Hot answers tagged

54

We always hear... Do we? I don't. Installing some untrusted program as a normal user is a bad idea with Linux the same it is with Windows or Mac: this program has access to all your data and can delete these data, send these data to somebody else etc. Moreover it can make screenshots, control other applications running on the same X windows screen ...


31

In short: yes, being on a low-privilege account helps protect you against malware, but does not make you immune. Like any security measure, no single thing is going to keep you 100% safe. TL;DR: Running on a low-privilege account (aka "principle of least privilege") should be part of a balanced breakfast which also includes good firewall configurations; ...


19

Video files by themselves can not contain a "virus" in the classical sense but they can be used to exploits bugs in the media players (or sometimes even the OS) when handling the file formats and codecs. By using these exploits they can then execute code. Like most video players vlc also has/had lots of bugs which could be exploited, including in the ...


18

As the system is compromised, nothing is to be trusted via way of tools. Unless you have the tools validated (e.g. Tripwire FIM), your best bet is to take a similar system, copy over what is necessary, which should run if the systems are similar in architecture, etc. This is not the optimal method though. Because the machine is compromised, depending on your ...


10

Yes, VLC can be hacked. Here you can check CVE list of VLC. But don't panic, just because your VLC freeze, that doesn't necessarily ​mean that someone hacked you. Make sure that your VLC is up to date. Can you submit that file to this website Cuckoo Sandbox and then paste the report here, just out of curiosity let us see, what will heppen when that file is ...


7

If your system has been compromised, you shouldn't trust anything. I think usually the standard utilities will mostly work correctly, but leave out stuff related to the attacker's processes. Rootkits are designed this way so you're less likely to notice that the machine is compromised. So I think you can generally trust them for looking at your own ...


7

This is a horrible case of Security Theater Security Theater is the practice or belief of something that looks like it improves security, but in reality does little/harm to it. This false belief has been around as long as the following rumor Linux has no viruses because of it's permission system That's almost as good as saying I don't have a ...


5

The attack listed in the referenced question certainly would not work with VLC or Linux. VLC does not support the obscure Windows Media Player DRM it utilizes (at least not to my knowledge), and even if it did, the purpose of the attack is to trick you into downloading and running some Windows executable files. That being said, a different kind of attack is ...


5

I will focus only on some problems with your approach: The insecure system writes the CD and thus can tamper with both the data on the CD but also with the format of the CD, i.e. the file system. This CD is then read by the secure (air-gapped) system and mounted there. Mounting is done inside the kernel (i.e. system level access) and there were bugs in the ...


4

The system itself is safe from accounts that aren't root-equivalent, but that doesn't help much on a desktop where most of what you care about is your own data, and you authenticate regularly to become root from your account. If someone has an account on a correctly-configured multi-user system, and they don't have sudo privileges or the root password, then ...


4

You cannot. Not all chipsets/wifi drivers support monitor mode. Broadcom is know for lacking in open source drivers functionality support. It is already public knowledge the RPi 3 current driver implementation does not support monitor mode. PSA: The Raspberry Pi 3's embedded WiFi card does not support promiscuous mode. If you are buying a replacement, do ...


3

As per the page you linked, there's a workaround. Add the following to your policy.xml: <policy domain="coder" rights="none" pattern="EPHEMERAL" /> <policy domain="coder" rights="none" pattern="HTTPS" /> <policy domain="coder" rights="none" pattern="MVG" /> <policy domain="coder" rights="none" pattern="MSL" /> <policy ...


3

The misconfiguration would come from either a group, or user entry in sudoers.conf. This is the file that controls who can do what (with regards to sudo). In this instance judging by your commands (if they were not edited) the sudoers file contains an entry for the user asterisk to run the sudo command without entering a password. Now in the case of nmap ...


3

I pulled out my crystal ball and, Good News!, none of ps, netstat, top, and lsof have been changed! In fact, none of the commands on your system were changed by the rootkit... except for bash. However, bash intercepts calls to all the other utilities in order to hide the continued presence of the rootkit by modifying any output before you see it; you might ...


3

Authentication to SSH Authentication takes two primary forms, username and password, and key-based authentication. There is also an authenticity check performed when the client connects to the SSH daemon by confirming that the trusted public key has not changed by comparing the fingerprint that is in the trusted database known_hosts, and what the server ...


