Hot answers tagged

154

There are various utilities in different operating systems which allow hot-patching of running code. An example of this would be kpatch and livepatch features of Linux which allow patching the running kernel without interrupting its operations. Its capabilities are limited and can only make trivial changes to the kernel, but this is often sufficient for ...


100

I watched a presentation at a security conference by a Netflix employee. They don't patch at all. Instead, when a patch is required, they stand up new instances and then blow away the unpatched ones. They are doing this almost constantly. They call it red-black deployment.


90

Nope. After Microsoft discontinue security updates for a version of Windows there is not a safe way to run that version of Windows. Some people will promote Virtual Patching where you have a external firewall scan all your traffic looking for patterns of traffic that look malicious. I would not trust that, and it requires a seperate non-vulnerable ...


69

Because there are security vulnerabilities found in software all the time. These vulnerabilities are sometimes publicly disclosed, sometimes not. Either way, as developers find or find out about them they patch them. Running old versions of browsers leaves you vulnerable to malicious websites trying to infect your computer. Below are links to web pages ...


64

The short answer is: They do reboot. You seem to assume that Amazon and Google run on a single server, and if that is rebooted, the whole site/service is down. This is very far from the truth - large services typically run on many servers that work in parallel. For further reading, look at techniques like clustering, load balancing and failover. Google, ...


59

You are essentially asking what to do if you are using software which is known to be vulnerable but where no updates are available. This is a problem not restricted to Android phones but you'll find it everywhere, for example in IoT devices like routers or cameras but also with software on the PC which only get support for a limited time. The answer should ...


34

No, anti-malware is not a replacement for security updates. Neil Matz summarized the Fortinet's Q2 Global Threat Landscape report for 2017, noticing: WannaCry and NotPetya targeted a vulnerability that had been patched by Microsoft a few months earlier. But it’s not just these high-profile attacks that target recent vulnerabilities that are the ...


32

The crux of the problem is that with only a few notable exceptions, every phone ships with a fork of Android, not with the software written by Google. So Google can't push changes to Samsung's phones any more than FreeBSD can push changes to Apple's Macbooks. Android is Open Source, which is a bit unusual. This is the first time a major consumer operating ...


23

I'm really just repeating other answers but let's try to explain it using a metaphor. A computer program is a long description of how the computer must behave, based on what information it is given. A browser program is given some instructions by a Web server program and draws a Web page for you to use. It then tells the Web server which next page it would ...


21

Yes, this is accurate. If your version of the Android OS has known privilege escalation vulnerabilities, there is nothing stopping a rogue application from exploiting a privilege escalation vulnerability and thus escaping the sandbox (i.e., gaining unrestricted access to your phone). This absence of security upgrades is a shortcoming of the Android ...


18

This is a pervasive problem with nearly all Android phone vendors. I suspect (only suspicion, I'm afraid) that they do it to boost the sales of their new models. I have tried reaching out to vendors and received responses that vary from "please wait, an update is on it's way" (no it wasn't), to "we're no longer releasing updates for that old model" (if ...


11

There is no realistic substitute for software patches. There are additional security measures one can take, but all of them have their limitations. Antiviruses will not do a thing against attacks that do not write to disk. If an attacker hijacks a legitimate process in memory, it's open-season on your data. These kinds of attacks are becoming more and more ...


10

You can check "Deployment Activities" under "Software Deployment". A common method is to use a Load Balancer in-front of your services and redirect traffic accordingly. In a technique called "blue-green deployment", you redirect traffic from "blue" to "green" servers. This does not have any user-side downtime, provided of course that the application can ...


8

Auto-updates greatly improved security by fixing any non zero-day vulnerabilities. Most vulnerabilities only become known to the general public after a patch for it is released. Years ago, when auto-updates were not the norm, black-hat hackers used to reverse-engineer any security updates, found out what vulnerabilities they fixed, wrote exploits for it and ...


8

It's a bit late for you now (I imagine), but as an Android fan I make sure and only buy phones from manufacturers that I know provide regular security updates. In the past I've had phones that received effectively zero security updates over the lifetime of the device, and I didn't want to have to worry about that again. To be clear the reason this happens ...


