Tag Info

Hot answers tagged

5

If the attacker knows for sure that the (character space size) ^ (password length) is greater than 2 ^ (AES key length), then, yes, it's a better idea for the attacker to brute-force the AES key. Given such an assumption of the attacker's knowledge, it's a mathematical fact that the search size for the AES key will be smaller. Such an assumption of attacker ...


4

A lot of analysis tools look for known data structures (i.e., patterns) in memory that indicate a particular type of information. For instance, malloc'd memory has header (and sometimes trailer) data that point forward and backward in memory to adjacent memory. Free'd memory pointers can jump around in memory if they aren't consolidated/coalesced. Windows ...


3

In fact, the sudo and su programs are not parts of either security model for several reasons. Protection rings are referring to the memory/CPU access permissions and in the user-space the only access is to files. Capabilities refer to process permissions and as independent programs they are a separate process than the caller and do not inherit or give away ...


2

Whether traditional "protections" for sensitive data in desktop RAM (e.g. SecureString) are really needed or not, is debatable. When attackers can read the RAM contents, they already have a lot of control on the machine. We can still justify some proactive measures in the following sense: RAM in a machine may leak to disk, through virtual memory. The ...


2

The issue is that cybersecurity is not limited to vulnerabilities in software, which is what you seem to be focused on. Yes, software vulnerabilities are a big part of it, but there's much, much more. For example, take cryptography, the mathematical algorithms we depend on to secure nearly all sensitive information. In order for AI to do the work of humans, ...


2

Your question assumes that "Security" is limited to technical vulnerabilities. It is not. People are the biggest issue in "Security", and they are not going to go away ....


2

I'm gonna try to answer you separately: Access Control Matrix Q: "Could you say that in this matrix, the right r of S1 over O1 is leaked to S2 (because S2 can use S1 to access O1)?" A: No. If you consider the execution right to behave like a take right, then yes, S1's reading rights over O1 have leaked to S2, because originally S2 had no rights over O1. ...


1

According to this and Wikipedia, the OSI Session Layer is responsible for setting up any kind of conversation/dialogue. As ISAKMP runs on top of UDP (port 500) and it sets up a secure and authenticated channel for communication, i would say that it is part of OSI Session Layer.


1

In capability-based security, programs follow the principle of least privilege as stated on Wikipedia. This means that each program has almost no permissions to begin with and permissions are then granted for only the parts that the program needs. This is generally done on a much higher level than hierarchical protection domains. In hierarchical protection ...



Only top voted, non community-wiki answers of a minimum length are eligible