Tag Info

Hot answers tagged

20

At the moment there is no way to easily work out whether to trust specific docker containers. There are base containers provided by Docker and OS providers which they call "trusted" but the software lacks good mechanisms as yet (e.g. digital signing) to check that images haven't been tampered with. For clarification to quote the recently released CIS ...


17

Yes, it can be done as (theoretically) every "computing device" is computationally equivalent to every other computing device. Look up the Church-Turing thesis if you are interested. However your question is grounded in practice and in this case the answer is "yes, but it would cost too much". Effort in virtualisation today aims at speeding up the virtual ...


11

Google Chrome OS is a Linux-based operating system on which Chrome is the browser and focuses on the use of the online applications that belong to Google (Google Drive, Youtube ...). It is the direct competetor with Windows OS of Microsoft. Centos OS is also a Linux-based operating system but unlike Chrome OS which runs on mobiles, Centos OS is widely ...


8

Actually, you cannot. Even without speaking of an actual compromise, from a security perspective you may assume that your application already contains bugs which can be at least be as effective than a software compromise. That's why, when building a secure system, your security must not rely on a single tool. Instead, you must use a layered security ...


8

Actually lorenzo's answer does not quite cut it. The Church-Turing thesis only provides us with a model of computing, it can't tell us anything about virtualization because it is not concerned with other aspects of a machine. But there is theoretical analysis for the ability of a machine to be virtualized by Popek et al: ...


7

One of the articles you link to -- If the NSA has been hacking everything, how has nobody seen them coming? -- makes an assumption in posing the question: "If the NSA was owning everything in sight (and by all accounts they have) then how is it that nobody ever spotted them?" The premise for this question is incorrect, because for all we have found out ...


7

There are several major impacts, not all of them relevant to all users. Performance (based on throughput, i.e. MB/s - the more data you're moving in a given timeframe, the more encryption has to happen in that timeframe - when the encryption can no longer keep up, your data moves more slowly); if you use symmetric AES encryption with software that uses ...


7

A sandbox is like a special "section" of your computer that has been blocked off from accessing the rest of your computer. In a perfect sandbox you can do anything you want within it, but it will not effect the rest of your computer. This is used as a form of security, keeping any malware you might download from being able to affect the rest of your ...


7

Trust it as much as any unsigned code that you run on your systems. Containers are just processes with some extra namespace protections on them, so that's all the protections they get. They still talk to the same kernel underneath.


6

A list of the various tests used are provided in the mmap documentation at http://nmap.org/book/osdetect-methods.html#osdetect-probes-seq. For more specific details you'll have to read the source code. Essentially various different probe packets are sent and the results analysed. Slight differences between TCP/IP software mean there are sometimes slight ...


5

Heuristically. nmap observes the behaviour of the system during probes, develops a "fingerprint", which analagous to a real fingerprint test, looks mainly for the minutiae: out of specification behaviour and extra-specification or undefined behaviour retransmission times response to fragmentation and various ICMP probes patterns in TCP sequence numbers, IP ...


5

In essence, I argue it is the same question as whether open source software is trustworthy. But I think the risk of using community Docker containers is somewhat higher at present than the risks of using open source software. First, as you mentioned, there is no signing and verification now. Good open source packaging systems today include this, at least ...


4

You are correct about performance. With symmetric key encryption, the performance hit should be very small. The other effect is to render useless some operating system features. The one that comes immediately to mind for encrypted files (not full-disk encryption) is the content indexing and searching feature of Windows. If a file is encrypted, its ...


4

In theory, a microkernel, by putting the bulk of the driver code into userspace, is more resilient against attacks: an attack against one driver can't easily be used to leverage access to the other drivers, or gain kernel-level privileges. Additionally, the reduced size of the kernel gives it a much smaller attack surface. In practice, kernel architecture ...


4

Performance was once the biggie, but there's also the impact on low-level access and operations. A good aspect to explore might be DRM. DRM is bad (or good) because it makes it hard to access your data in ways that you desire to. Almost always, there are very good reasons that you might want to access information in a non-standard or out-of-band way that ...


