Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
2,073
questions
0
votes
0
answers
15
views
Binwalk IMOU Firmware Dump
I have recently acquired a firmware dump of an IMOU Cue IP camera.
When I ran binwalk -eM on it I got the following output, however, It failed to extract any files:
Scan Time: 2023-02-04 19:37:14
...
- 1
1
vote
0
answers
35
views
How can I sandbox wine itself, and all wine applications?
I don't want wine accessing my ext4 partition which is typically the Z: drive. How can I restrict or sandbox wine?
- 11
0
votes
0
answers
60
views
Password gets cached by keyboard? [closed]
I noticed something very strange today: one of my passwords is being saved by the keyboard (or programmable G-keys on the keyboard).
Explanation of my system:
Dual-Boot-Setup with Windows 10 (always ...
1
vote
0
answers
36
views
Using the readlink function to avoid symbolic link race conditions when opening a file path [migrated]
I'm reading this paper. On the page 11 the paper says:
Unix applications can obtain access to files without encountering symlink races. This is important for normal application programmers who, for ...
- 11
0
votes
0
answers
17
views
Security and practicality of passing secrets to services running as non-privileged user
I strongly dislike and mistrust the practice to store secrets in plain text files for unattended access by services.
This is increasingly less of an issue in modern deployments where secrets are ...
- 113
0
votes
1
answer
81
views
Vulnerability in the source code, but can't elevate do Privilege Escalation
Playing a CTF, I am trying to gain access to level 3 (you have to gain access sequentially from level 1 to level 2 and so on...), and in the level 2 directory there's this source code 2.c and along ...
- 11
1
vote
0
answers
27
views
Evil twin WiFi station has no internet connection [migrated]
I am trying to create a fake AP using the airbase-ng to test how evil twin works.
I have a WiFi adapter TP-link WN4226 [Atheros AR9271 chipset], which supports monitor mode. My laptop (running on ...
- 111
0
votes
0
answers
7
views
What linux distro allows full encryption when dual booting from windows 11 [migrated]
I want to install a distro to work with windows when I dual boot.
I know that lubuntu allows full disk encryption, but it doesnt encrypt /boot. I am also aware to this ubuntu guide:
https://help....
1
vote
1
answer
58
views
user namespaces: do they increase security, or introduce new attack surface?
user namespaces in Linux are presented as a security feature, which should increase security. But is this really true?
Is it possible that while user namespaces fix one kind of problem, they introduce ...
- 223
0
votes
0
answers
51
views
How to generate PFX file for Wild Card SSL Certificate using Openssl Command in Linux
I want to generate PFX file for my Wild Card SSL Certificate. I am using below mentioned command to generate the same however getting error message:
openssl pkcs12 -export -out ./star_domain_com.pfx -...
- 1
0
votes
0
answers
31
views
Why doesn't this reverse shell work?
If I have the following php code:
$output = exec("/usr/bin/python /opt/scripts/log_process.py {$_POST['delim']}");
why does this code work when injecting with burpsuite:
delim=comma;bash -c ...
- 101
0
votes
3
answers
113
views
What is the most secure way to transfer untrusted data between containers?
Let's suppose we have two containers running on a linux box and one has untrusted user data that the other needs to process. What is the most secure way to transfer this data? Is it better to write ...
1
vote
0
answers
25
views
TPM FAPI sealing data inside /dev
I am using TPM simulator in my local VM to test FAPI API and able to seal the important data inside directory ~/.local/share/tpm2-tss/user/keystore as per the path mentioned in config file /etc/fapi-...
- 151
2
votes
2
answers
141
views
What can a virus hidden in a video do and will the video be playable?
Based on existing answers, I found out that viruses can "hide" in a video by exploiting the software/libraries used to open the video, say ffmpeg. But my question is:
If a video contains ...
0
votes
1
answer
169
views
Format a probably infected USB, is it safest Ubuntu live or Ubuntu installed?
I have an USB drive that probably is infected. I have a PC where currently I have not any partition, just an "empty" PC and I have a CD with Ubuntu 22.04. I would like to copy USB data, ...
0
votes
0
answers
18
views
Can I know kernel address layout and memory mapped IO layout from the user privilege in linux kernel?
My current understanding is that the user does not have any way of knowing the kernel address space layout due to the protection mechanisms such as Kernel Address Space Layout Randomization (KASLR).
...
- 1
6
votes
4
answers
743
views
How can non-root intercept privileged loopback ports?
