Tag Info

Hot answers tagged

57

Two generic things you apparently have missed: In case of disk failure, having the data encrypted at rest solves the issue of having potentially sensitive data on a media you can't access any more. It makes disposing of faulty drives easier and cheaper (and it's one less problem) Full disk encryption also makes it harder for an attacker to retrieve data ...


13

If the decryption key is stored in plain on the very same media as the encrypted data, then the encryption is pointless. If you have a set of rules, which require data to be encrypted, but permit storing the key in plain on the very same media, then the rules are flawed. If you ever face such a flawed set of rules, you should point out the flaw. If the key ...


7

Consider what you mean by 'secure' data center. Generally, I don't consider anything secure against a determined and well-resourced attacker. True, having 18" of reinforced concrete, double man-traps, and armed security provides a fair amount of protection, but it's rare that this protection is all just for you. In most co-location facilities, the only ...


7

There are attacks on the firmware of hard disks. Googling for hard drive firmware attack will return some results about what the NSA does or can do, which probably isn't very relevant to you; but even hobbyists are able to modify the firmware of drives. This guy even installed a linux kernel on his hard disk - no, it wasn't the PC that ran linux, the hard ...


6

No, having keys for your root user does not impact your security profile. It is wise though to disable root login in ssh and NOT have an authorized_keys in your /root/.ssh/ folder. However. I got the feeling your going about this the wrong way. Personally, I would not use the root user in this manner (but a system user like www-data) and make several ...


5

In short, there is no way to know this. There are to many 'badly written' USB controller chips out there that either not report that you can write to them. or worse report you can. but simply ignore any attempt to write to them. So without knowing specifically what chip it is you can not know how it reacts to such an instruction. As a even worse case ...


4

If you consider that attackers may recover the RAM contents (a cold boot attack) then you have to take into account that attackers may recover the RAM contents. Your /tmp filesystem is used by application as a temporary repository for some data elements, but the same applications read it back -- into RAM. That is, the RAM-based filesystem is unlikely to ...


3

You may want to try: usermod -p '!!' root usermod with the -p parameters takes the raw value to bet set as encrypted password in the /etc/shadow files. The traditional usage of this parameter is to give to usermod an already encrypted password, but it accepts also the '!!' flagging the account as locked. In the end, this command will remove the current ...


3

The cat binary doesn't implant flock() calls using the LOCK_EX for exclusive write access so your assumption is correct. You can verify that by following the system calls issues by that or any binary by running strace cat file. A way to prevent the problem would be as follows: #!/bin/bash set -e ( flock -n 200 echo > /tmp/shadowcopy chmod 600 ...


3

It highly depends on what software you're using to manage the keys. For example, the proprietary crypto library we use here splits the key over several memory locations, flips them big-endian / little-endian, etc and only reassembles them when they're needed. Any good crypto / key management tool will have its own bag of similar obfuscation tricks. This will ...


3

With your unencrypted boot partition, malware could theoretically replace your unsigned kernel with its own (say, a hypervisor running your original kernel). This malware would then be undetectable by your system, while having full access to it. A signed kernel closes this hole, at least in theory: since the malware hypervisor isn't be signed, a EFI BIOS ...


2

(Disclaimer: I am not an authority on OpenVZ. This answer is more opinionated than my answers usually are, so feel free to criticise!) OpenVZ might be "more" secure in that it does not integrate with the entire kernel, so that its attack surface is a bit lower. Though, essentially OpenVZ is what served as inspiration for namespaces and hence ultimately, LXC ...


2

I agree that the execise is intended to detect the race condition, but as there's no error checking in place (just a set -e would work), there are more holes available: As /tmp is a shared folder, I can create a /tmp/shadowcopy with mode 666 (so you can open and write it, but not chmod). If your script were run by a being member of shadow group (so ...


2

I'd recommend reading the original paper on the Cold Boot attack. Section 6 explains "Identifying keys in memory." They wrote an app called "keyfind" that you might be able to search for.


1

The kernel normally gets its first 'base' time from the RTC or Real Time Clock so while it won't be as accurate yet as after the NTP protocol has updated the time. it is sufficient to validate a signature of a certificate. you can set this value normally in the BIOS before ever booting an OS.


1

The potential problem with cloud machines and randomness is VM cloning; see this. Any decent Linux system will be able to produce high-quality randomness from /dev/urandom at any point after boot, regardless of whether it sits in the cloud or not. However, if a VM is cloned, then the two machines will start at the same internal state, and there is no safety ...


1

Quote: " . . .they have done little to nothing to actually reduce risk associated with unencrypted data. . ." Ok, yeah, I think you are right. The simple answer is "it is pointless", but "it is also NOT pointless." Which is why, and forgive me for saying this, I think you may be barking up the wrong tree. Let me explain. The full disk encryption (FDE) does ...


1

Not surely. It depends on, against what you want to defend yourself. Some examples: If you live in a country, where the government can confiscate your server to analyze its content and then use it against you, or your employer. If you are the owner of the server, but won't give the possibility of your employee/collegues having physical access to it, that ...


1

As @kjetil-limkjær points out, Powershell version 4 and up includes the Get-FileHash cmdlet. powershell get-filehash -algorithm sha1 <file_to_check> Use doskey to make a persistent alias that's easier to remember. doskey sha256sum=powershell get-filehash -algorithm sha256 "$1" doskey sha1sum=powershell get-filehash -algorithm sha1 "$1" doskey ...


1

This is an attempt to exploit CVE-2014-6271 (the “shellshock” vulnerability, if we must). Its appearance in this message is no indication that it was successful; any client can include any string in the Referer: header and have it included in logs here. The attempt didn't succeeded in this specific case, because the log message is telling you there was no ...


1

So it looks like someone is trying to use the shellshock vulnerability which was recently discovered in the bash shell. The key give-away is the part of the log which reads: referer: () { :;}; /bin/bash What the attacker (or unknowing participant) has done is to set their web browser's http referer header to everything you see after the word "referer" in ...


1

As others said, putting SSH on a port other than 22 will make more unlikely to be hit with a random scan. You will be targetted if the attacker is trying to get your server, not any server. I have a server with ssh bound to a random high port. And I have a ssh honeypot on port 22, that will reply to any and every login attempt with a 'access denied' ...


1

This is something of a philosophical question: "is control X helpful?" And as the best answer pointed out, you should also consider "what are the costs (client support, doc exemptions, system support, monitoring support, and I'd throw in direct costs, licensing costs, etc) of control X?" Anything is helpful in certain contexts. It is a good idea to ask ...



Only top voted, non community-wiki answers of a minimum length are eligible