Tag Info

New answers tagged

2

Is it possible for a virus/worm to attack on your host to attack the guest OS? Yes. Is it likely? No. Malware can do anything you can do, including writing to the virtual disk. The easiest route would be to simply mount the virtual machine drive, and write new malware to it. This is unlikely because it would take specially crafted code to exploit this. ...


-1

Short Answer: Yes, both the host (in your case Windows) and the guest (in your case Linux) OS can be attacked by malware. Additional Details: In fact - with techniques like "Red Pill and Blue Pill" (like in the Matrix movie) it is possible for malware to bypass the barrier of virtualization and proliferate on the host or hypervisor. So please follow ...


1

I'd recommend Virtutech's SIMICS software. Note that Virtutech was bought by Intel and assigned to their subsidiary: Wind River. Simics is a SIMULATOR, which has important distinctions from an EMULATOR (like qemu). See http://stackoverflow.com/questions/1584617/simulator-or-emulator-what-is-the-difference for specifics on the differences. Simics simulates ...


0

You first want to set up a host OS (Windows or Kali, whichever you prefer to use when you're not hacking.) Inside that host OS, install a virtual machine platform (VMware, VirtualBox, whatever you choose.) Inside the virtual machine control panel, create a first VM and install Kali, (presuming you want to use Kali for your pentest environment.) I would ...


0

Running a kali VM provides some benefits: Restoration - It is easy to restore your machine when you mess it up. If you're playing around with security tools and/or malware, changes are good that, at some point, you will damage your operating system. Without a VM, you would have to reinstall everything from scratch; with a VM, you can save an image and ...


0

With meterpreter (some) common activities of an attack may include: 1. Process injection/migriation 2. Password dumping 3. Logging keystrokes 4. Loading more malware 4. Opening new ports/services 5. Adding new users Uploading/downloading files Some AV will pick up a plain meterpreter exe dropped on a system, if for example it's sent as part of a ...


0

What happens during the installation of Ubuntu Let's solve this problem first: don't really know what exactly happens during installation of ubuntu Then I think you'll understand where you can be attacked. The BIOS The BIOS is stored on a flash chip. Typically we say rom on the motherboard but the truth is it's probably stored on an SPI flash rom ...


0

BadUSB attacks against peripherals like your external DVD drive work by reprogramming the chip on the peripheral. Your attack scenario is entirely plausible if the attacker knew beforehand that you would be installing Ubuntu with the drive, then wrote a specific USB firmware that would inject the keystrokes or even alter the blobs getting read on-the-fly. ...


0

Yes, and in fact there is such a password manager, that uses gpg for the encryption. It's called pass, and it's available at http://www.passwordstore.org/ for linux/Unix. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be ...


2

I don't believe any improvements were made to the Linux development cycle in response to ShellShock. As "the vulnerabilities had existed since version 1.03 of Bash released in September 1989" (Wikipedia), it's not considered a current development cycle issue. (And insofar as it is, it's a universal lesson: "don't write buggy code, and find it if you do", ...


0

As others have said, please, please change all your passwords. You don't want to take a chance here. Now might be a good time to think about using some sort of solid password keeper as well. There are a few out there with varying levels of quality but even using something that's closed source, but easy to use like LastPass is better than using the same ...


3

In short, you have NO idea what he downloaded, so change ALL PASSWORDS. I would also be interested to know if it was possible to upload.


1

There was some very carful algebra done on this site on the variables that manage a doubly linked list of addresses. Have you investigated the source code in for malloc.c and unlink to see that the code has not changed in some way? I believe you will find your problem in there.


1

Access can be controlled for local processes accessing local network assets like for example network ports. By associating labels with port objects and userids, groupids associated with processes (even individual processes, allowing you to specify whether and how an entities associated with particular labels can operate on or interact with entities ...


0

Typically you verify a vulnerability in three ways: Run exploit code. Did it blow up? Check your package manager's documentation. Do you have their version? Check the code. Do you have the affected lines? Since #3 is not effective for binaries, and you do not want to run exploit code, your other option is updating. I'd imagine by now that every distro ...


2

What you're looking at is a PLT, which is a way of doing late-bound library imports. The "calling convention" of PLTs isn't standard, but the toolchain usually uses register-based parameter passing for performance, which is why you're seeing edi as the address of the string. The call will go to a stub in the Global Offset Table (GOT) which then calls into ...


0

I would suggest you to try scapy, if you're doing it on linux. It has great features for the case you need. https://samsclass.info/124/proj11/proj16x-promscan.html


1

The seminal work on detection of promiscuous interfaces on the network is Detection of Promiscuous Modes using ARP Packets: ...promiscuous mode detection is performed by checking the responses of ARP packets, when ARP request packets are sent to all nodes on the network I don't know of implementations offhand, but the paper is detailed enough for ...


3

Your problem is ASLR randomly choosing where your program is loaded. You can turn off ASLR in Linux using sudo sysctl -w kernel.randomiz_va_space=0. Here's my program. I'm using RAX instead of EAX, and an unsigned long * rather than an int *. #include <stdio.h> #include <stdlib.h> unsigned long *get_stack_ptr(void) { __asm__( "mov ...


1

So this should answer the question of "is symlink common?" A search on the MITRE database shows there are 4 CVEs for a Linux Symlink Race condition vulnerability. For comparison, there are 2749 Linux CVEs known to MITRE. Linux at the kernel level has protections against this. Kees Cook created a patch for Linux to prevent this problem: The solution is ...


2

This is normal. It's how EFS works. Although it is common to refer to file folders with the encryption attribute set as “encrypted,” the folder itself is not encrypted. When encryption is set for a folder, EFS automatically encrypts all new files created in the folder and all files copied or moved into the folder by using My Computer. (Source: ...


1

I think it is fine to have a web facing panel as long as: Its not guessable, for example, www.example.com/admin. U don't want notorious users to attempt brute-forcing for two reasons: Incase the brute-force succeeds. If u have an account lockout policy in place, which you should, u don't want to be locked out by notorious users. Use strong passwords ...


0

For low value sites, username and password is ok. There are a lot of sites that are just not worth hacking into, and where the risk/cost of compromise to you is fairly minimal compared to the cost of securing it. For most sites though, you should require the use of HTTPS or VPN when doing administrative functions. There are now some SSL certificate ...


0

Lot of applications relies on a simple username/password combination. This is not the technique that you should worry about, but how you implement it. You need to make sure that passwords are strong enough not to be guessed. They should not be stored in plain-text in your database in case it gets compromised. Furthermore, you want to avoid interception of ...


3

From the nmap documentation: Another cause of duplicate fingerprints is embedded devices which share a common OS. For example, a printer from one vendor and an ethernet switch from another may actually share an embedded OS from a third vendor. In many cases, subtle differences between the devices still allow them to be distinguished. But ...


0

Just remember the fact that 'end to end' encryption doesn't necessary mean that every single link needs to be encrypted. E.g. Payment request is encrypted in client browser using app-3 public key. Corresponding private key resides in a HSM. Client Browser (encrypted payload) -> reverse proxy -> web -> app1 -> app2 -> app3 Payload is decrypted in app3 ...


0

For testing firewalls, I generate my own scripts using hping. One of the options is to fragment traffic (-f) and you can set the data size (-d).


1

There is no isolation between GUI apps on X11, so that allows your user to spy on your clipboard's content, create windows that may look like spoofs of your own windows (e.g. spoofs of your polkit1 dialog or screen locker), record your entire monitor, implement a keylogger... Just create a guest session, seriously. Or use a VM. I would not trust other ...



Top 50 recent answers are included