Hot answers tagged

69

Because there are security vulnerabilities found in software all the time. These vulnerabilities are sometimes publicly disclosed, sometimes not. Either way, as developers find or find out about them they patch them. Running old versions of browsers leaves you vulnerable to malicious websites trying to infect your computer. Below are links to web pages ...


23

I'm really just repeating other answers but let's try to explain it using a metaphor. A computer program is a long description of how the computer must behave, based on what information it is given. A browser program is given some instructions by a Web server program and draws a Web page for you to use. It then tells the Web server which next page it would ...


15

Yes, this is accurate. If your version of the Android OS has known privilege escalation vulnerabilities, there is nothing stopping a rogue application from exploiting a privilege escalation vulnerability and thus escaping the sandbox (i.e., gaining unrestricted access to your phone). This absence of security upgrades is a shortcoming of the Android ...


12

The crux of the problem is that with only a few notable exceptions, every phone ships with a fork of Android, not with the software written by Google. So Google can't push changes to Samsung's phones any more than FreeBSD can push changes to Apple's Macbooks. Android is Open Source, which is a bit unusual. This is the first time a major consumer operating ...


11

There is a file called SHA256 which contains the checksums. Technically you only need that file to be transmitted securely; you could get the ISO through any mean, and just verify the checksum. This would be as good as getting the whole file through HTTPS. The OpenBSD people do not seem to maintain a public HTTPS web site with a copy of the SHA256 file. ...


11

First of all, OpenBSD is really just on a server in Canada, where the development takes place, through CVS. People replicate the tree by connecting using SSH there etc. When releases are made, isos are created and mirrors replicate them. I imagine they get the files using a secure way, but can't know for sure. Then you have a list of mirrors to download from....


7

All updates are digitally signed by Microsoft's private key, you will get warnings if any updates are not signed, or signed with the wrong key. Even if a MiTM was able to send fake updates they'd be rejected by the update utility for that reason.


7

The fact that they are constantly making changes to improve security is a good thing. It means they are keeping up with exploits and patching accordingly. This is the kind of thing you want to see in a security library. Just because a library isn't patched often, doesn't mean that they don't have any problems. It might just mean that they aren't fixing them ...


7

The general rule of thumb is to apply the updates in a test or parallel environment, run tests, then approve for general release. In some cases, people will apply patches to live environments but on lower priority servers and be willing to suffer outages on the less critical systems. BUT, because of the criticality of a lot of patches, it is also advised ...


6

I agree, they should make available a way to securely authenticate the iso's. They should provide an authenticated mechanism (to https://www.openbsd.org) to retrieve the sha hashes instead of leaving the hashes sitting beside the just-as-easily-compromised iso file. But in the absence of that you can, download, wait and verify that there isn't a security ...


6

Well the whole point of updating/patching anything is to fix known vulnerabilities. Any bugs/vulnerabilities found in the version of firefox you're running could be exploitable. Updating your browser will modify how the browser works and result in those vulnerabilities being no longer exploitable. It's really as simple as that. Updating can also introduce ...


5

some valid points... I personally go the custom rom route, you mention having to trust the developer, this is true.... Just like every other open source, community driven project. And for that matter Google, Apple, Microsoft, etc. I find it much easy to trust an open project vs closed source anything. These are choices we have to make with all tech ...


5

According to this interesting technical paper Microsoft do indeed use Level 3 as one of their CDN partners. As to why Microsoft use someone who also serves porn, they probably don't have a lot of choice. There aren't very many CDNs operating at that kind of level, and most of the customers for that sort of service are porn sites. According to this even more ...


5

It sounds like you are in a corporate environment with in house or vendor specific applications needed for business. You should be able to use a combination of code signing and whitelisting to setup policies where it will only run the JAVA applets and applications that are authorized. This is not full proof, but may help to reduce infections. See the JAVA ...


5

For a site I would recommend the SANS Internet Storm Center at https://isc.sans.edu/. I find the most useful for news for me is a twitter list of security professionals and researchers such as. @sans_isc @uscert_gov @schneierblog @gcluley @duckblog @markrussinovich @jeremiahg @briankrebs @mikko @hdmoore @dakami You can probably find other lists of ...


