180
The trouble with the situation (as you are reporting it) is that there are a lot of assumptions being made with a lot of opinions. You have your opinions and you want them to share your opinions, but they have their own opinions.
If you want to get everyone to agree to something, you need to find common ground. You need to challenge and confirm each ...
67
If someone tells me that their machine is not hackable and I ought to believe them, I immediately conclude that
The machine is kept guarded under Fort Knox/High security prison conditions, with 24/7 guards and security cameras,
and also one of the following:
The machine has no exchange of information of any kind (no usb, ethernet, firewire, serial, ...
42
Because you want a multi-layered security strategy with defence in depth. You have a firewall, but what if there's a security vulnerability in your firewall? What if some application exploit gives user-level OS access, and then an unpatched OS vulnerability allows that to be escalated to root access? For proper security you need to patch all known ...
32
It depends on how your organization uses these kind of reports.
If the people responsible for planning and/or implementing security controls read these documents once and then never look at them again OR see them more as a guideline than actual rules on how to set up an environment, I can see that you might want to refrain from adding too much information ...
17
How could a IANA reserved port(tcp/0) handle traffic?
It can. Generally, TCP (or UDP) port 0 being in a reserved state doesn't mean it can't be used in practice. Though the way Berkeley sockets are designed it's not that easy to bind on port zero, it's nevertheless possible to use it.
However, it's highly unlikely that this is actually happening in your ...
10
As a customer of vulnerability reports, I would say yes, but it is certainly a waste of time to give it equal weight as other vulnerabilities. E.g., live, exploitable massive remote access holes or active malicious backdoors wouldn't get the same coverage as something like a DoS vulnerability or in this case a vulnerability in a disabled bit of software.
...
10
Low discoverability doesn't necessarily mean "security by obscurity". It could just mean that the vulnerability lies deep in a portion of functionality that's rarely ever investigated. It could also mean that discovery would require a corner case so narrow that even the initial discovery was unlikely to have ever happened. Such examples would be Dirty COW ...
7
Yes there are security risks, especially if you allow arbitrary formats. FFmpeg supports a huge variety of formats, both popular and obscure, for video, audio, and images. Any vulnerability in decoders for any of the numerous formats could be exploited to gain arbitrary code execution. This becomes even more likely given the fact that FFmpeg is written in C, ...
6
There are no unhackable systems. For those mentioning airgapping, there are plenty of examples of actual hacks or potential hacks on airgapped systems. Stuxnet is probably the most famous (and most extreme) example. Some others include van Eck phreaking, acoustic analysis, or other side channel attacks.
There are ways to mitigate vulnerabilities that don't ...
6
First of all you need to have a scope of what you are scanning for and what you are reporting on.
For example is the scope of the scanning to discover and report on all vulnerabilities including low risk vulnerabilities, or just high risk one, or maybe just critical vulnerabilities. This should have been defined before you even started the vulnerability ...
6
Sounds like you're doing security assessments for compliance reasons, but I see no mention of compensating controls, acceptable risks, remediation plans in action, etc.
This whole question is really weird to me because from the information you've provided in your question, it seems like neither side of the business relationship -- either you or the client ...
6
I'm on the side that doesn't like the use of discoverability. It's poorly defined and for any given definition, people are especially bad at guessing at a measure for it.
There exists a measure of time and attention at which every piece of software is vulnerable, and every vulnerability, including ones you don't know you have, are discoverable.
There are ...
5
All security tests will have a scope and its this scope that would typically drive the process of the review.
So I'm assuming from the question that you're thinking about a network based review as opposed to a review of a specific application. With this kind of review the starting point is likely to be a set of IP address ranges that are in-scope of the ...
5
No system is truly "unhackable." However once we have decided that a system is "unhackable" enough then we do not have to maintain a channel for security patches.
For a concrete example, our "unhackable" system controls a security camera. The camera's job is to look at a fixed location. Every setting is either constant or the system is smart enough to ...
4
Assuming that you're talking about a vanilla EIP overwrite and not something like SEH, you have two options available to you. Neither of these are what I would consider to be "beginner" techniques as they require a bit of Assembly knowledge though there are some great websites that can help you out.
