New answers tagged operating-systems
0
What stops someone from attacking the system outside of the operating system? Or (at the very 'worst'), simply taking a copy of the storage and reloading the image onto the original device repeatedly?
On a PC, attacking outside the operating system is dead easy when you have physical access. All you need to do is boot from a CD or USB drive. If the BIOS ...
1
I agree with the answer that suggested the overall design of determining what is, and is not, a good system call may be difficult. Indeed, in isolation, a single system call might not be enough information.
In terms of the way Windows works, there are actually two levels of operation:
NT-level calls. These are the typical system calls you'd expect via ...
1
I just found Featherweight Virtual Machine, which is an open source sandbox implementation for windows:
http://static.usenix.org/events/vee06/full_papers/p24-yu.pdf
http://sourceforge.net/projects/fvm-rni/
Also interesting is Dune:
http://dune.scs.stanford.edu/
It implements a proof-of-concept sandbox like I described under linux using VT-x (which ...
1
Your plan is based on the flawed assumption that you can identify "bad" behavior by some kind of screening of system calls. You can't. Windows is replete with bugs, hidden features, and unexposed dependencies. As soon as you pass control to some other piece of code you didn't provide, you have absolutely no guarantee that it will do only things you ...
4
Another good one is http://exploit-exercises.com/
"exploit-exercises.com provides a variety of virtual machines, documentation and challenges that can be used to learn about a variety of computer security issues such as privilege escalation, vulnerability analysis, exploit development, debugging, reverse engineering, and general cyber security issues. "
2
Have you thought about setting up honeypots on your network as well? They are pretty good at being able to configure ect.
http://en.wikipedia.org/wiki/Honeypot_(computing)
I have also used a few programs for VMs.
Virtual box is one of the most common free ones (windows box).
Proxmox is really common freeware that provides a lot of flexibility with ...
7
So if I was you I would start relatively simply with some VMs and a host machine.
Personally I use VMWare workstation but other virtualization products are possibilities.
If you've got a decent enough machine (e.g. 8GB RAM, Quad-Core Sandy/Ivy bridge, fast disks), I'd recommend keeping the Host OS clear of lab tools or target Apps, as re-building VMs is an ...
1
The security of a pattern lock is going to depend greatly on a) how it is implemented and b) how long and what path the user chooses. The interesting metric you are looking for to know how secure something is is a concept called entropy or randomness.
If entropy is maximized, then each choice should be unrelated to prior choices and the difficulty of ...
1
Kos demonstrated a P2P attack on Android at Derbycon last year that only takes seconds. PDF Warning: http://kyleosborn.com/android/AndroidPhySec.pdf Here is a video of the demonstration from Hak5 http://hak5.org/episodes/hak5-1205 (Kos starts at 6:55).
A lot of time with the pattern lock, there are ways you can just look at it and see what the pattern is ...
1
Some mobile devices provide on device encryption to protect them, tied to the passcode/password that the user enters. When tied to a device wipe after a certain (small) number of incorrect attempts, they can provide an effective mechanism to protect the data held on the device in a "lost/stolen device" scenario.
To take iOS devices as an example, you can't ...
2
You are missing the point of the lockscreens of the various mobile operating systems.
They are not an effective deterrent for attackers who has stolen your phone and has an unlimited period of time to attack it. However, they are effective in deterring chance attackers who happens to walk by and only has a short period of access to your phone.
12
I'd suggest in additiona to HamZa DzCyberDeV's answer:
Pentester Labs exercises which are full VMs as well as full detailed walkthroughs etc. These are great for all skill levels and i've found them most useful.
23
There is quite a lot of them:
Metasploitable: Currently there are 2 versions.
Kioptrix: Currently 4 challenges.
Hackademic: Apparently 2 VM, check 1 and 2.
pWnOS: Currently 2 challenges.
Standalone which you can install directly without VM, this is to hone your Webattack-Fu:
OWASP WebGoat
Damn Vulnerable Web Application
Mutillidae
1
Make it require a password when the screensaver comes on. Make the screensaver come on after 5 minutes. I've also used a small utility (BtProx) which uses bluetooth to determine if you're close. When you walk away with your phone it locks the computer. You can also use something like LemonScan which uses your webcam to determine if you're using your computer ...
1
Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I step away for a minute while my browser is open, ...
As I previously implied on another post quoting this comic, the problem is that fundamentally, if you leave your screen unlocked the OS has no way to tell that the person typing and ...
Top 50 recent answers are included
