quarta-feira, 31 de maio de 2023

One Reason Why InfoSec Sucked In The Past 20 Years - The "Security Tips" Myth

From time to time, I get disappointed how much effort and money is put into securing computers, networks, mobile phones, ... and yet in 2016 here we are, where not much has changed on the defensive side. There are many things I personally blame for this situation, and one of them is the security tips.

The goal of these security tips is that if the average user follows these easy to remember rules, their computer will be safe. Unfortunately, by the time people integrate these rules into their daily life, these rules either become outdated, or these rules were so oversimplified that it was never true in the first place. Some of these security tips might sound ridiculous to people in InfoSec nowadays, but this is exactly what people still remember because we told them so for years.

PDF is safe to open

This is an oldie. I think this started at the time of macro viruses. Still, people think opening a PDF from an untrusted source is safer than opening a Word file. For details why this is not true, check: https://www.cvedetails.com/vulnerability-list/vendor_id-53/product_id-497/Adobe-Acrobat-Reader.html
On an unrelated note, people still believe PDF is integrity protected because the content cannot be changed (compared to a Word document).
Image stolen from Kaspersky

Java is secure

One of the best ones. Oracle started marketing Java as a safe language, where buffer overflows, format strings and pointer-based vulnerabilities are gone. Unfortunately, they forgot to tell the world that instead of "unsafe programs developed by others" they installed their unsafe program on 3 billion devices. 

Stay away from rogue websites and you will be safe

This is a very common belief I hear from average people. "I only visit some trusted news sites and social media, I never visit those shady sites." I have some bad news. At the time of malvertising and infected websites, you don't have to visit those shady sites anymore to get infected.

Don't use open WiFi

I have a very long explanation of why this makes no sense, see here. Actually, the whole recommendation makes no sense as people will connect to public WiFis, no matter what we (InfoSec) recommend.

The password policy nightmare

Actually, this topic has been covered by myself in two blog posts, see here and here. Long story short: use a password manager and 2-factor authentication wherever possible. Let the password manager choose the password for you. And last but not least, corporate password policy sux.

Sites with a padlock are safe

We tell people for years that the communication with HTTPS sites are safe, and you can be sure it is HTTPS by finding a randomly changing padlock icon somewhere next to the URL. What people hear is that sites with padlocks are safe. Whatever that means. The same goes for WiFi - a network with a padlock is safe.

Use Linux, it is free from malware

For years people told to Windows users that only if they would use Linux they won't have so much malware. Thanks to Android, now everyone in the world can enjoy malware on his/her Linux machine.

OSX is free from malware

It is true that there is significantly less malware on OSX than on Windows, but this is an "economical" question rather than a "security" one. The more people use OSX, the better target it will become. Some people even believe they are safe from phishing because they are using a Mac!

Updated AV + firewall makes me 100% safe

There is no such thing as 100% safe, and unfortunately, nowadays most malware is written for PROFIT, which means it can bypass these basic protections for days (or weeks, months, years). The more proactive protection is built into the product, the better!

How to backup data

Although this is one of the most important security tips which is not followed by people, my problem here is not the backup data advise, but how we as a community failed to provide easy to use ways to do that. Now that crypto-ransomware is a real threat to every Windows (and some OSX) users, even those people who have backups on their NAS can find their backups lost. The only hope is that at least OSX has Time Machine which is not targeted yet, and the only backup solution which really works.
The worst part is that we even created NAS devices which can be infected via worms ...

Disconnect your computer from the Internet when not used

There is no need to comment on this. Whoever recommends things like that, clearly has a problem.

Use (free) VPN to protect your anonimity

First of all. There is no such thing as free service. If it is free, you are the service. On another hand, a non-free VPN can introduce new vulnerablities, and they won't protect your anonymity. It replaces one ISP with another (your VPN provider). Even TOR cannot guarantee anonymity by itself, and VPNs are much worse.

The corporate "security tips" myth

"Luckily" these toxic security tips have infected the enterprise environment as well, not just the home users.

Use robots.txt to hide secret information on public websites

It is 2016 and somehow web developers still believe in this nonsense. And this is why this is usually the first to check on a website for penetration testers or attackers.

