Tag Info

New answers tagged

0

Having assessed the risk of turning my iptables off for a few minutes, these would be my first steps: stop the iptables process to allow the open-source app to initiate a connection home (again, only if you feel safe doing this) run netstat -lntp | less. This list should tell you the destination IPs that your box is connecting to. If you find the ones you ...


2

Short answer: this is the link you're probably looking for (-s specifies SSID). Longer answer: Precomputed 'hash' files are used to accelerate password bruteforce when cracking WPA. They do this by eliminating the need to perform costly transformation of a password into an encryption key; instead somebody already computed such keys for common SSIDs and ...


0

I had an extremely similar homework problem that I had in a security class. The reliability of your exploit depends on how large the buffer is. If you are overflowing a particularly large buffer, then your exploit will have a larger chance of working. Here is how your exploit sandwich should be structured: [NOPS][Shellcode (usually about ~60 bytes)][FP ...


1

If a machine is hijack by an hostile entity, then the attacker can gain full access to the hardware -- including every drive which is currently plugged in the machine. If the Linux drives are encrypted with a key that the Windows system never sees (which means that if you want to copy files from the Linux to the Windows, you have to do it from Linux, not ...


0

So the quick answer to the jest of your question is yes, having multiple OS's partitioned separately is technically safer. However, you are not immune by any means! There are countless attacks and viruses/malware aimed at the firmware/bios/etc of the computer itself -well beyond/before your OS starts up. Additionally, even with FDE (full disk encryption) ...


1

Yes, it is possible to detect unknown keyloggers and other malware, usually through computer forensics (Volatility or EnCase are well-known software for doing that). Keylogger detection, as for viruses and other malwares, can basically be achieved through two methods (I simplify for answer's clarity) : Signature based detection Heuristic based detection ...


-1

In theory, you could stop all the applications that you know are generating network traffic, then write a small piece of code to simulate lots of key typing events and monitor the network traffic to look for increased chatter over the wire. Even if the traffic is encrypted and sent in bulk packages, you could still have get a general idea about what your ...


0

Yes but normally not an easy task There is a framework exactly for this called Volatility: bunch of tools written in python it will crawl through the memory to determine if any keyloggers are running check it out at https://code.google.com/p/volatility/ hope that helps


0

The key item is whether you know whether there is a keylogger (or have reasonable suspicion) or you just want a way to automatically detect it. In the first case an investigation is very likely to lead to something: data travelling back to the attacker (as others have pointed out), suspicious devices, evidence of tampering, and so on. In the latter case ...


1

Yes. You could, for example, perform a code audit to identify software that is out of place. Or you might be able to detect the data as it travels back to the attacker.


0

But tons of information is available on this utility that it can be circumvented what other choices do I have? At the end of the day, all of this doesn't make any sense. The computer needs to execute it, therefore at some point in time all of the sensitive information will be somewhere in memory. With current day technology there is no way around it. ...


1

You could try to encrypt the script using standard methods and decode it on the fly by giving the secret key either directly or through a process. But, this would only help against attackers which have no permissions to modify any of your data or the programs you call, which especially means that they have neither root permission nor the same uid as you. And ...


1

As long as the pc is connected to the Internet (or any network for that matter) an antivirus and a firewall is a must. If you don't browse the net from windows then a free antivirus should be enough. Still, you should have one installed.


1

If your PC is going to be online at any point (which in all likelihood it will be) then it is recommended to use virus protection. There is plenty of free and light software that will be sufficient. For installation and continuous scanning, try Microsoft Security Essentials


4

When you are going to play games you downloaded from the internet, you should definitely get a virus scanner. This is especially a concern when you download pirated copies, because these are bundled with malware from time to time. But even when you stick to legal downloads there is a certain risk involved. There were cases of renowned download portals ...


1

If you don't browse, and if you get your games from official places, you can skip the antivirus. If you browse, or if you get your games through illegal download, then it has to be considered like a traditional PC and protected appropriately, from OS to browser level. If you don't use an antivirus, at least the Microsoft Security Essentials and things like ...


1

Besides the fact that this topic is not security related, but related to Ubuntu administration, you should really use a package manager, like apt-get or aptitude.


