Hot answers tagged operating-systems
193
You are touching a sore point...
Historically, computers were mainframes where a lot of distinct users launched sessions and process on the same physical machine. Unix-like systems (e.g. Linux), but also VMS and its relatives (and this family includes all Windows of the NT line, hence 2000, XP, Vista, 7, 8...), have been structured in order to support the ...
105
In some places they have a saying: "opportunity makes the thief". All you're doing by screen-locking a computer is making the cost of hacking it just a little bit harder.
Security is an economic good, with a price and a value. The value of locking is somewhat larger than the price of locking it. Sort of like how in good neighborhoods, you don't need to ...
53
It's a risk management thing, really. An attacker with a short window of opportunity (e.g. whilst you're out getting coffee) must be prevented at minimum cost to you as a user, in such a way that makes it non-trivial to bypass under tight time constraints.
Hitting WinKey+L or clicking the lock button is next-to-zero cost for you as a user. Taking the time ...
45
At every place I have worked (as a contract developer) developers are given local admin rights on their desktops.
The reasons are:
1) Developers toolsets are often updated very regularly. Graphics libraries, code helpers, visual studio updates; they end up having updates coming out almost weekly that need to be installed. Desktop support usually gets ...
26
Identify required applications and processes and apply a checklist to either avoid installing them, or worst case uninstall them after the initial build.
Here I'm thinking those common culprits which still seem to go on to far too many distros by default!
NFS services: nfsd, lockd, mountd, statd, portmapper
telnet server and ftp server
R services: rlogin, ...
26
Bluntly put, yes, they could. That's the massively oversimplified answer.
The more complicated answer is that you need to understand how your operating system handles memory. You might hear talk of rings, privilege levels etc. Let me explain briefly:
When your operating system starts (getting passed the whole 16-bit BIOS thing) it basically has a whole ...
26
I think the OS do his jobs and avoid processes to access other's allocated memory. But I think this is somehow doable.
Yes, it is possible to access the memory of another process. On Windows, this amounts to having SE_DEBUG_PRIVILEGE and using ReadProcessMemory() to extract the information you want.
You can do the same thing from a Windows Driver, ...
25
All shipping iOS devices (with the possible exception of the AppleTV, which doesn't have third party apps) have two filesystems, implemented as two partitions on the flash storage. The first is mounted read-only and just contains the OS. The second contains user data: the installed apps, and their supporting data including documents and caches. This second ...
24
Locking your computer prevents surreptitious snooping or alteration. If you don't lock, it is easy for someone to poke around inside your session in such a way that you will not notice it when you return to your machine.
The security benefit is real because there is a class of attacker who wants access without leaving any trace whatsoever. For that class of ...
23
There is quite a lot of them:
Metasploitable: Currently there are 2 versions.
Kioptrix: Currently 4 challenges.
Hackademic: Apparently 2 VM, check 1 and 2.
pWnOS: Currently 2 challenges.
Standalone which you can install directly without VM, this is to hone your Webattack-Fu:
OWASP WebGoat
Damn Vulnerable Web Application
Mutillidae
23
There are a number of reasons why building their "own OS" is not a viable option.
1. Research Cost
To built a new OS, from ground up without the use of any existing code would require significant research. Even today, there are only four or five popularly used kernels like Unix , Linux kernel, BSD, XNU and Windows NT.
2. Security through obscurity
It's a ...
19
First there was one...
Below is a shot of the network management table at Shmoocon this year. That one IBM? That's my work-issued machine that was powered on for an hour because I needed to get some things done while away. It didn't do anything else all weekend. Every single one of us did the rest of the work on macs.
Why do all the security guys have ...
18
This partly depends on the kind of software the dev team is expected to develop. Some types of software are easier to develop without administrative rights than others.
For example, you can do a fair amount of web-based Java development using the likes of Eclipse with Maven artifacts, all installed locally (and typically tested on port 8080), without ...
18
"What's the point of locking a computer besides keeping the average coworker from messing with your stuff?"
By protecting your self from average coworker you've protected your self from largest subset of people who'd want to find something personal about you or do you harm.
17
The "Linux Server" space includes a huge range of distributions, each with their own default configuration update strategy, package management toolchain, and approach to default services and open ports. There is also a wide range of deployment scenarios: hardening a web server is quite different than hardening a linux-based router. You may get better ...
