Hot answers tagged threat-mitigation
24
Imagine a shopping mall. By definition, anybody can enter the mall and then browse the shops. It is public. The shops are expecting people to come by, look at the displays, maybe enter and then buy things.
In the mall, there is a shopkeeper, who sells, say, computers. Let's call him Jim. He wants people to come by and see the computers and be enticed into ...
15
No, it is not possible, in theory or practice. A well enough distributed DDoS attack is indistinguishable from legitimate traffic.
Consider the "slashdot" or "reddit" or "digg" effects, where actual legitimate traffic takes down network services on the target website. Simply posting a link to the target website on slashdot is an effective DDoS in many ...
12
There was a presentation at BlackHat yesterday where they used a Arduino to open hotel rooms that are using a certain kind of lock: http://www.h-online.com/security/news/item/Arduino-used-as-master-key-for-hotel-rooms-1652281.html
As devices get smaller and more powerful, that are getting better suited to be used as pentesting drop boxes. Examples are:
...
12
A router misbehaving and trying to act as a fake server with regards to the client, and a fake client with regards to the true server, forwarding data in both directions, is the exact definition of a man-in-the-middle attack. Apart from routers (which act at the IP level), classic practical methods for MitM include:
hijacking a HTTP proxy
subverting the ...
11
Introduction
I'll try to the best of my knowledge to approach your questions without touching the technical parts of the Bluetooth technology itself. I've learned a lot of the following while I had to write a security report to shape a BYOD policy. Knowing you, I won't have to lecture you on that there's nothing 100% secure, everything we do is just to make ...
10
The basics
First, I assume you get the most basic session ID security right:
you are using an ID with sufficient entropy, and
you use transport level security (HTTPS).
Any approach to session ID (URL, cookies, whatever) that does not get those right has is vulnerable, your question is specifically about ID in URL, so I will not discuss that further.
...
9
Despite what others are saying, yes you can.
Many major corporates have very effective solutions, and even the recent Spamhaus battle, which used DNS DDoS at a scale that hasn't been seen previously was covered rapidly once CloudFlare were brought on board.
The solutions I have tested are very effective at transferring DDoS traffic, even when it is a ...
8
Short answer. The benefit is from an unpredictable serial number, not from any old serial number.
Indeed, a sequential serial number adds no security, as it is easily predictable. But randomizing the serial number (so it is hard to predict) does make it harder to exploit the known collision attacks on MD5 to get a forged certificate. Let me explain.
...
7
As a rule, the returns on this type of defense are nearly zero. There are exceptions, but even then this technique may offer only a small amount of security.
Exhaustive vulnerability scans of randomly-chosen hosts offer extremely low returns on scanning resources. Instead, successful attackers generally choose one of the following two options to increase ...
7
This answer may be incomplete or incorrect as my knowledge on the topic is limited, but my understanding of Bluetooth is that it is a fairly loose stack on which different protocols (called profiles) can be developed. A lot of the particulars of security are going to depend on the particular Bluetooth stack and profile that you have on your hardware.
...
6
Device security is limited to the type of device.
What are the security risks of Bluetooth and what technologies and
best practices should be used to protect my device?
Each device provides a level of services. The services provided create the restrictions or limitations to access and exploit. The best protection is to keep Bluetooth turned off (if ...
6
Well, you can scale infrastructure to make it more difficult for a botnet to keep up enough traffic to disable the service, but ultimately, the only counter if a DDoS is using otherwise legit traffic to cause issues, all you can do is increase your bandwidth to be higher than theirs. If you can identify a source as rogue, then you can try to block the ...
5
The first GPU-assisted malware is considered to be the Badminer trojan reported by Semantec in 2011. Although its GPU leverage level is pretty low and the risk is low too, this is still the first precedence of using the GPU maliciously in the wild.
Another more intrusive example of the same idea is RiskTool.Win32.BitCoinMiner.
Then antivirus designers ...
5
Your organisation might want to subscribe to Java for Business:
With the announcement of Java for Business customers and partners running Java applications on older release families (1.4, 5.0, 6) now have a choice of either migrating to a newer release or subscribing to Java for Business to continue receiving critical reliability, availability and ...
5
The article you quote applies their latency system on SYN packets, the first step of a TCP handshake. For the attacker, SYN flood attacks are attractive because they work well with IP spoofing: since the attacker does not need to see the response packets from the server (the SYN+ACK), then the attacker can use a fake source address, and thus remain "hidden". ...
