Tag Info

Hot answers tagged

10

Ok, this is a pretty nasty flaw. If directory traversal is possible, the attacker might overwrite often-used executables in order to infect the box with malware. From there, the rest of the network could get infected through a whole range of different mechanisms: USB spreading, remote code execution vulnerabilities, spear phishing, etc. Worse, they could ...


9

If the victim is using an open wireless network, spoofing DNS is easy. It is easy for the attacker to mount a man-in-the-middle attack and send forged DNS responses. Therefore, if you are using an open wireless network, you should not trust DNS at all: it is trivial to spoof. Similarly, if the attacker is on the same subnet as you, spoofing DNS is easy: ...


8

If the attacker gets to choose the files he can overwrite, then he just has to replace a few operating system files to completely own the machine (e.g. replace the kernel and wait for the next reboot). If the file names are "contained" (i.e. the files written to by the attacker will necessarily appear in a specific directory or a subdirectory thereof, ...


7

Threat Modeling is really a skill, based on experience, after learning what works and what doesn't. I don't think a choice of framework will make things much easier for you, you will still have the same issues and difficulties that you have now. On the contrary, I would recommend STRIDE-per-element as the better place to start, and later add in ...


7

In short, yes it would. But you could also use a simple triage approach if threat modelling is too much of an overhead. In detail - Code analysis can be a time consuming activity. Even tool lead approaches will generate large amounts of output that will require human review and prioritisation. As such a threat modelling approach can help to identify and ...


6

Just to add some point of view: Have you heard about the 10 Immutable Laws of Security ? It's a bit old, simple, etc., but goes to the point. Inside it you'll find some rules: Law #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore Law #2: If a bad guy can alter the operating system on your ...


6

I suggest the Microsoft Press book titled "Threat Modeling"


6

Definatly maybe. Methods and techniques have value when they assist you in acomplishing a task either more completely or with fewer resources than another approach. So are you looking to do the job thoroughly or more efficiently? Threat modeling may help you come up with test cases that anticipate a practical attack and ignore test cases, and thus code, ...


6

OWASP, the Open Web Application Security project, maintains a top 10 list of vulnerabilities. It's available in PDF form. That can be a good starting point for understanding, at a high level. "The OWASP Guide to Building Secure Web Applications and Web Services" explains how web applications can be exploited and how they can be designed for robustness.


5

SANS.org have a few really good resources. Including: http://www.sans.org/windows-security/2009/07/11/practical-risk-analysis-spreadsheet/ http://software-security.sans.org/resources/paper/reading-room/threat-modeling-process-ensure-application-security ...


5

Microsoft SDL v5 is pretty decent and you have to full paper explaining the whole process that can be downloaded from MSKB: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=12285 If you need to get just a general grasp of the process, you can read a short and solid intro @ TechSurface: ...


5

Yes, the "phone" itself is an application. It can be hijacked or replaced entirely. In fact, Android handsets are DESIGNED to do this so that you can automatically use a VOIP provider when making phone calls if you so desire. Malware with complete device control could simply place itself as such a service and when you dialed a call, it would be connected ...


4

If you have zero trace of what happened then you can only make assumptions as to what happened. Standard practice is to identify all platforms and versions, then to look at vulnerability databases to see if there are known weaknesses in your environment. Then look at all information flows and transforms - identifying entrance points. The above are common ...


4

It sounds like you are interested in something similar to the National Vulnerability Database (NVD), except for malware. I am not sure such a thing exists, but here are some similar repositories: http://home.mcafee.com/virusinfo/ http://www.microsoft.com/security/portal/Threat/Views.aspx http://www.virustotal.com/search.html ...


4

Google Authenticator is based on the Time-based One-time Password Algorithm (TOTP). http://en.m.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm The reason that it would be difficult to brute-force is because the tokens change every 30 seconds. So after every 30 seconds of trying to brute-force, the target moves, and suddenly the token can by any ...


4

You are using the expression "zero-knowledge proof" but it does not mean what you believe it to mean. A ZKP proof is a kind of cryptographic protocol by which a Prover demonstrates to a Verifier a given property on a secret value. The proof is "zero-knowledge" if it does not divulge any extra information to the verifier. For instance, suppose that there is ...


