Tag Info

Basically any process which can successfully connect to a X11 server has full access to what occurs on that server. The X11 security model assumes that attackers are rejected at connection time. The usual security system is that clients must send a specific "magic cookie" as part of their first message, the cookie being a random blob which is created when ...

I recommend the following steps, in rough order of priority: Enable automatic updates. This is the best way to ensure you are always running the best, patched version of all software. Turn on a firewall. A simple policy often suffices for desktops: roughly speaking, allow all outgoing connections, block all incoming connections. This is a lot easier than ...

First let me say, I'm not a security expert by any means. While you ask about securing linux desktops, I take your question to mean "how do I implement overall security using free unixes as a person who does personal computing as opposed to web serving." So I thought I would gather my thoughts on the subject and see what other people have to say about ...

Short answer There are three, separate issues claiming the name of "Secure Desktop": Windows builtin functions like GINA and the Credential Provider Model. Separation of privileged vs unprivileged applications running as the same user (nominally prevent privilege escalation), which may or may not be related to: SwitchDesktop(), which is what KeePass is ...

It will always vary depending on the application and implementation, however some of the ways in which these applications function can be quite effective at slowing down malicious users, and preventing breaking out of the Kiosk interface. At the end of the day, physical access will always prevail with sufficient time and resources. Kiosk countermeasures: ...

It really depends. To go through your points: Depending on the host and guest operating systems, you may need additional security here. For example, I have a couple of Windows VMs from which I can remove any dodgy programs onto the samba share without too much fear that the linux host will be infected by the presence of these files. However, there is the ...

A "Secure Desktop" is a desktop that can only be run by the system itself. That sounds a bit weird, and probably doesn't explain much. In Windows, a desktop is a view that allows you to interact with processes. When you log into Windows (the log in prompt) you are on a desktop. When you are logged in, and see the start menu, you are on a seperate ...

Your method #1 can be adapted to protect against symlink attacks: lstat() the file path you want to chmod. Save the values of st_dev and st_ino in the struct stat that is returned. These two numbers uniquely identify the file on your system. open() the file with O_RDONLY. fstat() the open file descriptor. Check to make sure that st_dev and st_ino are ...

There was a really good talk at Security Bsides London on how a single setting in Microsoft Terminal Services would let you break in using Metasploit to any locked down RDP session. Appliable to kiosks too I would imagine if you can get on same subnet http://www.slideshare.net/bsideslondon/breaking-out-of-restricted-rdp

You might be interested in looking at sources of iKat which is a framework made just for attacking kiosks. iKAT was designed to aid security consultants with the task of auditing the security of internet Kiosk terminals. iKAT is designed to provide access to the underlying operating system of a Kiosk terminal by invoking native OS functionality. ...

Are you paranoid enough? If yes, try http://qubes-os.org/Home.html It's a very interesting project, still in beta though, developed by Joanna Rutkowska and her team. It uses virtual machines to enforce isolation between user gui applications, and many other nice tricks. It's solely focused on being a secure environment for desktop computing. If you don't ...

The problem I think we're all having is saying which is a threat that you are concerned about. Someone that surfs all day long and goes to less than safe websites has a higher risk of being attacked than a grandmother trying to check email. But the grandmother has a higher risk because she can't tell the difference between real emails and phishing attacks. ...

That's a tough problem, with significant differences from the server space in terms of threats, attack surface, and vulnerabilities. The "easy" part is to start with Hardening Linux Server which also has some links relevant to the desktop. But then you run into the insecurity of both the older and newer windowing systems: Passive and active attacks via ...

Depending on what assets you're expecting the virtualzation to defend, this could easily result in a false sense of security. Simply separating your "online habits" from your "offline habits" via virtualization will only go so far as to help protect one from the other. To better clarify, here's an example of a scenario in which the virtualization you've ...

Simple answer: Essentially, virtualization will create a layer of obfuscation for you that will successfully keep standard malware contained to guest VMs. This is what you care about as home user. Install anti-virus and always apply patches and you're good. If something goes wrong, reset the VM to a known-good state. For more involved attack scenarios, you ...

You may need to use a File Integrity Monitoring tool to look at the directories the software may affect. The FIM will monitor for creation, modification and deletion of folders/files in those locations and provide a report. However, it may tell you that changes have been made but not what are the specific changes. You could run 2 separate systems; one ...

This clearly is being written to promote a reasonably tested application. I have three comments about this: First and foremost, they should have their own internal scanning program (vulnerability assessment) that they would provide a test bed to run your program on as part of their acceptance testing. A software vendor may choose to have and develop their ...

Web application scanners are hardly be the be all end all of web application security and simply running an off the shelf tool will not solve the the problem of an insecure application. That being said, the security impact of a desktop application is highly dependent on what your application does. Is it a server? Does it communicate over a network? Does ...

Be aware: setting an executable as non-executable doesn't prevent it from running if it is readable (not to mention the concept of copying the file). $ cp /bin/ls ~/bin/ls $ chmod a-x ~/bin/ls $ /lib/x86_64-linux-gnu/ld-2.15.so ~/bin/ls #Yup, that worked. ... though you can prevent that if the file isn't readable, which doesn't stop execution. $ chmod ...

Note that in this case, what is deemed insecure is the RarVM implementation found in WinRAR, and probably not in the core design of the VM (if so, more interesting). So you can either assume WinRar itself is insecure (something not improbable) or that all RAR files are insecure (more improbable than before). What you do with this information, is probably ...

This is a bit old, but it's a good place to start: http://www.hermann-uwe.de/blog/towards-a-moderately-paranoid-debian-laptop-setup--part-1-base-system For Firefox, DEFINITELY enable NoScript and RequestPolicy, and set up a proper AppArmor profile. OpenBSD might be of interest as well - it's highly focused on security (but not actually "Linux").