Tag Info

New answers tagged

2

The most secure server is the one which is most efficiently maintained. So this would point at the default SSH server (which happens to be OpenSSH): if a security flaw is found in that software, it can be expected that the corresponding patch will be made available within a few hours, and you will get it through the normal Debian update mechanisms (that I ...


0

There are obvious risks in piping a random file to an interpreter of any kind, but unix isn't set up to protect users from their own stupidity. Simply using cat filename may mess up your display but it shouldn't damage anything. If you are using cat to view files and identify their type I would suggest that you learn about file ( tells you what the file is ...


2

I'm gonna add this info here without actual intention to answer my own question. The characters that can get injected on the command line while printing some other characters, better know as escape sequences, are defined really good on this site(Thanks F. Hauri, for mentioning it): http://vt100.net/docs/vt100-ug/chapter3.html Under chapter: Reports ...


2

What you are seeing is xterm control sequences. Control sequences are activated when they are seen in output in the terminal; e.g., when you cat a file with bytes that are non-printable ASCII. In your example, the control sequence is ESC Z (bytes 1B 5A) which returns the terminal ID -- as a command in the terminal. You can try it yourself: echo -e ...


8

Yes, it's a potential risk, see CVE-2003-0063, or CVE-2008-2383 or CVE-2010-2713, or CVE-2012-3515 or OSVDB 3881, or CVE-2003-0020 or any of the similar ones listed here... Some more in comments below also. Update it's not just a potential risk, it's a real risk. The current version of a popular terminal emulator has this problem, resulting in user-assisted ...


0

You could use a loop to continuously call lsof to see all of the open network connections, log it to a file then grep through it for port 80. That would show you the process opening the socket and the user it's running as. It could go something like: #!/bin/bash # monitor.sh while true; do date lsof -i -P sleep 1 done To use it: $ chmod +x ...


5

"Real" glass terminals had an escape sequence to print the screen to a printer. They did this by running a command and pipeing the current screen contents to the printer's stdin. The command could be configured by another escape sequence. The classic way of exploiting this was to create files with names that embedded the escape sequence to set the printer ...


31

Yes. As you seem to be using a modern terminal emulator, some escape sequences could be used to modify Keyboard buffer. There could be injected proper shell commands. You could use argument -e of cat for safe operation, see man cat. Addendum In fact, it was possible, but in a very old past... As this become an issue, this kind of features was quickly ...


6

Typically there is no vulnerability, but obviously if you use it wrong, then you could create one. Printing the contents of a binary file produces beeps because character 7 is the old terminal command to make the machine beep, and some terminal programs still honor that command. But by design, there's nothing there that can hurt you. In the worst case, ...


0

Yes, there are potential weak links: BIOS, cache, memory, router(firmware), and? As always, separate/dedicated computers are considered better/safer. Also, consumer grade routers are potentially the worst threat now and enterprise router solutions are expensive. That said, if you still want to use one PC though, you can make things easier by installing ...


2

It is impossible to detect kernel modifications from inside the system. Whatever rootkit detector you use, the rootkit can be programmed to lie to it. If someone controls your kernel, then they control your system, not you, end of story. GMER suffers from that flaw too, it is intrinsic in the operating principle: it only finds rootkits that aren't good at ...


0

It is better to do pen-test stuff in a separate computer and have maximum security to protect it. A hacker can gain access to all hard drives that is connected to the OS you use to pen test.


1

(Quick answer, I don't have the time to research all I remember and double-check my facts.) There are multiple things to consider here: USB sticks may carry payload that you do not know is there, e.g. a virus to infect the computer it's plugged in to. Things like BIOSes, network cards, etc. can often be flashed to upgrade the firmware. You could also ...


0

nedR, after viewing the GnuTLS site, I found that any versions prior to version 3.2.12 or 3.2.22 are still vulnerable. The Ubuntu packages using GnuTLS 28 are mostly still affected. That is, packages 12.04, 12.10, 13.10, and 14.04. Glad to be of assistance!


-1

Having assessed the risk of turning my iptables off for a few minutes, these would be my first steps: stop the iptables process to allow the open-source app to initiate a connection home (again, only if you feel safe doing this) run netstat -lntp | less. This list should tell you the destination IPs that your box is connecting to. If you find the ones you ...


