Tag Info

Hot answers tagged

62

The wording of that sentence may seem a bit worrying because in a way it implies that they have root access as a backdoor that is already installed and in use. The truth is that it was just bad wording from Mark and what he tried to explain is that, yes, they have potential root access to your machine because every package update runs as root and at that ...


33

You trust them because they distribute the software that runs your computer. Their processes run as root: you have to trust them because the computer is in their hands, more so than it is in yours. While you are the administrator of the machine, you use their tools to do your administrator tasks. The point he's making is that you can only run an OS ...


25

There is quite a lot of them: Metasploitable: Currently there are 2 versions. Kioptrix: Currently 4 challenges. Hackademic: Apparently 2 VM, check 1 and 2. pWnOS: Currently 2 challenges. Standalone which you can install directly without VM, this is to hone your Webattack-Fu: OWASP WebGoat Damn Vulnerable Web Application Mutillidae


24

Yes, this is very possible. In fact, support for this is built into the most popular port scanning tool in use, nmap. This feature, OS detection, can be activated by passing the -O flag to the nmap tool. What nmap does is send different TCP and UDP packets to the target and examine the response. By comparing the response to a database of existing operating ...


12

It is unquestionably less likely that a Mac will be infected by any sort of virus. There are two reasons which have nothing to do with the baseline security of the OS: Reason 1: Low interest The first, and most commonly cited, is the lack of interest on the part of attackers. Mac malware is rare because its market share is small. Malware authors want high ...


11

I would go for Kali Linux . This Linux distribution is made for pentesting and security analysis. It contains a great many analysis tools, right in your main menu. In general, I would use an Open Source OS for security-related work, because with Open Source there is public scrutiny that your tools themselves are not compromised.


10

Basically, every disto has it's own repository servers, which are the default option for the installed system to fetch packages from. This means that when you install a new package or download updates these are downloaded from those repositories. You (we) trust the repo maintainers that the packages they upload are not malicious. Most of the official ...


7

So if I was you I would start relatively simply with some VMs and a host machine. Personally I use VMWare workstation but other virtualization products are possibilities. If you've got a decent enough machine (e.g. 8GB RAM, Quad-Core Sandy/Ivy bridge, fast disks), I'd recommend keeping the Host OS clear of lab tools or target Apps, as re-building VMs is an ...


7

Ubuntu's installer and package manager run as root. They have to: that's the only way it can install an operating system. It also installs programs that run as root. Other Linux distributions (and other operating systems, for that matter) are no different, even though the exact particulars may change a little: Ubuntu just happens to be in scope for this ...


6

Another good one is http://exploit-exercises.com/ "exploit-exercises.com provides a variety of virtual machines, documentation and challenges that can be used to learn about a variety of computer security issues such as privilege escalation, vulnerability analysis, exploit development, debugging, reverse engineering, and general cyber security issues. "


6

Whenever you run sudo apt-get upgrade you're downloading a .deb package from the Ubuntu repositories and letting the installer run under root (you know, sudo) to install it. If Ubuntu wanted to manipulate one of the packages and include a backdoor, they can, and you probably will never know it. You, implicitly, trust Ubuntu not to include a backdoor in ...


6

Besides the bear's points note that Microsoft Windows has been a target for a substantial amount of years for malware developers, whereas OS:X wasn't but is getting more and more malware targetted to its machines. Now Windows is like an army base under constant attack, they have experience. Whereas OS:X only has limited battle experience. So if you ask me ...


6

My first two cents: What is the actual problem here? Attackers knowing you are running a vulnerable operating system or you not upgrading it? Now in regards to your question. There are a number of utilities which can be used to fingerprint an operating system. There are several JavaScript libraries which allow you to get information about a person's ...


6

The sans sift kit/workstation (http://digital-forensics.sans.org/community/downloads) is very good if your looking to learn about forensics, as it comprises of things like autopsy and other open source tools which are commonly used. Little extra http://www.forensicswiki.org/wiki/Main_Page this page helps ALOT when your getting used to things


5

To some extent, all the Web/Cloud hype is about a new model (or, maybe, an old model with a new layer of paint). With "apps", applications are quite contained and isolated from each other. With the "apps" model as is employed on iOS / Android system, a further twist is applied in that only "allowed" apps can be installed. The user can still choose which apps ...


