Tag Info

Hot answers tagged

9

Two reasons I can think of: Attackers will know which servers are more valuable to attack. e.g. TEST_BOX_04 vs DB_BACKUP_02 Attackers will have better idea of the topology of your network: How many servers you have; which other servers probably exist because semantic implication (host03 implies host01 and host02); what style of application stack you have ...


8

It seems to me you're discussing two things: sandboxing on the desktop and then strategies for user content access in sandboxed applications. Sandboxing There are many sandboxing models out there, including the ones used by OSes: Windows 8 WinRT Store Apps OS X Sandboxed Store Apps iOS Apps Android Apps Some apps are shipped sandboxed, for instance ...


7

Firstly, it would be nice to define "give out". Not publish on external web sites? Internal web sites? Not put internal hosts into external DNS? Not create PTR records for? Not create A records for? You're asking a subtle cost-benefit question, and it's important to know the cost as well as the benefit. The short answer to your question is, the issue ...


4

Rootkit.Sirefef.Gen is not a specific specimen of malware as such. The ‘.Gen’ typically means the AV scanner has picked it up through generic heuristic algorithms as something that looks like Sirefef (ZeroAccess) rather than 100% matching a specific signature. There is a large extended family of trojans that would trigger a detection like this and no way to ...


3

It sounds like you are wanting to run a bare metal hypervisor as a desktop. This is only recently been supported on platforms like vSphere and Xen due to PCI/VGA Passthrough. If you are looking for any real performance, you are going to be slightly disappointed with this setup. What I generally suggest is to install the operating system, install the ...


3

I think the comment of @Luc is as giving a direction that merits to be expanded here into an answer. Consider the following. The hardware to have a 0.5lb mobile device run at 480p resolution etc is quite recent. Consequently it is only recently that those mobile systems you mention in your question exists. Desktop system which have been able to use ...


3

In addition to Lateral's answer, you can't guarantee your hostnames wont be used in another unforeseen way. Certain protocols require the correct hostname to work (NTLM, and possibly kerberos). If an attacker doesn't have the IP addresses, an external attacker can use the hostnames to perform attacks. A lot of times web application attacks will get you ...


3

AppArmor or SELinux is probably a better solution than running Firefox as a different user. As you mention, running any kind of new software (including Mandatory Access Controls like these) potentially introduces new vulnerabilities (I'm fairly sure some have been found for SELinux) but I think most agree that the tradeoff is worth it.


2

paranoid mode: install a different linux on a different machine, better, use a ro-mounted distro from cd like knoppix or so (virtualbox and kvm is your friend) run your browser from that other machine, using x-forwaring or x2go (free and good linux terminalserver/client-solution, works very nice on debian) harden this browser with noscript, adblockplus, ...


2

Have you thought about using something like Tails(https://tails.boum.org/)? As was suggested above you could use it with a Vm, but based on what it is fundamentally for you wouldn't need to keep an instance on your machine for it. There are also things like sandfox(http://igurublog.wordpress.com/downloads/script-sandfox/) that allow you to run firefox in a ...


1

To get to another aspect of the question: Same-Origin-Policy is an important security boundary and it sounds nice in theory. But, like with other security boundaries, it is often in the way so it gets frequently worked around in praxis. The most common workaround is to include third-party sides as script. Advertisements, tracking or social networks are ...


1

I think it comes down to what you consider to be a "same origin" for a desktop application. In a perfect world ignoring some Windows functionality: Is it a process? Process A can't access Process B memory. Is it a user? User A can't access User B's files. Is it user session? If you're not in Session 0, then you're not SYSTEM. So I think sandboxing a ...


1

You are on the right track realizing that the Xclient (in this case Firefox) will not be able to access an Xserver running under a different user (by default). The simplest solution would be to ssh -X webuser@localhost firefox (note I would explicitly NOT use the 'nobody' account - this should not be used for this purpose) - which automatically deals with ...


1

You can use Nessus for this. It has a plugin for finding data at rest which could be used for this kind of application. One advantage of using a tool like Nessus is that it already has options set-up for authenticating to various types of system over a network.



Only top voted, non community-wiki answers of a minimum length are eligible