Tag Info

Hot answers tagged

40

Using obscure applications is, as my phrasing suggests, a form of security through obscurity. Such reasoning is false, and only leads to a false sense of security. Obscurity is not security. Don't select your security-critical software based on how popular it is or isn't; select it based on the amount of analysis that has gone into the software, how quick ...


38

I used to be a Command Controller (CC) at the Laboratory for Atmospheric and Space Physics (LASP) (http://lasp.colorado.edu/). I was one of the people who would sit in front of the console during the times when spacecraft were visible to the ground stations. I would read/record telemetry to ensure spacecraft health and often send up new commands that would ...


31

MD5 for passwords Using salted md5 for passwords is a bad idea. Not because of MD5's cryptographic weaknesses, but because it's fast. This means that an attacker can try billions of candidate passwords per second on a single GPU. What you should use are deliberately slow hash constructions, such as scrypt, bcrypt and PBKDF2. Simple salted SHA-2 is good not ...


30

From what I can tell, there have only been two serious public vulnerabilities in Steam. Markup injection (XSS) from steam:// links HTTPS man-in-the-middle attack Neither are current. I can't see any real risk. However, since Steam is completely unnecessary at work, it's a minor potential risk that could be avoided. Most likely, he's nit-picking because ...


22

Steam should be treated just like any other application installed on a business computer. Ask yourself if it is needed to perform your job correctly. When your computer has more software install, it has more areas it can be attacked. Steam may not have a vulnerability now, but they may accidental release an update that will have a vulnerability in it. ...


14

Apparently, NASA is taking communication security very seriously (and I would, too, if I had 2G$+ toys to manage !). I think they've done so for a long time, because in the early times of space exploration (in the 1960s) they feared malicious interference from their arch-enemies, the Soviets. (I do not have a reference handy, but my brain cells tell me that ...


13

@Polynomial makes very good points regarding "security through obscurity" and you definitely shouldn't secure yourself based on "obscurity" because it has proven not to work. However, I don't believe that the answer to your question is that simple - I think your question is more of a "risk reduction" question but could be wrong. Quite often in the security ...


13

I agree with @polynomial, this sounds like a scam. Facebook would never call you, there's no such thing as a Facebook tech. Do not pay them any money! It could be that your computer has been infected and that you are getting pop-ups telling you that your computer is infected and you need to call a number to get it fixed, this is also a scam where they sell ...


13

Firewall and antivirus software are two fundamentally different and complementary kinds of security applications. Firewall : Also known as a 'packet filter'. Basically, software which monitors network traffic and connection attempts into and out of a network or computer and determines whether or not to allow it to pass. Depending on the sophistication, ...


12

It depends. If all reasonably functional alternatives are fundamentally prone to programming errors, like it is the case with browsers, it is probably a good idea to use a not-so-popular one. In particular, if your threat model does not include sophisticated adversaries that wait, observe and develop attacks specifically for your setup, using the ...


12

2 - the original BCrypt, which has been deprecated because of a security issue a long time before BCrypt became popular. 2a - the official BCrypt algorithm and a insecure implementation in crypt_blowfish 2x - suggested for hashes created by the insecure algorithm for compatibility 2y - suggested new marker for the fixed crypt_blowfish So 2a hashes created ...


11

It's an affiliate thing. Adobe get paid to promote McAfee's anti-malware software. You have nothing to worry about in terms of security, it's just a marketing trick to get you to buy an AV.


11

There are a lot of free tools out there. You may not find a free tool with the exact same functionality as Burp, but you could use several tools to compensate for the limitations of Burp's free version. use Owasp ZAP or Webscarab for their proxy functionality. use Nikto and W3AF to scan web applications. use SQLMap to exploit SQL injections ...


10

The official site is www.chiark.greenend.org.uk/~sgtatham/putty, you can find the download in the download section. If you want to play it safe, you can verify the signature of the download. In my opinion compiling it from source is as safe as downloading the binary and checking the signature (make sure to also verify the key itself with at least one ...


