Tag Info

New answers tagged

0

There are a lot of things that go into PCI compliance.. I've sent years at it and have my own share of questions here on it. :) PCI compliance covers a lot of ground - anything that "stores", "processes" or "transmits" cardholder data. Different systems need to have different parts of the standard applied to them to maintain a cohesive whole. Your system ...


1

You could protect /dev/kvm with a group. Transfer /dev/kvm ownership to the group so that root privileges aren't given. This link explains how to do it, and here's the direct quote: The cleanest way is probably to create a group, say kvm, and add the user(s) to that group. Then you will need change /dev/kvm to owned by group kvm. On a system that ...


1

Short answer Yes it is possible and aside from gpg-checking there are still several possible attacks! To tackle it, I would make sure that the automated update process does at least signature checking, use HTTPS for my repos, and possibly run a validating caching nameserver locally (DNSSEC) like Joe Sniderman suggests All this does still not ensure you ...


1

Except for the few exceptions for viruses that can run on Wine and iyou have Wine installed, Linux generally won't be affected by Windows virus. Note though that Linux can be an asymptomatic carrier of Windows viruses. If you send other people a file infected Windows virus, their machine can catch the virus, even if the file looks fine on your Linux ...


-1

It really depends on your threat model. If you are hosting some Wikileaks-grade document, that might be a very real threat. If it's just a casual server on the Internet, you'll just want to update as often as possible way before worrying about this kind of attack.


4

Yes it is possible to do a cache poisoning attack, and yes it is possible to protect yourself. In addition to the rather standard practice of signing the package files with GPG, some distros use DNSSEC to protect the domains that serve those files against DNS spoofing. Notice the 'ad' flag in the dns answer below: $ dig +dnssec security.debian.org. ; ...


1

With KVM and Xen, the rogue administrator can take a snapshot of your live machine, then explore at his leisure what is in the RAM of your VM. In particular, he will easily obtain the encryption keys for the encrypted filesystem, and then proceed to read all your files. By the very nature of the snapshot system, you will not notice it. With OpenVZ, you ...


2

To answer your question, it is possible to spoof the update servers DNS; then, your packet manager should not install unsigned packets, an attacker could send you bad data, but you wouldn't accept it. Most distributions use OpenPGP to sign their updates. Fedora and Debian do for example. You just have to make sure that your automated option validates ...


3

Use a clean PC or VM for your VPN connection and never ever use that system outside of the VPN. A VM will only work if your host is clean. If you install free games or random software then you SHOULD NOT trust your PC anymore. Never login to accounts that you use outside of the VPN !!! Create separate accounts for any service you use over the VPN. Never ...


1

Regardless of what virtualization technology you use. Once the attacker has access to the hardware, it's game over. In case of a VPS, even when encrypting the root partition, if the key is stored in memory and you have no control of the hypervisor, then you cannot protect your system's confidentiality with encryption. Administrators with access to the ...


1

As with most remote exploits targeting a 3rd party plugin (i.e, Adobe Flash, in this case), the attacker used a malformed compressed flash video to corrupt the embedded flash player on the victim. The exact mechanisms are unclear to me as I have no intent on clicking on the video you linked because that video COULD be malware itself... however, the ...


0

I believe this has nothing to do with drive-by downloads as the author claims. It just seems to me that he visited a website that had been injected with an iFrame containing the malicious site (a form of Cross-Site Scripting attack). He says his browser crashed and that's it. It's hard to test more without actually visiting the page where the incident ...


0

What to do next? Wipe the server clean and re-install, making sure you're using the latest versions of everything. Once an attacker gets in, it's difficult or impossible to figure out what's been tampered with. You could try making a copy of the compromised server for offline analysis, but you probably won't find anything interesting: if the attacker can ...


0

Been a long time since I've done C structured exceptions (MS specific but emulated on Wine), but the syntax is close to this. Somebody using this could have a lot of fun even if Z is not mapped. bool isLinux = 0; __try { asm { mov AL, 172 int 80h } isLinux = 1; } __except {} if (isLinux) asm { /* Linux shellcode here */ ...


0

last -w will tell you who logged in and from where. It can be changed, like the other things. You can write a script to run as a daemon that sends the log and history files to another server, so next time it's undeletable. I found this SO answer: http://stackoverflow.com/questions/1346509/automate-scp-file-transfer-using-a-shell-script If you setup the ...


0

Is there a log file that can tell me who edited a file and when. find / -mmin -90 -printf '%p\t%a\n' This will list all files changed in the last 90 minutes and when they were changed. It does not say who changed it though (this is not possible). And as Hae0 said looking at the bash history (and the logs in /var/log) is always a good idea. The root ...


