122
votes
Meltdown and Spectre Attacks
This answer is an attempt at addressing simply the main concerns. The details here might not be exemplary accurate, or complete. I'll try to link to more detailed explanations when possible.
What is ...
- 13.1k
85
votes
On Windows boxes, is patching for Spectre and Meltdown necessary?
the only point of easy penetration to a system seems to be via javascript running in a web browser.
How about Flash? Java? Silverlight? VBA in an office document? Any applications that load web-pages ...
- 10.9k
66
votes
Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?
You can do either, but I recommend applying for a CVE so that customers who get threat intelligence feeds are more likely to notice the issue and expedite a patch. Assigning a CVE also makes it easier ...
- 135k
60
votes
Accepted
My Android phone is vulnerable, but there are no updates?
You are essentially asking what to do if you are using software which is known to be vulnerable but where no updates are available. This is a problem not restricted to Android phones but you'll find ...
- 199k
55
votes
What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?
It can't be exploited remotely without another vulnerability. You need to be able to execute commands on the system already.
A classic example would be a web shell. Say the server is running a web ...
- 1,253
53
votes
Accepted
Should I disable TLS 1.0 on my servers?
TLS 1.0 when properly configured has no known security vulnerabilities. Newer protocols are better designed and better address the potential for new vulnerabilities. So that's why
I wouldn't ...
- 21.6k
48
votes
Accepted
What's the Impact of the CloudFlare Reverse Proxy Bug? ("#CloudBleed")
Compared to the famous HeartBleed bug leak, this is similar in some ways: the uninitialized memory exposure means unrelated private data is disclosed.
The things that are better
This only affected ...
- 38.3k
31
votes
On Windows boxes, is patching for Spectre and Meltdown necessary?
In my world, applying patches is a given. We're going to do it and it takes an exception to NOT apply a patch.
Right now, those are exploits we know about for Spectre and Meltdown. However, what's ...
- 2,778
29
votes
Accepted
As an end user, what risk is there in browsing a public website that uses TLSv1?
There is currently no real risk just based on the TLS protocol version for the end user when visiting a site which provides only TLS 1.0 (TLSv1) with a modern browser, i.e. a current version of Chrome,...
- 199k
28
votes
What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?
The dirty cow vulnerability, is a a privilege escalation vulnerability in Linux kernel versions 2.6.22 and higher; it has existed since 2007 and was fixed on Oct 18, 2016.
What is the possible impact ...
- 2,231
25
votes
Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?
It would be helpful to publish the CVE so that others know it's necessary to update: as you said, they can see it in threat intelligence feeds (or CVE scans) instead of having to read the changelog of ...
- 32.7k
24
votes
How exploitable is the recent UseRoaming SSH vulnerability?
Like Steve Sether said, this is not a man-in-the-middle attack.
How dangerous is it?
In some cases, buffer overflow attacks are possible.
Your private SSH keys can be leaked to an attacker.
...
- 22.6k
24
votes
Accepted
New CVE-2018-5407 "PortSmash vulnerablity" in Intel CPU
As with a lot of breaking-news coverage of computer security, there's a lot of questionable reporting on PortSmash. It's not actually very interesting, as it doesn't really add much to the attacker ...
- 1,061
19
votes
Accepted
Vim Modeline Vulnerabilities
Although in theory modelines shouldn't allow you to do anything bad, sanitizing modeline functions input is hard. There have been several security issues in the past that allowed arbitrary command ...
- 475
19
votes
My Android phone is vulnerable, but there are no updates?
This is a pervasive problem with nearly all Android phone vendors.
I suspect (only suspicion, I'm afraid) that they do it to boost the sales of their new models. I have tried reaching out to vendors ...
- 2,648
18
votes
Accepted
Steam and two-factor authentication
I think this works a bit like a home alarm system sign. Just the sign itself in your front lawn will deter burglars from even trying to get into your home because of how much more difficult it looks ...
- 876
15
votes
Should I disable TLS 1.0 on my servers?
I also recommend disabling TLS 1.0 if possible and supporting the most modern cryptography and cipher suites your web servers can handle.
TLS 1.0 is vulnerable in many implementations to a couple ...
- 4,322
12
votes
Accepted
Why do several bug bounties ignore user enumeration?
Because they are already aware of the issue. This is evident of them making a mention on the exclusion list. Not mentioning it would likely lead to a lot of users pointing it out.
And since they are ...
- 3,362
12
votes
What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?
CVE-2016-5195 is a so-called privilege escalation exploit. It allows you to elevate the privilege level from a normal Linux user to root. But privilege escalation exploits are usually local exploits (...
- 2,634
11
votes
Accepted
TLS_RSA_WITH_3DES_EDE_CBC_SHA reported as 112 bits
You should disable all triple DES ciphers because 192 bit triple DES keys only have about 112 bits of security and 128 bit triple DES keys have even less than 112 bit security, rather around 80 bits ...
- 4,633
10
votes
What are the main vulnerabilities of TLS v1.1?
Sticking with TLS 1.0 is a very bad idea and pretty unsafe. Can be POODLEd, BEASTed and otherwise padding-Oracled as well. Lots of other CVE weaknesses still apply which cannot be fixed unless by ...
- 101
10
votes
How exploitable is the recent UseRoaming SSH vulnerability?
could cause remote code execution
No remote code execution. No man-in the middle as it was cleared up by Mark. Everything is explained in the Qualys analysis as already linked.
But in short:
The ...
- 5,649
10
votes
Unknown process on my ubuntu machine communicating over multiple ports with UDP proto
So can anyone give me a heads up of what has happened
You got hacked. But it can just be anything (SQL injection, remote file inclusion, Shellshock...) and it is impossible to tell without having a ...
- 199k
10
votes
Accepted
Which ssh exploit works by changing the user name in the middle of the process?
I don't think, there was any vulnerability in this, at least not in openssh. The code resulting in this error was added in this commit and it is referencing recommendation from ietf-drafts. Probably ...
- 5,649
9
votes
Should I use SSL/TLS renegotiation?
As of 2020, TLS renegotiation is no more because it was insecure.
Renegotiation is removed from TLS 1.3 onward, year 2018.
All major software disabled renegotiation by default since as far as 2009 (...
- 1,266
8
votes
How can you check and analyze SSL ports other than 443?
I use https://testssl.sh/
testssl.sh is a free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and ...
- 2,144
8
votes
Accepted
Do high-level programming languages have more vulnerabilities or security risks than low-level languages?
Major Caveat upfront:
It is possible to be insecure in any language, any time, and only developer attentiveness/awareness can fix this. SQL injection is still a thing. Higher-level languages ...
- 1,988
8
votes
My Android phone is vulnerable, but there are no updates?
It's a bit late for you now (I imagine), but as an Android fan I make sure and only buy phones from manufacturers that I know provide regular security updates. In the past I've had phones that ...
- 31k
8
votes
On Windows boxes, is patching for Spectre and Meltdown necessary?
Yes, because it can be used for privilege escalation. Usually, if an attack compromises a host, they only have user privileges. Using this vulnerability, they can escalate privileges by leaking ...
- 872
8
votes
On Windows boxes, is patching for Spectre and Meltdown necessary?
Install the patches unless you have a very strong reason not to.
The approach you describe can basically be summed up as this:
I know about exploit X. I could patch my OS to resolve exploit X, or ...
- 9,256
Only top scored, non community-wiki answers of a minimum length are eligible