New answers tagged

0

Yes, Please do it . It is still better than a network without any firewall. looking at the link, this is a simple network firewall with DHCP, DNS and SNORT. It does not decrypt your SSL traffic because it is not a Proxy. the Main function of this firewall is to protect your LAN from attacks (including some commonly known DDoS attacks as well). as far as I ...


-6

As a programmer, the answer is simply put: "No." Video files do not contain executable code. Even if they did, Windows is very different from Linux in design. The two use different binary formats for the OS that are incompatible. What exploits work on Windows normally won't work on Linux. The only thing that a tampered video file could do is trip a bug ...


2

Yes. You can use echo maliciously. You can use > operator to redirect the output to a file where the output can be a malicious code. echo 'Malicious_code_here' > shell.php Lets consider a case where the webserver supports PHP and the www directory is writable. you can try something like: echo '<?php system($_GET["cmd"]);?>' > shell.php ...


9

Yes, VLC can be hacked. Here you can check CVE list of VLC. But don't panic, just because your VLC freeze, that doesn't necessarily ​mean that someone hacked you. Make sure that your VLC is up to date. Can you submit that file to this website Cuckoo Sandbox and then paste the report here, just out of curiosity let us see, what will heppen when that file is ...


19

Video files by themselves can not contain a "virus" in the classical sense but they can be used to exploits bugs in the media players (or sometimes even the OS) when handling the file formats and codecs. By using these exploits they can then execute code. Like most video players vlc also has/had lots of bugs which could be exploited, including in the ...


5

The attack listed in the referenced question certainly would not work with VLC or Linux. VLC does not support the obscure Windows Media Player DRM it utilizes (at least not to my knowledge), and even if it did, the purpose of the attack is to trick you into downloading and running some Windows executable files. That being said, a different kind of attack is ...


1

The recipe here, while not by any means foolproof, is incomplete or wrong. Installing untrusted software under your unprivileged account is a disaster. Installing it in a carefully prepared other unprivileged account? Less risky, but by no means guaranteed to be safe. If: you are sure that your system is set up as a secure multi-user system (no random ...


1

All processes running as your user can read the contents of your clipboard and modify the contents. The KDE clipboard, called Klipper when I last used KDE, also stores previous clipboard history. It stores it by default in a text file. This means that the contents can be recovered from your hard drive by a forensics examiner or malware. You can disable this ...


0

I suspect that dac and mac are distinct enough that if you tried to minimize the code using common infrastructure, the amount of shared code would be small. Personally I'd do them separately, and then review and flag anything taht looked too similar...


8

This is a horrible case of Security Theater Security Theater is the practice or belief of something that looks like it improves security, but in reality does little/harm to it. This false belief has been around as long as the following rumor Linux has no viruses because of it's permission system That's almost as good as saying I don't have a ...


4

The system itself is safe from accounts that aren't root-equivalent, but that doesn't help much on a desktop where most of what you care about is your own data, and you authenticate regularly to become root from your account. If someone has an account on a correctly-configured multi-user system, and they don't have sudo privileges or the root password, then ...


1

No, for the following reason: root could patch sshd to always try root's authorized_keys file as well as its own. Of course if root's private key gets stolen you have a bad day. Don't allow that. You would be much happier if root's private key only exists in /root on the server. If someone can become root they can steal it but that's of no account because ...


30

In short: yes, being on a low-privilege account helps protect you against malware, but does not make you immune. Like any security measure, no single thing is going to keep you 100% safe. TL;DR: Running on a low-privilege account (aka "principle of least privilege") should be part of a balanced breakfast which also includes good firewall configurations; ...


-3

isn't it possible for a low-level user to install a script with a keylogger, for example, that waits for an su - or sudo call and takes system control from there? No - and you've already given the answer, because that is "out of their permission scope". Linux has always been a multi-user system and (nearly) everything which can be implemented outside of ...


52

We always hear... Do we? I don't. Installing some untrusted program as a normal user is a bad idea with Linux the same it is with Windows or Mac: this program has access to all your data and can delete these data, send these data to somebody else etc. Moreover it can make screenshots, control other applications running on the same X windows screen ...


1

Let me answer with a few observations, and comments. I will begin with the "whodunit" approach of aiding in determining who, what, when, where, and how. What - a file you found on your system When - what date was it found How - how was it uploaded Who - who uploaded it You already know the file because you found it. Let's call this file: malicious.php. ...