5

Assuming your server doesn't use any credentials besides system-level accounts and the MySQL password, there's one thing you need to protect: the swap file. Programs are supposed to take steps to prevent credentials from winding up in swap, but they don't always do so. There are some sensitive things in /dev and /proc (such as /dev/mem and /proc/kcore). ...


0

You can use cat .bash_history to see what commands have been entered. You should also check the various /var/log files. Note that you can use tail -f to watch the logs in real time to see if someones on the box.


1

There is no such thing as "entropy" of a file. The entropy is a characteristic of a process -- for instance, of a process that generates a file. The entropy does not describe what the file contents are; it describes what the file contents could have been. As such, any tool which purports to identify "entropy patterns" is, at best, loosing extremely poor ...


1

Most of Steve DL's points are good, the "best" approach is to use a run-time linker (RTLD) that you have more control over. The "LD_" variables are hard-coded into glibc (start with elf/rtld.c). The glibc RTLD has many "features", and even ELF itself has a few surprises with its DT_RPATH and DT_RUNPATH entries, and $ORIGIN (see ...


1

Yes, there is a way: don't let that user run arbitrary code. Give them a restricted shell, or better, only a predefined set of commands. You wouldn't prevent any malware from running, unless you've used some non-standard privilege escalation mechanism that doesn't erase these variables. Normal privilege escalation mechanisms (setuid, setgid or setcap ...


0

The short answer Usually you will only need connection tracking for outbound connections. If any local device makes a connection to the Internet, the firewall records that this specific IP and port tried to make a connection to the other IP and port. Thus when the answer from the Internet arrives, the firewall knows to let it pass, because it has seen an ...


2

Essentially, you need to control the execution environment of the apps. There's no magic about it. A couple of solutions that come to mind: You could somehow set all the binaries that worry you as setuid/setgid (that does not mean they must be owned by root, as far as I know). Linux normally prevents attaching to a setuid/setgid process. Please do verify ...


3

I think you can safely live normally ;) The user in this forum propably just took a guess on your UserAgent. This is neither considered hacking nor does it do any damage on your pc. There is even a Website telling you what OS you use, only by visiting it. There are also more informations about how this is working.


1

I wouldn't be overly concerned. There are plenty of ways he could possibly have found your operating system, a lot of them not considered malicious and are done directly through the browser without any form of exploit. For example this information could come from your user agent: http://en.wikipedia.org/wiki/User_agent Through the user agent they could ...


0

Any SSL with a single trusted key for each party in this communication would be ok. You would have to exchange keys between devices first. I mean something like pgp-sms, but implemented for communication across wifi


1

Malware doesn't care if you're running a "standard-install Ubuntu desktops only". Malware will run as long as the system supports the correct instruction set that the ELF binary was compiled for. Ubuntu is debian based supporting the following instruction sets: IA-32, x86-64, ARMv7, ARM64, PowerPC. Generally you find most are built on IA-32 or x86-64 ...


0

Yes, because while most viruses are not targeted at Linux, and so you personally are less at risk, you can still be a good citizen when sending data to people who use Windows. Example: you receive a file from WindowsFan1999, via email or dropbox or CD or whatever. You try and open it, but you think it's corrupted. so you forward the file on to knowledgeable ...


0

Probably the best protection for physical access is full disk encryption and a smartcard that stays on your keychain. I mean this is assuming you're colleagues aren't a bunch of professional hackers. I doubt the NSA is interested in your computer. Also, don't put personal files on your computer. Just don't. Assume that everything on your work computer is ...


28

You can install an antivirus if you want. It should not hurt your machine, but don't expect much protection for your system and don't consider yourself entirely safe. The efficacy of antivirus software is very relative, and they're mostly in use to avoid propagate old malware especially if you have Windows machines in your ecosystem. You should expect a ...


1

Question is asked for Ubuntu.If I can little wide the question to Linux desktop editions, SELinux type "Walled Garden" solution would be much useful. In SELinux mandatory access-control policies (MAC) can stop or limit the damage in infection attempt. Unlike AV which runs as separate process which makes burden to OS, SELinux has native support by the Linux ...


1

You can hide from Telnet by changing the welcome banner of each service you're worried about (some of these will be easy to change, others will be hard). You can make Nmap's OS detection less reliable by configuring your firewall to drop all packets to closed ports: Nmap works best if it can find both an open port and a closed port to probe.


0

You need to do it case by case for any remote service you expose: Disable the services you don't use Hide the version numbers for the services you use (example for a PHP server) I assume you are trying to avoid leaking information that your server may not be up-to-date or may be vulnerable to a specific zero-day. At the end of the day this won't do much ...


