Tag Info

Hot answers tagged

16

Basically any process which can successfully connect to a X11 server has full access to what occurs on that server. The X11 security model assumes that attackers are rejected at connection time. The usual security system is that clients must send a specific "magic cookie" as part of their first message, the cookie being a random blob which is created when ...


15

I recommend the following steps, in rough order of priority: Enable automatic updates. This is the best way to ensure you are always running the best, patched version of all software. Turn on a firewall. A simple policy often suffices for desktops: roughly speaking, allow all outgoing connections, block all incoming connections. This is a lot easier than ...


12

First let me say, I'm not a security expert by any means. While you ask about securing linux desktops, I take your question to mean "how do I implement overall security using free unixes as a person who does personal computing as opposed to web serving." So I thought I would gather my thoughts on the subject and see what other people have to say about ...


9

It will always vary depending on the application and implementation, however some of the ways in which these applications function can be quite effective at slowing down malicious users, and preventing breaking out of the Kiosk interface. At the end of the day, physical access will always prevail with sufficient time and resources. Kiosk countermeasures: ...


9

Two reasons I can think of: Attackers will know which servers are more valuable to attack. e.g. TEST_BOX_04 vs DB_BACKUP_02 Attackers will have better idea of the topology of your network: How many servers you have; which other servers probably exist because semantic implication (host03 implies host01 and host02); what style of application stack you have ...


7

Firstly, it would be nice to define "give out". Not publish on external web sites? Internal web sites? Not put internal hosts into external DNS? Not create PTR records for? Not create A records for? You're asking a subtle cost-benefit question, and it's important to know the cost as well as the benefit. The short answer to your question is, the issue ...


5

Your method #1 can be adapted to protect against symlink attacks: lstat() the file path you want to chmod. Save the values of st_dev and st_ino in the struct stat that is returned. These two numbers uniquely identify the file on your system. open() the file with O_RDONLY. fstat() the open file descriptor. Check to make sure that st_dev and st_ino are ...


5

There was a really good talk at Security Bsides London on how a single setting in Microsoft Terminal Services would let you break in using Metasploit to any locked down RDP session. Appliable to kiosks too I would imagine if you can get on same subnet http://www.slideshare.net/bsideslondon/breaking-out-of-restricted-rdp


5

A "Secure Desktop" is a desktop that can only be run by the system itself. That sounds a bit weird, and probably doesn't explain much. In Windows, a desktop is a view that allows you to interact with processes. When you log into Windows (the log in prompt) you are on a desktop. When you are logged in, and see the start menu, you are on a seperate ...


5

The problem I think we're all having is saying which is a threat that you are concerned about. Someone that surfs all day long and goes to less than safe websites has a higher risk of being attacked than a grandmother trying to check email. But the grandmother has a higher risk because she can't tell the difference between real emails and phishing attacks. ...


5

Are you paranoid enough? If yes, try http://qubes-os.org/Home.html It's a very interesting project, still in beta though, developed by Joanna Rutkowska and her team. It uses virtual machines to enforce isolation between user gui applications, and many other nice tricks. It's solely focused on being a secure environment for desktop computing. If you don't ...


5

To some extent, all the Web/Cloud hype is about a new model (or, maybe, an old model with a new layer of paint). With "apps", applications are quite contained and isolated from each other. With the "apps" model as is employed on iOS / Android system, a further twist is applied in that only "allowed" apps can be installed. The user can still choose which apps ...


4

I'd recommend using a FIM (File Integrity Monitoring) tool. This will let you take a snapshot of your system before you make changes, and then another snapshot after you make changes - then you can to see what files and registry entries have changed inbetween snapshots. OSSEC is an Open Source system that can monitor files for changes. I'm not sure if it ...


4

Rootkit.Sirefef.Gen is not a specific specimen of malware as such. The ‘.Gen’ typically means the AV scanner has picked it up through generic heuristic algorithms as something that looks like Sirefef (ZeroAccess) rather than 100% matching a specific signature. There is a large extended family of trojans that would trigger a detection like this and no way to ...