My password policy is safer than ever

As previously discussed, passwords are bad. Very bad. And they will stick with us for decades ...

Use WAF, IDS, IPS, Nextgen APT detection hibber-gibber and you will be safe

Companies should invest more in people and less into magic blinking devices.

Instead of shipping computers with bloatware, ship computers with exploit protection software
Teach people how to use a password safe
Teach people how to use 2FA
Teach people how to use common-sense

Conclusion

Computer security is complex, hard and the risks change every year. Is this our fault? Probably. But these kinds of security tips won't help us save the world. 

More information

eWPT - Web Application Penetration



 The eWPT - Web Application Penetration Testing Professional course from the popular eLearnSecurity Institute and INE is an advanced web penetration testing course. Prerequisites for this course Completion of the eJPT courseIs. The eWPT course is one of the most popular courses in the field of web penetration testing or web hacking. This course is usually compared to the AWAE course from Offensive-Security and the SEC542 course from SANS. This course starts from a complete beginner in the field of web penetration testing and its topics continue to an advanced level. In this course you will gain an in-depth understanding of OWASP, Burpsuite software, complete web application analysis, data collection, common bugs such as XSS and SQL Injection, Session-based vulnerabilities, as well as LFI / RFI, attacks On HTML, content management systems (CMS) penetration testing such as WordPress, penetration testing of SQL and non-SQL databases. 


Course pre requisites

Completion of the eJPT course
Course specifications
Course level: Intermediate
Time: 16 hours and 18 minutes
Includes: ‌ 30 videos | 18 labs | ‌ 15 slides
Professor: Dimitrios Bougioukas
EWPT Course Content - Web Application Penetration Testing Professional
Web Application Penetration Testing
Penetration Testing Process
Introduction
Information Gathering
Cross Site Scripting
SQL Injections
Authentication and Authorization
Session Security
Flash
HTML5
File and Resources Attacks
Other Attacks
Web Services
XPath
Penetration Testing Content Management Systems
Penetration Testing NoSQL Databases

Continue reading


  1. Growth Hacker Tools
  2. Hacker Tools For Pc
  3. Tools 4 Hack
  4. Pentest Tools Find Subdomains
  5. Hacking Tools Online
  6. What Is Hacking Tools
  7. Hacker
  8. Hack Tool Apk No Root
  9. Wifi Hacker Tools For Windows
  10. Hacking Apps
  11. Best Hacking Tools 2020
  12. Tools 4 Hack
  13. Hacking Tools Usb
  14. Beginner Hacker Tools
  15. Blackhat Hacker Tools
  16. Hacker Tools Linux
  17. Hacking Tools Download
  18. Easy Hack Tools
  19. Pentest Automation Tools
  20. How To Make Hacking Tools
  21. Hacker Tool Kit
  22. Hack Rom Tools
  23. Hacks And Tools
  24. Pentest Tools Port Scanner
  25. Hack Rom Tools
  26. Hacking Tools For Beginners
  27. Nsa Hacker Tools
  28. Hacker Tools Free
  29. Termux Hacking Tools 2019
  30. Growth Hacker Tools
  31. Hack Tools
  32. Best Hacking Tools 2019
  33. Pentest Tools For Android
  34. Hacking App
  35. Hacking Tools Pc
  36. Hack Apps
  37. Hacking Tools Free Download
  38. Hacking Tools Mac
  39. Pentest Tools Windows
  40. Nsa Hack Tools Download
  41. Growth Hacker Tools
  42. Hacking Tools Windows 10
  43. Pentest Tools Subdomain
  44. Hacking Tools For Mac
  45. Pentest Box Tools Download
  46. Hacking Tools For Mac
  47. Tools Used For Hacking
  48. Nsa Hack Tools
  49. Android Hack Tools Github
  50. Best Hacking Tools 2020
  51. Android Hack Tools Github
  52. Hack Tools 2019
  53. Pentest Tools Review
  54. Pentest Tools Subdomain
  55. Pentest Tools For Ubuntu
  56. Pentest Tools Android
  57. Hacking Tools For Windows 7
  58. Pentest Tools Website
  59. Hacker Techniques Tools And Incident Handling
  60. Hack Tools
  61. Hacker Tools For Pc
  62. Hacking Tools Hardware
  63. Hack Tool Apk No Root
  64. Pentest Tools Kali Linux
  65. Pentest Reporting Tools
  66. Free Pentest Tools For Windows
  67. New Hacker Tools
  68. Hacker Tools Windows
  69. Pentest Recon Tools
  70. Hacker Tools Free Download
  71. Pentest Tools Kali Linux
  72. Hacker Tools Software
  73. Hack Tools For Mac