1

Kudos for finding it quickly, it looks like you're doing something right. But you're also doing a lot of things wrong. The most obvious one is that directories within your document root are writeable by the webserver UID. It would help to know what you are trying to achieve by "tracing the origin" of the script. Certainly you should be looking for the ...


4

You cannot. Not all chipsets/wifi drivers support monitor mode. Broadcom is know for lacking in open source drivers functionality support. It is already public knowledge the RPi 3 current driver implementation does not support monitor mode. PSA: The Raspberry Pi 3's embedded WiFi card does not support promiscuous mode. If you are buying a replacement, do ...


2

You can disable the module. modprobe nf_conntrack nf_conntrack_helper=0 More info about securing helpers without disabling the module entirely can be found here https://home.regit.org/netfilter-en/secure-use-of-helpers/


0

Yes this can be done in IPTables by blacklisting known bad addresses. See the following related post for more details: Blacklisting IP addresses -- when should we take action?


2

If you have your system set up so that only connections to your bank (eg. www.bank.com and www.bankcompany.net IPs) were possible, a redirect to a third site wouldn't load. The exploiit would need to be hosted on the same site as your bank (which is admittedly rare). As with many security solutions, it's possible that some bank update makes the website not ...


3

If you used a LiveCD and never/rarely went out of your way to get a new one, yes it would eventually contain old and buggy software. However, the point of the LiveCD is that there is nothing saved in a nonvolatile way, so even if you do manage to luck out on your "risky click of the day" and the browser downloads some malware, all you have to do is hit the ...


6

There is a potential risk in using old versions, but in many cases this risk is less significant than the risk of using reasonably patched system which has all sorts of dubious software installed, and may possibly contain malware. There are of course distributions dedicated for use as a live OS dedicated for doing such things as banking. They are hardened by ...


16

Potentially, yes. That said, many distributions (e.g. Debian, Ubuntu) run package versions which are extremely out of date (years) with few backported security patches, and most people do just fine. You're also usually only exposed on the network you're immediately connected to, so if you're only using a trusted LAN then it's not so much of a concern. ...


0

Tomoyo has some kind of exclusion: /home/*-backup is what you need http://tomoyo.osdn.jp/2.5/policy-specification/expression-rules.html.en#wildcard


1

There are many things you can do with that. Check the web application source code for settings configurations like databases, then check for a way to connect with the db. Keep looking at the source code and you might find more vulnerabilities (rce,sqli) or misconfigurations that can lead you to database dump, or some old backups, passwords disclosures, ...


1

You should back up all files, not just ones you think look important. Don't back up individual files either. Instead, have your syslog daemon send a copy remotely to your backup server in real time. Most syslog daemons support this, and the good ones even support sending it over an encrypted channel. If that is not supported, you can always set up an ...


3

Depending on how the files have been deleted (and your file system) there might be forensic tools that evaluate the journal and retrieve as much information still alive behind the scenes of the filesystem. For example, if you are using ext3 or 4, extundelete may help when the attackers were sloppy with deletion and didn't overwrite the files. There are ...


-1

I assume you're saying 1.1.1.1 is forwarding all requests to 2.2.2.2 in an attempt to keep the 2.2.2.2 server IP/location anonymous. Correct? In that case, the user would think they were communicating with 1.1.1.1. As long as you were only serving static html or documents that should be fine. The problem occurs when you throw something which does backend ...


1

Generally capabilities are a good way of implementing a Mandatory Access Control system (see Eros OS, for example). The Linux system capabilities affect objects which can be under both DAC and MAC. They also don't seem to break the possibility to do MAC since you can limit altering capabilities using the bounding set. Once you remove the ability to ...


0

As others have mentioned, actually verifying that code has no malicious behavior is neigh impossible. There are a handful of special cases, where code was written to be verifiable, such as the seL4 kernel, but the general case is easily demonstrated as unsolvable. In practical situations there are steps you can take to decrease the likelihood of an issue: ...


1

Yes, if one blindly downloads and compiles source code, that code could contain an exploit that, if run, could harm one's system. What's more, the resulting binary may not need to be explicitly run. In his 1984 classic Reflections On Trusting Trust, Ken Thompson demonstrated how one might go about creating C code that, when compiled, exploited the compiler ...


