Questions tagged [linux]

Securing Linux systems and applications; understanding Linux security features.

198 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
0answers
273 views

Authentication using SysRq

The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should ...
5
votes
0answers
404 views

How did ntpd get patched to prevent NTP time synchronization attacks?

I recently tested the NTP Time Synchronization Attack as described and demonstrated by Jose Selvi in 2015. Basically, the attack was mostly used to send the victim's clock in the future, so the ...
5
votes
0answers
329 views

How to securely delete a file after it was insecurely deleted (in linux)

How can I securely delete/shred a file after I accidentally deleted the file insecurely? Let's say I have Debian Linux installed on a laptop with a 1000T spinning hard disk (so putting aside wear ...
5
votes
0answers
2k views

What is the general approach to create FIPS compliant SSH?

Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant. From what I've discussed with ...
5
votes
1answer
7k views

Error Running command shell :TimeoutError Operation Time out

I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
4
votes
0answers
712 views

Practicing with return-2-libc exploits

I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/ I made ...
4
votes
0answers
166 views

Address of environment variable different for each directory

I'm writing a return-to-libc attack for a school project. My script retrieves the system(), exit() and shell addresses as follows (it's a sh script that calls some c programs): Create the environment ...
4
votes
1answer
3k views

Linux antivirus and files bigger than 4GB

I wish to scan files that are bigger than 4GB, such as video files. I noticed many antivirus programs are limited to a maximum of 4GB (ClamAV for example). So: Is there an antivirus software that ...
3
votes
0answers
239 views

Using a TPM as a hardware authentication device

My company is currently developing a product which consists of a fairly generic PC hardware platform and a software stack (the software stack is based on a Debian Buster Linux OS + some applications ...
3
votes
0answers
90 views

Do BSD jails protect against some vulnerability class that LXC doesn't?

You can find many claims online regarding BSD jails being "better" in some way than Linux namespaces for containment, but they typically lack technical details. From what I understand, the attack ...
3
votes
0answers
154 views

What are the Linux hibernation feature threats?

The pre-built hardened linux kernel proposed by ArchLinux has disabled hibernation. The maintainer of the package commented on this choice: […] having this enabled allows replacement of the running ...
3
votes
1answer
443 views

Help with Format String Exploit

I am working on a 32-bit binary which reads an input from the user and uses that input as a format string for printf. I need to overwrite a specific address with a single byte. The issue is that I ...
3
votes
0answers
144 views

Identifying kernel pointer infoleaks via static analysis

Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
3
votes
0answers
234 views

Experimenting with SSLStrip+ on the same machine

I am trying to play around to understand how SSLStrip+ works by: $ cat /proc/sys/net/ipv4/ip_forward 1 $ sudo iptables --flush $ sudo iptables --flush -t nat $ sudo iptables -t nat -A PREROUTING -p ...
3
votes
0answers
269 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
3
votes
2answers
514 views

Malware techiques via Linux Chrome and its effects, non-root

Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
3
votes
0answers
204 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
3
votes
0answers
87 views

How do I obtain linux user authentication information securely?

For security purposes the application needs to know, securely who is logged in and what groups they are authorised for. This must be done securely so that a user application cannot perform a man in ...
3
votes
0answers
416 views

Why isn't rng-tools installed by default on all OS?

Many Linux distributions use the package rng-tools, but why isn't it always installed by default? It would increase entropy (/proc/sys/kernel/random/entropy_avail) greatly! Is there any security ...
3
votes
0answers
116 views

Can I detect unique identifiers from random radio chatter?

I am trying to find out if I can uniquely identify smartphones (I would like to find constant identifiers such as IMEI) by passively sniffing the cellular data frequencies. I know that sensitive data ...
3
votes
4answers
173 views

Real value of MAC models in Linux

I have read about MAC vs. DAC in the Internet, but I still fail to understand, what kind of attack it is impossible to protect against if one only uses DAC+capabilities in comparison to MAC+DAC+...
2
votes
0answers
83 views

How to prevent grub.cfg from breaking the chain of trust?

First some definitions and common understanding. The premise of secure boot is that each binary get's verified before it is loaded. This starts with the firmware in ROM verifying the EFI application. ...
2
votes
0answers
245 views

How to harden portable Tor Browser installation (SELinux, sandbox)?

tldr How can I define a SELinux policy, that limits filesystem access of portable Tor Browser to its installation directory, say /home/user/.local/opt/tor-browser_en-US? How might Tor Browser be ...
2
votes
1answer
196 views

How to verify a x509 certificate from Apple on a Ubuntu server?

I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this. Steps 3 and 4 of that API say: Use the publicKeyURL ...
2
votes
0answers
99 views

Log/Detect Clipboard access

With the public beta access to iOS 14 people got a warning when apps access the clipboard, and it lead to people realizing that many apps just grab everything from the clipboard they can get and send ...
2
votes
1answer
150 views

reading a file with other read permissions set

For this question assume a file with 604 perms in a directory with 700 permissions. Assume this file exists: /test/file A non-root user can techincally read that file but in practice to read it the ...
2
votes
0answers
101 views

Can binary firmware packages be executed on the system?

