Jumat, 28 Agustus 2020

One Reason Why InfoSec Sucked In The Past 20 Years - The "Security Tips" Myth

From time to time, I get disappointed how much effort and money is put into securing computers, networks, mobile phones, ... and yet in 2016 here we are, where not much has changed on the defensive side. There are many things I personally blame for this situation, and one of them is the security tips.

The goal of these security tips is that if the average user follows these easy to remember rules, their computer will be safe. Unfortunately, by the time people integrate these rules into their daily life, these rules either become outdated, or these rules were so oversimplified that it was never true in the first place. Some of these security tips might sound ridiculous to people in InfoSec nowadays, but this is exactly what people still remember because we told them so for years.

PDF is safe to open

This is an oldie. I think this started at the time of macro viruses. Still, people think opening a PDF from an untrusted source is safer than opening a Word file. For details why this is not true, check: https://www.cvedetails.com/vulnerability-list/vendor_id-53/product_id-497/Adobe-Acrobat-Reader.html
On an unrelated note, people still believe PDF is integrity protected because the content cannot be changed (compared to a Word document).
Image stolen from Kaspersky

Java is secure

One of the best ones. Oracle started marketing Java as a safe language, where buffer overflows, format strings and pointer-based vulnerabilities are gone. Unfortunately, they forgot to tell the world that instead of "unsafe programs developed by others" they installed their unsafe program on 3 billion devices. 

Stay away from rogue websites and you will be safe

This is a very common belief I hear from average people. "I only visit some trusted news sites and social media, I never visit those shady sites." I have some bad news. At the time of malvertising and infected websites, you don't have to visit those shady sites anymore to get infected.

Don't use open WiFi

I have a very long explanation of why this makes no sense, see here. Actually, the whole recommendation makes no sense as people will connect to public WiFis, no matter what we (InfoSec) recommend.

The password policy nightmare

Actually, this topic has been covered by myself in two blog posts, see here and here. Long story short: use a password manager and 2-factor authentication wherever possible. Let the password manager choose the password for you. And last but not least, corporate password policy sux.

Sites with a padlock are safe

We tell people for years that the communication with HTTPS sites are safe, and you can be sure it is HTTPS by finding a randomly changing padlock icon somewhere next to the URL. What people hear is that sites with padlocks are safe. Whatever that means. The same goes for WiFi - a network with a padlock is safe.

Use Linux, it is free from malware

For years people told to Windows users that only if they would use Linux they won't have so much malware. Thanks to Android, now everyone in the world can enjoy malware on his/her Linux machine.

OSX is free from malware

It is true that there is significantly less malware on OSX than on Windows, but this is an "economical" question rather than a "security" one. The more people use OSX, the better target it will become. Some people even believe they are safe from phishing because they are using a Mac!

Updated AV + firewall makes me 100% safe

There is no such thing as 100% safe, and unfortunately, nowadays most malware is written for PROFIT, which means it can bypass these basic protections for days (or weeks, months, years). The more proactive protection is built into the product, the better!

How to backup data

Although this is one of the most important security tips which is not followed by people, my problem here is not the backup data advise, but how we as a community failed to provide easy to use ways to do that. Now that crypto-ransomware is a real threat to every Windows (and some OSX) users, even those people who have backups on their NAS can find their backups lost. The only hope is that at least OSX has Time Machine which is not targeted yet, and the only backup solution which really works.
The worst part is that we even created NAS devices which can be infected via worms ...

Disconnect your computer from the Internet when not used

There is no need to comment on this. Whoever recommends things like that, clearly has a problem.

Use (free) VPN to protect your anonimity

First of all. There is no such thing as free service. If it is free, you are the service. On another hand, a non-free VPN can introduce new vulnerablities, and they won't protect your anonymity. It replaces one ISP with another (your VPN provider). Even TOR cannot guarantee anonymity by itself, and VPNs are much worse.

The corporate "security tips" myth

"Luckily" these toxic security tips have infected the enterprise environment as well, not just the home users.

Use robots.txt to hide secret information on public websites

It is 2016 and somehow web developers still believe in this nonsense. And this is why this is usually the first to check on a website for penetration testers or attackers.

My password policy is safer than ever

As previously discussed, passwords are bad. Very bad. And they will stick with us for decades ...

Use WAF, IDS, IPS, Nextgen APT detection hibber-gibber and you will be safe

Companies should invest more in people and less into magic blinking devices.

Instead of shipping computers with bloatware, ship computers with exploit protection software
Teach people how to use a password safe
Teach people how to use 2FA
Teach people how to use common-sense

Conclusion

Computer security is complex, hard and the risks change every year. Is this our fault? Probably. But these kinds of security tips won't help us save the world. 

More articles

  1. Top Pentest Tools
  2. Hack Tools Pc
  3. Hacker Tools Github
  4. Best Pentesting Tools 2018
  5. Hack Tools For Games
  6. Hacking Tools For Kali Linux
  7. Easy Hack Tools
  8. Hack App
  9. Pentest Tools Review
  10. Computer Hacker
  11. Hack Tools Github
  12. Hack Tool Apk
  13. Hack Tool Apk No Root
  14. Hack Tools 2019
  15. Github Hacking Tools
  16. Hacker Tools Online
  17. Computer Hacker
  18. Tools 4 Hack
  19. Hacking Tools For Pc
  20. Pentest Automation Tools
  21. Hacking App
  22. Pentest Tools Linux
  23. Pentest Tools Url Fuzzer
  24. Hacker
  25. Ethical Hacker Tools
  26. Best Hacking Tools 2019
  27. Pentest Tools Port Scanner
  28. Hacking Tools Kit
  29. Pentest Tools Linux
  30. Hacking Tools Windows
  31. Pentest Automation Tools
  32. Pentest Tools For Ubuntu
  33. Hacking Tools Mac
  34. Hacking Tools For Beginners
  35. What Are Hacking Tools
  36. Hacker Tools Mac
  37. Hacking Tools Name
  38. Hacker Search Tools
  39. Hacker
  40. Pentest Tools Review
  41. Pentest Tools Website
  42. Pentest Tools For Windows
  43. Hacking Tools 2020
  44. Hack App
  45. Beginner Hacker Tools
  46. Hacking Tools Kit
  47. Wifi Hacker Tools For Windows
  48. Hacking Tools For Games
  49. Tools 4 Hack
  50. Easy Hack Tools
  51. Free Pentest Tools For Windows
  52. Tools For Hacker
  53. Hacking Tools For Mac
  54. Tools 4 Hack
  55. Hacking Tools And Software
  56. Hacker Tools Apk Download
  57. Nsa Hacker Tools
  58. Beginner Hacker Tools
  59. Hacker Tools Mac
  60. Hack Tools For Mac
  61. Hack And Tools
  62. Best Hacking Tools 2019
  63. Hacker Tools Windows
  64. Pentest Tools Subdomain
  65. Hack Tools
  66. Hack Tools
  67. Hack Tools Pc
  68. Pentest Tools For Ubuntu
  69. Hacking Tools Mac
  70. Install Pentest Tools Ubuntu
  71. Hacking Tools Online
  72. Pentest Tools Windows
  73. Hacking Tools And Software
  74. Pentest Tools Kali Linux
  75. Pentest Tools Bluekeep
  76. Hacker Tools Software
  77. Best Pentesting Tools 2018
  78. Hacker Tools Linux
  79. Hacker
  80. Hacker Tools Mac
  81. Underground Hacker Sites
  82. Blackhat Hacker Tools
  83. Free Pentest Tools For Windows
  84. Pentest Recon Tools
  85. Hacking Tools For Beginners
  86. Pentest Tools Download
  87. Hack Tool Apk No Root
  88. Pentest Tools Download
  89. Hacker Hardware Tools
  90. Pentest Tools Review
  91. Hacker Tool Kit
  92. Hack Tool Apk
  93. Pentest Tools Find Subdomains
  94. Blackhat Hacker Tools
  95. Pentest Tools For Mac
  96. Pentest Tools Online
  97. Hacking Tools For Windows 7
  98. Black Hat Hacker Tools
  99. Physical Pentest Tools
  100. Tools For Hacker
  101. Hack Tools For Windows
  102. Pentest Tools For Windows
  103. Hack Tools For Pc
  104. Hacking Tools For Windows 7
  105. Hacking App
  106. Hacker Tools Free
  107. Pentest Tools Bluekeep
  108. Hacking Tools Software
  109. Hacker Tools 2020
  110. Hacking Tools Online
  111. Pentest Tools For Windows
  112. Pentest Reporting Tools
  113. Hack Tools For Windows
  114. Ethical Hacker Tools
  115. Pentest Automation Tools
  116. Pentest Tools Linux
  117. Pentest Tools Kali Linux
  118. Pentest Tools Online
  119. Hacking Tools Software
  120. Hackrf Tools
  121. Pentest Tools Android
  122. Hack Website Online Tool
  123. Hacks And Tools
  124. Pentest Recon Tools
  125. Game Hacking
  126. Hack And Tools
  127. Bluetooth Hacking Tools Kali
  128. Hack Tools For Windows
  129. How To Make Hacking Tools
  130. Hacking Tools 2019
  131. Nsa Hack Tools Download
  132. Nsa Hack Tools
  133. Hacker Tools Apk
  134. Hacking Tools For Windows
  135. Hacking Apps
  136. Kik Hack Tools
  137. Hacking Tools Hardware
  138. What Are Hacking Tools
  139. Hack Apps
  140. Hacker Tool Kit
  141. Hacking Tools For Windows Free Download
  142. Pentest Tools Port Scanner
  143. Hacker Tools
  144. Hacker Tools 2020
  145. Pentest Tools Find Subdomains
  146. Hacker Tools Apk Download
  147. Hacker Tools Apk Download
  148. Hacking Tools For Windows Free Download
  149. Hacker
  150. Hacker Tools For Ios
  151. Hacking Tools Windows 10
  152. Pentest Tools Download
  153. Hack Tools For Windows
  154. Hacker Tools Online

Tidak ada komentar:

Posting Komentar