Comparing how security experts and non-experts stay safe online
googleonlinesecurity.blogspot.com
googleonlinesecurity.blogspot.com
I think this betrays a lack of thought about the risks to non-experts. Tons of malware masquerades as legitimate updates, and non-experts don't always have the knowledge to distinguish legitimate updates from malicious ones. Therefore, to non-experts software updates are a security risk.
Edit: And this is why Chrome's policy of updating automatically and completely silently is the right thing to do, and everyone else (Adobe, Oracle, Microsoft, looking at you) is doing it wrong.
With windows 10 they're doing forced updates for home editions, so there's that.
When you have 1.6 billion users with such disparate hardware and software, even a small improvement can help tens of millions of users.
I expect Microsoft has lots of telemetry on this....
[1] Even with windows 10's forced updates, I still think it's possible to postpone updates, just not indefinitely.
Or consider how non-technical users can come to associate installs/updates with Arbitrary Negative Consequences even without that being a reflection of reality.
Bingo Card Creator, back when it was downloadable, was accused of killing multiple hard drives every year. You and I know that is preposterous, but all the user knows is that the last consequential thing they did with their computer was install the update and now their machine is bricked.
(The user does not appreciate that the MTBF of laptop hard drives among BCC users is approximately 18 months and that since we'd accordingly be the last thing someone did before data loss at least once a day.)
At least one of these users contacted their IT department, whereupon they were warned in the sternest possible terms to never ever ever ever download anything from the Googles because that could erase all their memory and give their hard drive a virus. A lifetime of learned (and taught) helplessness like that adds up.
Not everyone is hooked up to unlimited broadband 24/7. To anyone who is frequently jumping between capped satellite & 3G/4G networks, silent auto-updating software not only unexpectedly slows down your already non-ideal connection, but also eats up lots of your capped data.
Lots of services tend to forget about the users who aren't hooked up to broadband 100% of the time.
Of course, the intricacies of the process should still be exposed to the technical users via various tools and APIs.
Well, upgrading often equals bloating and not all of us want to be updating their computer every two years. That added to what's been said in this thread means no, is not the right thing to do.
The study seems to assume that they are. It may be a fair assumption, but it would be interesting to know if it actually is true or not. It would also help validate the security practices.
If it turns out that the security experts got infected just as much, or only slightly less than the non-experts, then following their practices might not be worth the effort...
I don't want invest the time and energy developing expertise when even those that have it don't use it.
As you point out, there are a variety of attacks and big differences between e.g. leaking a password or getting a virus infection. But since their highlighted techniques cover both of these attacks (virus scanners, password best practices), you have to assume that they are relating to a whole range of attacks.
Security experts may use a lot more password managers and want to use unique passwords, but you could say that's just because they have a lot more accounts than normal people. Most people have a couple accounts for social networking, their bank, perhaps a local library... experts usually work in the field, spend their days online in an office, and have lots of accounts for various tasks or activities.
The attack surface is very different: lots of accounts versus just a couple. Lots of time online browsing various sites versus browsing your average social network in spare time. Perhaps I'm overgeneralizing, but it probably matches a good percentage.
And then there is the definition of "safer" or "expert". Are you an expert when you got a degree in the field? When you followed some online courses? When you work in the field? Or when you read a lot about security?
Defining a security “expert” is challenging, and we settled upon a definition that is simple (5+ self-reported years of experience in the area)
Some users may be social butterflies, and some may be hermits. Independent of their level-of-security-awareness.
s/security experts/technical users/
Yes, we are. Whenever you see a laptop full of malware, that's a non-technical user. We're not safe from it entirely, nobody is 100% safe, but we're in much better shape than the regular folks.
Not just being pedantic here for the sake of it, I think it would be good to know how much safer experts generally are. Just saying "we're better than them!" isn't very convincing or useful.
"So what do we have in total? A Web application with SQL injection flaws and insecure passwords. Passwords that were badly chosen. Passwords that were reused. Servers that allowed password-based authentication. Systems that weren't patched. And an astonishing willingness to hand out credentials over e-mail, even when the person being asked for them should have realized something was up. [...]
Most frustrating for HBGary must be the knowledge that they know what they did wrong, and they were perfectly aware of best practices; they just didn't actually use them. Everybody knows you don't use easy-to-crack passwords, but some employees did. Everybody knows you don't re-use passwords, but some of them did. Everybody knows that you should patch servers to keep them free of known security flaws, but they didn't." [1]
Granted, this doesn't prove that experts are generally unsafe, and maybe somebody with a beef with these ones in particular would say they're just semi-knowledgeable salesmen cashing in on the cyber scare, but it lends some weight to the idea that too many experts aren't much safer.