7

The fact that they are constantly making changes to improve security is a good thing. It means they are keeping up with exploits and patching accordingly. This is the kind of thing you want to see in a security library. Just because a library isn't patched often, doesn't mean that they don't have any problems. It might just mean that they aren't fixing them ...


7

All updates are digitally signed by Microsoft's private key, you will get warnings if any updates are not signed, or signed with the wrong key. Even if a MiTM was able to send fake updates they'd be rejected by the update utility for that reason.


7

The general rule of thumb is to apply the updates in a test or parallel environment, run tests, then approve for general release. In some cases, people will apply patches to live environments but on lower priority servers and be willing to suffer outages on the less critical systems. BUT, because of the criticality of a lot of patches, it is also advised ...


7

The Linux kernel itself is not affected. The part responsible for WPA is wpasupplicant. From the Changelog: Version: 2.1-0ubuntu1.5 2017-10-16 17:06:43 UTC wpa (2.1-0ubuntu1.5) trusty-security; urgency=medium SECURITY UPDATE: Multiple issues in WPA protocol debian/patches/2017-1/*.patch: Add patches from Debian jessie CVE-2017-...


7

You've misread or mistranslated several things. Debian is not doing any data collection and it is downloading, not uploading. Upgrades do not upload anything. The only data that's sent from your computer is the requests to download the updated list of package versions and the package files for the packages that you install or update. The mirror from which ...


6

Well the whole point of updating/patching anything is to fix known vulnerabilities. Any bugs/vulnerabilities found in the version of firefox you're running could be exploitable. Updating your browser will modify how the browser works and result in those vulnerabilities being no longer exploitable. It's really as simple as that. Updating can also introduce ...


6

Take a look at man apt-secure, apt has done signature checks on release files for well over a decade. The release file contains a hash of all files in the package, and the release file gets signed by a trusted key that is included in the original installation media. It looks like md5 is still widely used here, which is concerning but not necessarily a deal-...


6

The problem is less likely the security of the Ubuntu system as shipped by the distributor. It is very rare that there are critical issues which allow an remote attacker to hack the system. And while there are sometimes critical issues which allow privilege escalation by a local user they are rare too. But you can actually limit the impact further by only ...


5

For a site I would recommend the SANS Internet Storm Center at https://isc.sans.edu/. I find the most useful for news for me is a twitter list of security professionals and researchers such as. @sans_isc @uscert_gov @schneierblog @gcluley @duckblog @markrussinovich @jeremiahg @briankrebs @mikko @hdmoore @dakami You can probably find other lists of ...


5

It sounds like you are in a corporate environment with in house or vendor specific applications needed for business. You should be able to use a combination of code signing and whitelisting to setup policies where it will only run the JAVA applets and applications that are authorized. This is not full proof, but may help to reduce infections. See the JAVA ...


5

The issue is now addressed in the paper signify: Securing OpenBSD From Us To You by Ted Unangst (BSDCan, 2015). In summary: Requiring mirrors to use HTTPS, and any other reliance on HTTPS, was rejected. As noted by other answers here, securing only the connection between users and mirrors does not secure the transit of artifacts from developers to users. (...


5

some valid points... I personally go the custom rom route, you mention having to trust the developer, this is true.... Just like every other open source, community driven project. And for that matter Google, Apple, Microsoft, etc. I find it much easy to trust an open project vs closed source anything. These are choices we have to make with all tech ...


5

According to this interesting technical paper Microsoft do indeed use Level 3 as one of their CDN partners. As to why Microsoft use someone who also serves porn, they probably don't have a lot of choice. There aren't very many CDNs operating at that kind of level, and most of the customers for that sort of service are porn sites. According to this even more ...


5

There are two main reasons for creating a new version of a program: (in this case a browser) To add new features (eg. viewing a video in the browser). To fix a problem, which may be: A minor issue (such as cmd-L not opening a new window when no window is available) A big issue (eg. a malicious web page can read data from other requests [1] ) Some changes ...


Only top voted, non community-wiki answers of a minimum length are eligible