Tag Info

Hot answers tagged

82

My favorite current resource for cold, hard, real world data is the Verizon 2011 Data Breach Investigations Report. An excerpt from page 69 of the report: Actions The top three threat action categories were Hacking, Malware, and Social. The most common types of hacking actions used were the use of stolen login credentials, exploiting ...


22

The simple answer is no - there is a wide variety of evidence that this type of attack is common. Some of the controls brought in by banks (two factor authentication etc) were in part required to combat the ever more common MITM attacks on customers. While there are other forms of attack (compromise of client is a good one) which may now be easier to carry ...


17

This is a bit old (2006), but may be helpful towards your goal. http://usabilitynews.org/password-security-what-users-know-and-what-they-actually-do/ It is based on a study of 328 undergraduate and graduate level college students from Wichita State University volunteered to participate in the survey, and these students were also regular users of the ...


9

One paper in the literature provides some partial data on this subject [1]. The paper analyzed 9 web applications using two methods: (1) black-box penetration testing, and (2) manual code review by an expert. It compared how many vulnerabilities were found by each. In total, the analysis found a total of 91 vulnerabilities. 39 of them (43%) were found by ...


9

The recent compromise of certificate authority DigiNotar resulted in the issuance of over 500 fake certificates for google.com, microsoft.com, cia.gov, and hundreds of other sites. These certificates somehow made their way into 40 different Iranian ISPs, resulting in a massive man-in-the-middle attack, confirmed to have affected over 300,000 Iranian users ...


8

During the AES competition, the organizing body (the NIST) went to the trouble of running extensive statistical testings on the output of the 15 submitted block ciphers, with what was believed to be the gold standard of such tests, the Diehard tests. They found nothing, of course. Comments from cryptographers at that time were that these tests were a bit ...


7

The most recent study I've seen was back in 2008 by the Web Application Security Consortium [webappsec.org]. The study was compiled from the results of eight separate security assessment projects and had a total sample size of 12186 web applications made up from various industries. The study makes for a very interesting read, but I'll summarize a few of the ...


7

Unless you shield your building completely, there is no way to determine if the signal is coming from in the room or from outside without triangulating the signal and there isn't a guaranteed way to force the phones to connect to your device instead of the actual cell tower. Depending on jurisdiction, this may or may not even be legal since it could cause ...


5

This answer is mostly about Chris Dixon's statement more than answering "How many attacks are coming from MiTM". If we assert the different way one could possibly become MiTM and the given consequences I think we can make up some conclusions of whether or not we care how prevalent MiTM attacks is. If we look at some risks for the different situations we ...


4

Well, obviously any estimate is going to fairly hand-wavy, since if we knew the existence of all bugs and could enumerate them, then the bugs probably wouldn't have shipped. So these bug counts are based on bugs found after the fact. Scrutinized software will naturally have proportionally more of its bugs discovered than rarely used software, so our ...


4

Any number you get is going to be fairly meaningless -- some factors to consider: Programming Language - Some languages let you do very unsafe things; e.g., C makes you directly allocate memory, do pointer arithmetic, has null terminated strings, so introduces many potential security flaws that safer (but slightly slower) languages like ruby/python do not ...


3

I happen to collect these type of statistics when I find them mentioned in a study or paper. Here are some recent figures: - 54% 1 to 5 - 28% 6 to 10 - 7% 11 to 15 - 5% 16 to 20 - 6% 20+ Source: CSID Consumer Survey: Password Habits, Sept 2012 Total average minimum number of private passwords = 17 Total average minimum number of work ...


3

Realistically speaking at the moment there aren't a lot of public attacks on web servers (e.g. IIS/Apache/NGINX) themselves (assuming that you're using the latest version of course). The web applications running on top of the servers are far more likely to be the point of attack. As to statistics for that I'm afraid it's massively variable, as the variety ...


3

WhiteHat Security's 2011 annual report has some detailed statistics on the web sites they monitor, and what fraction of them are vulnerable. Here are some highlights: 84% of web sites were vulnerable for at least 30 days out of 2010. (In other words, count the number days in 2010 when the web site had at least one serious vulnerability. For 84% of web ...


3

The Verizon Data Breaches report is useful here ( http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf) I can't view it right now but I seem to recall that the top routes in were social engineering, flash, document macros and pdf functionality. Very few these days are in the OS.


2

It did not find any static or white paper that includes the real world data you wanted to have. However, I would like to add that MitM attacks within companies happens daily and more than once. Several security vendors have solutions to scan encrypted traffic (for example, Palo Alto Networks) and at least the company I currently work for has activated this ...


2

Veracode released some data on the web applications they've analyzed. Here are some highlights. On compliance with OWASP standards, which say that your application should not have any vulnerability in the OWASP top 10 (see Figure 24): 16% of government web applications have no detected vulnerability in the OWASP top 10 24% of finance industry web ...


2

Likely helpful: Verizon's Data Breach Investigations Reports Trustwave's Global Security Reports Mandiant's M-Trends


2

The likelihood of it being hacked is directly proportional to the amount of care and skill you demonstrate in your management of said server. If you turn off unnecessary services, patch regularly, chose strong passwords, run secure web applications and configure them well, the likelihood goes down. The more of these items you neglect, and the likelihood ...


2

As @aviv pointed out, revealing to a user that some other user also has the same password is a problem. If you really intend to maintain such statistics, then you have another inherent problem: the "statistics engine" can only help any attacker, since it outputs a list of passwords that are in use. Even a reduced form which merely says "this password is ...


2

I dont think you want to do that at all... you will be giving hints about other user's passwords. If I get the message that 1 other user is using my password - now I have valuable information. I might even know or guess who that user is if I have some prior knowledge on him


1

First, it is important to realize that when using the term "virus" you are speaking about a specific family of malware. Symantec defines a virus as Virus is a program written to enter to your computer and damage/alter your files/data... Viruses can also replicate themselves Viruses also have several subgroups, such as a file virus, boot sector ...


1

Statistics of this kind would be very difficult to gather unless there was clear and verifiable evidence of a creation date within the sample itself. That is unlikely for a variety of reasons, such as the fact that the vast majority of malware is a minor variation of a similar group or family. The only other way I can think of to "start the clock" would be ...


1

http://datalossdb.org/statistics - truly opensource and not marketing-driven data.



Only top voted, non community-wiki answers of a minimum length are eligible