New answers tagged

0

This would be mildly helpful and help defend against lots of hardware keyloggers, however there are some that take into account mouse data, this is however harder to use and requires some resources. Additionally hardware mouse loggers are rather uncommon. However if someone with significant knowledge and resources has access to the hardware you are using and ...


0

It is most likely that your router was infected and android takes its dns server from dhcp. There are a few driveby attacks that work on routers like this.


1

With the module loaded, type info at the console prompt. You'll see what it expects. The INFILENAME is the path with the existing PDF to use and the FILENAME is the filename to export the malicious PDF as. msf exploit(adobe_pdf_embedded_exe) > info Name: Adobe PDF Embedded EXE Social Engineering Module: exploit/windows/fileformat/...


0

The PSK is not 'converted' to hexadecimal but if doing the calculation by hand it is often expressed that way to simplify the process. As the manpage indicates, wpa_passphrase pre-computes PSK entries for network configuration blocks of a wpa_supplicant.conf file. An ASCII passphrase and SSID are used to generate a 256-bit PSK This means, you ...


1

Linux uses TSC by default for its clock source due to its lower overhead, and only uses HPET as the fallback. The kernel gathers entropy from interrupt timing intervals, using the RDTSC instruction on x86 processors. Unless you do not have TSC support, then I do not believe disabling HPET will influence your entropy collection at all. Only on certain ...


1

No, it shouldn't scare you if you're worried about safety of packages. Though I do not recommend using it since it's not officially supported. Universe is community maintained software, that is to say "not officially supported software". I recommend you read this article so you'll understand the differences between Main, Restricted, Universe, and Multiverse ...


1

You can normally upload the file using standard HTTPS way, however, exposing application server for uploads is always very risky. Especially if the application server has a lot of libraries built-in and so on. So ideally: Create dedicated Tomcat instance just for file uploads with minimum set of libraries Enable HTTPS on it and disable HTTP, harden HTTPS ...


-1

plain dm-crypt does not use salt, wich means that if you cipher the same data with the same password you end up with the same result. That is a big weakness, specialy if the attacker knows you encrypted a file system, he can gess how your data look and try keys to see if it matches.


1

The direction of stack growth is hardware dependent. On x86 architectures, it grows downward, but it may be different on other architectures.


3

as all the libraries are providing almost similar functionalities ? It does not matter if they have similar functionalities because they have different implementations. The certification not only includes if a specific algorithm is implemented at all but also if it is implemented correctly.


-1

Is your computer a 32 bit or a 64 bit?


0

This means that you are most likely trying to run 64-bit version of Kali on a 32-bit CPU. Try downloading and using a 32-bit version of Kali.


0

Using root privileges throughout your system is similar to leaving your house keys near the window, even though it's shut. If you have experience breaking through web applications (or any other entry points) using weaknesses, then you will understand that defense-in-depth is very important. Why? Because applications always have vulnerabilities, they just ...


0

Create a visually recognizable fingerprint based on the shasum, and use it for verification. $ bishop $(find| LC_ALL=C sort|tar -cf - -T - --no-recursion|shasum|tr -d ' -') +--[ RandomArt ]--+ | .. ooooo | | Eo . . | | . . | | . | | S o | | o Oo. | | +.Xo | | .* o* | | ...


3

You could simply use md5sum. First keep a copy of the current checksum: md5sum /path/to/files/* > /path/to/safedirectory/checksum Then you can run the following to check for differences: md5sum /path/to/files/*|diff /path/to/safedirectory/checksum - An alternative proposed by @Jedi is to use the -c option: md5sum -c /path/to/safedirectory/checksum


0

Well, you said any means. Its not efficient, but one means to do this would be to continuously scan all running processes on a system (in particular if you expect someone to access a file in a few moments) and inspect all their arguments for matching paths to the base directory of the share. Once a match is found, you print the result. The hope here is the ...


1

This is called "Security by Obscurity", and is not a reliable form of hiding files at all. There are plenty of tools that can search a whole filesystem and index the files within, regardless of what permissions you're assigning to some randomly named folder. You have conflated an adversary not knowing something with them being unable to learn it. In your ...


0

I found the solution to removing minerd. I was lucky enough to find the actual script that was used to infect my server. All I had to do was remove the elements placed by this script - On monkeyoto's suggestion, I blocked all communication with the mining pool server - iptables -A INPUT -s xmr.crypto-pool.fr -j DROP and iptables -A OUTPUT -d xmr.crypto-...


1

The encryption key for full disk or partial disk encryption are stored in RAM while the OS is operational. How are the disk encryption keys protected when a laptop is locked? If the device is shut down, then RAM is cleared, thereby securing your keys. If RAM is really cold, it will last awhile longer, so one technique to extracting RAM is to freeze ...


4

Your first goal is (if you don't want to reinstall) is to determine how it managed to get there in the first place. If the attacker was crafty, they'd of run "timestomp" to modify the dates of binaries. You minimizing SSH does little if you're running a vulnerable version of Wordpress, or Joomla, or something different. For example, there was a Nagios ...


3

The problem is that the minerd is probably the payload of some (other) malware, so you can't really tell what else has been compromised on the system. Possibly there isn't anything else resident on the system, and you are just getting re-infected each time you kill the miner. Alternatively there is some management/dropper process which has opened a back-...