5

There are two main reasons for creating a new version of a program: (in this case a browser) To add new features (eg. viewing a video in the browser). To fix a problem, which may be: A minor issue (such as cmd-L not opening a new window when no window is available) A big issue (eg. a malicious web page can read data from other requests [1] ) Some ...


5

Would Homebrew +package updates have an additive effect with Apple security updates? It should improve security if you leverage it to regularly update packages that Apple is either shipping out of date, or not maintaining and patching. Example Does Homebrew have known security issues in and of itself? Without a full security review this answer is ...


5

Answering your direct question: You should read the pages on Secure Apt Ubuntu, and a slightly more thorough page on Secure Apt Debian. The summary is that packages are signed using gpg (aka "gnupg") which is a distributed web-of-trust style public key infrastructure - this should make you happy. In the PGP / GPG world, people sign each other's keys to ...


4

Yes it is possible to do a cache poisoning attack, and yes it is possible to protect yourself. In addition to the rather standard practice of signing the package files with GPG, some distros use DNSSEC to protect the domains that serve those files against DNS spoofing. Notice the 'ad' flag in the dns answer below: $ dig +dnssec security.debian.org. ; <...


4

Here is a link to Firefox's security update notes: Security Advisories You can see by the number of fixes, and especially those marked "critical," that by not updating you would invite significant risk.


4

Shortest answer, read the Firefox changelog for a release and witness why. You can find it @ https://www.mozilla.org/en-US/firefox/releases/ For all the specific releases. Just click on one of the release numbers.


3

http://security.didici.cc/ is all I use nowadays. Not a source per se - it's a news aggregator, but includes many high quality news sources, as well as podcasts, videos, events, CVEs and Tweets (as well as stackexchange posts - which is where I found your question). Full disclosure: I'm the author of the site.


3

Comodohacker, the guy who breached DigiNotar last year, claimed that he is able to issue fake certificates in the identity of Microsoft, and that he could provide fake updates. http://news.cnet.com/8301-1009_3-20104883-83/comodohacker-i-can-issue-fake-windows-updates/ I haven't heard any confirmation of this happening, and Microsoft moved immediately to ...


3

I wanted to say that maintaining an SSL site is a higher cost than HTTP especially when you have that many users. It costs more cycles of CPU, it costs more to maintain the certificates, and because SSL cares which order the packets come in, there is a higher bandwidth cost. In this situation, the user downloading the ISO is concerned that the file has ...


3

NuGet does not currently support code signing for package or nuspec files, so the author of the package cannot truly be identified. This issue was raised as a feature request in 2010, but it didn’t get much attention and hasn’t been implemented. See http://nuget.codeplex.com/workitem/79. Currently an already existing package NuGet can only be upgraded by ...


3

The claim can be substantiated by checking the successful exploit rates against (e.g.) Secunia databases, or by checking the latest, say, 100 security advisories from Microsoft TechNet (the management loves Microsoft sources :-) ) or e.g. US-CERT. Every time there's an exploit for something that was known at the time the exploit took place, that's a ...


3

You're right. If you go to Adobe's website the update is transferred over HTTP and not HTTPS, which give any hacker in the network to hijack your update file with a simple Man In The Middle Attack and inject his/her malicious file instead of the legitimate Adobe's update. However if you go to the same page and instead of clicking the download now button you ...


2

Since everything from the CLR to 3rd party libraries will be distributed via NuGet in ASP.NET vNext, the NuGet team has committed to supporting signed packages by, I believe, the time Visual Studio 2015 is released. See the blog announcement: http://blog.nuget.org/20150203/package-signing.html Also, see the signing spec: https://github.com/aspnet/Signing/...


2

The issue is now addressed in the paper signify: Securing OpenBSD From Us To You by Ted Unangst (BSDCan, 2015). In summary: Requiring mirrors to use HTTPS, and any other reliance on HTTPS, was rejected. As noted by other answers here, securing only the connection between users and mirrors does not secure the transit of artifacts from developers to users....



Only top voted, non community-wiki answers of a minimum length are eligible