Tag Info

Hot answers tagged

24

You should "nuke it from orbit": wipe and reinstall the OS and applications from clean source media, and then carefully restore the data from backup.


12

That utility needs root access because it uses a raw ethernet socket. In a similar way, ping needs root access, as it also uses raw sockets. The difference is that (on most systems) ping is suid-root so any user can run it. If you're happy with non-root users generating these packets, you can make etherwake suid-root, or use sudo as you suggested. There is ...


8

If this were a denial of service attack, you'd be seeing those 15k messages covering less than an hour -- probably far less. This is just the botnet-based brute-force attack on SSH passwords that constitutes part of the "background noise" of the Internet. Make sure you're using strong passwords (or better yet, key-based authentication) and that you've ...


5

been there, did that, faced a massive DDOS against my company afterwards. i'd suggest: take the script, setup an aws-instance and run it there. never ever run that script on a server that could be linked back to any production-system or your company. try to stay anonymous, because you dont know whom you deal with.


4

It's always a question of effort vs result. If an attacker has gained complete control over the system, there are thousands of things that can be replaced or trojanized. Hunting them down one by one is a very time consuming task. If the attackers aren't very sophisticated, you can start by searching for files that have been modified recently. One starting ...


4

I have done something similar, but took different steps to protect myself. My worry was not the authorities, but the people behind the network. I found it absolutely crucial that they would not learn my identitiy, as they surely would not be happy if they detected I had infiltrated their botnet. To avoid any problems, I installed the linux distribution ...


3

Had done some work in this area myself while studying in College, found this website really useful: http://www.amanhardikar.com/mindmaps/Practice.html You will find what you are looking for in the "Vulnerable Operating System Installations" Make sure to check out the OWASP for goodies as well: https://code.google.com/p/owaspbwa/ sourceforge with some goods ...


3

The act of powering down or powering up a machine should be restricted to a small subset of administrators and security personnel in your organization. The act of remotely sending a Wake on Lan packet could have serious negative security and administrative implications if it is given to the wrong users. If you are worried about adding a user to the sudoers ...


3

I doubt this is possible to set up in the BIOS. However, even if it was, you have a bigger issue: The only way to identify a USB device is by its vendor and device ID. However, all devices by a specific vendor share the same device ID. So even if you could whitelist your own USB, any USB of that same make would also be accepted. Also, I'm pretty sure it's ...


2

A server that receives email and delivers it to local users needs root permissions for two things. The component that listens to incoming connections needs to bind the TCP ports for SMTP (25 without SSL, 465 with SSL), because port numbers below 1024 are reserved to administrator-controlled services and binding them is reserved to root (or processes with ...


2

Right now, there are zero passwords that will work if an attacker randomly guesses it. If you set a password, there is at least one that works if an attacker randomly guesses it. This is infinity percent more likely to happen (still very, very unlikely, but it is a nonzero chance compared to the literally zero chance it'll happen with no password), so your ...


2

There's a myriad of ways, depending on the system configuration and installed software. Learn what you can about the system, and then look for publicly-known "privilege escalation" vulnerabilities in the OS and installed software. Make sure to check for the specific versions that are installed, as most known vulnerabilities will likely have been patched in ...


2

Note that magic packets work regardless of their type. Your tool requires root because it sends Ethernet frames directly. However, there is nothing stopping someone from sending the same data inside UDPv4 broadcasts, which is in fact done by practically all other wake-on-LAN tools. (UDP port 9 is common.) This makes network security concerns mentioned in ...


2

CVE Details allows you to create a customized RSS feed with certain CVSS scores. : http://www.cvedetails.com/vulnerability-feeds-form.php However, I'm not sure if there's a way to filter out only Windows & Red Hat OS vulns.. but perhaps someone has an idea?


2

Anonymity isn't binary. There is a sliding scale of anonymity on the web. How much you need to do depends on who is trying to deanonymize you, what resources they have and how much of those resources they are willing to spend on you. Depending on whether you are considered an advertising target, a nuisance to a specific website, a copyright violator, an ...


1

Java's SecureRandom does use /dev/random, but only briefly. Specifically it only uses it when generating seed information, either by explicitly calling SecureRandom.generateSeed() or by the first call to nextInt() So therefore, to repeat your bash example you can do the following, and it should block. import java.security.SecureRandom; public class A { ...


1

Here are some of the steps I would take: 1) Run Burpsuite as a proxy server, intercept the calls, and analyze whether or not there is a specific page you are visiting that is causing this. 2) Uninstall any browser plugins you may be using 3) Remove and reinstall the browser(s) The extreme measure would be to dig into your files and find where the ...


1

When you say that 128 bits are not enough for you, and you really want 256 bits, then you are basically saying one of the two following things: Laws of physics do not apply to you. You do not understand what key size is, and you just want the biggest number, the cryptographic equivalent of painting your car in red to make it go faster. Your choice. See ...


1

If I understand correctly, your computer serves as a Wifi Access Point, so it should have a dhcp server running on wlan0, is that so ? Assuming this is the case, First you need to have /proc/sys/net/ipv4/ip_forward set to 1 instead of 0 (if you are using IPv4, I don't know the equivalent for IPv6, if there is any) The iptables command you are looking for ...


1

First, there is no "standard Linux ACL". Default file permissions can vary by system and by distribution; most distributions seem to have default permissions of 644 or 664, but that's not inherent to the Linux kernel, and the proper umask depends on the system. More broadly: whether files are defaulted to world-readable is a security flaw or not strongly ...


1

Don't write directly the files! Use a logging service (or in the case of the Apache error_log just print into the stderr). And make sure that the logs are outside the document root - if the webserver can be fooled into serving them up as PHP files then you have a major code injection vulnerability. if the log file is subsequently opened/read via command ...


1

Yes. This data should be useful to help debug errors, however, there are at least a few (maybe more) potential security pitfalls to consider: Is any of the data privacy sensitive (like social security numbers, passwords, addresses, etc...?) If so, there could be privacy concerns, but those most of those concerns should already exist with the website ...


1

A bot net is usually associated with malicious behavior (e.g. the people running the botnet may use your computer as part of a distributed denial of service attack against an organization). I see a lot of dangers in doing this, and think it would be a very bad idea unless you have a great reason to do it (e.g. study the bot net to develop countermeasures, ...


1

The reason the master process has to be started as root is because only root can bind to a port in the range of the first 1024 "privileged" ports. Running any type of software as root could be considered a security thread but it also depends how secure the software itself is, and if updates/patches are applied regularly. If you would like to add an extra ...


1

I have recently done the same thing with a Doku Wiki (for secure, offline research storage) on my home desktop (An Arch Linux Box). Only instead of using Ubuntu directly, I ran my server through Virtualbox and Turnkey-Doku Wiki and only turn on Vbox when I need to add/remove things from it. I also have it setup with a bridged connection so it can still be ...



Only top voted, non community-wiki answers of a minimum length are eligible