Tag Info

Hot answers tagged

25

Yes, this is very possible. In fact, support for this is built into the most popular port scanning tool in use, nmap. This feature, OS detection, can be activated by passing the -O flag to the nmap tool. What nmap does is send different TCP and UDP packets to the target and examine the response. By comparing the response to a database of existing operating ...


15

Yes, most exploits are platform dependent. There are details. For instance, if an attacker targets Internet Explorer, then he targets Windows systems. Most Windows systems run on x86. Moreover, on Windows up to 7, the default IE is the 32-bit version, even if the OS is a 64-bit Windows. Also, at the assembly level, XP, Vista and 7 are very similar (indeed, ...


12

I would go for Kali Linux . This Linux distribution is made for pentesting and security analysis. It contains a great many analysis tools, right in your main menu. In general, I would use an Open Source OS for security-related work, because with Open Source there is public scrutiny that your tools themselves are not compromised.


11

Google Chrome OS is a Linux-based operating system on which Chrome is the browser and focuses on the use of the online applications that belong to Google (Google Drive, Youtube ...). It is the direct competetor with Windows OS of Microsoft. Centos OS is also a Linux-based operating system but unlike Chrome OS which runs on mobiles, Centos OS is widely ...


6

The SANS sift kit/workstation (http://digital-forensics.sans.org/community/downloads) is very good if you're looking to learn about forensics, as it comprises things like autopsy and other open source tools which are commonly used. Little extra: http://www.forensicswiki.org/wiki/Main_Page this page helps A LOT when you're getting used to things.


6

My first two cents: What is the actual problem here? Attackers knowing you are running a vulnerable operating system or you not upgrading it? Now in regards to your question. There are a number of utilities which can be used to fingerprint an operating system. There are several JavaScript libraries which allow you to get information about a person's ...


6

A list of the various tests used are provided in the mmap documentation at http://nmap.org/book/osdetect-methods.html#osdetect-probes-seq. For more specific details you'll have to read the source code. Essentially various different probe packets are sent and the results analysed. Slight differences between TCP/IP software mean there are sometimes slight ...


5

In your specific case, there's a different answer: never carry sensitive data through a border. Border agents almost always have enormously wide legal powers to search devices on their own, and are very happy to utilise them when asked to by intelligence agencies. In fact, if you expect to be subject to a targeted attack by an intelligence agency, I ...


5

A sandbox is like a special "section" of your computer that has been blocked off from accessing the rest of your computer. In a perfect sandbox you can do anything you want within it, but it will not effect the rest of your computer. This is used as a form of security, keeping any malware you might download from being able to affect the rest of your ...


5

Heuristically. nmap observes the behaviour of the system during probes, develops a "fingerprint", which analagous to a real fingerprint test, looks mainly for the minutiae: out of specification behaviour and extra-specification or undefined behaviour retransmission times response to fragmentation and various ICMP probes patterns in TCP sequence numbers, IP ...


4

TL;DR: Yes, it is possible for an attacker to fingerprint your system and yes it will help him to attack your system. So you should correctly protect your system (an antivirus is not enough). How does fingerprint work ? There are different kinds of fingerprint, mainly fingerprint at network level and application level. At network level Operating systems ...


4

The short answer is that yes attackers can usually detect your operating system in standard configurations. Usually this would come while your browsing, and the browser will provide that information to systems that you contact in the User-Agent String (N.B. with some browsers and plugins this can be changed to anything you like). Also as @terrychia notes, ...


4

Yes, it's possible to trust companies. You do it all the time. If you use Windows, you're trusting Microsoft very heavily. Same goes for Apple if you use any of their products. When you use HTTPS you're trusting a whole raft of Certificate Authorities, most of whom you've never heard of before. Most of the companies that you're forced to trust when you use ...


4

You have a non-question right here. Let's look at your second and third assumptions. Rebuilding a machine has negligible cost with zero downtime. The logical conclusion in this ideal world is rebuilding after any instruction is executed. After all, it has zero cost. Then you say, Ideally a way that avoids 'unnecessarily' excessive recycling which ...