17
Yes. Your colleagues, if they really wanted, could probably access your computer, your personal files, your passwords, your banking account, etc. That's just the way of it.
There are any number of ways they could do this, if they wanted to be dishonest and malicious. One simple way would be to install a keylogger (or other spyware) on your machine at ...
15
Yes there is, the suckit rootkit as featured in Phrack is one such example, which modifies the linux kernel via /dev/kmem. Essentially, the goals remain the same - replace entries in the system call table to do what we want them to do. The difference here being that the modification is done via /dev/kmem.
The grsecurity/PaX patches for the kernel include ...
14
The underlying idea of the comic is that separation of user accounts has been designed for mainframes: big computers, shared by many users. In that model, the potential attackers are other users. Account separation is then about protecting users from other users; only the god-like admin account can access everything on the machine, and the administrator has ...
13
I recommend the following steps, in rough order of priority:
Enable automatic updates. This is the best way to ensure you are always running the best, patched version of all software.
Turn on a firewall. A simple policy often suffices for desktops: roughly speaking, allow all outgoing connections, block all incoming connections. This is a lot easier than ...
13
If you can send packets to the target machine, use nmap -O, which provides OS fingerprinting.
If you can eavesdrop/intercept network traffic with the target machine, use pof, a tool for passive OS fingerprinting.
You didn't provide much information about what are your constraints or why the standard tools (like nmap or pof) didn't work for you. Therefore, ...
13
I work in the consumer electronics arena and security here is somewhat different than in the server environment. Here we have to assume that the product is in a hostile environment. So for subscriber management purposes keys are kept secure. The first line of defence is that the SoC has hidden registers that even the operating system can't actually access, ...
12
Point in time system hardening is a beneficial feat, but what really defines deploying a server securely is what is done to maintain that state.
Pick any of the quality checklists (see links below) that detail the recommended configuration modifications to make to strengthen the security of your servers and apply those changes that make sense for your ...
12
When you copy a file to a different filesystem, what's going on under the hood is that a you create a new file and copy the contents. Moving a file to a different filesystem is done by copying then removing the source. So you have no more privileges when copying a file than at any other time you're creating a file.
When you create a file, it belongs to you. ...
12
The OKL4 Verified microkernel has passed the most stringent of Common Criteria evaluation assurance levels (EAL 7). Even this doesn't mean that it's "secure", "100% secure" or "more secure", it just means that it has been formally proved that the microkernel's implementation is compatible with the security model defined by the vendor.
Such a security model ...
12
The number of options for places to hide, places to hook etc is so vast that any step-by-step list for manual checking is going to be incomplete.
And of course, there is a whole other story of kernel rootkits, which leave a very small amount of traces in the system, that can usually be discovered with forensic analysis if implemented correctly.
What you ...
12
Short concise answer
To the best of my knowledge, such a scheme is not available in a general purpose filesystem in a general purpose operating system using full block level RSA-only non-hybrid crypto. This is because operations like RSA in software are generally slower than their symmetric counterparts and require a lot of implementation extras, which are ...
11
You could do a lot worse than starting with the Sans checklist.
My only criticism of this is that it does not place enough emphasis on managing the security of a deployed system - particularly ensuring vendor patches are up to date, planning a good permissions model, managing IDS exception reporting etc.
11
It's possible to use Group Policies to hide specific drives in My computer, windows explorer and similar file browsing mechanisms (Microsoft article on it here).
It's been a while since I've seen this implemented, but back then there was usually a way around the restriction, so this kind of control would prevent casual access, but wouldn't stop a determined ...
11
The first point I'd make is that the number of hits on a given vulnerability/exploit db is not a reliable indicator of overall security. This could largely be defined by other factors such as the focus of security researcher's efforts or disclosure policies.
Even a quick read over the project websites provides an indicator of the likely comparative security ...
11
Short answer
There are three, separate issues claiming the name of "Secure Desktop":
Windows builtin functions like GINA and the Credential Provider Model.
Separation of privileged vs unprivileged applications running as the same user (nominally prevent privilege escalation), which may or may not be related to:
SwitchDesktop(), which is what KeePass is ...
Only top voted, non community-wiki answers of a minimum length are eligible