3

If you run the following command on the SFTP server (assuming the correct path) ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub You will have an output similar to the following: 2048 7c:d9:68:a7:de:ad:26:12:34:56:78:00:4a:9b:a2:b9 root@localhost (RSA) If you save this hash string with your client you can compare it upon first connecting or if you ever ...


3

If you used a LiveCD and never/rarely went out of your way to get a new one, yes it would eventually contain old and buggy software. However, the point of the LiveCD is that there is nothing saved in a nonvolatile way, so even if you do manage to luck out on your "risky click of the day" and the browser downloads some malware, all you have to do is hit the ...


2

If you have your system set up so that only connections to your bank (eg. www.bank.com and www.bankcompany.net IPs) were possible, a redirect to a third site wouldn't load. The exploiit would need to be hosted on the same site as your bank (which is admittedly rare). As with many security solutions, it's possible that some bank update makes the website not ...


2

You can disable the module. modprobe nf_conntrack nf_conntrack_helper=0 More info about securing helpers without disabling the module entirely can be found here https://home.regit.org/netfilter-en/secure-use-of-helpers/


2

If you don't do anything wrong and don't lose your encryption key, then you should be reasonable safe that others won't be able to decrypt those files. However, somebody who is able to gain read access will probably have write access, too (and delete or destroy your backups). Just a few suggestions: Keep your encryption keys at a safe place. If you want ...


2

In a default configuration, all traffic (including DNS) should be routed through an OpenVPN tunnel. However OpenVPN in itself does not provide mechanisms to enforce all traffic being routed via its tunnel and if an application or the operating system decides to route traffic via unencrypted interface, it is free to do so (as was the case with Windows 10 ...


2

Yes. You can use echo maliciously. You can use > operator to redirect the output to a file where the output can be a malicious code. echo 'Malicious_code_here' > shell.php Lets consider a case where the webserver supports PHP and the www directory is writable. you can try something like: echo '<?php system($_GET["cmd"]);?>' > shell.php ...


2

Amazingly, against all the laws of the universe, a car-based analogy is useless here. An Invasion of the Body Snatchers analogy works, though. Any of your system's commands (or the libraries that they depend upon) can be (and probably has been) replaced with a copy that looks and acts almost exactly like the original but also has the secret purpose of ...


2

Probably, but not necessarily. The attacker could always replace the programs with modified versions of their own if they had root access.


2

From the name, I'm guessing that is the des(1) command included with Solaris, that someone pulled forward from Solaris 7 to your Solaris 10 installation (unclear why, as it is also available out of the box from Solaris 10u4 and up, and in SUNWcry before). des(1) encrypted data with single-DES, but the file format will not match OpenSSL's file format. the ...


2

It seems that the issue has been reported back in 2011. In addition, a patch proposed to make /proc/interrupts readable by root only. By reading the thread, it seems that they consider the distributions should change the permission of /proc/interrupts if they wanted to. An issue was raised about the fact that it can be cumbersome to force everyone mounting ...


2

It's world-readable now because it was made world-readable when it was created twenty years ago or so. I haven't researched the history (which probably exists only in Linus Torvalds's head anyway) but it's likely that this file is world-readable because there's no obvious reason to make it so. After all, it doesn't contain any confidential information: just ...


1

chage -M 99999: The password will be valid for 99999 days (until 21 feb 2290 if changed today) chage -M -1: This will remove the checking of the password's validity. So, unless your users are quite longlived (and are not going to change your systems passwords)… no, I don't see any functional difference ☺ That security scan doesn't seem too thorough.


1

Here is a reference for you: https://imagetragick.com According to that page, you should verify magic bytes for the file you are processing, and you should use a policy file to disable the vulnerable ImageMagick coders. The site provides a sample global policy. However it is not one size fits all. You can use it as a starting point.


1

Yes, Please do it . It is still better than a network without any firewall. looking at the link, this is a simple network firewall with DHCP, DNS and SNORT. It does not decrypt your SSL traffic because it is not a Proxy. the Main function of this firewall is to protect your LAN from attacks (including some commonly known DDoS attacks as well). as far as I ...



Only top voted, non community-wiki answers of a minimum length are eligible