Serious Discussion Security configuration Gurus

Practical Response

Level 7
Thread author
Mar 10, 2024
340
Correct me if I’m wrong, but isn’t there enterprise server security? I’d assume that would block breaches on the server side. Even if a breach is done, wouldn’t there be investigation response through these solutions as well?
Servers can have multitudes of vulnerabilities in various forms, including: outdated software versions, software bugs, configuration lapses, and coding errors. Since many servers as stated before can not take the time down to properly patch and adjust the servers or from lack of funding ect, exploitable vulnerability exists. If these services you presented were able to negate those that would be great for everyone, but simply it is not the case, all one has to do is sift through the security news feed here too see breaches happen often, data is stolen often, and usually from vulnerable servers and websites.
 

Sandbox Breaker

Level 9
Verified
Well-known
Jan 6, 2022
435
Full Zero Trust (App, Network, Devices, Cloud), constant log/alert review, active threats hunting and research, consistent compromise assesments, ETC...

Even doing the whole textbook and all theoretically possible things we can do... The risk still remains. Agnostic of whatever OS, device and technology used.

Security can lead one into madness.
 

Sandbox Breaker

Level 9
Verified
Well-known
Jan 6, 2022
435
Being paranoid has made me good at my job. Plus I like it :p
1711634865732.png

1711634887341.png

Reminds me of the Vault7 Leak and the CIA thinking Comodo users are paranoid.
 

blackice

Level 38
Verified
Top Poster
Well-known
Apr 1, 2019
2,787
Being paranoid has made me good at my job. Plus I like it :p
I believe the problem for a lot of users, even those who are very tech savvy, is they start off enjoying intense security and then it wears them down and they lose interest. I used to use ESET with tons of firewall and HIPS rules, I no longer do this.
 

LennyFox

Level 7
Jan 18, 2024
308
Please explain. Are you afraid that webshops misuse your (few) bank account data or that hackers of those sites do so?
Not afraid that those websites misuse it. With Dutch payment systems, there is no need for webshops to know my bankaccount number (e.g ideal selects the correct bankaccount number when you purchase something).

Webshops know my bankaccount number when the order is paid and they have to keep that data for a few years according to tax law.

When you don't have registeted as returning user, the ordering data is usually 'dropped' to back office systems (e.g. accounting) after 2 weeks.

Usually back office systems are better secured (and updated) than front office systems needing to be online (and exposed) 24x7.

So not registrating as client, reduces your digital footprint. This helps (makes it harder) when those webshops might leak data or might be breachef.
 
Last edited:

LennyFox

Level 7
Jan 18, 2024
308
With this scenario, are you talking about Stored XSS?
Needs to be, when it is persistent, (at least to my knowledge) . There is not much end users can do when that happens.So I am asking what is the point worrying about it? On the other hand when ##### really hits the fan, adding multiple layers of protection also does not help. With that in mind I agree with the OP. This is also the reason why I explained I don't register as client with all webshops anymore. In server side infection scenario's safe hex is of more use that adding triple or quadruple layers of protection on my PC (and sympathize with @oldschool 's "stay safe, not paranoid").
 
Last edited:

wat0114

Level 12
Verified
Top Poster
Well-known
Apr 5, 2021
571
Needs to be, when it is persistent, (at least to my knowledge) . There is not much end users can do when that happens (so what is the point worrying about it).

So I was wondering about this. What about a browser extension such as NoScript or uBlockO, both of which can block 3rd-party scripts and in the case of NS, has built-in XSS protection? Also, do most browsers have some sort of XSS protection built-in to their code? Persistent XSS is so dangerous because it's stored on the server side, so a web visitor has no control over that, but could a browser extension like the ones I mention or even the browser used mitigate against this?
 

LennyFox

Level 7
Jan 18, 2024
308
So I was wondering about this. What about a browser extension such as NoScript or uBlockO, both of which can block 3rd-party scripts and in the case of NS, has built-in XSS protection? Also, do most browsers have some sort of XSS protection built-in to their code? Persistent XSS is so dangerous because it's stored on the server side, so a web visitor has no control over that, but could a browser extension like the ones I mention or even the browser used mitigate against this?
NoScript and Netcraft only offer protection from 1 out of 3 XSS scenario's. I dove into that a few years ago, so knowledge has sunken away (only remembered they offered partial protection, because it is simply impossible to detect all). Enabling Edge's super duper mode reduces a lot of the risks of XSS attacks (because the stored XSS attacks need loopholes like unpatched vulnabilities which are easier to exploit with JIT enabled).

1711649559161.png
 
Last edited:

wat0114

Level 12
Verified
Top Poster
Well-known
Apr 5, 2021
571
I found the following post from Harborfront from a few years ago:


With blocking of 3rd-party scripts and CSP policy, it makes sense that this would help to protect against persistent XSS, but of course if the user allows the malicious script unknowingly, then it's game over.
 

