Tag Info

Hot answers tagged

11

Yes, this is accurate. If your version of the Android OS has known privilege escalation vulnerabilities, there is nothing stopping a rogue application from exploiting a privilege escalation vulnerability and thus escaping the sandbox (i.e., gaining unrestricted access to your phone). This absence of security upgrades is a shortcoming of the Android ...


9

There is a file called SHA256 which contains the checksums. Technically you only need that file to be transmitted securely; you could get the ISO through any mean, and just verify the checksum. This would be as good as getting the whole file through HTTPS. The OpenBSD people do not seem to maintain a public HTTPS web site with a copy of the SHA256 file. ...


8

First of all, OpenBSD is really just on a server in Canada, where the development takes place, through CVS. People replicate the tree by connecting using SSH there etc. When releases are made, isos are created and mirrors replicate them. I imagine they get the files using a secure way, but can't know for sure. Then you have a list of mirrors to download ...


5

For a site I would recommend the SANS Internet Storm Center at https://isc.sans.edu/. I find the most useful for news for me is a twitter list of security professionals and researchers such as. @sans_isc @uscert_gov @schneierblog @gcluley @duckblog @markrussinovich @jeremiahg @briankrebs @mikko @hdmoore @dakami You can probably find other lists of ...


5

I agree, they should make available a way to securely authenticate the iso's. They should provide an authenticated mechanism (to https://www.openbsd.org) to retrieve the sha hashes instead of leaving the hashes sitting beside the just-as-easily-compromised iso file. But in the absence of that you can, download, wait and verify that there isn't a security ...


5

It sounds like you are in a corporate environment with in house or vendor specific applications needed for business. You should be able to use a combination of code signing and whitelisting to setup policies where it will only run the JAVA applets and applications that are authorized. This is not full proof, but may help to reduce infections. See the JAVA ...


5

The fact that they are constantly making changes to improve security is a good thing. It means they are keeping up with exploits and patching accordingly. This is the kind of thing you want to see in a security library. Just because a library isn't patched often, doesn't mean that they don't have any problems. It might just mean that they aren't fixing them ...


4

some valid points... I personally go the custom rom route, you mention having to trust the developer, this is true.... Just like every other open source, community driven project. And for that matter Google, Apple, Microsoft, etc. I find it much easy to trust an open project vs closed source anything. These are choices we have to make with all tech ...


3

http://security.didici.cc/ is all I use nowadays. Not a source per se - it's a news aggregator, but includes many high quality news sources, as well as podcasts, videos, events, CVEs and Tweets (as well as stackexchange posts - which is where I found your question). Full disclosure: I'm the author of the site.


3

The claim can be substantiated by checking the successful exploit rates against (e.g.) Secunia databases, or by checking the latest, say, 100 security advisories from Microsoft TechNet (the management loves Microsoft sources :-) ) or e.g. US-CERT. Every time there's an exploit for something that was known at the time the exploit took place, that's a ...


2

According to this interesting technical paper Microsoft do indeed use Level 3 as one of their CDN partners. As to why Microsoft use someone who also serves porn, they probably don't have a lot of choice. There aren't very many CDNs operating at that kind of level, and most of the customers for that sort of service are porn sites. According to this even more ...


2

NuGet does not currently support code signing for package or nuspec files, so the author of the package cannot truly be identified. This issue was raised as a feature request in 2010, but it didn’t get much attention and hasn’t been implemented. See http://nuget.codeplex.com/workitem/79. Currently an already existing package NuGet can only be upgraded by ...


2

I wanted to say that maintaining an SSL site is a higher cost than HTTP especially when you have that many users. It costs more cycles of CPU, it costs more to maintain the certificates, and because SSL cares which order the packets come in, there is a higher bandwidth cost. In this situation, the user downloading the ISO is concerned that the file has ...


2

First of all, never assume that if a system doesn't directly contact the internet that it is safe from malware infection as other systems becoming infected can spread it throughout a network. Second, new vulnerabilities are still being found on unsupported OSes, meaning that even if your 2003 server is fully up to date at the time support ends it will be ...


