Tag Info

Hot answers tagged

66

The important thing is maintenance. Regardless of whether you reused existing code or wrote your own, you will achieve decent security only if there is someone, somewhere, who understands the code and is able to keep it afloat with regards to, say, evolution of compilers and platforms. Having code without bugs is best, but in practice you must rely on the ...


40

Using obscure applications is, as my phrasing suggests, a form of security through obscurity. Such reasoning is false, and only leads to a false sense of security. Obscurity is not security. Don't select your security-critical software based on how popular it is or isn't; select it based on the amount of analysis that has gone into the software, how quick ...


39

I used to be a Command Controller (CC) at the Laboratory for Atmospheric and Space Physics (LASP) (http://lasp.colorado.edu/). I was one of the people who would sit in front of the console during the times when spacecraft were visible to the ground stations. I would read/record telemetry to ensure spacecraft health and often send up new commands that would ...


38

Even more so. Security code is tricky. Cryptography code is downright hard, even if you are a trained cryptographer - and impossible to get right, if you are not. If there are so many critical bugs in so many big important software packages and companies - what makes you think* you would be able to do a better job? * Unless of course this is your ...


32

MD5 for passwords Using salted md5 for passwords is a bad idea. Not because of MD5's cryptographic weaknesses, but because it's fast. This means that an attacker can try billions of candidate passwords per second on a single GPU. What you should use are deliberately slow hash constructions, such as scrypt, bcrypt and PBKDF2. Simple salted SHA-2 is good not ...


32

From what I can tell, there have only been two serious public vulnerabilities in Steam. Markup injection (XSS) from steam:// links HTTPS man-in-the-middle attack Neither are current. I can't see any real risk. However, since Steam is completely unnecessary at work, it's a minor potential risk that could be avoided. Most likely, he's nit-picking because ...


23

Steam should be treated just like any other application installed on a business computer. Ask yourself if it is needed to perform your job correctly. When your computer has more software install, it has more areas it can be attacked. Steam may not have a vulnerability now, but they may accidental release an update that will have a vulnerability in it. ...


15

Interesting question! I'd like to answer it more from probability standpoint, than from Best Current Practices standpoint. While Thomas and others provide great answers, I do not think they touch on the core question - which is "is unique (or less used) code more resilient in practice than popular code". Note that I've deliberately not used "more secure ...


14

Apparently, NASA is taking communication security very seriously (and I would, too, if I had 2G$+ toys to manage !). I think they've done so for a long time, because in the early times of space exploration (in the 1960s) they feared malicious interference from their arch-enemies, the Soviets. (I do not have a reference handy, but my brain cells tell me that ...


13

@Polynomial makes very good points regarding "security through obscurity" and you definitely shouldn't secure yourself based on "obscurity" because it has proven not to work. However, I don't believe that the answer to your question is that simple - I think your question is more of a "risk reduction" question but could be wrong. Quite often in the security ...


13

I agree with @polynomial, this sounds like a scam. Facebook would never call you, there's no such thing as a Facebook tech. Do not pay them any money! It could be that your computer has been infected and that you are getting pop-ups telling you that your computer is infected and you need to call a number to get it fixed, this is also a scam where they sell ...


13

Firewall and antivirus software are two fundamentally different and complementary kinds of security applications. Firewall : Also known as a 'packet filter'. Basically, software which monitors network traffic and connection attempts into and out of a network or computer and determines whether or not to allow it to pass. Depending on the sophistication, ...


12

It depends. If all reasonably functional alternatives are fundamentally prone to programming errors, like it is the case with browsers, it is probably a good idea to use a not-so-popular one. In particular, if your threat model does not include sophisticated adversaries that wait, observe and develop attacks specifically for your setup, using the ...


12

2 - the original BCrypt, which has been deprecated because of a security issue a long time before BCrypt became popular. 2a - the official BCrypt algorithm and a insecure implementation in crypt_blowfish 2x - suggested for hashes created by the insecure algorithm for compatibility 2y - suggested new marker for the fixed crypt_blowfish So 2a hashes created ...


12

There are a lot of free tools out there. You may not find a free tool with the exact same functionality as Burp, but you could use several tools to compensate for the limitations of Burp's free version. use Owasp ZAP or Webscarab for their proxy functionality. use Nikto and W3AF to scan web applications. use SQLMap to exploit SQL injections ...