LennyFox

Level 7
Jan 18, 2024
308
I found the following post from Harborfront from a few years ago:


With blocking of 3rd-party scripts and CSP policy, it makes sense that this would help to protect against persistent XSS, but of course if the user allows the malicious script unknowingly, then it's game over.
You need hard mode, medium mode would not be sufficient (script could also be pulled in via XMLHTTPrequest and executed just in time). But as Harborfront mentions, Content Security Policies habe reduced the attack surface against XSS a lot (Edge's super duper mode closes itfurther). I am not really worrying about it.
 

wat0114

Level 12
Verified
Top Poster
Well-known
Apr 5, 2021
571
No worries here either, just bringing it up for discussion because of the question being asked by the OP, and that I think most people don't know or think about XSS in their daily browsing. Btw, I have Edge installed in Linux but I don't see Super Duper mode option for it.

The link is old, but it discusses XSS, including the benefits of CSP, in depth in an easy to understand format:

 

Practical Response

Level 7
Thread author
Mar 10, 2024
340
With this scenario, are you talking about Stored XSS?
No I was referring to network Trojans embedded and filtering from the server, usually mimicking legit applications or code, intercepting traffic before it reaches out. Such as ISP servers ect, not necessarily website based as XXS. Certainly not something you can block with noscript.
 
Last edited:
  • Hundred Points
Reactions: Trident

LennyFox

Level 7
Jan 18, 2024
308
No I was referring to network Trojans embedded and filtering from the server, usually mimicking legit applications or code, intercepting traffic before it reaches out. Such as ISP servers ect, not necessarily website based as XXS. Certainly not something you can block with noscript.
So you are asking what are our thoughts about security measures when we are hit by a bus (laying splattered on the ground)?

In that scenario I would choose safe habits (you know what we learn kids to look left-right-left or (only mentioning the left driving countries I have visited :) ) in UK/Ireland/Australia/New Zealand/South Africa/Namibia/Malawi/Tanzania/Kenia/Indonesia/Malaysia/Thailand/Japan/India/Sri Lanka right-left-right before crossing the street).
 
Last edited:
  • +Reputation
Reactions: Trident

Practical Response

Level 7
Thread author
Mar 10, 2024
340
So you are asking what are our thoughts about security measures when we are hit by a bus (laying splattered on the ground)?

In that scenario I would choose safe habits (you know what we learn kids to look left-right-left or (only mentioning the left driving countries I have visited :) ) in UK/Ireland/Australia/New Zealand/South Africa/Namibia/Malawi/Tanzania/Kenia/Indonesia/Malaysia/Thailand/Japan/India/Sri Lanka right-left-right before crossing the street).
This is not a scenario as much as a reality I'm trying to impart. Once information leaves one's devices and networks, it's out of their control as to what may happen with it. Those servers and websites their information travels through and too, are not as secure as one would think or hope to be.

On the system and networks, those good habits will negate most issues, certainly minimize any damage that could occur. Creating images storing them offline, backing up personal items such as documents, photos, videos ect storing them offline on an external device, leaving nothing on the system. This will make one's life much easier all the way around. If one were to be hit by something nasty on their personal device, with these habits deployed, they could simply wipe and re-image the machine and the problem is solved. This means they do not have to chance backing up items now the machine is infected, possibly bringing the infection within the back up effectively losing personal items. Even if a user does not feel comfortable trying to use imaging software, with items backed up they can reset windows. Once their personal stuff is backed up to a external devices they can access it at any time for items such a as documents ect by plugging it in to the system. If they keep the external devices organized, backing up becomes easier and so does finding items one may need such as a pdf to send off.

As for websites using an ad blocker is a good start, but over all being careful where you visit by "researching" sites before enter, even something as simple as highlighting, copying a url to scan on Virus Total could save you a headache. Being careful where and how much information you divulge, now this part, is important. Just as this website, one does not have to include accurate information such as names ect, the less accurate information you bestow upon sites like social sites ect, the less likely you will have a problem such as identity theft ect.

There are those convinced that all they need is layers of security, to bolster the system, in which they simply state they do not have time to have good habits. This leads to a false sense of security, adding more bugs to the system from misconfigurations "lack of understanding the product/settings" and of course development, and basically expanding the attack surface while still leaving all your personal items at jeopardy. One could look at the former and then the latter and realize that with good habits in place, as once they are, they are easier to maintain, that chances of an issue are much more survivable in the long run. As a species we tend to think we control everything, the universe, all variables and outcomes, this is not true and often remembered when one has their world altered. There are those of the malicious type that will portray this as they try to dominate the world, take what is not theirs, smash and hurt others for their benefit. We take away that control when we establish contingencies in place to minimize anything they could possibly try.
 
Last edited:

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top