2

Comodohacker, the guy who breached DigiNotar last year, claimed that he is able to issue fake certificates in the identity of Microsoft, and that he could provide fake updates. http://news.cnet.com/8301-1009_3-20104883-83/comodohacker-i-can-issue-fake-windows-updates/ I haven't heard any confirmation of this happening, and Microsoft moved immediately to ...


2

Are you talking about a decade+ ago when they didn't have a built-in mechanism for updates? This may sound a bit self-referencing but they did it over a browser because they didn't have a built-in mechanism. They chose that particular way because it was easier and faster to get Windows out the door. Also, at the time most computers weren't constantly ...


2

I would suggest running a virtual machine with external network disabled, and install a fresh OS from an old ISO image which predates the fix. Disabling external network prevents automatic installation of updates; it also blocks "Windows activation" so you will have only a few days or weeks to try it (but you can "stall" the clock between runs: since the VM ...


2

Patch management is important in order to resolve security vulnerabilities. Known exploits are released for many of these vulnerabilities, and attackers can use these holes to breach your computers. In many cases, anti-virus will never catch it. The danger is that the patches have already been released, which means that attackers know EXACTLY what's wrong ...


2

Here's the Security section from my RSS reader, in the form of the OPML file so you can read it directly into yours. It's oriented to news about latest exploits on the 'user level', i.e. what you can encounter 'out there'. <?xml version="1.0" encoding="UTF-8"?> <opml xmlns:rssowl="http://www.rssowl.org" version="1.1"> <head> ...


2

If you're working as a contractor for the U.S. Government, as is generally implied by your requirement for USGCB compliance, then they will probably require that your system be put into a Security Plan which is compliant with NIST SP 800-53 guidelines. The process for this is not without exception. For any control in 800-53 that you cannot meet, for any ...


2

I'm going on the assumption that you or your company is working as a contractor for the government... In which case, do you know if the contract stipulates that the computer needs to be certified to operate (i.e. is it going to be audited for compliance with the USGCB)? If so, it would be worth your while to speak with the auditor about the matter. The ...


2

For updating non-connected computers, you can use offline updating tools that download the updates using another computer (which you can then transfer to the non-networked computer via USB drive for installation). For example, you can use the WSUS Offline Updater for Windows. For your AV vendor though, you would have to check with them on how to get offline ...


2

You have to consider what an attacker might do. He can grab your update file, inject it with malware, compute a SHA hash, deliver it to one of your clients, and infect them. Their computer would not reject it if it's only looking at hashes. If your app only accepts signed files, he cannot infect them. But checking individual files may or may not be ...


2

I would probably sign the files with a key not accessible to the internet or the update server and only install files that are signed by that key. This prevents a compromise of your server from being able to compromise your clients. SSL should help make sure that your clients don't connect to an attackers server, but it won't protect your clients if your ...


2

The actual definition of a security upgrade (as used by unattended-upgrades, the package which does automated security upgrades) is this "${distro_id}:${distro_codename}-security"; (from /etc/apt/apt.conf.d/50unattended-upgrades) So, to create a security upgrade, you need to set up your own repository, and add the following line to /etc/apt/sources.list ...


1

They do provide security fixes relating to Ruby - for example the fairly recent Security Update 2013-002 includes some Ruby stuff, as did 2013-001. They don't seem to have patched CVE-2013-4073 yet, but to be fair that vulnerability is only a couple of weeks old. As you imply in your question, the non-careless developer will never try and run a production ...


1

Alright. So they aren't all strictly hacking: http://www.scmagazine.com.au/News/ http://thehackernews.com/ http://www.ehackingnews.com/ https://news.ycombinator.com/ I don't use twitter, but occasionally i read The Jester's twitter feed, cause frankly, its pretty bad-ass from time to time.


1

This is an all too common scenario within the corporate world. I have to deal with exactly this problem and it isn't easy. The apps are business critical and cannot be replaced (last replacement implementation project came in at $15 million). There are firewalls and other layers of protection, but these are PCs used by staff who will also surf the web and ...


1

Among possible updates are updates of the default contents of the trust store itself. If Windows was using the default trust store then any CA in that store could edit a forged update which would evict its competitors. It could also alter about any part of the OS. For an OS, the path for updates is very sensitive. It would be quite risky to give the power of ...



Only top voted, non community-wiki answers of a minimum length are eligible