Hot answers tagged

224

It is not. This is a FUD (fear, uncertainty, and doubt) campaign by GMX because they want to display their ads. There is absolutely no security risk from the mentioned ad blockers. They added some crapware to the list to make it look more legitimate. Of course such campaigns are very unusual, especially from such a big and well known company like GMX. ...


110

Update After thinking it over, I have to agree with the other answers in that, despite the fact that it CAN access your data, Adblock is more likely to protect your privacy than invade it. The real risk are malicious ads that prompt you to install software on your computer. Adblock prevents these. Below is the original, cautionary answer: Yes, it totally ...


55

Assuming that you have looked up the official terms and wanted further help: An event is something that has triggered notice. An event need not be an indication of wrongdoing. Someone successfully logging in is an event. An incident is something that indicates a problem, however you define "problem". It carries from an event but has a layer of ...


54

This really comes down to an issue of trust. It is true that today, the AdBlock extension is safe. We know that it will not steal your data, even though—as the other answers point out—it has the technical ability to do so. However, Chrome extensions are silently and automatically updated. Do you trust that the developer of the AdBlock ...


42

All software is a security risk, but in this case their claim is misleading. Just like all advice is potentially bad and and all transactions are potentially fraudulent. "Risk" just means your security isn't guarenteed, with is true in 100% of cases. But in the case of AdBlock Plus, the software is well-understood and developed by a team that has a track ...


38

From what I can tell, there have only been two serious public vulnerabilities in Steam. Markup injection (XSS) from steam:// links HTTPS man-in-the-middle attack Neither are current. I can't see any real risk. However, since Steam is completely unnecessary at work, it's a minor potential risk that could be avoided. Most likely, he's nit-picking because he ...


30

From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...


28

Steam should be treated just like any other application installed on a business computer. Ask yourself if it is needed to perform your job correctly. When your computer has more software installed, it may have more areas where it can be attacked. Steam may not have a vulnerability now, but they may accidentally release an update that has a vulnerability ...


20

Just an observation - I tend to promote ad blockers especially for my less savvy friends and associates - precisely because it reduces security threats. How? Because much of the most malicious content on the web comes in the form of a misleading advertisement like "click here to make your pc faster"... These largely disappear with an ad blocker.


20

Broken functionalities in a web application are not a security threat per se, but they might be one. For you as a penetration tester, look out for: Information leakage about the system (stacktraces, version numbers, error messages, file paths, ...) as they might help an attacker Missing security features (if the functionality to change the password is ...


19

It really depends on your point of view. From the outside, the "script kiddie" is, nominally, the wannabe attacker who uses tools written by other people (the "scripts"), without really understanding what is going on. Everybody uses tools written by other people (if only operating systems, C compilers, libraries...), but some people have a certain ...


18

While schroeder's answer is certainly correct, it might not be formal enough. In the the terms and definitions of the ISO/IEC 27000 you will find the following: threat potential cause of an unwanted incident1, which can result in harm to a system or organization information security event identified occurrence of a system, service or ...


14

No, for so many reasons. First, let's lay out there that right now (2018-10-05) there has been discernible concern within the Security community about the fact that "what we know" so far is very thin and rests heavily on the reputation of the reporters. The "targeted" companies have published denials which are "heavily detailed, denying the Bloomberg ...


12

The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader: To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user. This is a losing battle and you take a chance every time you use an ATM. Security is relative, that ...


11

tl;dr - It is incredibly easy to be hacked as an average user. It is also rather easy to protect yourself online. Unfortunately most average users don't see themselves as a target so do not protect themselves appropriately. It doesn't matter if you are not a CEO of a large company, or have very little in your bank account - your PC is a target even if you ...


10

There's also the Pentest Standard


9

Adblock (as other extensions and, for that matter, browser developers) has the technical ability to get a lot of your data, and you have all the risks commonly associated with running third-party applications - namely, that the vendor can be malicious, and there may be bugs in their software that break your security. That being said, I'd consider AdBlock as ...


9

Yes. Why do I say this? It is important to understand what all these vulnerability's are and why they exists (I will be calling the victim "subscriber"): Why do they exists: SS7 was designed and developed in 1975 as a protocol for telecommunication for call operating centers. Since we are talking here about 1975, the security of the protocol was not ...


9

You are asking a couple different questions at once: how is ML implemented by a certain vendor, and how could it be implemented to be effective. Let's focus on the later. I have designed such algorithms for a major global financial institution, and I can give you the broad strokes. It's not too good to be true. Any security analyst will look at the logs, ...


8

There are 4 basic principles used in cryptography: confidentiality integrity authenticity non-repudiation. I will not go through the mathematical aspects involved, instead I will try to offer a more general description. Confidentiality is assured by the encrypting of data, integrity and authenticity are assured by a signed digest and non-repudiation is ...


8

You could be asking one of many questions here. If you are asking "How do I know that the software I have here is what the vendor made - could it have been altered before I got it?" then you will want to compare the hash of what you have to what the vendor has published, assuming they have. (Almost everyone does nowadays.) If you are asking "How can I tell ...


8

The way this information is spread by United Internet is misleading (I am trying hard to avoid saying "libel"). The allegation as it stands is clearly wrong by all objective means, and the presentation is defamatory. Of course, in principle, one has to admit that Adblock (Plus) is of course a potential security risk. Whether this risk warrants a reasonable ...


8

After going through the code, I'm not sure that it is supposed to exploit or attack anything. It looks like its only purpose is to encode a payload using barcodes. It would be a nice way to import code into a system using a barcode reader when all other routes may be blocked. After you locate a vulnerability in a system, you can "upload" a payload using one ...


7

Steam records game usage, time and other game characteristics. In addition, Steam reports configuration details and all installed applications. So, Steam can be considered as a spyware itself when the configuration or the installed applications are an important strategy key of the company.


7

This is remarkably similar to attacks like SQLi, and the remediation is the same. Wherever you allow a barcode to be scanned as input, validate it in the scanner and only allow input that matches the requirements. If you expect a field of 20 digits, only allow 20 digits and strip off anything after 20. If you expect 8 alphanumerics, limit it to that. ...


6

Stream itself may or may not be a risk, but let's not forget that it installs other programs (games), and those will very likely have security vulnerabilities.


6

NIST 800-53A and NIST 800-115 That's not strictly a test plan, but it is a catalog of the elements of a test plan. If you're working with a government system, that is a list of test standards for the security controls. If you're working on a commercial system, it is a catalog of resources. Another resource for test plans is SANS Critical 20 Security ...


6

"Non-repudiation" is a legal concept which means that you cannot successfully claim not being the source of a given piece of data. Laws for that vary quite a lot around the World, and they tend to change over time, too. One powerful tool for non-repudiation is digital signatures. Digital signatures do not provide non-repudiation immediately, no more that ...


6

The best you can really do is use ATMs you know or ATMs that have good physical security if one you know isn't available. (go to an ATM inside a bank). Even then, I always spot check the machine for any signs of tampering. A simple trick that can work well is to make sure the keypad isn't compromised (by looking and pulling on it) and then if it appears ...


Only top voted, non community-wiki answers of a minimum length are eligible