Tag Info

Hot answers tagged

31

Yes. As you seem to be using a modern terminal emulator, some escape sequences could be used to modify Keyboard buffer. There could be injected proper shell commands. You could use argument -e of cat for safe operation, see man cat. Addendum In fact, it was possible, but in a very old past... As this become an issue, this kind of features was quickly ...


19

First there was one... Below is a shot of the network management table at Shmoocon this year. That one IBM? That's my work-issued machine that was powered on for an hour because I needed to get some things done while away. It didn't do anything else all weekend. Every single one of us did the rest of the work on macs. Why do all the security guys have ...


19

Introduction I'll try to the best of my knowledge to approach your questions without touching the technical parts of the Bluetooth technology itself. I've learned a lot of the following while I had to write a security report to shape a BYOD policy. Knowing you, I won't have to lecture you on that there's nothing 100% secure, everything we do is just to make ...


17

Yes. Your colleagues, if they really wanted, could probably access your computer, your personal files, your passwords, your banking account, etc. That's just the way of it. There are any number of ways they could do this, if they wanted to be dishonest and malicious. One simple way would be to install a keylogger (or other spyware) on your machine at ...


12

Answer: Yeah. It's possible. Re-install OSX and then change all her passwords. She got phished. IT Services is correct here. Prevention: To prevent this from happening in the future make sure she understands the importance of updates, and how to spot and avoid phishing scams. How it Happened: A lot of attackers will use shortened URLs or legitimate ...


12

It is unquestionably less likely that a Mac will be infected by any sort of virus. There are two reasons which have nothing to do with the baseline security of the OS: Reason 1: Low interest The first, and most commonly cited, is the lack of interest on the part of attackers. Mac malware is rare because its market share is small. Malware authors want high ...


11

Compared to Windows, Mac OS X has: Smaller user base: Means it is less interesting to malware creators, thus fewer viruses. Although there are viruses for Mac OS X, they're not as much as Windows malware. In the past few years, this has been changing, and it's backfiring. Because people think they're less prone to malware, they tend to develop bad usage ...


10

Seeing that you're using Mac, manipulating logs is as simple as elevating yourself to a root (admin) user, by using a command such as 'sudo -i' in your terminal, and then editing them as you like. As far as I'm concerned, logs are a security professional's best friend. The more logs you have the more information you have to pull from (at the same time, ...


10

is there anyway that my colleagues can access my computer information and my personal files? Many ways. From just looking over your sholder when you are not paying attention to installing a hardware key logger to intercepting your network traffic. Someone there probably has administrative access to your machine. Whoever has administrative access can ...


9

sudo cp /usr/bin/curl /usr/bin/curl.bin sudo vim /usr/bin/curl.wrapper here is the wrapper: #!/bin/sh date >> /var/tmp/curl_ppid.log ps -f -p $PPID >> /var/tmp/curl_ppid.log exec curl.bin "$@" and then: sudo chmod 755 /usr/bin/curl.wrapper sudo touch /var/tmp/curl_ppid.log sudo chmod a+w /var/tmp/curl_ppid.log sudo ln -sf ...


9

Linuxios can already answered this but I'll see if I can explain in more detail. It's not always obvious why Physical Access = Game Over: It is not a "flaw" because if an attacker has physical access to your computer, the login password cannot protect it. If your data is not encrypted, an attacker with physical access to your computer will just remove the ...


8

Having done the same mistake myself a couple of years ago: Most protocols/software will return an error code if you try to login with a valid username (other than "anonymous") and an empty password. That is even true for most systems that allow some kind of anonymous usage without being logged in at all. For LDAP, however, the common case is that the ...


7

In a mixed Windows/Unix environment, what I use for common cryptographic algorithms is: OpenSSL for many calculations, especially hashes (but not HMAC) and X.509 certificate manipulations. Python's hashlib and hmac for SHA and HMAC. Unfortunately, neither is provided with Windows, they require a separate installation. Here's a simple one-liner to ...


7

Go buy Little Snitch http://www.obdev.at/products/littlesnitch/index.html for $30. Little Snitch informs you whenever a program attempts to establish an outgoing Internet connection. You can then choose to allow or deny this connection, or define a rule how to handle similar, future connection attempts. This reliably prevents private data from being sent ...