[1] http://arstechnica.com/tech-policy/2011/02/anonymous-speaks-...
Where I work the actual IT staff/server admins are pretty safe. They update, patch, and in general choose good passwords.
The programmers... ugh, good lord. They have the worst practices ever.
You do have a point about programmers, or to generalize a bit, people who are more technically-inclined than average but who don't care/know about security. I shake my head seeing things like people flashing community-built Android ROMs with signature checks disabled, closed-source rooting tools, sideloaded APKs downloaded from dubious filesharing sites, "curl http://whatever | sh".
We also don't have a ground truth for what users should do to stay safe online. Do updates work better than a strong password? Measuring the effectiveness of different security actions as scale is so challenging, that we don't now how to do it.
Edit: I'm also surprised that we have such a large proportion of this discussion talking about something (using VMs) that is mentioned nowhere in the paper the thread is supposedly about. Perhaps if we were also discussing the (apparently) surprising fact that it was not mentioned it would make sense (to me, anyway).
For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility?
I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/folders and dragging them out of the browsers "Download" folder and onto the host's file system, disallowing saving files outside of that folder, and so forth) but it doesn't seem that bad.
What do most users do with a browser other than open the thing, browse websites, and download files for later?
(I hate VMs so much I just use two computers).
It's usable, just a bit annoying. I feel little option but to run Windows as a host OS in order to get best driver/video/battery support, so VMware is essentially mandatory.
It's also a huge attack surface.
Using an uncommon browser for something like banking (Opera or Vivaldi or something) would be a pretty good solution because no one would have bothered to develop the hooks for them, unless the malware is keylogging, which is not uncommon but less popular now than the smarter solution of watching browser form submits on known bank websites.
Of these someone who's installed their own OS has 2 slightly novel steps. So yeah trivial is maybe the wrong words but still easy.
Most people aren't. I think most people haven't installed on OS at all for that matter.
Except for the obscurity angle of course (nobody writes exploits against Chrome-under-Docker).
To be fair, VMs are also mostly about the obscurity angle too, and if you do all your browing in a VM the cookies alone will make the attacker sufficiently happy that they will probably not care. People don't hack because they want root on the bare-metal OS, people hack because they want to steal data. If it's in a VM or container, then getting there is enough.
Sorry, are you referring to Native Client or Chrome's site isolation?
The download part is the scary one. An average user can’t make the distinction between an OS message and a malware disguising as the former. Thus they download shit that wrecks havoc on their PCs. Besides, you could be infected by a compromised Flash banner so you don't even have to download anything.
And I don’t think that containers are a feasible approach for the average user. I doubt VMs are either. Our best bet would be browsers running in an isolation context simulating a VM. But that would require more RAM than the average user has available.
https://zeltser.com/security-risks-and-benefits-of-docker-ap...
Please dear god no. Kill me now.
I would never claim to know my email-renderer so well that I was 100% confident that it didn't have any attack vectors, particularly with all the crazy things you can do with unicode nowadays - much more straightforward to just read it in a virtual-machine. That way, even if you guessed wrong on the attack surface of your email client, the damage is contained.
If so, have you ever forgot to use the virtual machine and instead browsed or read email on your host operating system? If so, what did you do?
Furthmore, is it possible to break out of the hypervisor and into the host operating system?
Note that that vuln is related to shared directories - anyone using a VM for isolation should probably not use these. I recently heard an amusing story of another infosec professional that cryptowalled their Macbook by testing on a VM with over-generous folder shares. Of course this is an extreme example caused by a clear mistake, but it's food for thought.
Debian is what I'm most familiar with, so that's my new place to go. Still quite big with a relatively basic install, but not as big as Ubuntu or Linux Mint.
Really lightweight stuff is Damn Small Linux (old) or Puppy Linux (never tried it), but I'm not sure how usable that is for day-to-day tasks.
You can use Fedora, Debian, Whonix, or Windows in "seamless" mode with minimal effort. It has a composable networking architecture (e.g. easy to make all a VM's traffic go through Tor, whose traffic in turn goes over a VPN). Disposable VMs are a native feature. Template VMs reduce duplication of /; Application VMs use a template VM with CoW / and their own persistent /home.
Qubes uses Fedora 20 for Dom0, so you get all the same graphics support as Fedora gives you.
I'm all for getting the latest security patches. Or any security patches, really. I'm growing tired of getting the latest possibly risky feature from a product because it is the only way I can get a security patch.
I did update it yesterday though!
And since Windows 10 breaks the ability to block specific updates, I'll probably have to keep the installer around and reinstall it every damn time that Windows Update decides that the driver MS is distributing is better than the one from nvidia.com.
