Tag Info

Hot answers tagged

19

At the moment there is no way to easily work out whether to trust specific docker containers. There are base containers provided by Docker and OS providers which they call "trusted" but the software lacks good mechanisms as yet (e.g. digital signing) to check that images haven't been tampered with. For clarification to quote the recently released CIS ...


17

Yes, it can be done as (theoretically) every "computing device" is computationally equivalent to every other computing device. Look up the Church-Turing thesis if you are interested. However your question is grounded in practice and in this case the answer is "yes, but it would cost too much". Effort in virtualisation today aims at speeding up the virtual ...


8

Actually, you cannot. Even without speaking of an actual compromise, from a security perspective you may assume that your application already contains bugs which can be at least be as effective than a software compromise. That's why, when building a secure system, your security must not rely on a single tool. Instead, you must use a layered security ...


8

Actually lorenzo's answer does not quite cut it. The Church-Turing thesis only provides us with a model of computing, it can't tell us anything about virtualization because it is not concerned with other aspects of a machine. But there is theoretical analysis for the ability of a machine to be virtualized by Popek et al: ...


7

A sandbox is like a special "section" of your computer that has been blocked off from accessing the rest of your computer. In a perfect sandbox you can do anything you want within it, but it will not effect the rest of your computer. This is used as a form of security, keeping any malware you might download from being able to affect the rest of your ...


7

There are several major impacts, not all of them relevant to all users. Performance (based on throughput, i.e. MB/s - the more data you're moving in a given timeframe, the more encryption has to happen in that timeframe - when the encryption can no longer keep up, your data moves more slowly); if you use symmetric AES encryption with software that uses ...


7

One of the articles you link to -- If the NSA has been hacking everything, how has nobody seen them coming? -- makes an assumption in posing the question: "If the NSA was owning everything in sight (and by all accounts they have) then how is it that nobody ever spotted them?" The premise for this question is incorrect, because for all we have found out ...


7

Trust it as much as any unsigned code that you run on your systems. Containers are just processes with some extra namespace protections on them, so that's all the protections they get. They still talk to the same kernel underneath.


6

A list of the various tests used are provided in the mmap documentation at http://nmap.org/book/osdetect-methods.html#osdetect-probes-seq. For more specific details you'll have to read the source code. Essentially various different probe packets are sent and the results analysed. Slight differences between TCP/IP software mean there are sometimes slight ...


5

Heuristically. nmap observes the behaviour of the system during probes, develops a "fingerprint", which analagous to a real fingerprint test, looks mainly for the minutiae: out of specification behaviour and extra-specification or undefined behaviour retransmission times response to fragmentation and various ICMP probes patterns in TCP sequence numbers, IP ...


5

In essence, I argue it is the same question as whether open source software is trustworthy. But I think the risk of using community Docker containers is somewhat higher at present than the risks of using open source software. First, as you mentioned, there is no signing and verification now. Good open source packaging systems today include this, at least ...


4

You are correct about performance. With symmetric key encryption, the performance hit should be very small. The other effect is to render useless some operating system features. The one that comes immediately to mind for encrypted files (not full-disk encryption) is the content indexing and searching feature of Windows. If a file is encrypted, its ...


4

Performance was once the biggie, but there's also the impact on low-level access and operations. A good aspect to explore might be DRM. DRM is bad (or good) because it makes it hard to access your data in ways that you desire to. Almost always, there are very good reasons that you might want to access information in a non-standard or out-of-band way that ...


4

In theory, a microkernel, by putting the bulk of the driver code into userspace, is more resilient against attacks: an attack against one driver can't easily be used to leverage access to the other drivers, or gain kernel-level privileges. Additionally, the reduced size of the kernel gives it a much smaller attack surface. In practice, kernel architecture ...


4

A network scanner interrogates the target over the network: determines open ports via (semi-)exhaustive search determines software and versions, if possible, based on banners and behavior checks for known vulnerabilities (e.g., does /CFIDE/administrator exist) but it is limited by only having network access. The banner printed on port 22 will identify ...


