182
votes
Accepted
How can I argue against: "System is unhackable so why patch vulnerabilities?"
The trouble with the situation (as you are reporting it) is that there are a lot of assumptions being made with a lot of opinions. You have your opinions and you want them to share your opinions, but ...
- 123k
68
votes
How can I argue against: "System is unhackable so why patch vulnerabilities?"
If someone tells me that their machine is not hackable and I ought to believe them, I immediately conclude that
The machine is kept guarded under Fort Knox/High security prison conditions, with 24/7 ...
- 873
41
votes
How can I argue against: "System is unhackable so why patch vulnerabilities?"
Because you want a multi-layered security strategy with defence in depth. You have a firewall, but what if there's a security vulnerability in your firewall? What if some application exploit gives ...
- 10.1k
32
votes
Accepted
Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?
It depends on how your organization uses these kind of reports.
If the people responsible for planning and/or implementing security controls read these documents once and then never look at them ...
- 7,913
17
votes
Accepted
Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners
How could a IANA reserved port(tcp/0) handle traffic?
It can. Generally, TCP (or UDP) port 0 being in a reserved state doesn't mean it can't be used in practice. Though the way Berkeley sockets are ...
- 3,445
10
votes
Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?
As a customer of vulnerability reports, I would say yes, but it is certainly a waste of time to give it equal weight as other vulnerabilities. E.g., live, exploitable massive remote access holes or ...
- 7,535
10
votes
Is "Discoverability = low" an acceptable reason to reduce the risk of a vulnerability?
Low discoverability doesn't necessarily mean "security by obscurity". It could just mean that the vulnerability lies deep in a portion of functionality that's rarely ever investigated. It could also ...
- 654
9
votes
Accepted
Security risks of using ffmpeg as part of web service
Yes there are security risks, especially if you allow arbitrary formats. FFmpeg supports a huge variety of formats, both popular and obscure, for video, audio, and images. Any vulnerability in ...
- 64k
6
votes
How can I argue against: "System is unhackable so why patch vulnerabilities?"
There are no unhackable systems. For those mentioning airgapping, there are plenty of examples of actual hacks or potential hacks on airgapped systems. Stuxnet is probably the most famous (and most ...
- 61
6
votes
Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?
First of all you need to have a scope of what you are scanning for and what you are reporting on.
For example is the scope of the scanning to discover and report on all vulnerabilities including low ...
- 7,629
6
votes
Accepted
How to maintain balance between integrity and client satisfaction in vulnerability assessments
Sounds like you're doing security assessments for compliance reasons, but I see no mention of compensating controls, acceptable risks, remediation plans in action, etc.
This whole question is really ...
- 22.5k
6
votes
Is "Discoverability = low" an acceptable reason to reduce the risk of a vulnerability?
I'm on the side that doesn't like the use of discoverability. It's poorly defined and for any given definition, people are especially bad at guessing at a measure for it.
There exists a measure of ...
- 3,339
5
votes
Accepted
How do pentesters approach a large complex network?
All security tests will have a scope and its this scope that would typically drive the process of the review.
So I'm assuming from the question that you're thinking about a network based review as ...
- 60.7k
5
votes
How can I argue against: "System is unhackable so why patch vulnerabilities?"
No system is truly "unhackable." However once we have decided that a system is "unhackable" enough then we do not have to maintain a channel for security patches.
For a concrete example, our "...
- 1,560
4
votes
Buffer Overflow doesn't have enough space for exploit after being crashed
Assuming that you're talking about a vanilla EIP overwrite and not something like SEH, you have two options available to you. Neither of these are what I would consider to be "beginner" techniques as ...
- 9,207
4
votes
Why are the CVSS scores differ so much between Redhat and NVD page?
Working out the inputs to the calculations is very subjective:
Take the CVSSv2:
RH: AV:N/AC:M/Au:N/C:P/I:P/A:P
NVD: AV:N/AC:L/Au:N/C:C/I:C/A:C
Both agree the Attack Vector is Network, and the ...
- 1,949
4
votes
How can I argue against: "System is unhackable so why patch vulnerabilities?"
The fact that they can't think of (right now) on a way to hack it, does not mean that it is "unhackable". That is why, as a principle, we apply all security patches, even if it's on a component that ...
- 17.4k
4
votes
Accepted
How to rate a CVSS Score if OS/compiler vulnerablity mitigations are highly likely but not guaranteed?
The CIA scores are indications of the impact of a succesful exploitation. The CVSS is meant to rate the severity of the vulnerability, not the risk. So that it's hard to exploit is not sufficiently ...
- 28.6k
4
votes
Security for a Windows application running in a corporate network
Yes, it is important to fix vulnerabilities inside a corporate environment, even if these hosts are not internet-facing.
Why? Because if the endpoint is used by an employee, it can be compromised via ...
- 56
3
votes
How can I argue against: "System is unhackable so why patch vulnerabilities?"
feel that the machine is not hackable
Feelings do not matter. Facts do.
Go back to your risk assessment and/or threat model. Look if patching or keeping the software up-to-date was part of your risk ...
- 9,994
3
votes
How can I argue against: "System is unhackable so why patch vulnerabilities?"
the engineers who designed the original product feel that the machine
is not hackable
The engineers who designed the Titanic felt that it was unsinkable.
The problem in IT is that people see no ...
- 319
3
votes
How can I argue against: "System is unhackable so why patch vulnerabilities?"
“System is unhackable so why patch vulnerabilities?” In your question, you're trying to argue against a fallacy and an unprovable argument ("How do you know that it's 'unhackable'? Or do you just ...
- 31
3
votes
Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners
How could a IANA reserved port(tcp/0) handle traffic?
While the accepted answer explains how port 0 is still a real port, it may be helpful to understand how ports work in TCP. Below is a 32-bit-wide ...
- 64k
3
votes
How do pentesters approach a large complex network?
The question is selective & is about approaches to the penetration testing methodology followed on a large scale network. To be precise, there needs to be a scope of work which could be mapped ...
- 1,592
3
votes
Accepted
owasp top 10 2017 automation
It's a good idea to want to approach this problem with automation. The OWASP list itself, however, is not a list of vulnerabilities, where a vulnerability is a known bad version of publicly-released ...
- 3,339
3
votes
Are there any known vulnerabilities in libre office password protection for *.odt files?
According to the OpenDocument Specification, these files use a strong encryption with no known flaws.
...This digest is used to produce a derived key by undergoing key stretching with PBKDF2
...ODF 1....
- 112
3
votes
Accepted
Is it reasonable to provide admin access for a PCI vulnerability scan?
Is this a standard part of vulnerability scanning as far as PCI is concerned?
No, it's unusual, and having worked with 4-5 different auditors, I've never been asked for that.
It's much more common ...
- 71.7k
3
votes
Accessing user data by a public 'token' - is it a potential vunabilility?
Token ids are a common tool. They originate into the 80's where the Kerberos protocol used a random token to identify a user for a period of time without requiring to give again a password.
The ...
- 25.5k
Only top scored, non community-wiki answers of a minimum length are eligible