Tag Info

Hot answers tagged

179

It is not. This is a FUD (fear, uncertainty, and doubt) campaign by GMX because they want to display their ads. There is absolutely no security risk from the mentioned ad blockers. They added some crapware to the list to make it look more legitimate. Of course such campaigns are very unusual, especially from such a big and well known company like GMX. ...


84

Update After thinking it over, I have to agree with the other answers in that, despite the fact that it CAN access your data, Adblock is more likely to protect your privacy than invade it. The real risk are malicious ads that prompt you to install software on your computer. Adblock prevents these. Below is the original, cautionary answer: Yes, it totally ...


42

This really comes down to an issue of trust. It is true that today, the AdBlock extension is safe. We know that it will not steal your data, even though—as the other answers point out—it has the technical ability to do so. However, Chrome extensions are silently and automatically updated. Do you trust that the developer of the AdBlock ...


36

All software is a security risk, but in this case their claim is misleading. Just like all advice is potentially bad and and all transactions are potentially fraudulent. "Risk" just means your security isn't guarenteed, with is true in 100% of cases. But in the case of AdBlock Plus, the software is well-understood and developed by a team that has a track ...


30

From what I can tell, there have only been two serious public vulnerabilities in Steam. Markup injection (XSS) from steam:// links HTTPS man-in-the-middle attack Neither are current. I can't see any real risk. However, since Steam is completely unnecessary at work, it's a minor potential risk that could be avoided. Most likely, he's nit-picking because ...


22

Steam should be treated just like any other application installed on a business computer. Ask yourself if it is needed to perform your job correctly. When your computer has more software install, it has more areas it can be attacked. Steam may not have a vulnerability now, but they may accidental release an update that will have a vulnerability in it. ...


21

From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...


19

Just an observation - I tend to promote ad blockers especially for my less savvy friends and associates - precisely because it reduces security threats. How? Because much of the most malicious content on the web comes in the form of a misleading advertisement like "click here to make your pc faster"... These largely disappear with an ad blocker.


18

One notion is called Perfect Forward Secrecy. This applies to situations where you encrypt data and decrypt it almost simultaneously, but you worry about an attacker who would later on obtain a copy of the decryption key. This is a restrictive model, but it applies to SSL connections: the server private key is long-lived (usually, it is stored in a local ...


11

Loss of revenue is the only threat you really need to talk about with business people. Frame the issue in terms of money and emphasize that money will be lost if security is not given a high priority. Explain that money can be lost in the following ways: Lawsuits due to disclosing sensitive user information. Bad publicity, which damages the brand, which, ...


11

Microsoft has had a horrific security track record. But the real problem in 2011 isn't operating systems, its web applications and web browsers. You should explore projects like Damn Vulnerable Web App, OWASP WebGoat and especially Google Gruyere. You can find pre-built VM's for all of them, and Google is hosting theirs so you don't have to install ...


11

It really depends on your point of view. From the outside, the "script kiddie" is, nominally, the wannabe attacker who uses tools written by other people (the "scripts"), without really understanding what is going on. Everybody uses tools written by other people (if only operating systems, C compilers, libraries...), but some people have a certain ...


10

There's also the Pentest Standard


10

The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader: To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user. This is a purely loosing battle and you take a chance every time you use an atm. Security is ...


9

Adblock (as other extensions and, for that matter, browser developers) has the technical ability to get a lot of your data, and you have all the risks commonly associated with running third-party applications - namely, that the vendor can be malicious, and there may be bugs in their software that break your security. That being said, I'd consider AdBlock as ...


8

You could be asking one of many questions here. If you are asking "How do I know that the software I have here is what the vendor made - could it have been altered before I got it?" then you will want to compare the hash of what you have to what the vendor has published, assuming they have. (Almost everyone does nowadays.) If you are asking "How can I tell ...


8

The practical upshot of this is that almost all the security departments I work with treat encryption as something which they expect to protect for a length of time and their decisions on what encryption to use are based on how long they need data to be 'secure' Admittedly the factors which feed into this are woolly, and are prone to change as someone ...


8

I read somewhere, I forget where, they divided hackers into three levels of expertise. The lowest level was Script kiddie. Script kiddies have very limited knowledge and almost no knowledge beyond the attack they are attempting. They may not completely understand the attack they are attempting. An example of this would be a person ARP poisoning a network ...


7

Ones I tend to draw on: Verizon Data Breach Report - this is generally considered THE source on data breaches Krebs Java Security Report - Krebs is very well respected - various studies, of which this is a grand example WHID Security Report - also very useful These are all freely available online, and updated versions available annually (or more often in ...


7

For trade shows, do you HAVE to connect to your live database ? Could you make do with a (recent) copy on a local machine. The additional risks at a trade show are that you are surrounded by competing companies who would have a commercial interest either in your data or in making your application unavailable (crashing the server). There's also more ...


7

It sounds like you've got a decent grasp on threats, know that what you're doing now is preferable from a security standpoint, and are facing a cost / benefit analysis. With that in mind, here are some alternate thoughts: Configure MySQL with an SSL frontend. There are some features in MySQL for that, but stunnel may make you less crazy. While client ...


7

There are 4 basic principles used in cryptography: confidentiality integrity authenticity non-repudiation. I will not go through the mathematical aspects involved, instead I will try to offer a more general description. Confidentiality is assured by the encrypting of data, integrity and authenticity are assured by a signed digest and non-repudiation is ...


7

The way this information is spread by United Internet is misleading (I am trying hard to avoid saying "libel"). The allegation as it stands is clearly wrong by all objective means, and the presentation is defamatory. Of course, in principle, one has to admit that Adblock (Plus) is of course a potential security risk. Whether this risk warrants a reasonable ...


7

tl;dr - It is incredibly easy to be hacked as an average user. It is also rather easy to protect yourself online. Unfortunately most average users don't see themselves as a target so do not protect themselves appropriately. It doesn't matter if you are not a CEO of a large company, or have very little in your bank account - your PC is a target even if you ...


6

Trust me when I say there are scanners running days and nights on the net. When you open your DB up to the public, you'll see all sort of scanning attempts in the server log. Some examples of blind attacks are SQL Slammer worm specifically targetting MS SQL, LizaMoon a mass SQL injection and SpoolCLL targetting weak passwords in MySQL. So, if you must ...


6

NIST 800-53A and NIST 800-115 That's not strictly a test plan, but it is a catalog of the elements of a test plan. If you're working with a government system, that is a list of test standards for the security controls. If you're working on a commercial system, it is a catalog of resources. Another resource for test plans is SANS Critical 20 Security ...


6

The best you can really do is use ATMs you know or ATMs that have good physical security if one you know isn't available. (go to an ATM inside a bank). Even then, I always spot check the machine for any signs of tampering. A simple trick that can work well is to make sure the keypad isn't compromised (by looking and pulling on it) and then if it appears ...


5

Stream itself may or may not be a risk, but let's not forget that it installs other programs (games), and those will very likely have security vulnerabilities.


5

Personally, I'd start with getting the representatives of the business talking about their most valued assets. People who are not security professionals generally have a very hard time figuring out threats. And an even harder time figuring out what threats should matter most to them. But most good business people knows what's important to their business - ...


5

There is a good resource on MSDN. Did you had a chance to read about this topic in MSDN Magazine? Well, here you are the links that may help to define what you look: Penetration Testing Vulnerability Assessment and Penetration Testing Plan Templates



Only top voted, non community-wiki answers of a minimum length are eligible