2

Short answer: this is the link you're probably looking for (-s specifies SSID). Longer answer: Precomputed 'hash' files are used to accelerate password bruteforce when cracking WPA. They do this by eliminating the need to perform costly transformation of a password into an encryption key; instead somebody already computed such keys for common SSIDs and ...


0

I had an extremely similar homework problem that I had in a security class. The reliability of your exploit depends on how large the buffer is. If you are overflowing a particularly large buffer, then your exploit will have a larger chance of working. Here is how your exploit sandwich should be structured: [NOPS][Shellcode (usually about ~60 bytes)][FP ...


2

If a machine is hijack by an hostile entity, then the attacker can gain full access to the hardware -- including every drive which is currently plugged in the machine. If the Linux drives are encrypted with a key that the Windows system never sees (which means that if you want to copy files from the Linux to the Windows, you have to do it from Linux, not ...


0

So the quick answer to the jest of your question is yes, having multiple OS's partitioned separately is technically safer. However, you are not immune by any means! There are countless attacks and viruses/malware aimed at the firmware/bios/etc of the computer itself -well beyond/before your OS starts up. Additionally, even with FDE (full disk encryption) ...


2

Yes, it is possible to detect unknown keyloggers and other malware, usually through computer forensics (Volatility or EnCase are well-known software for doing that). Keylogger detection, as for viruses and other malwares, can basically be achieved through two methods (I simplify for answer's clarity) : Signature based detection Heuristic based detection ...


-1

In theory, you could stop all the applications that you know are generating network traffic, then write a small piece of code to simulate lots of key typing events and monitor the network traffic to look for increased chatter over the wire. Even if the traffic is encrypted and sent in bulk packages, you could still have get a general idea about what your ...


0

Yes but normally not an easy task There is a framework exactly for this called Volatility: bunch of tools written in python it will crawl through the memory to determine if any keyloggers are running check it out at https://code.google.com/p/volatility/ hope that helps


0

The key item is whether you know whether there is a keylogger (or have reasonable suspicion) or you just want a way to automatically detect it. In the first case an investigation is very likely to lead to something: data travelling back to the attacker (as others have pointed out), suspicious devices, evidence of tampering, and so on. In the latter case ...


1

Yes. You could, for example, perform a code audit to identify software that is out of place. Or you might be able to detect the data as it travels back to the attacker.


0

But tons of information is available on this utility that it can be circumvented what other choices do I have? At the end of the day, all of this doesn't make any sense. The computer needs to execute it, therefore at some point in time all of the sensitive information will be somewhere in memory. With current day technology there is no way around it. ...


1

You could try to encrypt the script using standard methods and decode it on the fly by giving the secret key either directly or through a process. But, this would only help against attackers which have no permissions to modify any of your data or the programs you call, which especially means that they have neither root permission nor the same uid as you. And ...


1

As long as the pc is connected to the Internet (or any network for that matter) an antivirus and a firewall is a must. If you don't browse the net from windows then a free antivirus should be enough. Still, you should have one installed.


1

If your PC is going to be online at any point (which in all likelihood it will be) then it is recommended to use virus protection. There is plenty of free and light software that will be sufficient. For installation and continuous scanning, try Microsoft Security Essentials


4

When you are going to play games you downloaded from the internet, you should definitely get a virus scanner. This is especially a concern when you download pirated copies, because these are bundled with malware from time to time. But even when you stick to legal downloads there is a certain risk involved. There were cases of renowned download portals ...


1

If you don't browse, and if you get your games from official places, you can skip the antivirus. If you browse, or if you get your games through illegal download, then it has to be considered like a traditional PC and protected appropriately, from OS to browser level. If you don't use an antivirus, at least the Microsoft Security Essentials and things like ...


1

Besides the fact that this topic is not security related, but related to Ubuntu administration, you should really use a package manager, like apt-get or aptitude.


1

No. TRESOR only provides a method of storing AES encryption keys in the CPU. It will not prevent an attacker from stealing certificates, user information, password, or whatever else may present in the server's RAM


2

Here is what I have done, and still do in some specific cases: I use a machine with no swap. In my case, an old Asus EeePC with the famously horrendous proto-SSD; you really do not want to use it for swap space. Instead, I replaced the RAM chip, up to 2 GB. I configure /tmp to be a RAM-based filesystem (search for "tmpfs" in the man page for "mount"). When ...


