Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

8
votes
1answer
1k views

Linux wireless hacking book

I am looking for recommendations on a good wireless hacking book. I would like something more focused towards the defensive, but a healthy knowledge of both would be great. I would also need it to go ...
8
votes
1answer
432 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
8
votes
2answers
378 views

In Linux, when I consider trusting a new software source, what do I need to evaluate?

When I'm using the Linux software PackageKit, I get confused about what specific items of information I will need in order to decide whether to authorize software installation from a new software ...
7
votes
2answers
3k views

Hacked Ubuntu server, probably hacked commands (netstat, ps, …), how to replace them? [duplicate]

An Ubuntu server of my company has been hacked to carry out a DoS attack. I found the shellshock bug had not been fixed by my colleagues, and I think it's the problem. Then, I found an ELF file that ...
7
votes
7answers
4k views

Server compromised for 2nd time, cannot locate source of attack

I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads. According to the filesystem dates, ...
7
votes
4answers
680 views

Security of different OS

At my work we are given a computer to set up at home so if we ever feel like working from home we can do so. The thing is that whenever it comes to developing for java I always prefer using windows or ...
7
votes
4answers
997 views

How to trace the actions performed by a virus?

Is that possible to trace the actions performed by a virus? Run Time , stolen data and the files consulted and get the relative impact on my pc.?
7
votes
2answers
808 views

Linux kernel entropy - does it matter to /dev/urandom and what is a minimum?

This question had been asked several times, but still something's not clearly understood from other answers I have a few servers running with a custom built linux kernel (minimal driver modules etc), ...
7
votes
2answers
15k views

Decrypt from cipher text encrypted using RSA

I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is Public Key: ...
7
votes
2answers
515 views

What features do you look for in an Enterprise Log Management solution?

This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them. What are your requirements for such a Event Log ...
7
votes
2answers
892 views

Is there any Linux distro or kernel patch that wipes a process memory space after the process exits?

An application runs on an embedded battery-powered PC, accessible to some restricted public, that stores secrets in RAM. To prevent cold boot attacks and that the PC is stolen to extract its secrets, ...
7
votes
2answers
1k views

Can i compare linux user permissions without root access?

I've compromised two Linux user accounts on a RHEL machine (neither of which have root permissions) and I want to determine which account is more 'useful' to me in terms of access and privileges. Is ...
7
votes
2answers
7k views

How to secure a dedicated linux server running a LAMP stack for commercial E-commerce use

To be more specific, I would like to get some help, either through a tutorial or through a book, on how to configure an apache server to run securely and minimize the risks for commercial use. ...
7
votes
1answer
3k views

Has Linux Mint updated the OpenSSL library for LMDE (Heartbleed bug)? [closed]

Background I am using Linux Mint for one of my servers and have been trying to find out if the Linux Mint Debian Edition(LMDE) has updated their repositories with patches for the OpenSSL bug. I ...
7
votes
1answer
9k views

Is it safe to disable connection tracking in iptables?

While reading about NOTRACK target of raw table in iptables, I encountered an article suggesting that for certain traffic you could (or even should) disable connection tracking. The two examples were: ...
7
votes
1answer
91 views

Impact of using a NON-SSL/TLS connection for API calls on same server

I have two domains hosted on the same server, Domain A and Domain B, both domains have different IP addresses, assuming IPs 1.1.1.1 for Domain A, and 2.2.2.2 for Domain B. Each domain has a different ...
7
votes
2answers
246 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
7
votes
2answers
434 views

List all files with only arbitrary file path read, but no directory listing nor sudo

I have found a path traversal vulnerability that allows me to read any path on the server that does not require sudo. To fully exploit this, I would like to know which files exist in each directory ...
7
votes
2answers
1k views

Does KASLR really provide more security against exploits?

I know all about how ASLR works, and how it has been implemented on both Linux and Windows systems. It provides an extra layer of protection that malware has to take into account. But nowadays with ...
7
votes
3answers
4k views

How to sandbox Iceweasel (Firefox) on Debian? [closed]

Are there any tools for sandboxing Iceweasel (Firefox) on Debian systems? I'm mostly interested in tools distributed by Debian. (An equally trustworthy source would be second best.) (I suppose that ...
7
votes
2answers
631 views

Process authentication for Linux

Is there any possibility to authenticate a running process in Linux to be sure that this is the original/right one? I know that an Linux operating system is only that secure like the way you use it. ...
7
votes
2answers
2k views

Breaking out of a strict linux sandbox running virtually under windows: do the linux-sandbox access control policies even matter?

I am developing an application which will run untrusted code. I have been designing it for linux, thinking that I can just run it in a virtual machine on windows when the need arises. The linux ...
7
votes
2answers
181 views

Can BTRFS provide authentication on an encrypted disk?

One of the problems of disk encryption is providing authentication. An attacker with access to the ciphertext can modify the ciphertext at will without consequence. Given, this isn't a likely attack, ...
7
votes
2answers
269 views

What output can a program, when executed from a command line, output to generate behavior that is a vulnerability on the terminal emulator?