1

The "normal" way to use remote X11 is to have the X11 server run not on your server, but on the machine which is physically in front of the user. Then use ssh to do X11 forwarding, so that the application on your server talks to the X11 server that runs on the client machine. (Yes, the terminology is a bit confusing. "Your server" is the machine you are ...


4

Short of reading and understanding every line of code and how it all fits together you realistically can't. The best you can really do it to download it as a package from a reputable source who vet the packages in advance, to minimise the risk to the user. However there are times when even full blown operating systems are are hacked (such as Mint Linux ...


0

I think what you are asking for is "static analysis" (as opposed to "dynamic analysis" which analyzes running code). The web security group OWASP has a page talking about static source code security analysis in broad terms. If you simply google for "static source code security analysis" you will find many product available (some payware, some free). The ...


1

Is it a good idea to remove & re-pair my devices on a set interval (thinking that this is changing the Bluetooth PIN) No, it might not be a good idea. There is an exchange of information during the pairing that can be exploited by someone eavesdropping the radio communication link. Please see the excellent presentation by Dominic Spill ...


2

The short answer is: if your Firefox is compromised, it can do whatever it wants. It can modify whatever files it wants. It can even keylog and get root. But there are a few ways you can improve your security, like using a more secure browser, AppArmor or the NoScript plugin. The long answer is... Yes, if your Firefox process is compromised, it can do ...


1

There are the usual risks associated with explicitly or implicitly trusting something which comes from outside and thus can be controlled by the attacker. And there is a risk of assuming that environment variables provide a restricted visibility which they don't do always. Some examples: Implicitly trusting environment variables like PATH, LD_LIBRARY_PATH, ...


0

You can create deniable encryption using dm-crypt and remote header or raw dm-crypt encryption and block device offsets (1, 2). It's not as easy as TrueCrypt though and it's extremely ready to get wrong, as dm-crypt is a very low level tool, but you have more control and flexibility.


2

Legal note: That depends on what you expect to achieve with plausible deniability: This can bite you in the ass in several countries (like the UK, for example.) The police there know of the existence of TrueCrypt, and under the RIPA Act (and similar legislation elsewhere), they may fine and/or imprison you if you do not provide the decryption key to all ...


2

I have heard that the full disk encryption helps protect against malware threats, specifically in this case a malware which could programmatically copy the information while it was temporarily saved on the servers. Full disk encryption does not protect against anything that uses the OS interfaces to read and write to the device in question while the ...


1

This likely will become a problem, if you simply try to use tresor-xts-plain or tresor-xts-plain64. While I haven't tested it extensively, even when I tried TRESOR even with cbc-essiv, it resulted in a non-working system. Only cbc-plain worked, which does use a single key. The way I personally use TRESOR is with tresor-cbc-plain chained with ...


0

The disadvantage would be that the TCP sequence could wrap. This is a risk on very high speed networks. You can randomize the initial timestamp, however, just as you asked. It's a very simple patch, so any rejects will be trivial to fix. It requires the grsecurity patchset to already be applied. From https://grsecurity.net/~spender/random_timestamp.diff: ...


5

To me, one of the biggest reasons to use sudo (as opposed to su) is to avoid the need to keep track of "the root password" for every server I administer, and change it every time someone who knows it leaves the company. Instead, it's just a matter of managing members of the wheel group, who can come and go without forcing each others' passwords to be ...


11

There are valid convenience uses for sudo, but because they are already adequately explained in other posts, I won't elaborate on them much here. I will however point you to sudoers(5), which is the sudo configuration file. It shows some of the extensive configuration possible with sudo. I will be explaining when and why you should not use sudo to elevate ...


18

Aside what's mentioned by the other users, sudo also keeps the original identity of the user that's executing the command. Meaning that you can track what userid performed the command. If you are using root in a multiuser environment, you will not be able to track the execution of a command to a single user as the uid will be 0.


37

Because sudo allows much finer-grained controls than "login as root then do whatever you want." For example you can configure sudo so that some users are only allowed to run certain commands (like wrapper scripts or "acceptable" binaries). You're concerned about a trojan horse compromising a single-user's computer, but sudo was created to allow logging and ...


2

The reason not to run as root is that by using sudo you're making a conscious decision to run one particular command as root. Running as root allows for a careless typo to ruin your day.



Top 50 recent answers are included