4

"Average length of time that an announced vulnerability has widespread exploitation", T "Attractiveness of server as a target", A, on a qualitative scale of 1-5 (higher number representing more attractiveness). "Ease of exploitation", E, using the CVE score as a basis of common comparison (T/A) x E = N Considering that T is now considered to be measured ...


4

It's best to consider a Docker container to be the same as running an application on the host system. There are some attempts to lock down the Docker daemon by removing Linux Kernel capabilities, but this is not really a guarantee. If you do run Docker, there are a few things you can do to help mitigate some of this risk. SELinux - Enabling this will ...


4

I complete my own answer after a more in-depth comparison between the OSes I am the more familiar with and which took quite surprisingly different directions... PID randomization was popularized by OpenBSD which added it as soon as 1997. At that time it pursued two main goals: Protect against PID prediction vulnerabilities affecting mostly software which ...


4

I just asked a similar question; mine was about how Apple will fix this though, not necessarily what the bug does that causes the phone to crash. As @LvB suggested, it seems to be a bug in the SpringBoard notification text processing, where the program infinitely reads the Unicode string into memory, taking up all the available memory. Then, the SpringBoard ...


3

This is almost certainly a hardware fault in the video card; it's possible (but unlikely) that it's a bug in the video driver instead. The scrambled image you're seeing is leftover data from the game, stored in the video card's memory. Since you rebooted rather than doing a cold shutdown, the data wasn't lost due to lack of power. On starting up, Linux ...


3

I think you can safely live normally ;) The user in this forum propably just took a guess on your UserAgent. This is neither considered hacking nor does it do any damage on your pc. There is even a Website telling you what OS you use, only by visiting it. There are also more informations about how this is working.


3

The most common? Probably HKLM\Software\Microsoft\Windows\CurrentVersion\Run -- it's how programs arrange to be run at startup. Of course, a lot of perfectly harmless programs also use it, so watching it won't gain you much. The problem with simply watching registry keys for modification is that normal programs also change many of them. You can't, for ...


3

From the nmap documentation: Another cause of duplicate fingerprints is embedded devices which share a common OS. For example, a printer from one vendor and an ethernet switch from another may actually share an embedded OS from a third vendor. In many cases, subtle differences between the devices still allow them to be distinguished. But ...


3

Realistically, the risk reduction options available will most likely not be cost effective. Especially considering those servers may be upgraded within the year. Two options that come to mind are network segmentation and application white listing. Symantec has a nice guide entitled, "Windows Server 2003 Migration: A Guide to Effectively Mitigate Risks". ...


3

Put an actual computer in a physical sandbox environment. The computer itself isn't a sandbox and don't virtualize anything. Need active directory? Put active directory in the sandbox environment. Do your tests, verify what has changed, review computer and network logs. This is more practical than building a sandboxed OS which limits normal hardware ...


2

Probably the best protection for physical access is full disk encryption and a smartcard that stays on your keychain. I mean this is assuming you're colleagues aren't a bunch of professional hackers. I doubt the NSA is interested in your computer. Also, don't put personal files on your computer. Just don't. Assume that everything on your work computer is ...


2

The page lists the affected systems and your windows 7 32bit is not included: Affected Avaya DefinityOne Media Servers Avaya IP600 Media Servers Avaya S3400 Message Application Server Avaya S8100 Media Servers Microsoft Windows 2000 Advanced Server SP1, SP2, SP3, SP4 Microsoft Windows 2000 Datacenter Server SP1, SP2, SP3, SP4 Microsoft Windows 2000 ...


2

This an artifact with the way windows does permissions: you can't act as a user without knowing the user's password because certain key bits of information are encrypted using the user's password. So this applies to no other operating systems. But the key here is that users have permissions and ownership rights, programs do not. So each application is just ...


2

This is a fundamental problem with using a system you don't control. You don't control it and cannot force it to behave. You hinted at one solution in your question. Send a single request to multiple remote systems and compare the results. If they are different, one of them is wrong. It doesn't matter if it's compromised or buggy. As long as you have ...



Only top voted, non community-wiki answers of a minimum length are eligible