1

Did you say something about running phpMyAdmin? Is its directory standard and/or publicly available? (even if [you think] nobody has the password). phpMyAdmin is usually an attack vector on web and database servers, and its existence is widely searched for on automated crawlers. Is the server compromised? As David said, we can't tell whether it was or not, ...


2

Your assessment sounds correct. It's impossible, of course, to say that your server has not been compromised, but by default, PHP receives all the data before executing the script, so it writes file uploads to /tmp and provides that filename to the running script. If your /tmp is mounted with atime enabled, the fact that atime==mtime is reassuring. If the ...


0

Your problem probably has nothing to do with viruses. If you can only access a specific domain, it may be that this one (for whatever reason) is inside your DNS cache but you can't reach any other site because your DNS server is unresponsive. I would start by using a network analysis utility (such as Wireshark) to determine whether DNS queries succeed or ...


1

If the host machine has a damaged hosts file, any traffic going from the guest VM, through the host, will encounter this damaged hosts file before it accesses the internet. EVEN IF the guest is using a USB wifi adapter, it will still have to interact with the hosts host file.


0

VM commands get redirected through the host OS. Some stuff may go direct to the CPU depending on what kind of virtualization support your system has, but that is still only granted at the will of the host OS. If the host OS is compromised, then the virus can potentially impact anything running within it, including a virtual other process. Sandboxing tries ...


0

You might need to change some computer habits if you've been "pirated several times already", but to answer your question, yes it's definitely possible for a virus on your host to have adverse effects on a VM. The VM uses resources allocated to it by the host machine. If your Guest OS has direct access to your host file system for example, it's entirely ...


1

On Linux kernel 3.3, this is done with the hidepid= and gid= mount options for /proc (to be added in /etc/fstab). See this answer. Possibly, some distributions which use older kernels may have backported the patch. On FreeBSD there is a sysctl flag for that, called security.bsd.see_other_uids. See this documentation (search for "see_other_uids"). I am not ...


0

There is an open source file integrity monitor called Mugsy that ships with a list of important directories to monitor for Linux: - /boot - /lib - /lib64 - /sys - /bin - /sbin - /usr/bin - /usr/sbin - /usr/local/bin - /usr/local/etc - /usr/local/sbin - /etc I'm the developer of Mugsy, so shameless plug. I agree that all files should be monitored, but ...


0

It is not possible to prevent a root or administrator user from accessing a file under control of the OS. Your suggestion of obscuring the file might prevent someone from piecing it together in a meaningful way, but isn't really securing the file. Your thought to use an encrypted filesystem simply encrypts the files on disk such that only users with access ...


6

Ye cannot defeat root ! The root user can have complete control of the machine. The best that you can hope for is encryption: use GnuPG to encrypt the data with a sufficiently strong random password, that, of course, you won't reveal to the root user. However, as soon as you decrypt the file on the machine, wherever you put it, root will be able to see it. ...


0

For Linux, disable root if you don't need it. Use sudo with a properly configured sudoers file. This allows fine-grained control over what users have what superuser permissions (i.e. you can allow sudo only for Nessus). Alternatively, you can set permissions so the account running Nessus has permissions to access the resources it needs (this will be more ...


0

In most cases another user cannot read your environment variables. However, the well known security hole that an instance of a setuid program runs as the same user as any other instance of a setuid program can be exploited. This means that if someone runs a setuid program and someone else can exploit another program that is setuid to the same user to read ...


0

This is an assumption, but presumably your site is for the most part HTTP, then when it needs to process a payment it becomes HTTPS or forwards to a HTTPS page? If so there is a risk there, as it is possible to fool users into visiting a HTTPS page over only HTTP. For example see http://www.thoughtcrime.org/software/sslstrip/. As m1ke alludes to, you can ...


3

It's often not only the case that "payment information" is the only sensitive information. If your portal requires some sort of "login" (which it undoubtedly does), you allow many parties in between (Internet Cafe owners, ISP's, "hackers", employers, govermenments, ...) to see these credentials and take over the account. If your portal has anything in ...


2

Putting an xinetd server in front of your web server will reduce security: in addition to any security holes in the web server, you now also are vulnerable to any security holes in xinetd. Any security measures you can apply through xinetd, you can apply instead through the firewall or the web server.


0

If you want to know what security (and other) problems a particular version of a Debian package corrects, check its changelog. All changelogs are online; for example, for bind9 in squeeze, navigate to https://packages.debian.org/squeeze/bind9 (http://packages.debian.org/RELEASE/PACKAGE) and click the “Debian Changelog” link. If you know the exact package ...



Top 50 recent answers are included