2

What methods can I use to protect certain important and private data like my ssh keys from other applications I might install?

Is there anyway to block access to these files and restrict the access of other applications? I am concerned about the case where the application may copy some of my data and send it back to the software author.

What protection methods and steps can I take to isolate an application or restrict its access - or is is necessary to have some type of full audit for any software I want to use since you can't just "trust" software from the Internet, even if it comes from a trusted website.


How to be sure such things not happen? If that tool does not require internet connection, then maybe block all ports for that tool with firewall? Probably configure firewall to block all ports by default.

But if that tool needs internet connection, not sure about the example now.

Or am I too paranoid and I should assume that tools are safe, unless there are some news about the tool that it was stealing data? So just do quick google search about it?

  • I consider this question as too broad. It essentially asks how to trust some software not to do malicious things on purpose but also that it cannot be misused to do malicious things by others (due to bugs). You don't know. If you don't trust the software don't use it or at least install it only inside some restricted environment where it cannot do much harm (separate machine, VM, container, jail, chroot, different user ... - there are different qualities of separation). – Steffen Ullrich Jan 13 '18 at 13:03
  • So... you found random code on the internet, don't know the author, and want to know if you can trust it? – baldPrussian Jan 13 '18 at 14:53
  • @baldPrussian - yes. Actually random tool, not the code. Tool which I can install to my system – Darius.V Jan 13 '18 at 15:26
  • You might want to mention what operating system you are using. – David Jan 13 '18 at 19:07
  • Ubuntu 16. But I actually I want to know in general. – Darius.V Jan 14 '18 at 9:34
2

Unless you have the technical ability to audit it you can't trust random code from the Internet. All you can ever have to go on is the reputation of that softwares authors amongst other users and the verification methods offered by the authors to show the binary is actually produced by them (hash, signatures, SSL certificates for transport etc).

If you do not trust either the authors or the method by which the binary found its way onto your machine then you should assume it is malicious.

As you implied there are ways to sandbox code. For example - you talk about your.ssh directory. You can run the tool under another user account that has restricted priveledges and no read access to any valid ssh keys (you should have your Web server running under a restricted user account as it is!). You can then audit any output files from the tool before using them from the production account.

How paranoid you should be depends on what is at risk. If this is a production server for an Alexa 100 site or a bank then you shouldn't even consider running code without verifying what it does first. If this is a dev test VM firewalled from your internal networking that you don't care if you have to reimage then you can be a bit less careful.

0

if you're on your OWN machine, and you have sufficient memory then the safest (Note, not 100% safe) methid would be too bring up a vm for any code that you consider untrustworthy, if you're more memory constrained then perhaps a Docker container might suit your needs, but be weary of the resent speculative execution bugs in modern CPUs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.