1

No. TRESOR only provides a method of storing AES encryption keys in the CPU. It will not prevent an attacker from stealing certificates, user information, password, or whatever else may present in the server's RAM


2

Here is what I have done, and still do in some specific cases: I use a machine with no swap. In my case, an old Asus EeePC with the famously horrendous proto-SSD; you really do not want to use it for swap space. Instead, I replaced the RAM chip, up to 2 GB. I configure /tmp to be a RAM-based filesystem (search for "tmpfs" in the man page for "mount"). When ...


8

I am running LMDE as a workstation and I am afraid as of now (Wed Apr 9 11:28:14 UTC 2014) no patch has been released yet. All available patches have been applied by me and right now # openssl version -a shows OpenSSL 1.0.1e 11 Feb 2013. You might want to consider changing your sources to point to Debian repos directly in order to get the update. I'll be ...


0

A good analogy to your question would be airport security. There are only a limited number of entry points which a person can use to enter a secure area. But is the secure area really secure? Consider this: Airport employees and such do not go through the rigorous screening that passengers go through before entering the secure area or boarding a plane. ...


3

Under the premise that the system is so well-secured that there is only one person which can connect to it via network, then file permissions do not really matter anymore. The operating system can only enforce them against local users anyway. When an attacker can not log into the system or influence some public service running on the machine to do their ...


1

First of all, it should be noted that virtualization is not a security measure in any way. This is an infrastructure / application technology, and it won't protect you from being compromised. Generally speaking, using chmod 777 to address application issues (log writing, cache etc.) is not a viable solution. You might want to understand what is going wrong ...


4

Making a file "undeletable" in Linux is done with attributes, specifically the "immutable" attribute. See lsattr to see attributes, chattr to change them. However, this only answers to the proximal cause. The important thing is that your machine was put through hostile control, and the hijacker installed things for his own devious goals. In particular, he ...


0

You could try chmod on them if you have su access. They may be disabled for your users permissions. If you chmod 777 it will give permission for all users then you could try rm them. If this does not work i would suggest refreshing the systems if it is not too much messing about as they may be hiding deeper in the filesystem. You could also try a chkrootkit ...


0

The RdRand instruction is broken on Ivy Bridge due to a hardware bug that has appeared on those processors. It is not implausible that there is a reason other than error for that. Cryptographic algorithms that have been seeded using deterministic pseudo-random algorithms probably are 100's of millions of times easier to break that those seeded with genuine ...


-2

Ubuntu is the most secure operating system in the world, check out this link http://www.technology91.com/ubuntu-12-04-lts-tops-gchq-security-report-over-windows-and-mac/


2

Non-system partition For partitions other than the system partition you can use the following systemd unit: [Unit] Description=Wipe Keys before <target> After=<target> [Service] Type=oneshot ExecStart=/path/to/wipe [Install] WantedBy=<target> <target> is the corresponding target of your desired mode. From the ...


0

Really the same way you secure anything else. LXC doesn't add anything new to the equation, it's just using cgroups to add more isolation between tasks. And Docker is just LXC automated. Secure your server as you always secure your server. Process isolation, privileges only as necessary, keep software up to date, log management, monitoring ... everything ...


1

There is a Linux version of Skype however, I wouldn't recommend running it on bare metal. Have you considered running a virtual machine on your main Linux system (either Windows or Linux) and running Skype inside that? This way the software inside the virtual machine cannot access the ram of the host. I assume that in such a case the RAM is still ...


0

Docker and LXC are a great concept; isolate potentially vulnerable applications from the rest of the system to limit the damage they can do if something does go wrong. They are not silver bullets, mostly due to limitations in the design of Linux itself i.e. root is root, even inside a chroot. http://www.bpfh.net/simes/computing/chroot-break.html There are ...


5

I've already answered this question a few times here. Have a look at this answer in particular: Virus scanner on server And in particular this part: The concept of a virus implies a user at an interactive session. Someone opening email in Outlook or documents in Word, or running programs they received in an email. A virus implies a human element. ...


1

In addition, I would add that most attackers don't directly log in via the console or ssh, but instead use bugs in other software in order to break out into a root shell or elevate their privileges. Adding 2-factor authentication or other mechanisms will definitely improve your security posture, but must be viewed as part of a larger overall hardening ...


0

This is called two-factor authentication. It already exists, though it may not be trivial to implement in all cases.