7

This is really two questions and aren't really handled well by a single program. The antivirus question is easy, you'll be wanting ClamX. It is an OSX port of the venerable ClamAV engine. It is widely considered to be the default AV for Unix/Linux systems. For your other question, free utilities that have good Mac integration may be hard to come across. ...


7

The computer is not yours anymore, it is probably his. You cannot trust that he did not actually compromise your box further than you currently know about. He could have compromised the kernel, binaries or virus scanner on your box and you would never know. I would recommend wiping and re-installing from known good media. Then scan your current hard ...


7

When I tried downloading from https://www.mozilla.org/en-US/firefox/fx/ I was pointed to http://mirrors.coreix.net once, then http://mozilla.mirror.nexicom.net/, then http://mozilla.c3sl.ufpr.br. Whether this is the way Firefox's download page is supposed to work or not, I do not know myself. A more appropriate way to resolve this though, would be to ask: ...


7

This answer may be incomplete or incorrect as my knowledge on the topic is limited, but my understanding of Bluetooth is that it is a fairly loose stack on which different protocols (called profiles) can be developed. A lot of the particulars of security are going to depend on the particular Bluetooth stack and profile that you have on your hardware. ...


7

Is he using your credit? If so contact Apple. If he's not, then he just might have the same name as you and he's not really doing anything wrong. What you can do is send an email to apple making them aware of the problem so they can force the user to choose a new email address. Since you do not own the apple account, it's not really your right to change ...


7

"You have new mail" in a terminal is a very old Unix behaviour: the shell (the software which interprets the commands you type in the terminal) regularly checks whether the file /var/mail/username (where username is, you guess it, the name of the current user) has been modified (precisely, whether its last modification time is ulterior to its last reading ...


7

"Secure Keyboard Entry" maps to the EnableSecureEventInput function whose concept is described here. Basically, applications don't access the hardware themselves; they obtain events (e.g. about key strokes) from the operating system. Some elements in the OS decides what application gets what events, depending on its access rights and GUI state (there are ...


6

According to this table, the software update goes through the same port than the HTTP protocol, so you really just need to open up port 80. Additionally to port 80, I would suggest the following: 443 -> HTTPS 22 -> SSH 115 -> SFTP (don't use regular FTP if you can help it. If you are that paranoid, stick to SFTP. Otherwise, use 20*) 587 -> Authenticated ...


6

Try using Wireshark to do a packet capture and see whats data is being sent out. Then you should at least be able to tell if its anything to worry about. Alternatively try using the netstat -p command that will list what programs are currently listing on ports and you can see if there is anything strange.


6

To directly answer your question: Type last at a command prompt and it will show you user names and timestamps of successful login attempts (this doesn't do much good if they pulled your hard drive out to browse your files). Although you shouldn't do your personal stuff on your work computer (legal reason.. something about the company owning any documents ...


6

You could create big files until the disk is full. Something like this: dd if=/dev/zero bs=8192 of=junkfile # ... wait for the disk to fill up, at which point this command exits sync rm junkfile The sync command makes sure that all the zeros in the new file make it to the disk. Then, the rm gives you back your disk space. You should run these commands as ...


6

There was WeaponX in 2004, there is even a guide here on how to develop one yourself. Since OSX is a combination of Mach and BSD, there have been rootkits specially developed to target the Mach or Unix side or both. I use Rkhunter on my Unix machines, there is a version for OSX as well, so I suggest you take a look at that. The problem with a rootkit is ...


6

Yes, OS X is still vulnerable to the Cold Boot Attack, because the encryption keys are kept in memory while the machine is powered on (i.e., from you enter your password on boot until your machine is completely powered off). This is a problem for all software full-disk encryption tools, and not specifically related to FileVault 2. Depending on the version ...


6

Just a quick addition to the previous answers; if you are still worried someone would get the hold of your encryption key from RAM during standby, one could enable a power management feature of OS X called "DestroyFVKeyOnStandby", as mentioned here (same link as Richard Belisle), page 37. From man pmset: destroyfvkeyonstandby - Destroy File Vault Key when ...



Only top voted, non community-wiki answers of a minimum length are eligible