12

The simple answer is: don't roll your own security. There are two parts to this. Algorithm and implementation. As for the algorithm, creating your own encryption algorithm is horrendous. Even if you are versed in the field of cryptography, you still aren't in a position to create a new algorithm. Unless you have a team of experts in the field working on ...


11

It's an affiliate thing. Adobe get paid to promote McAfee's anti-malware software. You have nothing to worry about in terms of security, it's just a marketing trick to get you to buy an AV.


11

The official site is www.chiark.greenend.org.uk/~sgtatham/putty, you can find the download in the download section. If you want to play it safe, you can verify the signature of the download. In my opinion compiling it from source is as safe as downloading the binary and checking the signature (make sure to also verify the key itself with at least one ...


9

Hardware security modules Running code in a physically-protected chip such as a HSM or a smartcard is not about protecting from software bugs. If there's a software bug in a HSM, it can be exploited just as any webserver, laptop, smartphone, whatever. The difference between a HSM and a PC is that with physical access to a PC, you can just boot from a USB ...


8

There is no cryptography in there. It is all a matter of state. The application can access the system time, also the hardware clock (that's the clock with a battery which keeps time when the computer is off). The application can also look at the modification dates of various files to try to detect foul play with the system clock; and it can measure elapsed ...


7

There is no absolute, consensual and systematic convention for versioning. Every vendor numbers his successive product versions as he sees fit. I mean, even Microsoft decided that the next version after "2000" was "XP", followed by "Vista", then "7", then "2008". I do not know what logic this follows, but I doubt it is from Earth. Usually, vendors try to ...


7

Bypassing the activation key checker on any software usually isn't a problem. It's a relatively simple task of reverse engineering the binary and making the necessary modifications. Can a cracked antivirus perform it's job? Yes, most definitely. The problem is that you have no idea what other modifications have been made to the binary in the process of ...


7

So if I was you I would start relatively simply with some VMs and a host machine. Personally I use VMWare workstation but other virtualization products are possibilities. If you've got a decent enough machine (e.g. 8GB RAM, Quad-Core Sandy/Ivy bridge, fast disks), I'd recommend keeping the Host OS clear of lab tools or target Apps, as re-building VMs is an ...


7

File ≠ network An antivirus is working at the file level where a firewall is working at the network protocol level. An antivirus will analyze web pages downloaded (which are local files), and E-mail attachments (which are also local files) to detect if they contain known signatures. A firewall will decide how the protocols 80/tcp or 161/udp (for example) ...


6

This will entirely depend on what has been changed in those versions. I would expect that you will have performance fixes, security fixes etc - which would make it a good idea to upgrade - but you may also have new functionality added in, which could add security vulnerabilities. So, read the changelogs for the versions between where you are and the latest ...


6

You should learn to read further before panicking: TrueCrypt 7.0a is a highly secure program for encrypting containers based on the current state of the art in cryptography. We found no back door or security-related mistake in the published source code except for our attack on keyfiles. If you use this program in a secure environment such as Ubuntu privacy ...


6

To complete @CodesInChaos' answer, MD5 is often used because of Tradition, not because of performance. People who deal with databases are not the same people as those who deal with security. They often see no problem in using weak algorithms (e.g. see the joke of an algorithm that MySQL was using for hashing passwords). They use MD5 because they used to use ...


6

An antivirus will usually recognize a file's binary signature (roughly speaking, "it contains a byte sequence that's typical of XYZ virus"). For greater protection, many antiviruses are able to check system operation and block suspicious activity patterns (e.g., "this process is trying to write to a system file!"). A firewall could be considered a ...


5

Any number you get is going to be fairly meaningless -- some factors to consider: Programming Language - Some languages let you do very unsafe things; e.g., C makes you directly allocate memory, do pointer arithmetic, has null terminated strings, so introduces many potential security flaws that safer (but slightly slower) languages like ruby/python do not ...


5

Steam records game usage, time and other game characteristics. In addition, Steam reports configuration details and all installed applications. So, Steam can be considered as a spyware itself when the configuration or the installed applications are an important strategy key of the company.



Only top voted, non community-wiki answers of a minimum length are eligible