I'm a techy and I completely understand why users ignore updates. Either it's invisible and the user doesn't know it happened, or it breaks something with no obvious way to revert, or it arbitrarily changes things that were fine how they were. So their perception ends up being "every time it updates, things get worse."
As a heavy desktop Linux user, hearing about examples of half-assed, incompetent, hacky, lazy product support by nvidia isn't exactly new territory.
Nvidia is causing your pain, not Microsoft.
By going through WHQL, Nvidia gets to have better out of the box support on Windows, and Microsoft gets to ship a stripped down driver without Nvidia's control panel cruft and with better support for DirectX than OpenGL.
I don't see what Nvidia's motivation for the last part is unless Microsoft said "Don't bother including all of the OpenGL capabilities, DirectX is fine for basic drivers."
Personally, I find Figure 2 (on Page 5) of the paper most interesting: it shows the difference between expert and non-expert mentioning certain practices -- which to me seems roughly equal to how under-/overappreciated that practice is.
The top contenders for underrated (i.e. used more frequently by experts compared to non-experts) are: System updates, 2-factor-auth, password managers, unique passwords and checking for https. Most overrated: antivirus, password changes, only visiting known sites and using strong passwords.
As a security community, we appear to have gotten the point across when it comes to antivirus and strong passwords. Anyone giving general advice should consider this and emphasize the "underrated" measures.
Funny enough, we did exactly that last month!
https://paragonie.com/blog/2015/06/guide-securing-your-busin...
Unfortunately, Archive.org did not crawl us before this Google blog post came out, so I can't prove that I did not ninja edit the post. Google has a cache from July 8, though: https://webcache.googleusercontent.com/search?q=cache:-ovweQ...
> The high adoption of antivirus software
> among non-experts ... might be due to the
> good usability of the install-once type of
> solution that antivirus software offers.
https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...
Some others potentially worth installing:
https://www.eff.org/https-everywhere
https://www.eff.org/privacybadger I prefer this over Ghostery. You can also for the most part replicate Ghostery by just downloading an appropriate filter for Ublock Origin.
https://addons.mozilla.org/en-US/firefox/addon/betterprivacy...
EDIT This question is partly motivated by wondering if a Linux browsing user should be running a virus scanner?
- many would prefer to whitelist trusted software than blacklist malware
- bypassing AV is trivial
- http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf
- https://github.com/Veil-Framework/Veil-Evasion
Great question, though. :)
See, for example, https://lock.cmpxchg8b.com/sophailv2.pdf
What I'm saying is that I view A/V as protection from users, not from malicious actors. In a corporate environment with mixed-skill users, A/V is key. On my own devices, I don't frequently get into situations where A/V would be effective, the threats that are more likely to get me are more sophisticated.
This isn't to say that I don't have Windows Defender enabled, but I don't see a value return in purchasing a commercial product.
We, as an industry, still have a long way to go in making it easy and safe for consumers to keep their software up to date. Have you ever tried to explain to someone (outside the industry) which "click to install the latest version" messages are important to obey, and which are malicious?
For example, 'software updates' are half the battle, but the other half of the battle is configuring your software to be more secure (browser sandboxing, NoScript, pop-up blockers, malware detectors, OS hardening).
All the rest of the security concerns are authentication-based, but there are very few accounts that are important enough to need a secure account. Banks and money transfer services, business accounts (taxes, professional services, ebay/etsy merchants, etc), followed e-mail accounts, are probably the only really critical accounts most people have. You can hack my Facebook or my Huffington Post account; it doesn't really threaten my safety.
I think the one thing nobody does that would actually matter to them eventually is keep offline backups. Facebook might lose all your pictures and FB messages tomorrow. They have zero responsibility to keep that crap for you. If you do get hacked and someone deletes all your pictures, don't go crying to Facebook; they have enough problems.
At the end of the day, the biggest threat to your online safety in general is malware. Once malware is on your device it's game over.
Our systems can be hacked, expert or not. Minimize online footprint. Do not keep years and years of email and other stuff on Internet connected devices, back it up to external media.
It's great to see a large company like Google focusing on this kind of work though.
I don't think we're talking about the same applications here when comparing security experts and non-experts.
1. Run a version of Linux ( Windows is simply insecure )
2. Use Firefox + NoScript and only ever temporarilly allow JS to run as needed. ( JS is -not- safe and at any point in time there are at least a handful of zero day exploits )
3. Use an offline password manager ( KeePass )
4. Use a secure anonymous non-logging VPN for all internet use
5. Use a paid private email account, not some free one
6. Use VMs for running software that may not be safe
However Firefox does not have tab sandboxing, extension sandboxing, or process isolation. These are pretty standard features in most browsers now (except for process isolation which seems to be Chrome only at present).