9

Hardware security modules Running code in a physically-protected chip such as a HSM or a smartcard is not about protecting from software bugs. If there's a software bug in a HSM, it can be exploited just as any webserver, laptop, smartphone, whatever. The difference between a HSM and a PC is that with physical access to a PC, you can just boot from a USB ...


8

There is no cryptography in there. It is all a matter of state. The application can access the system time, also the hardware clock (that's the clock with a battery which keeps time when the computer is off). The application can also look at the modification dates of various files to try to detect foul play with the system clock; and it can measure elapsed ...


7

So if I was you I would start relatively simply with some VMs and a host machine. Personally I use VMWare workstation but other virtualization products are possibilities. If you've got a decent enough machine (e.g. 8GB RAM, Quad-Core Sandy/Ivy bridge, fast disks), I'd recommend keeping the Host OS clear of lab tools or target Apps, as re-building VMs is an ...


6

You should learn to read further before panicking: TrueCrypt 7.0a is a highly secure program for encrypting containers based on the current state of the art in cryptography. We found no back door or security-related mistake in the published source code except for our attack on keyfiles. If you use this program in a secure environment such as Ubuntu privacy ...


6

To complete @CodesInChaos' answer, MD5 is often used because of Tradition, not because of performance. People who deal with databases are not the same people as those who deal with security. They often see no problem in using weak algorithms (e.g. see the joke of an algorithm that MySQL was using for hashing passwords). They use MD5 because they used to use ...


6

Bypassing the activation key checker on any software usually isn't a problem. It's a relatively simple task of reverse engineering the binary and making the necessary modifications. Can a cracked antivirus perform it's job? Yes, most definitely. The problem is that you have no idea what other modifications have been made to the binary in the process of ...


6

File ≠ network An antivirus is working at the file level where a firewall is working at the network protocol level. An antivirus will analyze web pages downloaded (which are local files), and E-mail attachments (which are also local files) to detect if they contain known signatures. A firewall will decide how the protocols 80/tcp or 161/udp (for example) ...


5

There is no absolute, consensual and systematic convention for versioning. Every vendor numbers his successive product versions as he sees fit. I mean, even Microsoft decided that the next version after "2000" was "XP", followed by "Vista", then "7", then "2008". I do not know what logic this follows, but I doubt it is from Earth. Usually, vendors try to ...


5

This will entirely depend on what has been changed in those versions. I would expect that you will have performance fixes, security fixes etc - which would make it a good idea to upgrade - but you may also have new functionality added in, which could add security vulnerabilities. So, read the changelogs for the versions between where you are and the latest ...


5

Steam records game usage, time and other game characteristics. In addition, Steam reports configuration details and all installed applications. So, Steam can be considered as a spyware itself when the configuration or the installed applications are an important strategy key of the company.


5

In addition to the other excellent answers here -- You asked about some of the threats that one must defend against. One possible risk is the possibility that the launch vehicle or spacecraft could be hijacked and retargeted to de-orbit and come back to Earth, hitting some designated location on Earth -- in effect, turning the spacecraft into a ...


5

Stream itself may or may not be a risk, but let's not forget that it installs other programs (games), and those will very likely have security vulnerabilities.


5

No there is no way to future proof the content output of an open source product against mimic software acting as an impostor. By definition, any open source project can be forked to do exactly the thing about which you are concerned. You can (must) address this issue with trust rather than technology. Trust is precisely the opposite of an API. Trust ...


5

I'd suggest that you could use Process Monitor from the sysinternals suite to do this.


5

You probably want to look at two classes of products: Data Leakage Protection (DLP) and intrusion detection systems (IDS). To detect ePHI on a system, you are more or less going to be checking for some common things based upon patterns. For example, in your EMR if you identify patients using a 10 digit code that starts with 4 letters followed by 6 numbers, ...


5

The point of keepass is not to prevent keyloggers. (Granted incidentally it will almost prevent hardware keyloggers; someone inserting a keylogging device between your keyboard and computer will not be able to observe a password you used once via cutting and pasting. It doesn't really succeed in this task though, as an attacker could trivially record your ...



Only top voted, non community-wiki answers of a minimum length are eligible