Top Linux Commands Related To Hardware With Descriptive Definitions


Commands in Linux are just the keys to explore and close the Linux. As you can do things manually by simple clicking over the programs just like windows to open an applications. But if you don't have any idea about commands of Linux and definitely you also don't know about the Linux terminal. You cannot explore Linux deeply. Because terminal is the brain of the Linux and you can do everything by using Linux terminal in any Linux distribution. So, if you wanna work over the Linux distro then you should know about the commands as well. In this blog you will exactly get the content about Linux hardware commands which are related to CPU and memory processes.

dmesg

The dmesg command is used in Linux distribution for the sake of detecting hardware and boot messages in the Linux system.

cat /proc/cpuinfo

The cat command is basically used to read something over the terminal like cat index.py will display all the content which exist in index.py over the terminal. So cat /proc/cpuinfo will display the model of the CPU over the terminal.

cat /proc/meminfo

This command is similar to the above command but the only difference is that this command shows the information of hardware memory over the terminal. Because it will open the memory info file over the terminal.

cat /proc/interrupts

This command is also similar to the above command but there is the difference of one thing that this command will display lists the number of interrupts per CPU per input output device.

lshw

This command is used in Linux operating system to displays information on hardware configuration of the system in Linux.

lsblk

The "lsblk" command is used in Linux operating system to displays block device related information in the Linux operating system.

dmidecode

The "dmidecode" command is used in Linux distributions to display the information about hardware from the BIOS.

hdparm -i /dev/sda

The hdparm command basically used to display the information about the disks available in the system. If you wanna know the information about the "sda" disk so just type "hdparm -i /dev/sda" and if you wanna know the information about "sdb" so just type "hdparm -i /dev/sdb".

hdparm -tT

The "hdparm" command is used for displaying the information about disks as we discussed in above command. If you wanna do a read speed test on the disk sda or sdb just type the command "hdparm -tT /dev/sda".

