Hot answers tagged

52

We always hear... Do we? I don't. Installing some untrusted program as a normal user is a bad idea with Linux the same it is with Windows or Mac: this program has access to all your data and can delete these data, send these data to somebody else etc. Moreover it can make screenshots, control other applications running on the same X windows screen ...


30

In short: yes, being on a low-privilege account helps protect you against malware, but does not make you immune. Like any security measure, no single thing is going to keep you 100% safe. TL;DR: Running on a low-privilege account (aka "principle of least privilege") should be part of a balanced breakfast which also includes good firewall configurations; ...


19

Video files by themselves can not contain a "virus" in the classical sense but they can be used to exploits bugs in the media players (or sometimes even the OS) when handling the file formats and codecs. By using these exploits they can then execute code. Like most video players vlc also has/had lots of bugs which could be exploited, including in the ...


16

Potentially, yes. That said, many distributions (e.g. Debian, Ubuntu) run package versions which are extremely out of date (years) with few backported security patches, and most people do just fine. You're also usually only exposed on the network you're immediately connected to, so if you're only using a trusted LAN then it's not so much of a concern. ...


10

Yes, VLC can be hacked. Here you can check CVE list of VLC. But don't panic, just because your VLC freeze, that doesn't necessarily ​mean that someone hacked you. Make sure that your VLC is up to date. Can you submit that file to this website Cuckoo Sandbox and then paste the report here, just out of curiosity let us see, what will heppen when that file is ...


7

This is a horrible case of Security Theater Security Theater is the practice or belief of something that looks like it improves security, but in reality does little/harm to it. This false belief has been around as long as the following rumor Linux has no viruses because of it's permission system That's almost as good as saying I don't have a ...


6

There is a potential risk in using old versions, but in many cases this risk is less significant than the risk of using reasonably patched system which has all sorts of dubious software installed, and may possibly contain malware. There are of course distributions dedicated for use as a live OS dedicated for doing such things as banking. They are hardened by ...


5

Depending on how the files have been deleted (and your file system) there might be forensic tools that evaluate the journal and retrieve as much information still alive behind the scenes of the filesystem. For example, if you are using ext3 or 4, extundelete may help when the attackers were sloppy with deletion and didn't overwrite the files. There are ...


5

The attack listed in the referenced question certainly would not work with VLC or Linux. VLC does not support the obscure Windows Media Player DRM it utilizes (at least not to my knowledge), and even if it did, the purpose of the attack is to trick you into downloading and running some Windows executable files. That being said, a different kind of attack is ...


4

The system itself is safe from accounts that aren't root-equivalent, but that doesn't help much on a desktop where most of what you care about is your own data, and you authenticate regularly to become root from your account. If someone has an account on a correctly-configured multi-user system, and they don't have sudo privileges or the root password, then ...


4

Short of reading and understanding every line of code and how it all fits together you realistically can't. The best you can really do it to download it as a package from a reputable source who vet the packages in advance, to minimise the risk to the user. However there are times when even full blown operating systems are are hacked (such as Mint Linux ...


4

You cannot. Not all chipsets/wifi drivers support monitor mode. Broadcom is know for lacking in open source drivers functionality support. It is already public knowledge the RPi 3 current driver implementation does not support monitor mode. PSA: The Raspberry Pi 3's embedded WiFi card does not support promiscuous mode. If you are buying a replacement, do ...


3

If you used a LiveCD and never/rarely went out of your way to get a new one, yes it would eventually contain old and buggy software. However, the point of the LiveCD is that there is nothing saved in a nonvolatile way, so even if you do manage to luck out on your "risky click of the day" and the browser downloads some malware, all you have to do is hit the ...


3

If you run the following command on the SFTP server (assuming the correct path) ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub You will have an output similar to the following: 2048 7c:d9:68:a7:de:ad:26:12:34:56:78:00:4a:9b:a2:b9 root@localhost (RSA) If you save this hash string with your client you can compare it upon first connecting or if you ever ...