4

A network scanner interrogates the target over the network: determines open ports via (semi-)exhaustive search determines software and versions, if possible, based on banners and behavior checks for known vulnerabilities (e.g., does /CFIDE/administrator exist) but it is limited by only having network access. The banner printed on port 22 will identify ...


4

"Average length of time that an announced vulnerability has widespread exploitation", T "Attractiveness of server as a target", A, on a qualitative scale of 1-5 (higher number representing more attractiveness). "Ease of exploitation", E, using the CVE score as a basis of common comparison (T/A) x E = N Considering that T is now considered to be measured ...


4

It's best to consider a Docker container to be the same as running an application on the host system. There are some attempts to lock down the Docker daemon by removing Linux Kernel capabilities, but this is not really a guarantee. If you do run Docker, there are a few things you can do to help mitigate some of this risk. SELinux - Enabling this will ...


4

I complete my own answer after a more in-depth comparison between the OSes I am the more familiar with and which took quite surprisingly different directions... PID randomization was popularized by OpenBSD which added it as soon as 1997. At that time it pursued two main goals: Protect against PID prediction vulnerabilities affecting mostly software which ...


4

I just asked a similar question; mine was about how Apple will fix this though, not necessarily what the bug does that causes the phone to crash. As @LvB suggested, it seems to be a bug in the SpringBoard notification text processing, where the program infinitely reads the Unicode string into memory, taking up all the available memory. Then, the SpringBoard ...


4

For a malicious attacker who tries to alter an ISO file while keeping its hash value identical to the hash value of the "genuine" file, the problem is known as a second preimage attack. No such attack is known for SHA-1 right now; if somebody wanted to compute such a second preimage, he would have to pay a cost of about 2160 hash function computations, which ...


3

From the nmap documentation: Another cause of duplicate fingerprints is embedded devices which share a common OS. For example, a printer from one vendor and an ethernet switch from another may actually share an embedded OS from a third vendor. In many cases, subtle differences between the devices still allow them to be distinguished. But ...


3

This is almost certainly a hardware fault in the video card; it's possible (but unlikely) that it's a bug in the video driver instead. The scrambled image you're seeing is leftover data from the game, stored in the video card's memory. Since you rebooted rather than doing a cold shutdown, the data wasn't lost due to lack of power. On starting up, Linux ...


3

Realistically, the risk reduction options available will most likely not be cost effective. Especially considering those servers may be upgraded within the year. Two options that come to mind are network segmentation and application white listing. Symantec has a nice guide entitled, "Windows Server 2003 Migration: A Guide to Effectively Mitigate Risks". ...


3

Put an actual computer in a physical sandbox environment. The computer itself isn't a sandbox and don't virtualize anything. Need active directory? Put active directory in the sandbox environment. Do your tests, verify what has changed, review computer and network logs. This is more practical than building a sandboxed OS which limits normal hardware ...


2

This an artifact with the way windows does permissions: you can't act as a user without knowing the user's password because certain key bits of information are encrypted using the user's password. So this applies to no other operating systems. But the key here is that users have permissions and ownership rights, programs do not. So each application is just ...


2

To complete the answer given by Mark, the same is true for Windows systems: you can find a lot of information about the hardware on the hard drive... you just have to look in the registry files: You can even find a list of all the external drives ever mounted on the machine: Even on a data-only NTFS formatted disk, where no OS files are present, you ...


2

For Linux-based operating systems, very much so. The kernel prints out a detailed hardware summary during the startup process, which typically gets written to the system log. For example, some excerpts from my computer's log: Memory: 32877348k/34603008k available (3933k kernel code, 1126392k absent, 599268k reserved, 1997k data, 576k init) ... CPU0: ...


2

Some questions that you can answer in your essay: Who owns the data? Who should own the data? The user? The computer's owner (e.g. the user's employer)? The administrator? The operating system vendor? The hardware vendor? "Holywood"? (This ties in with @dewi-morgan's answer about DRM) Who is responsible for ensuring legitimate users can access the data? ...


2

Maybe you have another trustworthy live system CD (such as knoppix) available. You can boot your computer from that CD, mount your filesystem in the live session, download and burn from within the live session. Then you can boot off the downloaded/burnt CD.



Only top voted, non community-wiki answers of a minimum length are eligible