badblocks -s /dev/sda

This command is used in linux to display test operations for unreadable blocks on disk sda. If the command is like "badblocks -s /dev/sdb" it will display test operations for unreadable blocks on disk sdb.More information
  1. Hack Apps
  2. Hacking Tools Download
  3. Hacker Tools Free Download
  4. Hacking Tools Hardware
  5. Hacker Tools Windows
  6. Pentest Tools Online
  7. Computer Hacker
  8. How To Install Pentest Tools In Ubuntu
  9. Hacker Tool Kit
  10. Pentest Tools Online
  11. Pentest Tools Kali Linux
  12. Hacking Tools Kit
  13. Hacker Tools Github
  14. Hacker Tools For Mac
  15. Hacker Tools For Windows
  16. Hacking Tools And Software
  17. Hacking Tools Github
  18. Pentest Automation Tools
  19. How To Install Pentest Tools In Ubuntu
  20. Hack Apps
  21. Hacking Tools Usb
  22. Hack Tools For Windows
  23. Hacker Hardware Tools
  24. Hack Tools For Ubuntu
  25. Pentest Tools Windows
  26. Pentest Tools Bluekeep
  27. How To Install Pentest Tools In Ubuntu
  28. Hack Tool Apk No Root
  29. Hackrf Tools
  30. Top Pentest Tools
  31. Pentest Tools Github
  32. Hacker Tool Kit
  33. Hacking Tools Free Download
  34. Nsa Hack Tools
  35. Pentest Automation Tools
  36. Hack Rom Tools
  37. Pentest Tools Website Vulnerability
  38. Pentest Tools Nmap
  39. Hacker Search Tools
  40. Hacking App
  41. Pentest Tools Subdomain
  42. Hack Tools For Ubuntu
  43. Hacking Tools For Windows
  44. Nsa Hack Tools Download
  45. Hacker Techniques Tools And Incident Handling
  46. Pentest Tools Subdomain
  47. Hack Tools
  48. Hacking Tools And Software
  49. Pentest Tools Subdomain
  50. Hacker Tools For Ios
  51. Hacker Tools Windows
  52. Hacker Search Tools
  53. New Hacker Tools
  54. Free Pentest Tools For Windows
  55. Hacker Tools Free
  56. Hacker Tools Apk Download
  57. New Hacker Tools
  58. Pentest Tools For Mac
  59. Pentest Tools Free
  60. Blackhat Hacker Tools
  61. Hacker Tools List
  62. Game Hacking
  63. Best Hacking Tools 2019
  64. Hacker Hardware Tools
  65. Kik Hack Tools
  66. Pentest Tools Url Fuzzer
  67. Hacker Tools Apk Download
  68. Pentest Tools Open Source
  69. New Hacker Tools
  70. Growth Hacker Tools
  71. Hacker Tools Github
  72. Hacking Tools For Pc
  73. Hacker Tools List
  74. Hacker Security Tools
  75. Hack Tools 2019
  76. Hacker Tools Hardware
  77. Hack Rom Tools
  78. Kik Hack Tools
  79. Free Pentest Tools For Windows
  80. Hacking Tools For Windows 7
  81. Hacking Tools For Kali Linux
  82. Hacking Tools 2020
  83. Pentest Tools List
  84. Hacking Apps
  85. Pentest Reporting Tools
  86. Hack Rom Tools
  87. Pentest Automation Tools
  88. Pentest Tools For Ubuntu
  89. Black Hat Hacker Tools
  90. Hacking Tools Pc
  91. Hacker Tool Kit
  92. Hack And Tools
  93. Pentest Automation Tools
  94. Hack Website Online Tool
  95. Hacker Hardware Tools
  96. Pentest Tools Github
  97. Pentest Tools Framework
  98. Tools For Hacker
  99. Hack Website Online Tool
  100. Hack And Tools
  101. Pentest Tools Alternative
  102. Hacker Tools Free
  103. Hacker Tools Linux
  104. Hacker Tools For Windows
  105. Growth Hacker Tools
  106. Pentest Tools Review
  107. Pentest Tools Bluekeep
  108. Pentest Automation Tools
  109. Hacking Tools Online
  110. Hacking Tools For Windows 7
  111. Hacker Tools Free
  112. Pentest Tools Kali Linux
  113. Best Hacking Tools 2020
  114. Hacking Tools Mac
  115. Underground Hacker Sites
  116. Hack Tools Mac
  117. Wifi Hacker Tools For Windows
  118. Hacker Tools Linux
  119. Nsa Hacker Tools
  120. Pentest Tools Free
  121. Pentest Tools Github
  122. Kik Hack Tools
  123. Install Pentest Tools Ubuntu
  124. Free Pentest Tools For Windows
  125. Hacker Tools List
  126. Hacker Tools Mac
  127. Pentest Tools Android
  128. Hacking Tools Usb
  129. Best Pentesting Tools 2018
  130. Hacking Tools Kit
  131. Hacker Tools For Ios
  132. Hacker Tools For Windows
  133. Hacker Tools For Pc
  134. Free Pentest Tools For Windows
  135. Hacking Tools Kit
  136. Pentest Tools Free
  137. Pentest Reporting Tools
  138. Hacking Tools Hardware
  139. Hack Rom Tools
  140. Hack And Tools
  141. Pentest Recon Tools
  142. Pentest Tools For Windows
  143. Hack Tools For Windows
  144. Nsa Hacker Tools
  145. Tools 4 Hack
  146. Hack Tools For Pc
  147. Install Pentest Tools Ubuntu
  148. Pentest Reporting Tools
  149. Hackers Toolbox
  150. How To Make Hacking Tools
  151. Nsa Hack Tools
  152. Pentest Tools For Ubuntu
  153. Hacker Tools Hardware
  154. Hack Tools
  155. Hack Tools Download
  156. Hack Tools Online