Kernels like linux-libre (standard in Debian and other free Linux distributions) ship no binary firmware packages by default. From my limited understanding of their functionality, a binary firmware ...
2
votes
0answers
114 views

Can I skip any password hashing for localhost authentication?

Setup I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system. everyone is on the same host they use the loopback interface (127.0.0.1) to ...
2
votes
2answers
256 views

Fetching GPG private key from Linux server to decrypt files on a Win 10 computer in production

I have a need to fetch automatically the GPG private key from a Linux server to decrypt files on a Windows 10 computer in production. There are a few challenges here: How to assure SCP from the ...
2
votes
0answers
305 views

Retrieving a flag from vim commands by reading through strace output [CTF]

So, to clarify, I'm currently working on a CTF challenge that consists of running an strace over on a bash script that is running vim commands using commands like vim -c ":!cat flag.txt" inside of a ...
2
votes
1answer
187 views

Sanitising a file/folder path from user input

I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush. The scp command below executed on the backup ...
2
votes
0answers
118 views

Patch management for production servers

I'm trying to implement an automated patching program at a small SaaS provider. When a customer signs up for our software, we provision them a Linux VM in our primary datacenter. Each customer also ...
2
votes
0answers
428 views

How to detect file or file system tampering

I would like to know if the following is possible: Is it possible to detect a file that has been put into my file system using back dating? Are there any trace artifacts left behind which can help to ...
2
votes
0answers
155 views

Identification of Unknown Potential MITM/Malware involving SSL Connections

On my server one of the services is a Discord bot. It was down which prompted me to look into why. In my syslogs I noticed three increasingly concerning items: do-agent[1066]: 2019/08/25 08:50:21 ...
2
votes
0answers
243 views

Why does linux cryptsetup use PBKDF2 instead of bcrypt?

I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
2
votes
0answers
206 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the ...
2
votes
0answers
154 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
2
votes
0answers
89 views

How is CVE-2016-6787 a UAF bug in Linux kernel?

From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
2
votes
0answers
206 views

Can maliciously modified ACPI AML be executed without a reboot?

ACPI tables contain ACPI Machine Language, or AML, which is executed by an interpreter in the kernel at boot. Certain ACPI tables, such as the DSDT, are necessary to support hardware ACPI events such ...
2
votes
1answer
2k views

Files on external drives executable by default with exFAT or NTFS under Ubuntu

On Ubuntu, if you use (external) drives formatted as exFAT or NTFS, i.e. not ext4 or something made for the UNIX world, you may end up with a situation where all files are executable. This is because ...
2
votes
0answers
431 views

Linux memory acquisition issues

I am reaching out for possible assistance regarding memory acquisition of a linux system. As of yet I have been unable to either acquire or inspect the memory dump with known tools. The following ...
2
votes
0answers
141 views

Protecting the password in a PBE scheme for an application

I am currently formulating security best practices and requirements for ongoing Java software development in my department and have settled with a recommendation of using the Jasypt framework for ...
2
votes
0answers
406 views

Setting up Yubikey for GnuPG on Linux Mint: Unsupported certificate

I am trying to set up my Yubikey 4 for GnuPGP following the Yubico documentation. I plugged in my Yubikey and it is recognized: $ lsusb ... Bus 001 Device 005: ID 1050:0407 Yubico.com ... However, ...
2
votes
0answers
184 views

Get IP/network info with Local File Inclusion

I've been thinking about expanding what I could do with a LFI attack to somehow extract information that we usually get by invoking commands. And since a lot of things in linux behaves like a file or ...
2
votes
1answer
989 views

Shellcode not executing properly

I managed to get shellcode to be pointed to by eip by building my executable without safety measures. However, it does not appear to execute. Here is the C source of my vulnerable program: #include ...
2
votes
0answers
1k views

web view addjavascriptinterface exploit

I have been banging my head around this for almost 56 hours now (+/- a few that I took out to have a couple of naps and RedBulls) and have not been able to get anywhere with it so far. I am trying ...
2
votes
0answers
165 views

Wayland Partial Encryption for Mouse / Keyboard? (Also X and RDP)

Question What are the best practices for implementing Partial Encryption, to encrypt just the input devices (mouse/keyboard, etc), not the actual video display, during remote desktop sessions using X,...
2
votes
0answers
102 views

Is an unprivileged LXC where the host user itself is mapped to 0 less secure of one where one of its subids is mapped to 0, and why?

Instead of creating "common" LXC unprivileged containers where all the users are mapped to (unprivileged) subuid/gid of my host user, I'm considering a mapping where my host user itself will be mapped ...
2
votes
0answers
529 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
2
votes
0answers
544 views

Why use oddly compiled ELF files for Linux malware?

I ran file on some Linux malware ELF files that I've acquired over the last couple of years. I noticed some oddities: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...