Hot answers tagged

153

There are various utilities in different operating systems which allow hot-patching of running code. An example of this would be kpatch and livepatch features of Linux which allow patching the running kernel without interrupting its operations. Its capabilities are limited and can only make trivial changes to the kernel, but this is often sufficient for ...


118

(updated, at the bottom - "The 1950 car") Forget talking about security. Don't take the "SECURITY" road. Because if you talk about "security" alone, then chances are good that they are right, and you are wrong, and they'll be clear-sighted enough to realize it. There is no computer that is completely secure, and there is no computer that is completely ...


100

I watched a presentation at a security conference by a Netflix employee. They don't patch at all. Instead, when a patch is required, they stand up new instances and then blow away the unpatched ones. They are doing this almost constantly. They call it red-black deployment.


99

Nope. After Microsoft discontinue security updates for a version of Windows there is not a safe way to run that version of Windows. Some people will promote Virtual Patching where you have a external firewall scan all your traffic looking for patterns of traffic that look malicious. I would not trust that, and it requires a seperate non-vulnerable ...


80

Most people (this isn't simply "old timers") think computers get broken into by a hacker sitting in a dark room personally trying to attack them by typing really fast. That's why you get responses like "What am I the CIA/Millionaire?". They simply don't see the value in anyone bothering to try to go after them. And if this were the correct model, they'd ...


69

Because there are security vulnerabilities found in software all the time. These vulnerabilities are sometimes publicly disclosed, sometimes not. Either way, as developers find or find out about them they patch them. Running old versions of browsers leaves you vulnerable to malicious websites trying to infect your computer. Below are links to web pages ...


64

The short answer is: They do reboot. You seem to assume that Amazon and Google run on a single server, and if that is rebooted, the whole site/service is down. This is very far from the truth - large services typically run on many servers that work in parallel. For further reading, look at techniques like clustering, load balancing and failover. Google, ...


60

You are essentially asking what to do if you are using software which is known to be vulnerable but where no updates are available. This is a problem not restricted to Android phones but you'll find it everywhere, for example in IoT devices like routers or cameras but also with software on the PC which only get support for a limited time. The answer should ...


37

No, anti-malware is not a replacement for security updates. Neil Matz summarized the Fortinet's Q2 Global Threat Landscape report for 2017, noticing: WannaCry and NotPetya targeted a vulnerability that had been patched by Microsoft a few months earlier. But it’s not just these high-profile attacks that target recent vulnerabilities that are the ...


33

The crux of the problem is that with only a few notable exceptions, every phone ships with a fork of Android, not with the software written by Google. So Google can't push changes to Samsung's phones any more than FreeBSD can push changes to Apple's Macbooks. Android is Open Source, which is a bit unusual. This is the first time a major consumer operating ...


23

I'm really just repeating other answers but let's try to explain it using a metaphor. A computer program is a long description of how the computer must behave, based on what information it is given. A browser program is given some instructions by a Web server program and draws a Web page for you to use. It then tells the Web server which next page it would ...


22

Yes, this is accurate. If your version of the Android OS has known privilege escalation vulnerabilities, there is nothing stopping a rogue application from exploiting a privilege escalation vulnerability and thus escaping the sandbox (i.e., gaining unrestricted access to your phone). This absence of security upgrades is a shortcoming of the Android ...


22

One possible response could be: "Because I can't support helping you fix it anymore. If you want help from me, in the future, you'll need to upgrade." Yes, this is effectively holding your expertise hostage, but if you give them sufficient notice that you'll stop offering support at a reasonable point in the future, and explain that you can't afford the ...


19

This is a pervasive problem with nearly all Android phone vendors. I suspect (only suspicion, I'm afraid) that they do it to boost the sales of their new models. I have tried reaching out to vendors and received responses that vary from "please wait, an update is on it's way" (no it wasn't), to "we're no longer releasing updates for that old model" (if ...


