Hot answers tagged security-theater
15
Since raw emails are not encrypted, what you can read in an email could have (conceptually) been read by anybody. However, to read the email, the attacker would still have to connect to the HTTPS server, which leaves tracks (the IP from which the attacker connects will be known to that server -- of course, that IP will probably be that of a Tor exit node). ...
10
I don't rate their security particularly high; but they are more than just security theater. They potentially can make the job of the attacker more difficult and the job of a security forensic experts tracking down anomolies easier.
Let's say there is no security image/phrase or equivalent. Then an man-in-the-middle attacker can construct a fake version ...
10
I'd like to add this to what The Bear has already said
This method adds almost no security at all. Why?
Exposing the email with the link = Exposing the real message
This is almost the same as sending the text in the same email used to send the link. Then why are they doing this? You might ask. Here are some possible reasons:
Delivery and reading ...
10
One area where ZIP files could present a risk to the application the zip bomb attack. this occurs where an archive is constructed in such a way that when it's opened it consumes a large quantity of space on the server potentially causing it to crash.
It might be possible to mitigate this issue by opening zip files on a dedicated filesystem and then ...
8
The biggest risk in any language is to have developers who do not master the said language. Secure development requires thinking of all "corner cases" and it does not work unless the developer knows what he does at all points. A competent C programmer who does not know Java will do more secure code in C than in Java (and vice versa).
A case can be made that ...
7
Great question! As it happens, I can present experimental data on this question -- and the data is fascinating. (I noticed that some of the answers contain speculation from first principles about how much security these security images offer. However, the data turns out to have some surprises for all of us!)
Experimental methodology.
"Security images" ...
7
Self protection:
What you list in your answer sounds pretty good. About my only thought would be to change your long ranty fake security question answers to truly fake answers. Either sentences or more pseudo-random characters. But assuming you get somewhere with trying to change the system, I don't think you want those in there when some guy who is ...
7
The problem with a zip is that you aren't really sure what's inside of them. You would need to unzip the contents, scan for virusses and then you know that there aren't any known virusses in them.
Second of all, when fileuploads are in use, you can only allow a certain amount of file extensions (white list rather than blacklist) and you need to verify that ...
6
One this that hasn't yet been mentioned is that this approach can improve security from a different angle: rather than addressing privacy concerns (which it clearly doesn't), it definitely helps in establishing verifiability.
Anyone can send an email and forge the headers to make it appear to have come from your vendor, but (presuming their systems are ...
6
There are no security threat. At least not any that are specific to zip files.
The major concerns have already been outlined by other users. However, all of these are either not harmful to the application itself or not specific to zip files.
Zip Bomb attacks, as described by Rory McCune. These are only a concern if the files will be unpacked.
Inclusion ...
5
Account for poor backend security
If they're storing your password in plaintext (which is more than reasonable to suspect) then there's really nothing you can do about that. But what you can do is limit the amount of exposure to yourself that a security breach would cause. To the extent that their poor security isn't your problem, you don't really have to ...
5
Legally speaking, a corporation is one of the best "liability shields" you can have. It is its own entity that is, for most purposes, the entity that the rest of the world is interacting with when they interact with anyone empowered to represent it and make decisions on its behalf. It, and not its agents, bears the full brunt of any legal liability for ...
4
The OWASP top ten is an important list to get under control, but it is necessarily a little vague and make be difficult to translate the generalized best-practices into coding suggestions.
A good rule to keep in mind is always assume your input is malicious, no matter where it comes from, as it can be difficult to imagine just how malicious input can be ...
4
There are a bunch of potential ways for an attacker on your network to break into it:
Bruteforce the password.
Sniff traffic on the network, wait for you to log in via HTTP (not HTTPS) and steal the login details.
Use ARP spoofing (a.k.a. poison routing) to perform a man-in-the-middle attack and steal credentials that way.
Run sslstrip to perform an SSL ...
4
This is exactly what you want, I googled: only allow root ssh lan
First hit...
http://drsavoye.blogspot.com/2010/06/enable-root-login-from-lan-only.html
On Linux, edit /etc/ssh/sshd_config. On Macs, edit /etc/sshd_config.
Locate the line that defines PermitRootLogin, uncomment if it is
commented out, and change its value to yes.