Please walk through how an attacker can intercept Chrome's connection to 127.0.0.1:999, as suggested by the warning below.
This warning is consitently displayed across many versions of Chrome in many ...
- 389
4
votes
0
answers
136
views
Secure boot + full disk encryption, should I sign the kernel?
I'm redoing my laptop installation from scratch, and this time I want a full secure boot chain.
Here's what I did so far :
Enroll my own keys in the UEFI firmware
Sign my grub bootloader
Full disk ...
- 140
1
vote
3
answers
40
views
Authenticating a request from a valid application (unshadowed)
I am working on an application which has an architectural description as below,
There is a docker container, lets say Microservice-A, in which multiple processes are running. Each process is ...
- 11
13
votes
3
answers
5k
views
How do we know that our SSL certificates are to be trusted?
On Linux, the /etc/ssl/certs folder includes all the necessary public keys for Certificate Authorities. If I have not misunderstood something, this makes it possible to verify public keys received ...
- 185
1
vote
3
answers
85
views
Understanding FDE: Is the encrypted Linux protected against a compromised boot volume?
I use this initramfs-based FDE on my headless server. My motivation is to secure my system against physical tampering.
I am aware that securing an untrusted hardware is not possible. This question is ...
- 113
2
votes
1
answer
72
views
FTPS with IP restriction OR SFT over SSH without IP restriction - which one is more secure?
Im able to connect to my managed Linux Ubuntu Server only through
FTP using explicit SSL (Auth TLS) with IP restriction
and
SFT over SSH without IP restriction
Question: which method is more secure to ...
- 23
3
votes
1
answer
167
views
Docker Apache - safe to chown /usr/local/apache2 to non-root user?
I would like to run the official Docker Apache image as a non-root user. To make it work, it seems like it is necessary to chown the /usr/local/apache2 directory (see this and this):
chown -hR appuser:...
- 153
0
votes
2
answers
148
views
How to backdoor windows?
Studing pentest, I was astonished by how easy it was to backdoor a Linux machine after I got root. I just needed to compile a program like this:
#define _GNU_SOURCE
#include <stdlib.h>
#include &...
- 11
0
votes
3
answers
155
views
What can an attacker do with physical access to a Linux server?
I have physical access to a Linux computer (Ubuntu 20.04). My colleague asked me what an attacker could do if he had physical access to this computer?
I would like to know if, by default (after a ...
2
votes
1
answer
179
views
Store/Secure openssl cert and key file in TPM2.0
I have my TPM2.0 connected to my raspberry pi. I generated a Cert file and Private key using openssl. These files are used to connect MQTT with TLS. How do I store/secure these files in/with the TPM ...
- 23
0
votes
0
answers
97
views
Restrict node.js filesystem access
I have a Node.js app which has a lot of npm-dependencies, running on Linux (Centos) machine.
When Node starts, the script has access to the files outside its directory (as least by default), so ...
- 289
1
vote
0
answers
84
views
Buffer overflow on a program that only accepts arguments as input
I've got a pretty tricky flag that I have been beating my head against for a while now and would love an explanation for how something like this would be possible. I have a program that when run, ...
- 11
0
votes
0
answers
32
views
fscrypt master key handling at kernel space adding additional secure params
In fscrypt, the master key is generated from userspace and actual encryption keys are derived from this master key using KDF.
If any other process is able to get hold of the master key, they can ...
1
vote
0
answers
17
views
Can you configure Tripwire to produce an actual diff between modified files
I'm using the open source version of Tripwire on Ubuntu 22.04. Right now when a file is modified Tripwire will document this in the integrity check with an "Expected" vs "Observed" ...
- 11
0
votes
2
answers
117
views
My Linux Mint just accessed a wifi network WPA2 without knowing the password [closed]
I brought my personal notebook to work. Asked the IT technician to access the WiFi on it (it's a federal institution of health research, lots of biological risks involved). Then he noticed that the ...
12
votes
3
answers
6k
views
Understanding suspicious HTTP GET Request
I was looking through my Apache log files and besides other GET requests with response status codes of 4XX (error), I've found this one which has a 200 (success) response status code:
"GET /?...
- 153
2
votes
2
answers
653
views
Is it safe to install curl and openssl in Alpine Docker image
I want to install curl and openssl packages in a Docker image based on Alpine Linux that I use in production. These packages will help me with debugging SSL certificates and HTTPS connections in my ...
0
votes
1
answer
46
views
Dismissing 500 errors in logwatch
Logwatch shows those attacks giving a 500. Given that 500 is an internal server error, does that mean I need to examine further or dismiss?