4
In SRP, the server stores a password-derived token, which can be used to guess the password in an offline dictionary attack (attackers tries potential passwords until a match is found). This is not a flaw of SRP: the server necessarily contains some similar password-derived data, regardless of the used authentication protocol. The magic of SRP is that no ...
4
Just to add on other answers too. Such devices make it relatively cheap to build a sensor network. Granted it is not a general sensor network in that it cannot sense stuff outside WiFi, Ethernet and Bluetooth, but it is a sensor network. So imagine where (and why) you want a sensor for and imagine deploying such a network in a whole building, or even cars, ...
4
Microsoft SDL v5 is pretty decent and you have to full paper explaining the whole process that can be downloaded from MSKB: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=12285
If you need to get just a general grasp of the process, you can read a short and solid intro @ TechSurface: ...
4
Unfortunately I think you already answered your question with the "fixing SELinux basically involves turning it off" comment. It is hard work.
In an ideal world specific requirements for access etc. would be detailed and any application would be coded to enforce MAC or other control paradigm, however in the real world the following issues arise:
...
4
It sounds like you are mostly moving the problem around. The CI server used to have the credentials to push new installs to the Heroku server, now it's the deploy server.
So the big question from me is - what is the difference in security between the CI service and the deploy server? Is one hosted externally? Is there a reason you trust one more than ...
4
Many phones allow you charge with only power and ground connected. Some phones (looking at you, Apple) use the data lines to determine whether or not the charger is "permitted" to charge your phone. Other phones still (some Android phones in particular) explicitly ask you to decide what to do with the USB connection -- e.g. charge only, or mount as usb ...
4
Model Binding is quite a nice feature and may add a plus to the overall security if it is properly used.
Here is how it works (the code and the features apply to ASP.NET MVC but may be the same in Ruby):
Suppose you have a form in a web page:
<form action="/SendData">
Email: <input type="text" name="email" id="email"><br>
...
4
Preventing this kind of issue depends on the type of protocol that's used. Assuming that we're talking about web access (HTTP) here then the main defence against this kind of attack is a well configured SSL setup combined with some user awareness.
If you try to intercept access to an SSL encrypted website then you need to present a certificate to the user ...
4
This is what SSL certificates are for. Your browser has a list of trusted certificates and certificate providers, and when a site says I'm PayPal.com your browser knows the certificate is wrong.
A man in the middle attack may spoof certificates or persuade you to accept an incorrect certificate, and a successful one could indeed do what you say, and steal ...
3
In my opinion the implications are new possibilities, as you've hinted towards. Presumably a person can plug a wifi usb adapter into one of after installing linux (all for around $55-$65 bucks) and start monitoring networks. How it would send a report, is not clear, it would rely on the device first being able to crack the wifi network. That doesn't sound ...
3
Rook, Chrome on Windows uses CryptoAPI on other platforms they use NSS but NSS's revocation platform isn't "Faster" and doesnt send nonces (by default) either - its actually the least performant and robust revocation implementation of all the browsers.
There are a bunch of pending improvements to the NSS revocation behavior that should fix this in the near ...
3
This is going to be an annoyingly trivial answer, BUT...
The only way to perform a Response Splitting attack on an updated ASP.NET (or MVC) server, is if the application itself is writing back raw HTTP responses.
Yes, of course no programmer in their right mind would do that... but in the case of the 60% of programmers that are not in their right mind, it ...
3
Since you refer to SDL I assume you know it already, but to have it mentioned here: Microsoft provides a SDL Threat Modelling Tool (http://www.microsoft.com/security/sdl/adopt/threatmodeling.aspx)
OWASP hosts a primer about Threat Risk Modelling (and recommends the use of Microsoft SDL)
And of course NIST has a whole load of docs on this topic, e.g.: ...
3
"Static" ARP entries is the more commonly used term than "Permanent"; you should know this if you're Googling and the like.
Static ARP entries do provide protection against ARP poisoning / spoofing. However, someone in a position to perform ARP spoofing can also perform MAC spoofing to achieve close to the same effect, and overcome the obstacle that a ...
3
You have 2 points that can get compromised: git repository access and the CI service. Are you using CI SaaS, because what is the difference if your deploy server or your CI machine get compromised? They can both push code.
If you have a CI service that is remote, you might as well build on your deploy server and push that actual build to the CI ...
Only top voted, non community-wiki answers of a minimum length are eligible
