Securing Linux systems and applications; understanding Linux security features.
-1
votes
0answers
5 views
where should I put a malware to load it at boot on ubuntu?
I want to analysis my ubuntu box to detect if it was been hacked.
In your opinion what are the best place where to put a malware to autoload it ?
I am talking about a lkm rootkit and in my thesis the ...
17
votes
3answers
499 views
+200
What can an attacker do with Bluetooth and how should it be mitigated?
What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? What can an attacker do once a malicious device is paired with mine?
...
3
votes
1answer
57 views
What about AD2P vulnerability?
My goal is to create a simple one-way intercom using B Speech TX2 and B Speech RX2, an Audio2Bluetooth and Bluetooth2Audio converter.
My question is, how secure is the audio(in my case voice) being ...
-6
votes
2answers
62 views
Install Metasploit under Cygwin? [closed]
Is there a way to install Metasploit under Cygwin? Metasploit is meant to be run under a linux environment.
The Windows installation doesn't have many tools such as msfpayload available.
Please ...
4
votes
2answers
67 views
Executing arbitrary commands through iptables-restore input
During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
3
votes
2answers
122 views
Vulnerability testing without the use of exploits?
I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
2
votes
2answers
34 views
Does glibc2 version of the crypt function still use DES for alternative hashing methods?
I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
18
votes
0answers
568 views
Where can I find a vulnerable operating system to practice pentests on? [duplicate]
I am looking for vulnerable operating systems that are used for practicing pentests. Damn Vulnerable Linux (DVL) is not maintained anymore. Are there any other simillar OS´s to download somewhere that ...
-2
votes
1answer
181 views
Cascading Encryption Algorithm using mcrypt or GnuGP
I'm trying to a cascading cipher encryption algorithm to encrypt a textfile via mcrypt. I'm essentially trying to emulate the behavior of TrueCrypt, where it can cascade two or three different cipher ...
1
vote
2answers
58 views
any reason not to run tmux/wemux on a bastion host?
Is there any reason to worry about running tmux/wemux on a bastion host? It seems to me that it would open up vectors to have your terminal sessions hijacked by some locally exploited account on the ...
3
votes
3answers
360 views
Pseudo Random Generator is not initialized from the (entropy pool)?
The RHEL5 manuals state that /dev/urandom will use the entropy pool until it's exhausted, and then it will resort to a fall-back pseudo-random algorithm, so that it will never block.
But when ...
1
vote
1answer
90 views
Linux Runtime Memory protection [closed]
I'm searching for a solution to protect process memory at runtime level in Linux (just like GameGuard in Windows). I googled many times but didn't get any useful information.
Does anyone know any ...
10
votes
2answers
462 views
How to encrypt data on the server?
I have some data on the server (running Linux) which needs to be encrypted (company policy). This data is being served by an application running on this machine. Now I consider a few possibilities:
...
7
votes
0answers
145 views
Help in understanding an application's crash - exploitable?
Being new to researching vulnerabilities in native applications (as opposed to web apps), I'm having difficulties understanding a crash in Debian's browser, Epiphany (version 2.30.6), and determining ...
3
votes
5answers
136 views
Blocking network access to host(s) at the kernel level in Linux?
Getting it out of the way: Not iptables!
What I'd like to do is block network access to certain IPs, subnets, and/or hostnames at the Linux kernel level, such that no user, including root, could ...
1
vote
1answer
45 views
Configure Wireshark to capture preformatted data from pseudo-device
So, for a research project, I'm trying to use the HONE project on github, which creates during its module installation two pseudo-devices in the /dev folder. These are called hone and honet, the ...
2
votes
2answers
80 views
How to protect source code that resides on virtualbox web server which starts at boot?
I installed CentOS 6 on a 3gb virtualbox disk. It hosts a web server which starts automatically when the OS boots. No user login required. When it boots, it is given an IP and the host machine can ...
8
votes
1answer
172 views
Configure SSL Mutual (Two-way) Authentication
A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
2
votes
1answer
113 views
What is the actual value of disabling remote root login using ssh?
I have read the answers regarding why you should disable remote root login, but there is something nagging me. Assume this:
Scenario 1:
Remote server A.
Remote root login disabled.
Password ...
0
votes
0answers
66 views
Writing a script to tell which users are currently typing? [closed]
I'm working on a lab for a cyber-security class and need to find out when certain users are communicating with each other (through named pipes).
The users use:
python gameProgram.py
And then that ...
7
votes
3answers
259 views
Is it appropriate to use haveged as a source of entropy on virtual machines?
While looking for solutions to entropy pool depletion on virtual machines, I came across an interesting project called haveged, which is based on the HAVEGE algorithm (HArdware Volatile Entropy ...
3
votes
1answer
191 views
Exploited by newbie3viLc063s
My debian server got exploited by some scriptiekiddie who used Newbie3viLc063
http://pastebin.com/jma8JRG1 .
Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
6
votes
2answers
194 views
Using 'sudo vim' to spawn a shell
I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using ...
0
votes
1answer
388 views
Pre Installed OpenVAS , light way Linux [closed]
Is there any Pre installed light way OpenVAS Linux distributions Or any light way Linux witch Openvas Tested on it and work properly on that Linux distribution ?
I have used Back Track (UBUNTU ...
1
vote
1answer
64 views
Bypass va_randomize_space and stack-protector
Is a program compiled with the GCC -fstack-protector option and running in a Linux environment with the va_randomize_space kernel variable set to 1, totally protected against buffer overflow attacks?
