh well..) you check both e-mail from the same web browser that browser is not up to date, or you stumble upon a 0-day ...


1

There are a few different kind of labs available. There are ones you can construct yourself in VM's such as Vulnhub and they have a lot of links to good resources there. Another site i can recommend with good resources is Pentesterlab, i tend to steer clear of the online sites such as hackme so can't give much as to online but hope these help.


1

FTP is a very old protocol and not recommended anymore today because credentials are transmitted in plaintext which can be read by sniffing the network traffic. If you don't need it you should uninstall it or you can block this port with a firewall. On Linux you could use iptables to block all traffic to this port as follows: iptables -A INPUT -p tcp ...


1

ASP.NET uses something called request validation to prevent stored (and possibly reflected?) XSS attacks. Request validation basically looks for malicious content when requests are submitted. If it finds any it will block the request. By default request validation is enabled, but users can disable it. It should be noted that request validation will not ...


1

I wouldn't do it. Injection attacks have been in the wild for long time, and everyone (in this field) know about them. As I see you are focusing on web applications, my suggestion is to take one of the vulnerabilities in the end positions of the OWASP's ranking, and then research about it.



Only top voted, non community-wiki answers of a minimum length are eligible