Tag Info

Hot answers tagged

29

You can install an antivirus if you want. It should not hurt your machine, but don't expect much protection for your system and don't consider yourself entirely safe. The efficacy of antivirus software is very relative, and they're mostly in use to avoid propagate old malware especially if you have Windows machines in your ecosystem. You should expect a ...


11

For a single-user system, there's not much difference between the two from a security perspective: in either case, the attacker needs to guess one password to gain superuser privileges. The big difference shows up in a situation where you've got multiple administrators. In that case, requiring sudo creates an audit trail of exactly who performed which ...


8

Who are you worried about? Attacks from the Internet on e.g. SSH? You can prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips. Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You ...


6

Ye cannot defeat root ! The root user can have complete control of the machine. The best that you can hope for is encryption: use GnuPG to encrypt the data with a sufficiently strong random password, that, of course, you won't reveal to the root user. However, as soon as you decrypt the file on the machine, wherever you put it, root will be able to see it. ...


5

Assuming your server doesn't use any credentials besides system-level accounts and the MySQL password, there's one thing you need to protect: the swap file. Programs are supposed to take steps to prevent credentials from winding up in swap, but they don't always do so. There are some sensitive things in /dev and /proc (such as /dev/mem and /proc/kcore). ...


4

Yes it is possible to do a cache poisoning attack, and yes it is possible to protect yourself. In addition to the rather standard practice of signing the package files with GPG, some distros use DNSSEC to protect the domains that serve those files against DNS spoofing. Notice the 'ad' flag in the dns answer below: $ dig +dnssec security.debian.org. ; ...


3

I think you can safely live normally ;) The user in this forum propably just took a guess on your UserAgent. This is neither considered hacking nor does it do any damage on your pc. There is even a Website telling you what OS you use, only by visiting it. There are also more informations about how this is working.


3

Use a clean PC or VM for your VPN connection and never ever use that system outside of the VPN. A VM will only work if your host is clean. If you install free games or random software then you SHOULD NOT trust your PC anymore. Never login to accounts that you use outside of the VPN !!! Create separate accounts for any service you use over the VPN. Never ...


3

It's often not only the case that "payment information" is the only sensitive information. If your portal requires some sort of "login" (which it undoubtedly does), you allow many parties in between (Internet Cafe owners, ISP's, "hackers", employers, govermenments, ...) to see these credentials and take over the account. If your portal has anything in ...


2

Putting an xinetd server in front of your web server will reduce security: in addition to any security holes in the web server, you now also are vulnerable to any security holes in xinetd. Any security measures you can apply through xinetd, you can apply instead through the firewall or the web server.


2

Your assessment sounds correct. It's impossible, of course, to say that your server has not been compromised, but by default, PHP receives all the data before executing the script, so it writes file uploads to /tmp and provides that filename to the running script. If your /tmp is mounted with atime enabled, the fact that atime==mtime is reassuring. If the ...


2

To answer your question, it is possible to spoof the update servers DNS; then, your packet manager should not install unsigned packets, an attacker could send you bad data, but you wouldn't accept it. Most distributions use OpenPGP to sign their updates. Fedora and Debian do for example. You just have to make sure that your automated option validates ...


2

Essentially, you need to control the execution environment of the apps. There's no magic about it. A couple of solutions that come to mind: You could somehow set all the binaries that worry you as setuid/setgid (that does not mean they must be owned by root, as far as I know). Linux normally prevents attaching to a setuid/setgid process. Please do verify ...


2

Short answer Yes it is possible and aside from gpg-checking there are still several possible attacks! To prevent getting a fake repo, I would make sure to use HTTPS for my repos, and run a validating caching nameserver locally (DNSSEC) like Joe Sniderman suggests (the only available measure against DNS spoofing I have seen so far) But if the repository ...


1

Except for the few exceptions for viruses that can run on Wine and iyou have Wine installed, Linux generally won't be affected by Windows virus. Note though that Linux can be an asymptomatic carrier of Windows viruses. If you send other people a file infected Windows virus, their machine can catch the virus, even if the file looks fine on your Linux ...


1

I wouldn't assign a password to the root account, it makes guessing usernames too easy. I solved this "problem" by assigning my account to a admin group and gave this group sudo rights without the use of a password. Once you made a group and added yourself use visudo to alter the sudoers file and add the following line: %GROUPNAME ALL=NOPASSWD: ALL Now you ...