...
6
votes
0answers
137 views
Getting exploit reliability when using the off by one framepointer overwrite on linux
scenario:
we have a program that is vulnerable to a one byte framepointer overwrite (note: stack is marked executable, Linux machine with aslr disabled and stack cookies disabled also standard x86 so ...
5
votes
2answers
178 views
Securing USB flash drive on linux
We have a industrial system(running on linux) with a USB port. We have the USB port only for copying certain data. Other than this we don't want the USB drive to contain any other executables or ...
1
vote
2answers
159 views
Is this Scenario Exploitable?
Here is the scenario:
You get to overwrite 4 (consecutive) Bytes of a Userland Remote Process in Linux without Exploit Mitigation and without the ability to inject any Shellcode and you know the ...
5
votes
2answers
137 views
Linux forensics questions (ssh config, user activity)
I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates.
We're supposed to answer:
...
5
votes
6answers
576 views
Using linux to combat windows flash drive malware?
I just put an old flash drive which i used with a windows machine into my linux. I noticed many files, mostly exes which were never visible in windows (my windows does not hide hidden files and ...
2
votes
1answer
75 views
Force all user processes to be ptraced
I'm implementing a ptrace based tool for logging system call use. It is much more simple than strace, but I'm doing this so I can learn how these tools work. I'd like to trace all user processes since ...
1
vote
2answers
64 views
What kind of privacy leakage do stuff printed to stdout pose?
1- When a program outputs to stdout, is that normally logged anywhere else?
2- When is it an issue to make a command verbose in printing to stdout instead of working quietly or redirecting to a file?
...
0
votes
2answers
274 views
How to completely password protect login into Ubuntu 12.10?
I am running Ubuntu 12.10 on my laptop and I would like to make a set up such that without a login password, no one would be able to login into my system. Currently it seems that one can, quite ...
3
votes
3answers
196 views
Using /usr/bin/passwd as login shell
I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host.
I have set up a separate user account (say 'tunnel') ...
1
vote
1answer
138 views
Can exploit vulnerability if program started with gdb, but segfaults if started without gdb
i'm currently trying to exploit a simple program called basic_vuln.c
#include <stdio.h>
int main(int argc, char** argv) {
char buf[64];
strcpy(buf, argv[1]);
}
I'm using xubuntu ...
-5
votes
1answer
50 views
LUG war games — suggested strategies? [closed]
My LUG on campus once in awhile holds a mock wargames on a VM. I'm trying to figure a way to get root access and make everyone else not be able to have root (king of he hill).
I have a few ideas, but ...
3
votes
3answers
1k views
Besides OpenVas and Nessus, what are my other options for vulnerability detection?
I know of Nessus (which is $1300 for a pro feed) and OpenVAS (which I don't like).
I use Linux so do I have any other options for vulnerability detection?
23
votes
4answers
1k views
Should I change the default SSH port on linux servers?
Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.
If you have a strong password and/or a certificate, is it useful for anything?
...
0
votes
3answers
531 views
Retrieve auto saved Skype password from Ubuntu 12.04 LTS
The email address I used to create Skype profile has been disabled and I can't get it back.
Unfortunately, I don't remember the Skype password now.
As the password is auto saved in my local machine I ...
3
votes
2answers
141 views
Proper Linux user authentication through PAM aware applications
Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. ...
13
votes
8answers
2k views
Any comprehensive solutions for binary code protection and anti-reverse-engineering?
Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
1
vote
1answer
127 views
Dual Linux System with Whole Disk Encryption
(This is a continuation of my question on Ask Ubuntu.)
My goal is I want to have a Xubuntu/Ubuntu dual boot, with a catch - I want the disk to be fully encrypted with the dm-crypt (native supplied) ...
2
votes
1answer
157 views
Tacacs+ scenario: can I permit user to configure only for one interface and deny others
I'm currently deploying TACACS+ with a Cisco device, I use a TACACS server from here: http://www.shrubbery.net/tac_plus/
My scenario is: I want to permit a user to configure my router but only for a ...
5
votes
3answers
1k views
Is CentOS a good choice from a security perspective?
How secure is the CentOS Linux distribution? I noticed there were times when there were no up-to-date patches for some version of CentOS (e.g., 5.6). I read this on some mailing list that I can't ...
3
votes
2answers
208 views
Is GPG suitable as part of a password manager and generator?
I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
1
vote
2answers
266 views
Test firewall rules (Linux)
I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface.
I added an ...
0
votes
2answers
128 views
Tracing root compromises
In regards to the following:
0day Linux/CentOS SSHd Spam Exploit — libkeyutils.so.1.9
SSHD Rootkit
There apparently seems to be a bunch of redhat server being backdoored via a library. Does ...
1
vote
3answers
126 views
How to Detect Zimbra Sniffing Trojan
I am a sys admin of our system, we are running zimbra as email server in our environment. I got the following message from the CEO.
"Everytime I send or receive an email - I get a SPAM ads a few ...
2
votes
1answer
77 views
tshark - dump the data section
As the name suggests, im trying to dump the data section of the packet,
man would suggest that its something like tshark -r file.pcap -t fields but im not having any luck
0
votes
3answers
379 views
Best practices for firewall hardware
I'm planning to implement a linux based firewall/router with at least 6 x 1Gb NIC's (network with ~300 computers/server with >=8 VLANs)
Can anybody recommend hardware best practices (reference to ...