5

Short answer is "data STILL readable but just behind a password". It is rare that anything in RAM is encrypted, simply because it would require some sort of a password to decrypt, and most passwords would reside in RAM anyhow. Going a bit further with this, the decryption password for the majority of disk-encryption programs would actually also (ironically)...


0

I would recommend splitting your app into multiple components communicating through standardized REST APIs. In this case you'd have a storage manager app which runs as a user with enough privileges to manage LVM volumes (or if impossible, then as root) and exposes its services through a REST API the main app (which is unprivileged) can consume. That little ...


0

It is usualy considered a bad idea to run externally accessible applications as root The correct way to do this would be to either: create a new user like node-data give it only the permissions it needs (aka permissions to the the root of the NAS file system NOT / as well as specific permissions to the executable needed) and/or create 2 node servers ...


0

Assuming no flaws in the program, you are safe running with root credentials. Unfortunately, this is not always the case, so you should never run a publicly accessible service with root credentials. If the service is not publicly accessible (i.e. LAN only, or you are using an IP address access list to limit visitors) then you should judge the likelihood of ...


17

Linux Mint was compromised and a backdoored ISO was deployed, Ubuntu was compromised, the entire Linux Kernel was compromised before, as were others (Debian, FreeBSD, etc). Developers protect code through checks and balances in what code is accepted into the mainline source code repository, and checksums. The issues revolve around whether or not an attacker ...


0

A shell is used (and first executed) when an interactive login happens for this user-id. Putting a value such as bin/false or /usr/sbin/nologin terminates this session and essentially logs the user out. Many system services / daemons do not use interactive logins and are started by other processes, they are assigned a user-id and group-id though, to ...


0

Using shell_exec() and its multiple variants is perfectly fine so long as the web server's user account is limited to its directory structure. The real risk is to use unsafe scripts that run commands with user input. escapeshellcmd() and escapeshellarg() can be used to make that safer. Note that having no login shell does not prevent from running commands ...


1

As stated in another answer, for proper administration of the server (both from system and DB perspective) the contractors will need to have sufficient levels of access -often root in their respective domains. That said, there are some generally accepted security controls that should be in place in the environment such as: Principle of Least Privilege (...


1

They need to have access to the servers and databases to be able to do their job. For sysadmins they would need the root account, for DBAs they would need the superuser account in the database (not sure what that user is for Oracle, but on MySQL that user is also named root). If you don't trust them, don't employ them, or at the very least monitor them (by ...


1

Capabilities are described in the capabilities(7) manpage. To summarize and security-wise: CAP_NET_RAW: Any kind of packet can be forged, which includes faking senders, sending malformed packets, etc., this also allows to bind to any address (associated to the ability to fake a sender this allows to impersonate a device, legitimately used for "transparent ...


6

So I have found a few resources which seem to indicate that the main infection method is done by gaining access to the system using SSH bruteforce: A Avast antivirus research: The infection starts by an attempt to brute force SSH login credentials of the root user. If successful, attackers gain access to the compromised machine, then install the Trojan ...


0

There are several flaws in your procedure. Ubuntu only monitors issues that are relevant for the software versions included in supported releases. If an issue is discovered that affects software in 10.04 but not in any of the currently supported releases, they won't pay attention to it, so your system will remain vulnerable. Fixing issues by installing the ...


0

Most applications should be using static ports on the servers side. In other words, one side of a connection should always be using a predictable port. Unfortunately, as you stated, living with a firewall can be a pain at first, while you build a robust policy set. You have to identify each and every service necessary and add appropriate policies to your ...


3

It is better to try to manually patch serious security bugs than doing nothing, but it will be terribly hard to close everything. That's why we use distribs. There are teams of maintainers that keeps staying informed on security threats, look whether they can apply to their code and then either patch or upgrade. The problem when you use a no longer ...


4

I've been maintaining a private fork of a CMS for approx. 7 years. The initial release had some serious security issues which did not get fixed properly by the original vendor in time. This is why I have fixed it myself and this is where I have lost the compatibility to most of the original patches/upgrades. This is possible, it takes a lot of time. And it ...


3

Joanna Rutkowska, leader of the Qubes project, does a great job into documenting the concepts on which Qubes is relying. I therefore strongly suggest you to get the information at the source, and in particular to read the two following documents: Software compartmentalization vs. physical separation (Or why Qubes OS is more than just a random collection of ...


1

Those credentials have to be placed somewhere. If you decide to place them at a place like /usr/lib/cgi-bin, you'd have to grant your web user access to that directory structure which would in turn make your system more vulnerable. It is more common to place them one level above the web root as a compromise between the two. This way you don't open much of ...


0

In theory, Qubes would be more secure as it's running fewer services by default. No network discovery, file sharing, etc, so less probability for any of those to get remotely exploited. It also benefits from being open source as well as being a niche OS, which means there's less malware targeting it. In reality though, unless you have reasons to believe you ...


0

I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? Yes. Some ISPs may have terms that prohibit certain activities which appear to be attacks. To thwart this issue, you could use your own equipment to attack. So, instead of having your firewall be plugged into your "modem" (e.g., cable modem, ...



Top 50 recent answers are included