On a separate ...
4
The problem the sender of the email is trying to solve is data in transit and data at rest, specifically, a copy of their email and the path it takes to get to it's destination. When you log into one of these "secure" solutions, Tumbleweed is an example, you are simply logging into a server on the sender's network. The data never left the sender's network ...
3
What I have done in the past when porting something between languages or working on something that will need to work really closely with a different language is to look up specific language issues on the OWASP website.
C / C++ is: https://www.owasp.org/index.php/Category:C
Java is: https://www.owasp.org/index.php/Category:Java
Hopefully that helps as a ...
3
In the general case I would agree with you that cloud services are no more inherently risky than e-mail providers. Any time you store data with a 3rd party there are security risks, especially if you're using a consumer grade service which doesn't have things like contracts in place where you can specify security/audit requirements.
I'd say that there's a ...
3
One trick I've seen before is a single-use download link. If you visit the link, you cannot download the file after the first attempt. If you get there and the file has already been downloaded before you try it, then you have detected a compromise. Hopefully this site records the address and time of downloaders at a minimum.
3
If this is the case, security images seem to provide no additional security,
Instead of pulling a static copy of the login page, now the phishers have to make a page capable of interacting with the original website.
An extreme hypothesis is that they are extremely dumb, and will retrieve the custom images with their own IP, or an IP that can be linked ...
3
A RAT generally consists of two programs: A client and a server.
The server is the program that's intended to be executed on the victim, the client is the program that is used to control the server.
In order to infect the victim, it must be executed somehow. It could be either exploiting some known vulnerability that allows code to be executed from an ...
2
I can't see how a javascript can run the malicious code and automatic install the RAT into our/visitors PC and gaining access to their PC.
Javascript in and of itself cannot - the implementation of javascript usually has very, very limited access to the local system by design. That's assuming all works as designed.
Software systems rarely do; the ...
2
This is too broad to answer fully, but I'd start with everything on the OWASP Top Ten. Then I'd go on and review the entire OWASP web site, and move on to the SANS institute's top 25
After you've read those and have a baseline understanding of all the web application threats and vulnerabilities, THEN start Googling "Secure PHP Coding". This was the first ...
2
I would suggest that without knowing the entire flow, it shouldn't just be assumed that this is security theater; however, it is also entirely possible that it is. If you want to confirm that these are actually secure in the way your company intended, ask your infrastructure team if anything goes on behind the scenes.
The term “secure” could be being used ...
2
Nope. It makes absolutely zero improvement in security and disables a normally useful feature.
As you're probably well aware, there's a number of shortcuts that work to do all the things you've mentioned like F2 to rename files, Ctrl+C for copy, Ctrl+v for paste.
It does absolutely nothing to prevent keyloggers, screen cappers, viruses/malware etc. To ...
1
As cen commented, this, like so many security decisions, depends entirely on what you want to protect.
Many organisations keep their mail in house (although anything that needs to travel to a recipient elsewhere has to travel across systems you don't control... )
You need to weigh up your risk appetite and decide what can and what can't be outsourced ...
1
it seems to me that you are facing more of an encoding issue rather than a security one. windows uses CRLF, unix uses LF, mac uses CR. encoding may affect these behaviors. is the dedicated server has the same configuration as the 2 other boxes? you may need to compare.
also you may probably had the need to check your editor and the encoding of your source ...
1
OSPF is a routing protocol in which the various routers involved in the process periodically shout: they broadcast "Link State Advertisements" which tell the other routers how things look like in their own vicinity. The fight-back mechanism is the following: when a router observes a LSA which states falsehoods about itself, the router is allowed (and ...
1
Almost there. The fallout from the News International "phone hacking" case is going to produce prosecutions. There is an interesting case where during the investigation; a lot of the evidence was rapidly deleted. Whether any of the convictions result in jail time, we don't know.
Watch this space.
1
I would challenge that using most third party SAAS data storage services are MORE secure than e-mail. Some of them even use encryption on the communication to prevent unauthorized access to the data in transit. E-mail on the other hand offers no such protection in most cases. I think you are running in to the "security concern" of "I don't like it, it is ...
Only top voted, non community-wiki answers of a minimum length are eligible