12

There is no realistic substitute for software patches. There are additional security measures one can take, but all of them have their limitations. Antiviruses will not do a thing against attacks that do not write to disk. If an attacker hijacks a legitimate process in memory, it's open-season on your data. These kinds of attacks are becoming more and more ...


12

The answer may very well be that you're wrong. Yes, this is counter-intuitive, but it may be true. Whether or not using an XP machine is a problem depends a lot on your setup (mostly router, since even plugging in the cable is troublesome otherwise), on what you are doing, on who you are (yes, certainly, there are people who are more valuable targets than ...


10

You can check "Deployment Activities" under "Software Deployment". A common method is to use a Load Balancer in-front of your services and redirect traffic accordingly. In a technique called "blue-green deployment", you redirect traffic from "blue" to "green" servers. This does not have any user-side downtime, provided of course that the application can ...


9

Auto-updates greatly improved security by fixing any non zero-day vulnerabilities. Most vulnerabilities only become known to the general public after a patch for it is released. Years ago, when auto-updates were not the norm, black-hat hackers used to reverse-engineer any security updates, found out what vulnerabilities they fixed, wrote exploits for it and ...


9

If their old XP machine is working perfectly fine for them then there is a good chance they simply use the computer for light web usage and email. If so you might have some luck moving them over to a lightweight linux distro themed to look like XP. This way its secure/up to date and costs no money since they can use the computer they have. They seem to ...


8

It's a bit late for you now (I imagine), but as an Android fan I make sure and only buy phones from manufacturers that I know provide regular security updates. In the past I've had phones that received effectively zero security updates over the lifetime of the device, and I didn't want to have to worry about that again. To be clear the reason this happens ...


7

The fact that they are constantly making changes to improve security is a good thing. It means they are keeping up with exploits and patching accordingly. This is the kind of thing you want to see in a security library. Just because a library isn't patched often, doesn't mean that they don't have any problems. It might just mean that they aren't fixing them ...


7

All updates are digitally signed by Microsoft's private key, you will get warnings if any updates are not signed, or signed with the wrong key. Even if a MiTM was able to send fake updates they'd be rejected by the update utility for that reason.


7

The general rule of thumb is to apply the updates in a test or parallel environment, run tests, then approve for general release. In some cases, people will apply patches to live environments but on lower priority servers and be willing to suffer outages on the less critical systems. BUT, because of the criticality of a lot of patches, it is also advised ...


7

The Linux kernel itself is not affected. The part responsible for WPA is wpasupplicant. From the Changelog: Version: 2.1-0ubuntu1.5 2017-10-16 17:06:43 UTC wpa (2.1-0ubuntu1.5) trusty-security; urgency=medium SECURITY UPDATE: Multiple issues in WPA protocol debian/patches/2017-1/*.patch: Add patches from Debian jessie CVE-2017-...


7

You've misread or mistranslated several things. Debian is not doing any data collection and it is downloading, not uploading. Upgrades do not upload anything. The only data that's sent from your computer is the requests to download the updated list of package versions and the package files for the packages that you install or update. The mirror from which ...


6

Well the whole point of updating/patching anything is to fix known vulnerabilities. Any bugs/vulnerabilities found in the version of firefox you're running could be exploitable. Updating your browser will modify how the browser works and result in those vulnerabilities being no longer exploitable. It's really as simple as that. Updating can also introduce ...


6

Your problem here is that you are looking at Linux management as it was Windows management. In Linux, all distros have repositories of packages that handle the versions of the software available to that specific distro. You can look at these repositories as a WSUS, but it's not something that you manage but someone else does. Depending of the package ...


6

Take a look at man apt-secure, apt has done signature checks on release files for well over a decade. The release file contains a hash of all files in the package, and the release file gets signed by a trusted key that is included in the original installation media. It looks like md5 is still widely used here, which is concerning but not necessarily a deal-...


Only top voted, non community-wiki answers of a minimum length are eligible