Tag Info

Hot answers tagged

63

The wording of that sentence may seem a bit worrying because in a way it implies that they have root access as a backdoor that is already installed and in use. The truth is that it was just bad wording from Mark and what he tried to explain is that, yes, they have potential root access to your machine because every package update runs as root and at that ...


33

You trust them because they distribute the software that runs your computer. Their processes run as root: you have to trust them because the computer is in their hands, more so than it is in yours. While you are the administrator of the machine, you use their tools to do your administrator tasks. The point he's making is that you can only run an OS ...


25

Yes, this is very possible. In fact, support for this is built into the most popular port scanning tool in use, nmap. This feature, OS detection, can be activated by passing the -O flag to the nmap tool. What nmap does is send different TCP and UDP packets to the target and examine the response. By comparing the response to a database of existing operating ...


15

Yes, most exploits are platform dependent. There are details. For instance, if an attacker targets Internet Explorer, then he targets Windows systems. Most Windows systems run on x86. Moreover, on Windows up to 7, the default IE is the 32-bit version, even if the OS is a 64-bit Windows. Also, at the assembly level, XP, Vista and 7 are very similar (indeed, ...


12

I would go for Kali Linux . This Linux distribution is made for pentesting and security analysis. It contains a great many analysis tools, right in your main menu. In general, I would use an Open Source OS for security-related work, because with Open Source there is public scrutiny that your tools themselves are not compromised.


12

It is unquestionably less likely that a Mac will be infected by any sort of virus. There are two reasons which have nothing to do with the baseline security of the OS: Reason 1: Low interest The first, and most commonly cited, is the lack of interest on the part of attackers. Mac malware is rare because its market share is small. Malware authors want high ...


11

Google Chrome OS is a Linux-based operating system on which Chrome is the browser and focuses on the use of the online applications that belong to Google (Google Drive, Youtube ...). It is the direct competetor with Windows OS of Microsoft. Centos OS is also a Linux-based operating system but unlike Chrome OS which runs on mobiles, Centos OS is widely ...


10

Basically, every disto has it's own repository servers, which are the default option for the installed system to fetch packages from. This means that when you install a new package or download updates these are downloaded from those repositories. You (we) trust the repo maintainers that the packages they upload are not malicious. Most of the official ...


7

Ubuntu's installer and package manager run as root. They have to: that's the only way it can install an operating system. It also installs programs that run as root. Other Linux distributions (and other operating systems, for that matter) are no different, even though the exact particulars may change a little: Ubuntu just happens to be in scope for this ...


6

The SANS sift kit/workstation (http://digital-forensics.sans.org/community/downloads) is very good if you're looking to learn about forensics, as it comprises things like autopsy and other open source tools which are commonly used. Little extra: http://www.forensicswiki.org/wiki/Main_Page this page helps A LOT when you're getting used to things.


6

Whenever you run sudo apt-get upgrade you're downloading a .deb package from the Ubuntu repositories and letting the installer run under root (you know, sudo) to install it. If Ubuntu wanted to manipulate one of the packages and include a backdoor, they can, and you probably will never know it. You, implicitly, trust Ubuntu not to include a backdoor in ...


6

My first two cents: What is the actual problem here? Attackers knowing you are running a vulnerable operating system or you not upgrading it? Now in regards to your question. There are a number of utilities which can be used to fingerprint an operating system. There are several JavaScript libraries which allow you to get information about a person's ...


6

Besides the bear's points note that Microsoft Windows has been a target for a substantial amount of years for malware developers, whereas OS:X wasn't but is getting more and more malware targetted to its machines. Now Windows is like an army base under constant attack, they have experience. Whereas OS:X only has limited battle experience. So if you ask me ...


6

A list of the various tests used are provided in the mmap documentation at http://nmap.org/book/osdetect-methods.html#osdetect-probes-seq. For more specific details you'll have to read the source code. Essentially various different probe packets are sent and the results analysed. Slight differences between TCP/IP software mean there are sometimes slight ...


5

Roughly speaking, number of virus and other malware running around for a given OS tends to correlate with the market share of the said OS. Malware writers get interested in OS that many potential targets use. Windows market share is still in the 90% or so, hence a lot of virus. Whereas Linux is below 1% (for desktop system), and MacOS X is in-between. Of ...


