Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [linux]

Securing Linux systems and applications; understanding Linux security features.

225 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9 votes
0 answers
405 views

Authentication using SysRq

The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should ...
forest's user avatar
  • 66.8k
5 votes
0 answers
574 views

How did ntpd get patched to prevent NTP time synchronization attacks?

I recently tested the NTP Time Synchronization Attack as described and demonstrated by Jose Selvi in 2015. Basically, the attack was mostly used to send the victim's clock in the future, so the ...
programings's user avatar
5 votes
1 answer
9k views

Error Running command shell :TimeoutError Operation Time out

I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
Gerorge Timber's user avatar
5 votes
1 answer
277 views

reading a file with other read permissions set

For this question assume a file with 604 perms in a directory with 700 permissions. Assume this file exists: /test/file A non-root user can techincally read that file but in practice to read it the ...
sashang's user avatar
  • 183
4 votes
0 answers
443 views

How to securely delete a file after it was insecurely deleted (in linux)

How can I securely delete/shred a file after I accidentally deleted the file insecurely? Let's say I have Debian Linux installed on a laptop with a 1000T spinning hard disk (so putting aside wear ...
Michael Altfield's user avatar
4 votes
2 answers
807 views

Malware techiques via Linux Chrome and its effects, non-root

Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
Nathanal Lenner's user avatar
4 votes
0 answers
150 views

Can I detect unique identifiers from random radio chatter?

I am trying to find out if I can uniquely identify smartphones (I would like to find constant identifiers such as IMEI) by passively sniffing the cellular data frequencies. I know that sensitive data ...
beppe9000's user avatar
  • 565
4 votes
0 answers
821 views

Practicing with return-2-libc exploits

I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/ I made ...
devopsfun's user avatar
  • 211
4 votes
0 answers
204 views

Address of environment variable different for each directory

I'm writing a return-to-libc attack for a school project. My script retrieves the system(), exit() and shell addresses as follows (it's a sh script that calls some c programs): Create the environment ...
Thomas Vanhelden's user avatar
4 votes
1 answer
4k views

Linux antivirus and files bigger than 4GB

I wish to scan files that are bigger than 4GB, such as video files. I noticed many antivirus programs are limited to a maximum of 4GB (ClamAV for example). So: Is there an antivirus software that ...
Michael Ben-Nes's user avatar
4 votes
4 answers
311 views

Real value of MAC models in Linux

I have read about MAC vs. DAC in the Internet, but I still fail to understand, what kind of attack it is impossible to protect against if one only uses DAC+capabilities in comparison to MAC+DAC+...
Student4K's user avatar
  • 141
3 votes
1 answer
209 views

How to check if a PCI device is trusted or untrusted by the Linux kernel (for IOMMU)?

I am looking into the protection provided by IOMMU against DMA attacks. I noticed that the Linux kernel provides a feature called bounce buffers for untrusted PCI devices (https://lwn.net/Articles/...
sammy17's user avatar
  • 31
3 votes
0 answers
488 views

Secure boot + full disk encryption, should I sign the kernel?

I'm redoing my laptop installation from scratch, and this time I want a full secure boot chain. Here's what I did so far : Enroll my own keys in the UEFI firmware Sign my grub bootloader Full disk ...
ShellCode's user avatar
  • 130
3 votes
0 answers
3k views

When using VirtualBox, is it better to use the VirtualBox encryption or the OS disk encryption?

VirtualBox has an option to encrypt the drive of a VM. When I installed Debian or Ubuntu, I have the option to say that I want the full disk encrypted. I'm thinking that both do pretty much the same ...
Alexis Wilke's user avatar
  • 1,007
3 votes
0 answers
312 views

How to prevent grub.cfg from breaking the chain of trust?

First some definitions and common understanding. The premise of secure boot is that each binary get's verified before it is loaded. This starts with the firmware in ROM verifying the EFI application. ...
TheMeaningfulEngineer's user avatar
3 votes
0 answers
656 views

Using a TPM as a hardware authentication device

My company is currently developing a product which consists of a fairly generic PC hardware platform and a software stack (the software stack is based on a Debian Buster Linux OS + some applications ...
op414's user avatar
  • 131
3 votes
0 answers
155 views

Do BSD jails protect against some vulnerability class that LXC doesn't?

You can find many claims online regarding BSD jails being "better" in some way than Linux namespaces for containment, but they typically lack technical details. From what I understand, the attack ...
viraptor's user avatar
  • 215
3 votes
0 answers
191 views

Identifying kernel pointer infoleaks via static analysis

Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
forest's user avatar
  • 66.8k
3 votes
0 answers
301 views

Experimenting with SSLStrip+ on the same machine

I am trying to play around to understand how SSLStrip+ works by: $ cat /proc/sys/net/ipv4/ip_forward 1 $ sudo iptables --flush $ sudo iptables --flush -t nat $ sudo iptables -t nat -A PREROUTING -p ...
HCSF's user avatar
  • 153
3 votes
0 answers
390 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
Neon Flash's user avatar
3 votes
0 answers
303 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
Benoit Sevens's user avatar
3 votes
0 answers
124 views

How do I obtain linux user authentication information securely?

