Tag Info

Hot answers tagged

9

It seems to me you're discussing two things: sandboxing on the desktop and then strategies for user content access in sandboxed applications. Sandboxing There are many sandboxing models out there, including the ones used by OSes: Windows 8 WinRT Store Apps OS X Sandboxed Store Apps iOS Apps Android Apps Some apps are shipped sandboxed, for instance ...


4

Rootkit.Sirefef.Gen is not a specific specimen of malware as such. The ‘.Gen’ typically means the AV scanner has picked it up through generic heuristic algorithms as something that looks like Sirefef (ZeroAccess) rather than 100% matching a specific signature. There is a large extended family of trojans that would trigger a detection like this and no way to ...


3

It sounds like you are wanting to run a bare metal hypervisor as a desktop. This is only recently been supported on platforms like vSphere and Xen due to PCI/VGA Passthrough. If you are looking for any real performance, you are going to be slightly disappointed with this setup. What I generally suggest is to install the operating system, install the ...


3

I think the comment of @Luc is as giving a direction that merits to be expanded here into an answer. Consider the following. The hardware to have a 0.5lb mobile device run at 480p resolution etc is quite recent. Consequently it is only recently that those mobile systems you mention in your question exists. Desktop system which have been able to use ...


3

AppArmor or SELinux is probably a better solution than running Firefox as a different user. As you mention, running any kind of new software (including Mandatory Access Controls like these) potentially introduces new vulnerabilities (I'm fairly sure some have been found for SELinux) but I think most agree that the tradeoff is worth it.


2

paranoid mode: install a different linux on a different machine, better, use a ro-mounted distro from cd like knoppix or so (virtualbox and kvm is your friend) run your browser from that other machine, using x-forwaring or x2go (free and good linux terminalserver/client-solution, works very nice on debian) harden this browser with noscript, adblockplus, ...


2

Have you thought about using something like Tails(https://tails.boum.org/)? As was suggested above you could use it with a Vm, but based on what it is fundamentally for you wouldn't need to keep an instance on your machine for it. There are also things like sandfox(http://igurublog.wordpress.com/downloads/script-sandfox/) that allow you to run firefox in a ...


1

As an immediate patch, you should run such an application in a separate X server on a different VT. This is the only way you can guarantee that the app does not use the X API to spy on other clients. You may also try your hand at XSELinux but I know of very few people in the world who know how to run it, and it usually severely limits what your target app ...


1

Sprinkling crypto fairy dust will not prevent the attacker who controls the client from making the client do anything s/he wants with it. S/he can still redirect it to localhost, but now needs to replace the public key you embedded with the app with his/her own public key. Or attach a debugger and disable the use of crypto entirely. Or decompile, remove use ...


1

To get to another aspect of the question: Same-Origin-Policy is an important security boundary and it sounds nice in theory. But, like with other security boundaries, it is often in the way so it gets frequently worked around in praxis. The most common workaround is to include third-party sides as script. Advertisements, tracking or social networks are ...


1

I think it comes down to what you consider to be a "same origin" for a desktop application. In a perfect world ignoring some Windows functionality: Is it a process? Process A can't access Process B memory. Is it a user? User A can't access User B's files. Is it user session? If you're not in Session 0, then you're not SYSTEM. So I think sandboxing a ...


1

You are on the right track realizing that the Xclient (in this case Firefox) will not be able to access an Xserver running under a different user (by default). The simplest solution would be to ssh -X webuser@localhost firefox (note I would explicitly NOT use the 'nobody' account - this should not be used for this purpose) - which automatically deals with ...


1

You can use Nessus for this. It has a plugin for finding data at rest which could be used for this kind of application. One advantage of using a tool like Nessus is that it already has options set-up for authenticating to various types of system over a network.



Only top voted, non community-wiki answers of a minimum length are eligible