Tag Info

Hot answers tagged

90

My favorite current resource for cold, hard, real world data is the Verizon 2011 Data Breach Investigations Report. An excerpt from page 69 of the report: Actions The top three threat action categories were Hacking, Malware, and Social. The most common types of hacking actions used were the use of stolen login credentials, exploiting ...


24

The simple answer is no - there is a wide variety of evidence that this type of attack is common. Some of the controls brought in by banks (two factor authentication etc) were in part required to combat the ever more common MITM attacks on customers. While there are other forms of attack (compromise of client is a good one) which may now be easier to carry ...


18

This is a bit old (2006), but may be helpful towards your goal. http://usabilitynews.org/password-security-what-users-know-and-what-they-actually-do/ It is based on a study of 328 undergraduate and graduate level college students from Wichita State University volunteered to participate in the survey, and these students were also regular users of the ...


12

The recent compromise of certificate authority DigiNotar resulted in the issuance of over 500 fake certificates for google.com, microsoft.com, cia.gov, and hundreds of other sites. These certificates somehow made their way into 40 different Iranian ISPs, resulting in a massive man-in-the-middle attack, confirmed to have affected over 300,000 Iranian users ...


9

One paper in the literature provides some partial data on this subject [1]. The paper analyzed 9 web applications using two methods: (1) black-box penetration testing, and (2) manual code review by an expert. It compared how many vulnerabilities were found by each. In total, the analysis found a total of 91 vulnerabilities. 39 of them (43%) were found by ...


8

During the AES competition, the organizing body (the NIST) went to the trouble of running extensive statistical testings on the output of the 15 submitted block ciphers, with what was believed to be the gold standard of such tests, the Diehard tests. They found nothing, of course. Comments from cryptographers at that time were that these tests were a bit ...


7

The most recent study I've seen was back in 2008 by the Web Application Security Consortium [webappsec.org]. The study was compiled from the results of eight separate security assessment projects and had a total sample size of 12186 web applications made up from various industries. The study makes for a very interesting read, but I'll summarize a few of the ...


7

Unless you shield your building completely, there is no way to determine if the signal is coming from in the room or from outside without triangulating the signal and there isn't a guaranteed way to force the phones to connect to your device instead of the actual cell tower. Depending on jurisdiction, this may or may not even be legal since it could cause ...


7

If you're storing passwords properly, i.e. with PBKDF2/BCrypt/SCrypt, then as the user is changing their password you can spend the time to hash it with other user's salts (which are, of course, cryptographically random and unique per user), and if you find a match in the first N, then tell the user no. If you wanted, you could check every user, but that ...


6

The only practical ways to do that are to use the same salt for hashing all passwords (bad) or to store the passwords in plain text or reversible encryption (very, extremely bad.) Since those approaches are big and bigger security problems, I'd guess Google isn't doing either of them. What they might be doing is disalllowing the 1,000 or so most common ...


6

Any number you get is going to be fairly meaningless -- some factors to consider: Programming Language - Some languages let you do very unsafe things; e.g., C makes you directly allocate memory, do pointer arithmetic, has null terminated strings, so introduces many potential security flaws that safer (but slightly slower) languages like ruby/python do not ...


5

Likely helpful: Verizon's Data Breach Investigations Reports Trustwave's Global Security Reports Mandiant's M-Trends


5

This answer is mostly about Chris Dixon's statement more than answering "How many attacks are coming from MiTM". If we assert the different way one could possibly become MiTM and the given consequences I think we can make up some conclusions of whether or not we care how prevalent MiTM attacks is. If we look at some risks for the different situations we ...


4

Well, obviously any estimate is going to fairly hand-wavy, since if we knew the existence of all bugs and could enumerate them, then the bugs probably wouldn't have shipped. So these bug counts are based on bugs found after the fact. Scrutinized software will naturally have proportionally more of its bugs discovered than rarely used software, so our ...


4

I happen to collect these type of statistics when I find them mentioned in a study or paper. Here are some recent figures: - 54% 1 to 5 - 28% 6 to 10 - 7% 11 to 15 - 5% 16 to 20 - 6% 20+ Source: CSID Consumer Survey: Password Habits, Sept 2012 Total average minimum number of private passwords = 17 Total average minimum number of work ...