5

Roughly speaking, number of virus and other malware running around for a given OS tends to correlate with the market share of the said OS. Malware writers get interested in OS that many potential targets use. Windows market share is still in the 90% or so, hence a lot of virus. Whereas Linux is below 1% (for desktop system), and MacOS X is in-between. Of ...


5

In your specific case, there's a different answer: never carry sensitive data through a border. Border agents almost always have enormously wide legal powers to search devices on their own, and are very happy to utilise them when asked to by intelligence agencies. In fact, if you expect to be subject to a targeted attack by an intelligence agency, I ...


4

Remotely destroying all data on a laptop is reasonably easy to do thoroughly, with an EMP. It is somewhat messy, though; there is collateral damage. If you want something more "surgical", you can destroy data remotely, subject to the following caveats: You have to be able to remotely log on the machine. This can use RDP or some custom remote-control ...


4

If you want to use virtual machine as a sandbox mechanism to contain potentially hostile software, then indeed all the kinds of shortcuts you talk about are a source of worry. However, note that these "enablers" all apply to desktop-related virtualization. Most users of virtualization on their desktop systems do not do that for security, but for ...


4

One of the tenets of security seems to be that if something is overcomplicated, the probability of exploiting increases. ... Simplicity, however, implies homogeneity. After all, it's simpler to secure fewer OSes, maintain fewer antimalware solutions, and patch fewer applications. You're overloading the word "simplicity". You're using it to mean ...


4

A VM is nominally supposed to prevent code in the guest from escaping to the host. So when such an escape is possible, then it is due to a security hole in the VM implementation. Some such holes have been found in various VM engines. See for instance Cloudburst, an exploit described in 2009. In this case, the video emulation is instrumental to the escape, ...


4

The short answer is that yes attackers can usually detect your operating system in standard configurations. Usually this would come while your browsing, and the browser will provide that information to systems that you contact in the User-Agent String (N.B. with some browsers and plugins this can be changed to anything you like). Also as @terrychia notes, ...


4

Yes, it's possible to trust companies. You do it all the time. If you use Windows, you're trusting Microsoft very heavily. Same goes for Apple if you use any of their products. When you use HTTPS you're trusting a whole raft of Certificate Authorities, most of whom you've never heard of before. Most of the companies that you're forced to trust when you use ...


4

You have a non-question right here. Let's look at your second and third assumptions. Rebuilding a machine has negligible cost with zero downtime. The logical conclusion in this ideal world is rebuilding after any instruction is executed. After all, it has zero cost. Then you say, Ideally a way that avoids 'unnecessarily' excessive recycling which ...


3

All the apps on an Android device have their own updates, which are then fed to the devices through the normal app channels (say, Google Play). This covers not only the apps you have downloaded, but also the apps which were provided with your device (I know that my phone regularly nags me about an update for the Facebook app which came with the device OS). ...


3

That entirely depends on the option chosen during the use of the Reset your PC tool:              As you can see in the image above, the user is presented with two options: Just remove my files option is the faster of the two, and is meant to be selected when you're resetting your PC for your ...


3

OSes respond to invalid packets because that is very helpful in diagnosing network configuration problems. If you send a packet and nobody answers, you have no idea what happened to the packet: did some router eat it? Was its reply misrouted? Is there a connectivity problem? Or did the target receive the packet but not like it? If the target replies, you ...


3

The greatest problems of today's desktop PC environment: allowing arbitrary applications access to all the data that a user has; giving applications unlimited access to the Internet and sensitive hardware (mike, the camera, GPS chip, Bluetooth etc.); proliferation of idiot users; emergence of a business culture where stealing and selling users' personal ...


3

Code signing and ACL'ing the system locations are two mechanisms. windows won't load DLL's or EXE's that aren't signed by the Windows code signing key for system calls. Windows also periodically verifies the state of the files by making sure only code-signed file are present. Further, the default ACL's prevent writing to the system directories that store ...



Only top voted, non community-wiki answers of a minimum length are eligible