4

Are exploits platform dependent? Yes. As in, does that mean that the IE vulnerability needs to be developed IN ASSEMBLY once for each OS( XP, Vista, 7, 8 ), doubled based on 32/64 bit, then doubled again based on byte order? No. The use of assembly doesn't make it more platform dependent. It's only just as platform dependent as it would be if ...


4

There are a wide range of ways to trick OS identification functions, and they work to varying degrees, depending on how much functionality is built into the tool. For example, nmap doesn't just use one identification mechanism, but a few which feed in to it's confidence %age announced in it's OS identification. Nmap sends a series of TCP and UDP ...


4

In theory, a microkernel, by putting the bulk of the driver code into userspace, is more resilient against attacks: an attack against one driver can't easily be used to leverage access to the other drivers, or gain kernel-level privileges. Additionally, the reduced size of the kernel gives it a much smaller attack surface. In practice, kernel architecture ...


3

Bruce Schneier in his article linked to register site. In the article, the author talks about a virtual scenario where you want to ensure trust in all parts of the processes. By showing the true, but ridiculous things you would have to do for controlling things from start to end. To quote a relevant extract: The truly paranoid would worry about ...


3

Get a trusted computer, download the ISO on there and use that as installation disk.


3

Exploits are platform dependent as each platform may have a different way of handling the memory layout and process execution. For example, executing an exploit on WinXP will be relatively easier rather than on other recent versions of Windows. Talking particularly about the IE exploits, it has got more to do with finding vulnerability in some of the ...


3

The most common? Probably HKLM\Software\Microsoft\Windows\CurrentVersion\Run -- it's how programs arrange to be run at startup. Of course, a lot of perfectly harmless programs also use it, so watching it won't gain you much. The problem with simply watching registry keys for modification is that normal programs also change many of them. You can't, for ...


3

I think you can safely live normally ;) The user in this forum propably just took a guess on your UserAgent. This is neither considered hacking nor does it do any damage on your pc. There is even a Website telling you what OS you use, only by visiting it. There are also more informations about how this is working.


3

This is almost certainly a hardware fault in the video card; it's possible (but unlikely) that it's a bug in the video driver instead. The scrambled image you're seeing is leftover data from the game, stored in the video card's memory. Since you rebooted rather than doing a cold shutdown, the data wasn't lost due to lack of power. On starting up, Linux ...


2

Your question spreads out into broader IT operations and virtualisation, which is not really within the scope of this site (you might want to ask those questions at Serverfault). As for the Kali/Security Onion questions. Kali is primarily an offensive security distribution for Penetration Testing and research and Security Onion is a defensive distribution ...


2

Talks in the InfoSec community about the BlackPhone by Silent Circle. These people are in the business for security and privacy. It is yet to be released. You can also have a TOR relay setup by a raspberry pi and have a TOR browserclient on your phone to access the TOR relay, although I would not know how feasible it is in your scenario.


2

Someone implemented just the thing (which is kind-of opposite to what I need...) http://www.arthy.org/wocfs/ WOCFS is a write only crypto-locked FUSE based filesystem. You can write into the FUSE mount, but the files so written there can't be read from without a separate tool. Someone with sufficient privileges can delete or move the files, but without ...


2

The problem with an intentional security hole is that it looks exactly like an unintentional one. A well done attack shouldn't be detectable as anything more than a coincidental error. It is really a your guess is as good as anyone else's type scenario. Best practice if you need a high level of security is to firewall your system to prevent external ...


2

There's also a Nessus Plugin for that. You can find more details here. By the way, this technique is called OS Fingerprinting. You can find more details about it on this Wikipedia Page of course and in this SANS paper.


2

With this kind of configuration, there will always be a level of risk as they have shared resources which could be compromised. Probably the main area of concern would be the BIOS of the machine which could, theoretically, have malware installed which would be active when the "secure" OS was booted. Two approaches that spring to mind to minimize the risk. ...


2

If a machine is hijack by an hostile entity, then the attacker can gain full access to the hardware -- including every drive which is currently plugged in the machine. If the Linux drives are encrypted with a key that the Windows system never sees (which means that if you want to copy files from the Linux to the Windows, you have to do it from Linux, not ...



Only top voted, non community-wiki answers of a minimum length are eligible