3

SSLPulse, a monthly scan of SSL amongst the 200,000 biggest websites, has statistics on SSL 3.0 support: https://www.trustworthyinternet.org/ssl-pulse/ They publish at the beginning of each month, so any day now there should be new data. Already you can see SSL 3.0 support dropped from 98% to 60% from October to November. (You can use the "Previous" and ...


3

As @aviv pointed out, revealing to a user that some other user also has the same password is a problem. If you really intend to maintain such statistics, then you have another inherent problem: the "statistics engine" can only help any attacker, since it outputs a list of passwords that are in use. Even a reduced form which merely says "this password is ...


3

WhiteHat Security's 2011 annual report has some detailed statistics on the web sites they monitor, and what fraction of them are vulnerable. Here are some highlights: 84% of web sites were vulnerable for at least 30 days out of 2010. (In other words, count the number days in 2010 when the web site had at least one serious vulnerability. For 84% of web ...


3

The Verizon Data Breaches report is useful here ( http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf) I can't view it right now but I seem to recall that the top routes in were social engineering, flash, document macros and pdf functionality. Very few these days are in the OS.


3

Realistically speaking at the moment there aren't a lot of public attacks on web servers (e.g. IIS/Apache/NGINX) themselves (assuming that you're using the latest version of course). The web applications running on top of the servers are far more likely to be the point of attack. As to statistics for that I'm afraid it's massively variable, as the variety ...


2

The likelihood of it being hacked is directly proportional to the amount of care and skill you demonstrate in your management of said server. If you turn off unnecessary services, patch regularly, chose strong passwords, run secure web applications and configure them well, the likelihood goes down. The more of these items you neglect, and the likelihood ...


2

http://datalossdb.org/statistics - truly opensource and not marketing-driven data.


2

It did not find any static or white paper that includes the real world data you wanted to have. However, I would like to add that MitM attacks within companies happens daily and more than once. Several security vendors have solutions to scan encrypted traffic (for example, Palo Alto Networks) and at least the company I currently work for has activated this ...


2

Veracode released some data on the web applications they've analyzed. Here are some highlights. On compliance with OWASP standards, which say that your application should not have any vulnerability in the OWASP top 10 (see Figure 24): 16% of government web applications have no detected vulnerability in the OWASP top 10 24% of finance industry web ...


2

I dont think you want to do that at all... you will be giving hints about other user's passwords. If I get the message that 1 other user is using my password - now I have valuable information. I might even know or guess who that user is if I have some prior knowledge on him


2

Key List of Resources (2015) Industry Forecast Data Breach Industry Forecast by Experian Industry Survey Global Industry Information Security Survey by PWC Security Personnel Survey by Kaspersky Statistics & Reports Data Breach Statistics by IBM Data Breach Investigation Reports by Verizon Data Breach Statistics and summary by ITRC Security ...


2

Following your comments, it seems strange you got duplicates if you are actually using /dev/urandom as entropy source and sufficiently long session IDs. Are you sure that PHP is correctly configured? As of PHP 5.4.0, PHP defaults are now secured, but it happens that some historical server settings remains over time and decrease the security compared to ...


1

I'll add to this as I check for relevancy. FireEye + Mandiant Advanced Threat Report (2015): key findings (press release) CrowdStrike Global Threat Intel Report (Feb-2015). Numbers are sparse but charts are estimable. Intelligence reports and data in the adversary lineup section of the site are over these adversaries and target industries. Palo Alto ...


1

First, it is important to realize that when using the term "virus" you are speaking about a specific family of malware. Symantec defines a virus as Virus is a program written to enter to your computer and damage/alter your files/data... Viruses can also replicate themselves Viruses also have several subgroups, such as a file virus, boot sector ...


1

Statistics of this kind would be very difficult to gather unless there was clear and verifiable evidence of a creation date within the sample itself. That is unlikely for a variety of reasons, such as the fact that the vast majority of malware is a minor variation of a similar group or family. The only other way I can think of to "start the clock" would be ...



Only top voted, non community-wiki answers of a minimum length are eligible