4

That's a tough problem, with significant differences from the server space in terms of threats, attack surface, and vulnerabilities. The "easy" part is to start with Hardening Linux Server which also has some links relevant to the desktop. But then you run into the insecurity of both the older and newer windowing systems: Passive and active attacks via ...


4

You might be interested in looking at sources of iKat which is a framework made just for attacking kiosks. iKAT was designed to aid security consultants with the task of auditing the security of internet Kiosk terminals. iKAT is designed to provide access to the underlying operating system of a Kiosk terminal by invoking native OS functionality. ...


3

Depending on what assets you're expecting the virtualzation to defend, this could easily result in a false sense of security. Simply separating your "online habits" from your "offline habits" via virtualization will only go so far as to help protect one from the other. To better clarify, here's an example of a scenario in which the virtualization you've ...


3

AppArmor or SELinux is probably a better solution than running Firefox as a different user. As you mention, running any kind of new software (including Mandatory Access Controls like these) potentially introduces new vulnerabilities (I'm fairly sure some have been found for SELinux) but I think most agree that the tradeoff is worth it.


3

In addition to Lateral's answer, you can't guarantee your hostnames wont be used in another unforeseen way. Certain protocols require the correct hostname to work (NTLM, and possibly kerberos). If an attacker doesn't have the IP addresses, an external attacker can use the hostnames to perform attacks. A lot of times web application attacks will get you ...


3

The greatest problems of today's desktop PC environment: allowing arbitrary applications access to all the data that a user has; giving applications unlimited access to the Internet and sensitive hardware (mike, the camera, GPS chip, Bluetooth etc.); proliferation of idiot users; emergence of a business culture where stealing and selling users' personal ...


3

I think the comment of @Luc is as giving a direction that merits to be expanded here into an answer. Consider the following. The hardware to have a 0.5lb mobile device run at 480p resolution etc is quite recent. Consequently it is only recently that those mobile systems you mention in your question exists. Desktop system which have been able to use ...


3

It sounds like you are wanting to run a bare metal hypervisor as a desktop. This is only recently been supported on platforms like vSphere and Xen due to PCI/VGA Passthrough. If you are looking for any real performance, you are going to be slightly disappointed with this setup. What I generally suggest is to install the operating system, install the ...


2

You may need to use a File Integrity Monitoring tool to look at the directories the software may affect. The FIM will monitor for creation, modification and deletion of folders/files in those locations and provide a report. However, it may tell you that changes have been made but not what are the specific changes. You could run 2 separate systems; one ...


2

Have you thought about using something like Tails(https://tails.boum.org/)? As was suggested above you could use it with a Vm, but based on what it is fundamentally for you wouldn't need to keep an instance on your machine for it. There are also things like sandfox(http://igurublog.wordpress.com/downloads/script-sandfox/) that allow you to run firefox in a ...


2

paranoid mode: install a different linux on a different machine, better, use a ro-mounted distro from cd like knoppix or so (virtualbox and kvm is your friend) run your browser from that other machine, using x-forwaring or x2go (free and good linux terminalserver/client-solution, works very nice on debian) harden this browser with noscript, adblockplus, ...


1

You can use Nessus for this. It has a plugin for finding data at rest which could be used for this kind of application. One advantage of using a tool like Nessus is that it already has options set-up for authenticating to various types of system over a network.


1

Any secret key that you embed in a program can be recovered by a person who has full access to that program, the best you can do is make it time consuming to do so. But let's say you could make the secret totally unrecoverable by analysing the binary. The user could perform dynamic analysis by running the program while monitoring it's memory and wait ...


1

This clearly is being written to promote a reasonably tested application. I have three comments about this: First and foremost, they should have their own internal scanning program (vulnerability assessment) that they would provide a test bed to run your program on as part of their acceptance testing. A software vendor may choose to have and develop their ...



Only top voted, non community-wiki answers of a minimum length are eligible