5

In your specific case, there's a different answer: never carry sensitive data through a border. Border agents almost always have enormously wide legal powers to search devices on their own, and are very happy to utilise them when asked to by intelligence agencies. In fact, if you expect to be subject to a targeted attack by an intelligence agency, I ...


5

A sandbox is like a special "section" of your computer that has been blocked off from accessing the rest of your computer. In a perfect sandbox you can do anything you want within it, but it will not effect the rest of your computer. This is used as a form of security, keeping any malware you might download from being able to affect the rest of your ...


5

Heuristically. nmap observes the behaviour of the system during probes, develops a "fingerprint", which analagous to a real fingerprint test, looks mainly for the minutiae: out of specification behaviour and extra-specification or undefined behaviour retransmission times response to fragmentation and various ICMP probes patterns in TCP sequence numbers, IP ...


4

TL;DR: Yes, it is possible for an attacker to fingerprint your system and yes it will help him to attack your system. So you should correctly protect your system (an antivirus is not enough). How does fingerprint work ? There are different kinds of fingerprint, mainly fingerprint at network level and application level. At network level Operating systems ...


4

The short answer is that yes attackers can usually detect your operating system in standard configurations. Usually this would come while your browsing, and the browser will provide that information to systems that you contact in the User-Agent String (N.B. with some browsers and plugins this can be changed to anything you like). Also as @terrychia notes, ...


4

Yes, it's possible to trust companies. You do it all the time. If you use Windows, you're trusting Microsoft very heavily. Same goes for Apple if you use any of their products. When you use HTTPS you're trusting a whole raft of Certificate Authorities, most of whom you've never heard of before. Most of the companies that you're forced to trust when you use ...


4

You have a non-question right here. Let's look at your second and third assumptions. Rebuilding a machine has negligible cost with zero downtime. The logical conclusion in this ideal world is rebuilding after any instruction is executed. After all, it has zero cost. Then you say, Ideally a way that avoids 'unnecessarily' excessive recycling which ...


4

Are exploits platform dependent? Yes. As in, does that mean that the IE vulnerability needs to be developed IN ASSEMBLY once for each OS( XP, Vista, 7, 8 ), doubled based on 32/64 bit, then doubled again based on byte order? No. The use of assembly doesn't make it more platform dependent. It's only just as platform dependent as it would be if ...


4

There are a wide range of ways to trick OS identification functions, and they work to varying degrees, depending on how much functionality is built into the tool. For example, nmap doesn't just use one identification mechanism, but a few which feed in to it's confidence %age announced in it's OS identification. Nmap sends a series of TCP and UDP ...


4

In theory, a microkernel, by putting the bulk of the driver code into userspace, is more resilient against attacks: an attack against one driver can't easily be used to leverage access to the other drivers, or gain kernel-level privileges. Additionally, the reduced size of the kernel gives it a much smaller attack surface. In practice, kernel architecture ...


3

Your question is not very clear. If you mean that the main CPU includes some backdoor for eavesdropping, then in principle, all bets are lost. No matter what protections the operating system might include, the CPU could simply not execute them (but pretend to). In practice, if such a backdoor was identified, there might be a way to work around it, because ...


3

Get a trusted computer, download the ISO on there and use that as installation disk.


3

Bruce Schneier in his article linked to register site. In the article, the author talks about a virtual scenario where you want to ensure trust in all parts of the processes. By showing the true, but ridiculous things you would have to do for controlling things from start to end. To quote a relevant extract: The truly paranoid would worry about ...


3

Exploits are platform dependent as each platform may have a different way of handling the memory layout and process execution. For example, executing an exploit on WinXP will be relatively easier rather than on other recent versions of Windows. Talking particularly about the IE exploits, it has got more to do with finding vulnerability in some of the ...


3

The most common? Probably HKLM\Software\Microsoft\Windows\CurrentVersion\Run -- it's how programs arrange to be run at startup. Of course, a lot of perfectly harmless programs also use it, so watching it won't gain you much. The problem with simply watching registry keys for modification is that normal programs also change many of them. You can't, for ...



Only top voted, non community-wiki answers of a minimum length are eligible