Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.
182 votes
Accepted

How can I argue against: "System is unhackable so why patch vulnerabilities?"

The trouble with the situation (as you are reporting it) is that there are a lot of assumptions being made with a lot of opinions. You have your opinions and you want them to share your opinions, but ...
user avatar
  • 123k
68 votes

How can I argue against: "System is unhackable so why patch vulnerabilities?"

If someone tells me that their machine is not hackable and I ought to believe them, I immediately conclude that The machine is kept guarded under Fort Knox/High security prison conditions, with 24/7 ...
user avatar
41 votes

How can I argue against: "System is unhackable so why patch vulnerabilities?"

Because you want a multi-layered security strategy with defence in depth. You have a firewall, but what if there's a security vulnerability in your firewall? What if some application exploit gives ...
user avatar
  • 10.1k
32 votes
Accepted

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

It depends on how your organization uses these kind of reports. If the people responsible for planning and/or implementing security controls read these documents once and then never look at them ...
user avatar
  • 7,913
17 votes
Accepted

Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners

How could a IANA reserved port(tcp/0) handle traffic? It can. Generally, TCP (or UDP) port 0 being in a reserved state doesn't mean it can't be used in practice. Though the way Berkeley sockets are ...
user avatar
  • 3,445
10 votes

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

As a customer of vulnerability reports, I would say yes, but it is certainly a waste of time to give it equal weight as other vulnerabilities. E.g., live, exploitable massive remote access holes or ...
user avatar
  • 7,535
10 votes

Is "Discoverability = low" an acceptable reason to reduce the risk of a vulnerability?

Low discoverability doesn't necessarily mean "security by obscurity". It could just mean that the vulnerability lies deep in a portion of functionality that's rarely ever investigated. It could also ...
user avatar
  • 654
9 votes
Accepted

Security risks of using ffmpeg as part of web service

Yes there are security risks, especially if you allow arbitrary formats. FFmpeg supports a huge variety of formats, both popular and obscure, for video, audio, and images. Any vulnerability in ...
user avatar
  • 64k
6 votes

How can I argue against: "System is unhackable so why patch vulnerabilities?"

There are no unhackable systems. For those mentioning airgapping, there are plenty of examples of actual hacks or potential hacks on airgapped systems. Stuxnet is probably the most famous (and most ...
user avatar
6 votes

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

First of all you need to have a scope of what you are scanning for and what you are reporting on. For example is the scope of the scanning to discover and report on all vulnerabilities including low ...
user avatar
  • 7,629
6 votes
Accepted

How to maintain balance between integrity and client satisfaction in vulnerability assessments

Sounds like you're doing security assessments for compliance reasons, but I see no mention of compensating controls, acceptable risks, remediation plans in action, etc. This whole question is really ...
user avatar
  • 22.5k
6 votes

Is "Discoverability = low" an acceptable reason to reduce the risk of a vulnerability?

I'm on the side that doesn't like the use of discoverability. It's poorly defined and for any given definition, people are especially bad at guessing at a measure for it. There exists a measure of ...
user avatar
  • 3,339
5 votes
Accepted

How do pentesters approach a large complex network?

All security tests will have a scope and its this scope that would typically drive the process of the review. So I'm assuming from the question that you're thinking about a network based review as ...
user avatar
  • 60.7k
5 votes

How can I argue against: "System is unhackable so why patch vulnerabilities?"

No system is truly "unhackable." However once we have decided that a system is "unhackable" enough then we do not have to maintain a channel for security patches. For a concrete example, our "...
user avatar
  • 1,560
4 votes

Buffer Overflow doesn't have enough space for exploit after being crashed

Assuming that you're talking about a vanilla EIP overwrite and not something like SEH, you have two options available to you. Neither of these are what I would consider to be "beginner" techniques as ...
user avatar
  • 9,207
4 votes

Why are the CVSS scores differ so much between Redhat and NVD page?

Working out the inputs to the calculations is very subjective: Take the CVSSv2: RH: AV:N/AC:M/Au:N/C:P/I:P/A:P NVD: AV:N/AC:L/Au:N/C:C/I:C/A:C Both agree the Attack Vector is Network, and the ...
user avatar
4 votes

How can I argue against: "System is unhackable so why patch vulnerabilities?"

The fact that they can't think of (right now) on a way to hack it, does not mean that it is "unhackable". That is why, as a principle, we apply all security patches, even if it's on a component that ...
user avatar
  • 17.4k
4 votes
Accepted

How to rate a CVSS Score if OS/compiler vulnerablity mitigations are highly likely but not guaranteed?

The CIA scores are indications of the impact of a succesful exploitation. The CVSS is meant to rate the severity of the vulnerability, not the risk. So that it's hard to exploit is not sufficiently ...
user avatar
  • 28.6k
4 votes

Security for a Windows application running in a corporate network

Yes, it is important to fix vulnerabilities inside a corporate environment, even if these hosts are not internet-facing. Why? Because if the endpoint is used by an employee, it can be compromised via ...
user avatar
  • 56
3 votes

How can I argue against: "System is unhackable so why patch vulnerabilities?"

feel that the machine is not hackable Feelings do not matter. Facts do. Go back to your risk assessment and/or threat model. Look if patching or keeping the software up-to-date was part of your risk ...
user avatar
  • 9,994
3 votes

How can I argue against: "System is unhackable so why patch vulnerabilities?"

the engineers who designed the original product feel that the machine is not hackable The engineers who designed the Titanic felt that it was unsinkable. The problem in IT is that people see no ...
user avatar
  • 319
3 votes

How can I argue against: "System is unhackable so why patch vulnerabilities?"

“System is unhackable so why patch vulnerabilities?” In your question, you're trying to argue against a fallacy and an unprovable argument ("How do you know that it's 'unhackable'? Or do you just ...
user avatar
  • 31
3 votes

Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners

How could a IANA reserved port(tcp/0) handle traffic? While the accepted answer explains how port 0 is still a real port, it may be helpful to understand how ports work in TCP. Below is a 32-bit-wide ...
user avatar
  • 64k
3 votes

How do pentesters approach a large complex network?

The question is selective & is about approaches to the penetration testing methodology followed on a large scale network. To be precise, there needs to be a scope of work which could be mapped ...
user avatar
3 votes
Accepted

owasp top 10 2017 automation

It's a good idea to want to approach this problem with automation. The OWASP list itself, however, is not a list of vulnerabilities, where a vulnerability is a known bad version of publicly-released ...
user avatar
  • 3,339
3 votes

Are there any known vulnerabilities in libre office password protection for *.odt files?

According to the OpenDocument Specification, these files use a strong encryption with no known flaws. ...This digest is used to produce a derived key by undergoing key stretching with PBKDF2 ...ODF 1....
user avatar
  • 112
3 votes
Accepted

Is it reasonable to provide admin access for a PCI vulnerability scan?

Is this a standard part of vulnerability scanning as far as PCI is concerned? No, it's unusual, and having worked with 4-5 different auditors, I've never been asked for that. It's much more common ...
user avatar
  • 71.7k
3 votes

Accessing user data by a public 'token' - is it a potential vunabilility?

Token ids are a common tool. They originate into the 80's where the Kerberos protocol used a random token to identify a user for a period of time without requiring to give again a password. The ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible