by Bozho | Aug 29, 2019 | Aggregated, cybersecurity, infosec, Opinions
A few months ago an essay titled “Cybersecurity is not very important” appeared. The essay is well written and interesting but I’d like to argue against its main point. And that is actually hard – the essay has many good points, and although it has a contrarian feel, it actually isn’t saying anything outrageous. But I still don’t agree with the conclusion. I suggest reading it (or skimming it) first before continuing here, although this article is generally self-sufficient. I agree with many things in the essay, most importantly that there is no 100% protection and it’s all about minimizing the risk. I also agree that cybersecurity is a complex set of measures that span not only the digital world, but he physical one as well. And I agree that even though after watching a few videos from DEF CON, BlackHat or CCC, one feels that everything is fundamentally broken and going to live in the mountains is the only sane strategy to survive an impending digital apocalypse, this is not the case – we have a somewhat okayish level of protection for the more important parts of the digital world. Certainly exploitable, but not trivially so. There are, though, a few main claims that I’d like to address: There has not been any catastrophic cybersecurity event – the author claims that the fact that there was no digital Pearl Harbor or 9/11 suggests that we’ve been investing just the right amount of effort in cybersecurity. I don’t think that’s a fair comparison. Catastrophic events like that cost human lives as an immediate result of a physical action. No...
by Bozho | Aug 16, 2019 | Aggregated, Developer tips, infosec, Opinions, security
Most web pages now consist of multiple JavaScript files that are included in various ways (via >script< or in some more dynamic fashion). But since these scripts interact with everything on the page, they can be a security risk. And Magecart showcased that risk – the group attacked multiple websites, including British Airways and Ticketmaster, and stole a few hundred thousand credit card numbers. It is a simple attack where attacker inserts a malicious javascript snippet into a trusted javascript file, collects credit card details entered into payment forms and sends them to an attacker-owned website. Obviously, the easy part is writing the malicious javascript; the hard part is getting it on the target website. Many websites rely on externally hosted assets (including scripts) – be it a CDN, or a dedicated asset server (as in the case of British Airways). These externally hosted assets may be vulnerable in several ways: Asset servers may be less protected than the actual server, because they are just static assets, what could go wrong? Credentials to access CDN configuration may be leaked which can lead to an attacker replacing the original source scripts with their own Man-in-the-middle attacks are possible if the asset server is misconfigured (e.g. allowing TLS downgrade attack) The external service (e.g. CND) that was previously trusted can go rogue – that’s unlikely with big providers, but smaller and cheaper ones are less predictable Once the attackers have replaced the script, they are silently collecting data until they are caught. And this can be a long time. So how to protect against those attacks? A typical advice is to...
Recent Comments