1

This actually sounds like a pretty decent use case for PostgreSQL's TLS support. You can configure a trusted client certificate for the application to use with your deployment script and then get the other advantages of not having a shared secret, plus obviously encryption too (unless your app is already CPU bound, in which case selecting the NULL cipher is ...


3

Because mythical imagined malware that might subtly modify your unique proprietary source code is very unlikely to exist, there are a couple of slightly more real threats you could check for. If your friend's computer was compromised by a human hacker, the hacker could have copied your code to his computer, studied it, changed it, and uploaded his changes ...


0

Since these are .java / text files, all changes are visible; there is no decompression/unpacking/reversing required here. Since you use Git, my best suggestion would be to see the changes done form your previous commit and the last one. You can see all the changes done to the file and make sure there is nothing malicious code added to it. Git has a ...


2

The only way that I'm aware of for you to prove this "beyond any doubt" would be to have your client audit the servers themselves, or to have them audited by a 3rd party (e.g. consultant) that you both trust to do the work. Network scanning isn't likely to be sufficient on it's own as that wouldn't cover disabling services or the possibility that a firewall ...


2

Do a full scan of the target machine's IP address with Nmap from LAN or Internet: nmap -p- 12.34.56.78 If you've closed all the unused ports, then you'll see that in the scan result. Edit: It would look like this: Starting Nmap 6.40 ( http://nmap.org ) at 2014-03-29 11:26 CET Nmap scan report for abc.com (12.34.56.78) Host is up (0.030s latency). Not ...


0

There is a framework called snoopy which does this. I haven't really had a look into it but it may be what your looking for. Hope this helps


1

No - it does not mean you are not vulnerable. The patches you have installed may have fixed the particular vulnerability, but failure of a test does not automatically mean you are safe - it could just be the case that your test version is misconfigured, failed due to a local configuration or bug, or has had some other problem. The usual way to gain ...


3

It sounds like your question is really, "How do I harden PHP?" And a second question, "How do I harden Linux to be a web server?" This site is really for extremely specific questions, hence your downvotes. The other reasons for the downvotes, is because since your questions are so broad, there are ample google searches for you to mine to get your ...


5

Basically it is not safe. As far as I know, they use 512-bit RSA because they mimic what Microsoft's RDP server used to do, which indeed implied a 512-bit RSA key; using something bigger would risk breaking compatibility with existing clients. Biggest issue, though, is not that the 512-bit key is weak because too short; the main problem is that, as a client, ...


5

Most WiFi enabled devices broadcast their Mac address when probing for networks to join in the vicinity. By placing your own WiFi device in promiscuous/listening mode and utilizing a tool like Aircrack-ng, you can see and record all broadcast traffic enabling you to see if a device with a specific MAC address comes within earshot of your listening device. ...


1

I would recommend "Network and System Security, Second Edition" which include several topics like unix and network security.


3

I believe spartan is talking about Wifi "probe requests". You can capture these using wireshark when your wireless adapter is set to "monitor mode". You can filter for them using the following syntax: wlan.fc.type_subtype == 0x04 These are managment frames and are basically frames sent from your client to find out which wireless networks / AP are ...


1

The closest thing to a 'hello' packet concept in a smart phone, which mostly use TCP/IP, will probably be a DHCP-DISCOVER broadcast and then subsequent ARP requests, presuming it is active on the network. Most smart phones will probably respond to ping, too, so presuming you have control over DHCP on the network, once you know its IP address, send pings to ...


-1

No it's not broken. No fix is required as the 'fix' is in (so to speak) with later versions of Bluetooth. But that's also the problem and the criticism. Just like a password is only as good as who knows your password, Bluetooth is only as good as the implementation that you're using. You're right... it very handy and that very handiness is what makes ...


6

It is possible to find the MAC addresses of devices that are physically close to you if they have wifi enabled. When a device sends data packets over wifi they are stamped with the sender's MAC address and the destination MAC address (typically a wireless router). The contents of the packet will most likely be encrypted through WPA or WEP etc. but the MAC ...


14

If it's not in the same network, you most likely won't be able to. MAC addresses are hardware addresses and are usually hidden behind a router unless you are on the same network or have direct access to the device. In other words, once you leave the network, unless the device(s) in question is/are directly connected to a router you will get the MAC address ...



Top 50 recent answers are included