Tag Info

Hot answers tagged

297

You are touching a sore point... Historically, computers were mainframes where a lot of distinct users launched sessions and process on the same physical machine. Unix-like systems (e.g. Linux), but also VMS and its relatives (and this family includes all Windows of the NT line, hence 2000, XP, Vista, 7, 8...), have been structured in order to support the ...


111

In some places they have a saying: "opportunity makes the thief". All you're doing by screen-locking a computer is making the cost of hacking it just a little bit harder. Security is an economic good, with a price and a value. The value of locking is somewhat larger than the price of locking it. Sort of like how in good neighborhoods, you don't need to ...


62

The wording of that sentence may seem a bit worrying because in a way it implies that they have root access as a backdoor that is already installed and in use. The truth is that it was just bad wording from Mark and what he tried to explain is that, yes, they have potential root access to your machine because every package update runs as root and at that ...


54

It's a risk management thing, really. An attacker with a short window of opportunity (e.g. whilst you're out getting coffee) must be prevented at minimum cost to you as a user, in such a way that makes it non-trivial to bypass under tight time constraints. Hitting WinKey+L or clicking the lock button is next-to-zero cost for you as a user. Taking the time ...


47

At every place I have worked (as a contract developer) developers are given local admin rights on their desktops. The reasons are: 1) Developers toolsets are often updated very regularly. Graphics libraries, code helpers, visual studio updates; they end up having updates coming out almost weekly that need to be installed. Desktop support usually gets ...


39

Identify required applications and processes and apply a checklist to either avoid installing them, or worst case uninstall them after the initial build. Here I'm thinking those common culprits which still seem to go on to far too many distros by default! NFS services: nfsd, lockd, mountd, statd, portmapper telnet server and ftp server R services: rlogin, ...


33

You trust them because they distribute the software that runs your computer. Their processes run as root: you have to trust them because the computer is in their hands, more so than it is in yours. While you are the administrator of the machine, you use their tools to do your administrator tasks. The point he's making is that you can only run an OS ...


26

I work in the consumer electronics arena and security here is somewhat different than in the server environment. Here we have to assume that the product is in a hostile environment. So for subscriber management purposes keys are kept secure. The first line of defence is that the SoC has hidden registers that even the operating system can't actually access, ...


25

There is quite a lot of them: Metasploitable: Currently there are 2 versions. Kioptrix: Currently 4 challenges. Hackademic: Apparently 2 VM, check 1 and 2. pWnOS: Currently 2 challenges. Standalone which you can install directly without VM, this is to hone your Webattack-Fu: OWASP WebGoat Damn Vulnerable Web Application Mutillidae


25

Locking your computer prevents surreptitious snooping or alteration. If you don't lock, it is easy for someone to poke around inside your session in such a way that you will not notice it when you return to your machine. The security benefit is real because there is a class of attacker who wants access without leaving any trace whatsoever. For that class of ...


24

There are a number of reasons why building their "own OS" is not a viable option. 1. Research Cost To built a new OS, from ground up without the use of any existing code would require significant research. Even today, there are only four or five popularly used kernels like Unix , Linux kernel, BSD, XNU and Windows NT. 2. Security through obscurity It's a ...


24

Yes, this is very possible. In fact, support for this is built into the most popular port scanning tool in use, nmap. This feature, OS detection, can be activated by passing the -O flag to the nmap tool. What nmap does is send different TCP and UDP packets to the target and examine the response. By comparing the response to a database of existing operating ...


20

The "Linux Server" space includes a huge range of distributions, each with their own default configuration update strategy, package management toolchain, and approach to default services and open ports. There is also a wide range of deployment scenarios: hardening a web server is quite different than hardening a linux-based router. You may get better ...


20

"What's the point of locking a computer besides keeping the average coworker from messing with your stuff?" By protecting your self from average coworker you've protected your self from largest subset of people who'd want to find something personal about you or do you harm.


19

First there was one... Below is a shot of the network management table at Shmoocon this year. That one IBM? That's my work-issued machine that was powered on for an hour because I needed to get some things done while away. It didn't do anything else all weekend. Every single one of us did the rest of the work on macs. Why do all the security guys have ...


19

This partly depends on the kind of software the dev team is expected to develop. Some types of software are easier to develop without administrative rights than others. For example, you can do a fair amount of web-based Java development using the likes of Eclipse with Maven artifacts, all installed locally (and typically tested on port 8080), without ...


17

Yes. Your colleagues, if they really wanted, could probably access your computer, your personal files, your passwords, your banking account, etc. That's just the way of it. There are any number of ways they could do this, if they wanted to be dishonest and malicious. One simple way would be to install a keylogger (or other spyware) on your machine at ...


17

The underlying idea of the comic is that separation of user accounts has been designed for mainframes: big computers, shared by many users. In that model, the potential attackers are other users. Account separation is then about protecting users from other users; only the god-like admin account can access everything on the machine, and the administrator has ...


15

Point in time system hardening is a beneficial feat, but what really defines deploying a server securely is what is done to maintain that state. Pick any of the quality checklists (see links below) that detail the recommended configuration modifications to make to strengthen the security of your servers and apply those changes that make sense for your ...


15

I recommend the following steps, in rough order of priority: Enable automatic updates. This is the best way to ensure you are always running the best, patched version of all software. Turn on a firewall. A simple policy often suffices for desktops: roughly speaking, allow all outgoing connections, block all incoming connections. This is a lot easier than ...


14

There's a couple of good ones in addition to DVL, that I've come across Metasploitable is designed for testing out some of Metasploits functionality. There's some good information on using it in the free Metasploit Unleashed course. There's also DVWA from a web applications perspective EDIT: Another good list I came across on a blog recently, has quite ...


13

When you plug a USB key in, a considerable amount of things happen. The OS first talks to the USB device to know what kind of device it is and what it can do. Then, if the device says that it is a kind of disk, the OS will look for a filesystem on it, then mount it, and explore some of the files. Depending on what files were found and their name, the OS will ...


13

If you can send packets to the target machine, use nmap -O, which provides OS fingerprinting. If you can eavesdrop/intercept network traffic with the target machine, use pof, a tool for passive OS fingerprinting. You didn't provide much information about what are your constraints or why the standard tools (like nmap or pof) didn't work for you. Therefore, ...


13

What language/platform are you using? If it's .NET, check out the PasswordBox control and the SecureString class. The SecureString class represents a way to store the password in memory without making it accessible to anyone - even hackers who sneak peeks at your application's memory. The PasswordBox control is a textbox that incorporates the ...



Only top voted, non community-wiki answers of a minimum length are eligible