Reading this post, titled "Fixing Unix/Linux/POSIX filenames", I came across a VERY interesting phrase by the author, which says: Oh, and don’t display filenames. Filenames could contain control ...
7
votes
2answers
288 views

Prevent ARP spoofing with dynamic static entry on Linux

ARP spoofing detection/prevention seems to be quite popular here. With other techniques like port stealing aside, I'm wondering if the following could work to prevent it: Whenever my Linux ...
6
votes
7answers
8k views

Physical computer security, how to disable USB ports when the computer is 'locked'?

Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
6
votes
3answers
1k views

How to securely read a physical memory address in Linux?

I am trying to read a physical memory address in a device running embedded Linux with our application. The widely suggested method is to use mmap, convert it into virtual address and then read the ...
6
votes
4answers
614 views

Would running VMs inside of VMs be a more secure way to study viruses, etc?

I was reading this post on SuperUser, and it made me wonder about security. I've read somewhere else that some viruses/malware/whatever CAN break outside of a VM... and then infect the host OS. BUT, ...
6
votes
3answers
617 views

Appropriate defense for 404s in my logs - persistent web scans from one region

This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entries on one of my web servers with phpmyadmin in the connection criterion, but as I ...
6
votes
3answers
9k views

What key does Linux use when storing user passwords?

Linux typically stores user names and password hashes in /etc/passwd or /etc/shadow. Now lets say I have an old CentOS distro and I want to attempt to recover a user's password (it's in a legal, ...
6
votes
4answers
2k views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
6
votes
3answers
3k views

Privilege Escalation Ubuntu

I am trying to learn how an attacker can escalate privileges in Ubuntu 10.04. I have heard that this can be done but no one has ever said how to do it. The best defense is knowing how it is done and ...
6
votes
2answers
5k views

Security of Linux Full Disk Encryption (Ubuntu / Mint) -insecure?

I'm wondering, why is Ubuntu and Mint using SHA1 for Full Disk Encryption? I heard several times that SHA1 shouldn't be used anymore because it is weak and it could be cracked. Could you guys ...
6
votes
2answers
2k views

Is privilege escalation possible when shell is under www user?

So, suppose that someone obtained a shell of a remote machine (of course via Internet). But the (linux) shell is under www user. Would there be any way of trying privilege escalation?
6
votes
2answers
948 views

buffer overflow attack scripts

I saw various different scripts for a buffer overflow attack. Many of the scripts include lines that look like this: char code[] = "\xdb\xd7\xd9\x74\x24\xf4\xb8\x79\xc4\x64\xb7\x33\xc9\xb1\x38" ...
6
votes
2answers
12k views

Test firewall rules (Linux)

I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface. I added an ...
6
votes
3answers
966 views

Phishing virus found on server

I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
6
votes
1answer
261 views

How is using acces() opening a security hole?

The man page for access(2) tells : Warning: Using access() to check if a user is authorized to, for example, open a file before actually doing so using open(2) creates a security hole, because the ...
6
votes
3answers
556 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
6
votes
4answers
434 views

DNS spoofing of linux distribution repositories

Question(s) Is it possible to "redirect" linux-update-repos via DNS spoofing (e.g. DNS cache poisoning) to a malicious website, so that harmful software (updates) will be installed, when running the ...
6
votes
2answers
562 views

How often is ASLR randomness refreshed, in Linux?

Most Linux distributions now use ASLR for many programs, to randomize the layout of memory. How often is the randomness used for this changed? If I re-run the same program multiple times, will it ...
6
votes
3answers
2k views

Restrict access to a specific directory on Linux

I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access ...
6
votes
2answers
174 views

GUI isolation in X11 when entering Truecrypt password

I have been getting a bit paranoid regarding some of my old TrueCrypt containers. The paranoia has got nothing to do with suspicions regarding TrueCrypt itself (after the shut-down last year), rather ...
6
votes
4answers
1k views

Is it possible to USB whitelist in Linux?

After watching Black Hat's presentation on the fundamental problems with USB "security", I'm wondering if there's a way to do USB whitelisting in Linux. Is there currently a mechanism that will allow ...
6
votes
3answers
7k views

How to scan USB drive with clamav on Linux

Is there a way to scan the entire drive including auto-run and all partitions, including the master boot record (MBR)?
6
votes
1answer
2k views

Using TPM for full disc encryption?

E.g.: Can I make a better full disc encryption with e.g.: LUKS using the TPM? How?
6
votes
1answer
214 views

Linux - user can be in forbidden directory if su to it from user with access - is this concerning?

I was in a directory on CentOS as user1 (root in this case) and then did su to user2 which cannot normally get to that directory due to lack of "execute" permission on a parent directory, but as user2 ...
6
votes
2answers
353 views

Where can I “hide” easter eggs for students learning about Linux security?

I feel like this isn't the best place to ask this (since there's no single right answer), but I can't think of a better place. If you have a better recommendation, could you please recommend it and I ...
6
votes
2answers
563 views

How a malware executes remote payload

Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
6
votes
2answers
6k views

Issues with preserving $HOME on sudo

On Ubuntu, the default behavior with sudo is to preserve the user's $HOME environment variable, which means that sudo will be able to read the dot files in the user's home directory. I enjoy this ...