421 (undefined)
/: 4 Time(s)
500 Internal Server Error
...
- 182
0
votes
0
answers
27
views
Using your own server as a proxy without having set it up as a proxy
In logwatch I got
Connection attempts using mod_proxy:
146.66.178.78 -> mkzaim.ru:443: 1 Time(s)
90.151.171.106 -> host64.ru:443: 1 Time(s)
Can this mean that they used my server as a ...
- 182
1
vote
1
answer
27
views
Does i need vpn to update/upgrade packages on fedora or debian if https is configured in sources file
Does i need vpn to update/upgrade packages on fedora or debian if https is configured in sources file ?
Can packages be replaced by malicious ones through wifi attacks like fraggattacks ?
- 13
0
votes
2
answers
117
views
Is a Linux live CD safe? Password is known
For the Mint Linux live CD the login is "mint" and the password is blank (there is no password, when asked, simply press Enter). It appears that the live CD is in root or superuser mode by ...
0
votes
0
answers
111
views
Which of these filesystem encryption philosophies and methodologies are better for which purpose?
Currently on the "FLOSS market" there are multiple options for encrypting remote cloud storage following different security models and different philosophies. To name a few:
encfs (I guess ...
- 1,523
1
vote
2
answers
101
views
Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C
I wrote a NASM program that uses the execve system call to run wget inside a newly spawned shell and execute the retrieved page:
[bits 64]
global _start
section .text
_start:
xor rcx, rcx
...
- 992
2
votes
1
answer
485
views
Explanation of capabilities: CAP_NET_BIND_SERVICE
I am still studying kernel credential management (https://kernel.org/doc/html/v5.9/security/credentials.html) and I have encountered a use case I cannot explain.
I am in a VM (Kali).
❯ uname -a
...
- 165
1
vote
0
answers
40
views
Is "pam_ssh_agent_auth" more secure than passwords for sudo on a remote server?
I read about "pam_ssh_agent_auth" in combination with sudo, which can use a ssh agent to authenticate instead of using the users password: https://manpages.ubuntu.com/manpages/jammy/en/man8/...
- 101
0
votes
0
answers
35
views
Making time(0) produce an error
I'm currently reviewing/reversing a software (coded in C) and it has a line like this :
time_t var = time(0);
My goal it to get this time(0) call to return -1.
(I cannot modify the parameter.)
...
- 1
1
vote
1
answer
98
views
Do I have to block IPv4-mapped IP addresses in my IPv6 firewall?
I am writing the iplock tool to help me setup my Linux firewall. For the most part, my current strategy, since I don't yet use IPv6 much, is to pretty block everything IPv6 ("simple").
I ...
- 902
0
votes
1
answer
80
views
How do you trust two different cloud provider servers?
I've found a question with an answer here on Security StackExchange or on Unix StackExchange, but I can't find it anymore apparently :( If you find this answer already, help would be appreciated, I ...
- 1,523
0
votes
1
answer
99
views
Is it sufficient to put /var, /tmp/, and /home on their own encrypted partitions?
I want to encrypt my system, but I don't want the hassle of having to put in two passwords on boot; I just want to put in one password on login that would decrypt the other partitions. I have heard ...
- 123
-1
votes
1
answer
63
views
Confused about memory examination using gdb
I started reading "Hacking, The Art of Exploitation" and I am confused about some things regarding memory examination.
When I disassemble main, I get an output of all memories where the ...
- 1
1
vote
1
answer
54
views
Purpose of Real UID in spite of setresuid()
While reading the manual page of setresuid() a question arose about the purpose of Real UID.
As mentioned in the man page:
setresuid() sets the real user ID, the effective user ID, and the saved set-...
- 13
1
vote
1
answer
46
views
Details: snoop environment variables using D-Bus IPC
The page at: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment says:
Environment variables set for a unit are exposed to unprivileged clients via D-Bus IPC [...]
I don't ...
- 11
0
votes
1
answer
45
views
Connection problems with common name as domain
I was exploring SAN certs and was able to connect to the machine with domains specified in the SAN fields during CSR creation. But I was unable to connect to the machine with the common name specified ...
- 1
0
votes
1
answer
48
views
Honeyd not responding to TCP
I'm having some issues getting Honeyd to work properly on an external network interface on Ubuntu 20 LTS running on a Proxmox server. I'm fairly sure it's a configuration/setup problem on the VM I'm ...
- 1