1

I don't know how exactly a UML kernel is run on the host system. I'm entirely speculating, but my speculations might be useful if you can combine them with some documentation on UML implementations. Privilege escalation in the guest with a guest-specific exploit Being root on the guest kernel should essentially allow you to do whatever you want with the ...


1

PCI compliance covers a lot of ground - anything that "stores", "processes" or "transmits" cardholder data. Different systems need to have different parts of the standard applied to them to maintain a cohesive whole. Your system would fall into the "processes" category. Your needs would be different for storage, etc. In the case you have outlined you can ...


1

You could protect /dev/kvm with a group. Transfer /dev/kvm ownership to the group so that root privileges aren't given. This link explains how to do it, and here's the direct quote: The cleanest way is probably to create a group, say kvm, and add the user(s) to that group. Then you will need change /dev/kvm to owned by group kvm. On a system that ...


1

With KVM and Xen, the rogue administrator can take a snapshot of your live machine, then explore at his leisure what is in the RAM of your VM. In particular, he will easily obtain the encryption keys for the encrypted filesystem, and then proceed to read all your files. By the very nature of the snapshot system, you will not notice it. With OpenVZ, you ...


1

Regardless of what virtualization technology you use. Once the attacker has access to the hardware, it's game over. In case of a VPS, even when encrypting the root partition, if the key is stored in memory and you have no control of the hypervisor, then you cannot protect your system's confidentiality with encryption. Administrators with access to the ...


1

As with most remote exploits targeting a 3rd party plugin (i.e, Adobe Flash, in this case), the attacker used a malformed compressed flash video to corrupt the embedded flash player on the victim. The exact mechanisms are unclear to me as I have no intent on clicking on the video you linked because that video COULD be malware itself... however, the ...


1

I wouldn't be overly concerned. There are plenty of ways he could possibly have found your operating system, a lot of them not considered malicious and are done directly through the browser without any form of exploit. For example this information could come from your user agent: http://en.wikipedia.org/wiki/User_agent Through the user agent they could ...


1

Malware doesn't care if you're running a "standard-install Ubuntu desktops only". Malware will run as long as the system supports the correct instruction set that the ELF binary was compiled for. Ubuntu is debian based supporting the following instruction sets: IA-32, x86-64, ARMv7, ARM64, PowerPC. Generally you find most are built on IA-32 or x86-64 ...


1

There is no such thing as "entropy" of a file. The entropy is a characteristic of a process -- for instance, of a process that generates a file. The entropy does not describe what the file contents are; it describes what the file contents could have been. As such, any tool which purports to identify "entropy patterns" is, at best, loosing extremely poor ...


1

Most of Steve DL's points are good, the "best" approach is to use a run-time linker (RTLD) that you have more control over. The "LD_" variables are hard-coded into glibc (start with elf/rtld.c). The glibc RTLD has many "features", and even ELF itself has a few surprises with its DT_RPATH and DT_RUNPATH entries, and $ORIGIN (see ...


1

Yes, there is a way: don't let that user run arbitrary code. Give them a restricted shell, or better, only a predefined set of commands. You wouldn't prevent any malware from running, unless you've used some non-standard privilege escalation mechanism that doesn't erase these variables. Normal privilege escalation mechanisms (setuid, setgid or setcap ...


1

Question is asked for Ubuntu.If I can little wide the question to Linux desktop editions, SELinux type "Walled Garden" solution would be much useful. In SELinux mandatory access-control policies (MAC) can stop or limit the damage in infection attempt. Unlike AV which runs as separate process which makes burden to OS, SELinux has native support by the Linux ...


1

You can hide from Telnet by changing the welcome banner of each service you're worried about (some of these will be easy to change, others will be hard). You can make Nmap's OS detection less reliable by configuring your firewall to drop all packets to closed ports: Nmap works best if it can find both an open port and a closed port to probe.


1

Did you say something about running phpMyAdmin? Is its directory standard and/or publicly available? (even if [you think] nobody has the password). phpMyAdmin is usually an attack vector on web and database servers, and its existence is widely searched for on automated crawlers. Is the server compromised? As David said, we can't tell whether it was or not, ...



Only top voted, non community-wiki answers of a minimum length are eligible