1. Employ an Egg Hunter. An egg hunter involves sticking ...
4
Working out the inputs to the calculations is very subjective:
Take the CVSSv2:
RH: AV:N/AC:M/Au:N/C:P/I:P/A:P
NVD: AV:N/AC:L/Au:N/C:C/I:C/A:C
Both agree the Attack Vector is Network, and the Authentication is None. But disagree with everything else.
NVD think the attack difficulty is easy and the impact is complete.
RH think the attack difficulty is ...
4
The fact that they can't think of (right now) on a way to hack it, does not mean that it is "unhackable". That is why, as a principle, we apply all security patches, even if it's on a component that shouldn't be accessible (eg. why patch a privilege escalation vulnerability if an attacker wouldn't even have user access?).
Now, they may be right, and not ...
4
The CIA scores are indications of the impact of a succesful exploitation. The CVSS is meant to rate the severity of the vulnerability, not the risk. So that it's hard to exploit is not sufficiently incorporated in the CVSS, and certainly not in the CIA scores.
So I think this vulnerability has CIA set to P at least. You can set access complexity (AC) to high ...
3
feel that the machine is not hackable
Feelings do not matter. Facts do.
Go back to your risk assessment and/or threat model. Look if patching or keeping the software up-to-date was part of your risk treatment plan. Look if outdated software was part of your risk analysis or threat model.
Go back to the engineers with these facts and discuss with them how ...
3
the engineers who designed the original product feel that the machine
is not hackable
The engineers who designed the Titanic felt that it was unsinkable.
The problem in IT is that people see no need to update a system, why change a working system? These companies then make the headlines: "4 factories were closed due to the x outbreak" or "Company x has ...
3
“System is unhackable so why patch vulnerabilities?” In your question, you're trying to argue against a fallacy and an unprovable argument ("How do you know that it's 'unhackable'? Or do you just think that since you can't hack it, no one else can?"). In the end however, I think it's going to come down to a discussion on risk acceptability and who is willing ...
3
How could a IANA reserved port(tcp/0) handle traffic?
While the accepted answer explains how port 0 is still a real port, it may be helpful to understand how ports work in TCP. Below is a 32-bit-wide diagram of the a TCP packet, to scale. UDP is similar, although a lot simpler (after the ports, it has just a length field and a checksum field before the data)...
3
The question is selective & is about approaches to the penetration testing methodology followed on a large scale network. To be precise, there needs to be a scope of work which could be mapped something like below:
This will be first hand information gathering phase & if you're into an Enterprise Network, I assume - all such info could be retained ...
3
It's a good idea to want to approach this problem with automation. The OWASP list itself, however, is not a list of vulnerabilities, where a vulnerability is a known bad version of publicly-released software or known bad configuration that can be scanned for, identified and rectified.
Instead, it is a list of what OWASP calls risks, which are classes of ...
3
According to the OpenDocument Specification, these files use a strong encryption with no known flaws.
...This digest is used to produce a derived key by undergoing key stretching with PBKDF2
...ODF 1.0 and 1.1 use Blowfish in 8-bit cipher feedback mode, while ODF 1.2 considers it a legacy algorithm and allows Triple DES and AES
However, like almost every ...
3
Your question does not distinguish between administrative privileges, and "highest privileges possible".
Where to go when you have elevated privileges?
"Elevated privileges" are not the highest you can go. Even though you might be administrator, the operating system kernel can still deny you access to some resources or to perform some actions. Furthermore, ...
3
Is this a standard part of vulnerability scanning as far as PCI is concerned?
No, it's unusual, and having worked with 4-5 different auditors, I've never been asked for that.
It's much more common for the auditor to request certain evidence - either the auditor 'rides shotgun' while you gather the evidence, or they trust you to gather the evidence - from ...
3
Token ids are a common tool. They originate into the 80's where the Kerberos protocol used a random token to identify a user for a period of time without requiring to give again a password.
The rationale is that only the legimate user should know the token, and that the duration of the token is short enough to have it to expire before it will be captured. ...
3
This is a good start, but a thorough assessment would need to go much deeper than this. For example:
How does the client generate random numbers? Does it use a CSPRNG? Or, does it use a weak random number generator, like the one used in early versions of Netscape Navigator, where a passive attacker was able to guess the random numbers generated for the ...
Only top voted, non community-wiki answers of a minimum length are eligible