3

It sounds to me like you want your Web based SaaS application to be accessed only by browser/client/hosts that have some system integrity properties that are usually lacking in a typical web client host -- e.g. absence of malware, resistance to malware. If that is so, then you should consider developing a client that is a hardened dedicated browser ...


3

In a technical sense, DNS is easy to spoof. It (almost always) uses UDP as the transport protocol, which is trivial to spoof compared to TCP. And DNS itself offers no precautions against spoofing, so if the attacker can return their own packet first, they win. Note that DNSSEC is designed to address this issue and a couple of others. Successful DNS ...


3

Is DNSSec required for public key/hash distribution? Yes. One has to have a trusted starting point, and in this case that's the signature of the root domain. From there, each corresponding subdomain is signed so there is a chain of continuity to demonstrate that your request was not hijacked at any step of inquiry. Are there any threat models comparing ...


3

Look at the Microsoft Security Development Lifecycle. This is one of the seminal and best-in-breed approaches to secure software development, and Microsoft has generously provided a great deal of material, resources, and tools to support the lifecycle. Also, take a look at the Building Security In Maturity Model (BSIMM). BSIMM doesn't tell you how you ...


3

If you like to get into the basics of Threat Models, then Threat Modelling from Microsoft Press is a nice book. Don't be put off by the introduction-page, it is an overall fine beginner read.


3

Since you refer to SDL I assume you know it already, but to have it mentioned here: Microsoft provides a SDL Threat Modelling Tool (http://www.microsoft.com/security/sdl/adopt/threatmodeling.aspx) OWASP hosts a primer about Threat Risk Modelling (and recommends the use of Microsoft SDL) And of course NIST has a whole load of docs on this topic, e.g.: ...


2

WMI sits on top of DCOM which sits on top of RPC. So you'll have to expose the Windows RPC ports, which is a non-starter if you're trying to monitor servers across the Internet -- nobody should expose those. But assuming you're monitoring across a LAN, then you'll need whatever DCOM rights are necessary on that machine, and then enable WMI for remote ...


2

MyAppSecurity's ThreatModeler uses a software centric approach to Threat Modeling. It includes a feature to view an Attack Graph / Threat Pattern for individual software components. ThreatModeler Page


2

I agree with everyone else who says this is bad. What I want to add is to answer your question of how to mitigate the threat. The answer will depend upon the exact functionality of "Their Program" and what resources it needs to be able to access as part of its legitimate, ordinary functionality. The first and most natural suggestion to try: run "Their ...


2

OK, it sounds like you are asking for a policy, plan, and practices for secure system administration of a data center. I have some suggestions for you: Start with a policy. Start by thinking out your security policy. Develop a written security policy, and gain approval from management. Take a look at SANS's resources on security policies. They'll give ...


2

The most current documentation already posted (by the Trike team, anyway) is in the Help spreadsheet, which you can find here: http://sourceforge.net/apps/trac/trike/browser/spreadsheet/trunk/docs/help/TrikeHelp.xlsx I also have a very rough draft of the documentation for how to actually do the first half of the methodology using the spreadsheet. I am ...


2

Even if the passwords to a site are compromised the attacker still doesn't know the user names or sites the same password is used on, or even if the same password is used anywhere again at all! Why does he need to know? If he has a set of usernames and passwords, how will it hurt to try the set against common sites like Facebook, Twitter, Gmail etc? ...


2

Likely heuristics are: File is a valid file of a known type (eg. a JPEG that falls within a strict reading of the JPEG spec). File does not contain any extraneous data (eg. JPEG permits unformatted data after the image. A safe file would not have any.) File does not contain any known exploits for the format. Other possible heuristics: File does not ...


1

We differentiate so that it's easy to know what's in scope of the threat model and what's out of scope. An external interactor is something that the component(s) we are modeling interact with, but which we do not want to cover in this threat model. A process in a threat model represents a component (or collection of components) that we do want to cover. ...



Only top voted, non community-wiki answers of a minimum length are eligible