3

Authentication to SSH Authentication takes two primary forms, username and password, and key-based authentication. There is also an authenticity check performed when the client connects to the SSH daemon by confirming that the trusted public key has not changed by comparing the fingerprint that is in the trusted database known_hosts, and what the server ...


3

As per the page you linked, there's a workaround. Add the following to your policy.xml: <policy domain="coder" rights="none" pattern="EPHEMERAL" /> <policy domain="coder" rights="none" pattern="HTTPS" /> <policy domain="coder" rights="none" pattern="MVG" /> <policy domain="coder" rights="none" pattern="MSL" /> <policy ...


2

Legal note: That depends on what you expect to achieve with plausible deniability: This can bite you in the ass in several countries (like the UK, for example.) The police there know of the existence of TrueCrypt, and under the RIPA Act (and similar legislation elsewhere), they may fine and/or imprison you if you do not provide the decryption key to all ...


2

I have heard that the full disk encryption helps protect against malware threats, specifically in this case a malware which could programmatically copy the information while it was temporarily saved on the servers. Full disk encryption does not protect against anything that uses the OS interfaces to read and write to the device in question while the ...


2

The short answer is: if your Firefox is compromised, it can do whatever it wants. It can modify whatever files it wants. It can even keylog and get root. But there are a few ways you can improve your security, like using a more secure browser, AppArmor or the NoScript plugin. The long answer is... Yes, if your Firefox process is compromised, it can do ...


2

You can disable the module. modprobe nf_conntrack nf_conntrack_helper=0 More info about securing helpers without disabling the module entirely can be found here https://home.regit.org/netfilter-en/secure-use-of-helpers/


2

If you have your system set up so that only connections to your bank (eg. www.bank.com and www.bankcompany.net IPs) were possible, a redirect to a third site wouldn't load. The exploiit would need to be hosted on the same site as your bank (which is admittedly rare). As with many security solutions, it's possible that some bank update makes the website not ...


2

Yes. You can use echo maliciously. You can use > operator to redirect the output to a file where the output can be a malicious code. echo 'Malicious_code_here' > shell.php Lets consider a case where the webserver supports PHP and the www directory is writable. you can try something like: echo '<?php system($_GET["cmd"]);?>' > shell.php ...


1

The recipe here, while not by any means foolproof, is incomplete or wrong. Installing untrusted software under your unprivileged account is a disaster. Installing it in a carefully prepared other unprivileged account? Less risky, but by no means guaranteed to be safe. If: you are sure that your system is set up as a secure multi-user system (no random ...


1

All processes running as your user can read the contents of your clipboard and modify the contents. The KDE clipboard, called Klipper when I last used KDE, also stores previous clipboard history. It stores it by default in a text file. This means that the contents can be recovered from your hard drive by a forensics examiner or malware. You can disable this ...


1

No, for the following reason: root could patch sshd to always try root's authorized_keys file as well as its own. Of course if root's private key gets stolen you have a bad day. Don't allow that. You would be much happier if root's private key only exists in /root on the server. If someone can become root they can steal it but that's of no account because ...


1

Let me answer with a few observations, and comments. I will begin with the "whodunit" approach of aiding in determining who, what, when, where, and how. What - a file you found on your system When - what date was it found How - how was it uploaded Who - who uploaded it You already know the file because you found it. Let's call this file: malicious.php. ...


1

Kudos for finding it quickly, it looks like you're doing something right. But you're also doing a lot of things wrong. The most obvious one is that directories within your document root are writeable by the webserver UID. It would help to know what you are trying to achieve by "tracing the origin" of the script. Certainly you should be looking for the ...


1

There are many things you can do with that. Check the web application source code for settings configurations like databases, then check for a way to connect with the db. Keep looking at the source code and you might find more vulnerabilities (rce,sqli) or misconfigurations that can lead you to database dump, or some old backups, passwords disclosures, ...


1

You should back up all files, not just ones you think look important. Don't back up individual files either. Instead, have your syslog daemon send a copy remotely to your backup server in real time. Most syslog daemons support this, and the good ones even support sending it over an encrypted channel. If that is not supported, you can always set up an ...



Only top voted, non community-wiki answers of a minimum length are eligible