Tag Info

Hot answers tagged

92

There are several reasons why Windows is so heavily inflated with anti-virus products. (I am pointing to out-of-the-box (OOTB) experiences). Windows users are, by default, local administrators, so any social engineering done on Windows can usually lead to an execution of software. Modern Linux has users set-up as low-privilege local users. It requires your ...


42

The reason for this tends to be historical. There is no reason why a modern desktop Linux should be particularly more resistant to malware when compared to a modern Windows desktop. However there have been many more viruses for Windows than Linux amongst desktop users, which is down to factors such as the number of users of the respective platforms and also ...


25

Any time you execute code acquired from someone that you haven't fully reviewed and it runs on an Internet connected system, there is a risk that the person who wrote or deployed that code could transmit data about your usage to another system. That's true regardless of the OS. So yes it's possible. The question then becomes "has this happened in the ...


25

I think the most crucial factor for virus infection of desktop Windows system is, definitely, the culture and discipline of software distribution and installation. While the average Linux user opens the package manager and get the vendor-built software package (and doesn't leave the official repository to find software in 90% cases), the average (non-IT) ...


12

There are some good answers here. I just wanted to add a couple of points. There is an historical component to the argument that Linux is less vulnerable than windows. Some of the basis for this suggestion is not as valid when referring to modern windows implementaitons as it previously was. Perhaps the biggest difference was originally due to differences ...


10

On the Windows monoculture Every working Windows malware can cause an epidemic infection. There are hundreds of millions of Win 8.1 boxes in the world and on many of them e.g. Acrobat Reader has been installed. It is a monoculture. Linux on the other hand is less a monoculture. There are many different PDF viewers: Evince, Okular, mupdf, xpdf... There are ...


6

Bugs in your script If you think this script runs great, you haven't tested it enough. There is a classic vulnerability in your script: insecure temporary file. You attempted to protect from it, but in an overly complicated way, and you shot yourself in the foot. random=$(tr -dc [:digit:] </dev/urandom | head -c2) random is set to two random ...


5

A fundamental problem with Windows' excuse for a security model--probably the biggest one--is that the only way a user can allow programs to do certain things that almost any installable program might need to do is to grant the program unlimited authority to do anything and everything it wants. If it were possible for Windows to say e.g. "This program would ...


5

Well any program can have security flaws and one's that interact with the Internet are exposed to potentially malicious content. That said the major browsers have pretty good track records (all things considered) at reacting to security issues and issuing appropriate patches. If you do decide to try to protect yourself from this, it might make sense to ...


4

Comparing Windows and Linux is like comparing apples and oranges structurally. Configuration plays a larger role in protection than any specific OS architecture, and it goes from physical security all the way to maintenance and upkeep. All security implementations can be removed in all operating systems, and corners can be cut in terms of maintenance and ...


3

Why not install however you want, then mark the disk immutable, then take a snapshot? Every time it restarts, you'll get back to the disk image as you set it up. This way you can use FDE if you like, and still not have any persistence session to session.


3

No, this is correct, you are putting PPP packets into your SSH connection. The idea of a VPN is that you are tunnelling, which basically means that you have an SSH connection (a tunnel) that looks like PPP when you are sending something into it. Thus, if you send a request through your tunnel with a protocol like HTTPS, your packet on the wire will look ...


3

cgroups and namespaces are about isolation whereas SELinux is a mandatory access control system: fine-grained access over which system calls are allowed, how information is allowed to flow between processes (domains). The android permissions that applications have to subscribe to can be easily enforced through SELinux, as can process isolation and even many ...


2

Since the BIOS is generally the first thing that runs in a computer, using a PCI/PCI-E USB controller, bluetooth, or on screen keyboard would only "protect" you if the attacker didn't consider these cases. This is still a problem because you're depending on whether or not the attacker did attack something rather than whether or not they can attack ...


2

Alternatively, you might consider the JuiceSSH client. It stores your keys in its private app directory. In addition, it encrypts its storage so even jailbroken phones offer some level of protection. Sources: - @JuiceSSH: "External storage won't work as keys are imported into the internal JuiceSSH database". - @JuiceSSH: "They [ssh keys] are stored in an ...


2

The reason why it's important and not critical is not because there are mitigating factors. The description of Important is: This rating is given to flaws that can easily compromise the confidentiality, integrity, or availability of resources. These are the types of vulnerabilities that allow local users to gain privileges, allow unauthenticated ...


2

There are lots of Linux distributions with different business models. While most of them probably don't actively spy on their users some deliberately do it: North Korea's Red Star Linux inserts sneaky serial content tracker ERNW security analyst Florian Grunow says North Korea's Red Star Linux operating system is tracking users by tagging content ...


1

LLVM's LibFuzzer might be helpful. It is a toolkit to help with in-process fuzzing of libraries. It does not solve the problem of automatically identifying function signatures of each exported function and injecting random data of the appropriate type to each. Instead, it expects you to write a small test harness of your own that invokes the exported ...


1

Not a full answer, but another thing to think about: with a system like that the easiest way for an attacker to gain access (ie the weakest link) is to steal the private keys to one of those client certs. Things to think about: Are the linux machines physically secure, or do they leave the building (ie laptops)? Do you have good policies for certificate ...


1

It may not be best practice because you're using a specific-purpose CA (in which case, authenticating your OpenVPN clients) for something else, but security-wise, as long as that CA is secure, your solution is fine. I would recommend however putting the private key of that CA certificate somewhere safe, like a smartcard, a completely offline computer or an ...


1

To answer your question, I need mention an other opensource product (OpenSSL) in order to make a parallel with Linux and other opensource projects; so let me introduce you a short story about it and hopefully you understand the logic: HeartBleed is a vulnerability that was first introduced by Stephen Henson just an hour before 2011 new year's Eve. To be ...


1

You can use subuser to sandbox an application using Docker. Say you wanted to sandbox Firefox: You would create a folder my-subuser-images and then create a second folder firefox in the first one: my-subuser-images/firefox In the firefox folder, you need to create yet another sub-folder: docker-image Once you have done that you need to create two files: ...


1

If you speak typically about Ubuntu then the answer is no. There has not been developed any such nefarious software yet. If you talk about Unix-based systems then we can mention only one by now: It is coded to run on both 32-bit and 64-bit systems, which increases its chances of running on whatever computer it infects, Carter said. Newer versions of ...


1

So far, there aren't examples of ransomware in the wild targeting Linux (and especially Ubuntu). In general, Linux malware is near to non-existent.


1

TrueCrypt 7.1a has been forked into other projects, such as VeraCrypt, which just like TrueCrypt offers hidden volumes. I can't comment on whether to trust TrueCrypt/VeraCrypt or not (since TrueCrypt's sudden discontinuation), but both are open-source so you can figure it out yourself, and there has been an audit on TrueCrypt recently (as of writing).


1

Secure Boot is one security technology, it is not complete. There can be attacks before Secure Boot, Intel created Boot Guard for that. Read this Apress book for better understanding of the various Intel silicon and firmware technologies: http://firmwaresecurity.com/tag/isbn-978-1-4302-6572-6/ Also, Secure Boot varies in strength by OS, see: ...


1

Yes you definitely should install anti virus software. However you should always remember that even with the best protection you can still get infected by malware. A few months ago security researcher described how malware spread in Steam gaming platform. Basically gamers were receiving a message on Steam that looks like "WTF?????" linked to a JPEG image ...



Only top voted, non community-wiki answers of a minimum length are eligible