8

I am running LMDE as a workstation and I am afraid as of now (Wed Apr 9 11:28:14 UTC 2014) no patch has been released yet. All available patches have been applied by me and right now # openssl version -a shows OpenSSL 1.0.1e 11 Feb 2013. You might want to consider changing your sources to point to Debian repos directly in order to get the update. I'll be ...


0

A good analogy to your question would be airport security. There are only a limited number of entry points which a person can use to enter a secure area. But is the secure area really secure? Consider this: Airport employees and such do not go through the rigorous screening that passengers go through before entering the secure area or boarding a plane. ...


3

Under the premise that the system is so well-secured that there is only one person which can connect to it via network, then file permissions do not really matter anymore. The operating system can only enforce them against local users anyway. When an attacker can not log into the system or influence some public service running on the machine to do their ...


1

First of all, it should be noted that virtualization is not a security measure in any way. This is an infrastructure / application technology, and it won't protect you from being compromised. Generally speaking, using chmod 777 to address application issues (log writing, cache etc.) is not a viable solution. You might want to understand what is going wrong ...


0

The RdRand instruction is broken on Ivy Bridge due to a hardware bug that has appeared on those processors. It is not implausible that there is a reason other than error for that. Cryptographic algorithms that have been seeded using deterministic pseudo-random algorithms probably are 100's of millions of times easier to break that those seeded with genuine ...


-2

Ubuntu is the most secure operating system in the world, check out this link http://www.technology91.com/ubuntu-12-04-lts-tops-gchq-security-report-over-windows-and-mac/


2

Non-system partition For partitions other than the system partition you can use the following systemd unit: [Unit] Description=Wipe Keys before <target> After=<target> [Service] Type=oneshot ExecStart=/path/to/wipe [Install] WantedBy=<target> <target> is the corresponding target of your desired mode. From the ...


0

Really the same way you secure anything else. LXC doesn't add anything new to the equation, it's just using cgroups to add more isolation between tasks. And Docker is just LXC automated. Secure your server as you always secure your server. Process isolation, privileges only as necessary, keep software up to date, log management, monitoring ... everything ...


1

There is a Linux version of Skype however, I wouldn't recommend running it on bare metal. Have you considered running a virtual machine on your main Linux system (either Windows or Linux) and running Skype inside that? This way the software inside the virtual machine cannot access the ram of the host. I assume that in such a case the RAM is still ...


0

Docker and LXC are a great concept; isolate potentially vulnerable applications from the rest of the system to limit the damage they can do if something does go wrong. They are not silver bullets, mostly due to limitations in the design of Linux itself i.e. root is root, even inside a chroot. http://www.bpfh.net/simes/computing/chroot-break.html There are ...


5

I've already answered this question a few times here. Have a look at this answer in particular: Virus scanner on server And in particular this part: The concept of a virus implies a user at an interactive session. Someone opening email in Outlook or documents in Word, or running programs they received in an email. A virus implies a human element. ...


1

In addition, I would add that most attackers don't directly log in via the console or ssh, but instead use bugs in other software in order to break out into a root shell or elevate their privileges. Adding 2-factor authentication or other mechanisms will definitely improve your security posture, but must be viewed as part of a larger overall hardening ...


0

This is called two-factor authentication. It already exists, though it may not be trivial to implement in all cases.


1

This actually sounds like a pretty decent use case for PostgreSQL's TLS support. You can configure a trusted client certificate for the application to use with your deployment script and then get the other advantages of not having a shared secret, plus obviously encryption too (unless your app is already CPU bound, in which case selecting the NULL cipher is ...


3

Because mythical imagined malware that might subtly modify your unique proprietary source code is very unlikely to exist, there are a couple of slightly more real threats you could check for. If your friend's computer was compromised by a human hacker, the hacker could have copied your code to his computer, studied it, changed it, and uploaded his changes ...


0

Since these are .java / text files, all changes are visible; there is no decompression/unpacking/reversing required here. Since you use Git, my best suggestion would be to see the changes done form your previous commit and the last one. You can see all the changes done to the file and make sure there is nothing malicious code added to it. Git has a ...


2

The only way that I'm aware of for you to prove this "beyond any doubt" would be to have your client audit the servers themselves, or to have them audited by a 3rd party (e.g. consultant) that you both trust to do the work. Network scanning isn't likely to be sufficient on it's own as that wouldn't cover disabling services or the possibility that a firewall ...



Top 50 recent answers are included