For security purposes the application needs to know, securely who is logged in and what groups they are authorised for. This must be done securely so that a user application cannot perform a man in ...
tony wallace's user avatar
3 votes
0 answers
525 views

Why isn't rng-tools installed by default on all OS?

Many Linux distributions use the package rng-tools, but why isn't it always installed by default? It would increase entropy (/proc/sys/kernel/random/entropy_avail) greatly! Is there any security ...
pepite's user avatar
  • 225
2 votes
0 answers
62 views

What optimization can be made for nanosecond IO and CPU stability when performing a timing attack?

I'm using Rust to create a program to attempt a timing attack on a network resource (a printer I lost a password to). I'm wired directly into it. What Linux environmental constraints can I optimize to ...
Evan Carroll's user avatar
  • 2,823
2 votes
1 answer
375 views

Is running rsync as root problematic?

Is there a security risk with running rsync as root to copy potentially malicious files? Or for that matter with any read command like cp, cat, du? Background: I'm moving data from various systems ...
Fizz Khalifa's user avatar
2 votes
0 answers
238 views

Can SMB/CIFS credentials be extracted from Linux?

On a penetration test, I have completely compromised a Linux machine and I am now trying to move around the network. The Linux machine has a mounted CIFS share, and I want to get the password used to ...
Bob's user avatar
  • 99
2 votes
0 answers
580 views

How to harden portable Tor Browser installation (SELinux, sandbox)?

tldr How can I define a SELinux policy, that limits filesystem access of portable Tor Browser to its installation directory, say /home/user/.local/opt/tor-browser_en-US? How might Tor Browser be ...
reynor's user avatar
  • 21
2 votes
1 answer
527 views

How to verify a x509 certificate from Apple on a Ubuntu server?

I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this. Steps 3 and 4 of that API say: Use the publicKeyURL ...
Lincoln Bergeson's user avatar
2 votes
0 answers
197 views

Log/Detect Clipboard access

With the public beta access to iOS 14 people got a warning when apps access the clipboard, and it lead to people realizing that many apps just grab everything from the clipboard they can get and send ...
l4chsalter's user avatar
2 votes
0 answers
159 views

Can binary firmware packages be executed on the system?

Kernels like linux-libre (standard in Debian and other free Linux distributions) ship no binary firmware packages by default. From my limited understanding of their functionality, a binary firmware ...
Prototype700's user avatar
2 votes
1 answer
283 views

Can I skip any password hashing for localhost authentication?

Setup I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system. everyone is on the same host they use the loopback interface (127.0.0.1) to ...
problemofficer - n.f. Monica's user avatar
2 votes
0 answers
249 views

What are the Linux hibernation feature threats?

The pre-built hardened linux kernel proposed by ArchLinux has disabled hibernation. The maintainer of the package commented on this choice: […] having this enabled allows replacement of the running ...
Jules Lamur's user avatar
2 votes
0 answers
605 views

Retrieving a flag from vim commands by reading through strace output [CTF]

So, to clarify, I'm currently working on a CTF challenge that consists of running an strace over on a bash script that is running vim commands using commands like vim -c ":!cat flag.txt" inside of a ...
0xFFFFFF's user avatar
2 votes
0 answers
456 views

How to disabel relro to overwrite fini_array or .got.plt element?

I am reading the book Hacking: The art of exploitation and there is a format string exploit example which attempts to overwrite an address of the dtors with the address of a shellcode environment ...
ht332932's user avatar
2 votes
2 answers
799 views

Local Burp Proxy not showing routed packets

I created a hotspot on wlp2s0 and connected an android device, whose IP is 10.42.0.62. I am trying to route my all packets from my wlp2s0 interface to burp proxy which is running on 8080. I also ...
Monu's user avatar
  • 227
2 votes
0 answers
212 views

Patch management for production servers

I'm trying to implement an automated patching program at a small SaaS provider. When a customer signs up for our software, we provision them a Linux VM in our primary datacenter. Each customer also ...
crab's user avatar
  • 17
2 votes
0 answers
779 views

How to detect file or file system tampering

I would like to know if the following is possible: Is it possible to detect a file that has been put into my file system using back dating? Are there any trace artifacts left behind which can help to ...
ananth's user avatar
  • 21
2 votes
0 answers
232 views

Identification of Unknown Potential MITM/Malware involving SSL Connections

On my server one of the services is a Discord bot. It was down which prompted me to look into why. In my syslogs I noticed three increasingly concerning items: do-agent[1066]: 2019/08/25 08:50:21 ...
ThievingSix's user avatar
2 votes
0 answers
387 views

Why does linux cryptsetup use PBKDF2 instead of bcrypt?

I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
john doe's user avatar
  • 708
2 votes
0 answers
368 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the ...
yosra's user avatar
  • 121
2 votes
0 answers
487 views

How do I create exceptions on Wazuh (OSSEC)?

I currently have a setup with OSSEC and AIDE running on our servers. We are currently receiving a daily alert for each agent when AIDE runs and changes audit.log. I want to make an exception for ...
Thiago Escobar's user avatar
2 votes
0 answers
208 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
Marshall Whittaker's user avatar
2 votes
0 answers
131 views

How is CVE-2016-6787 a UAF bug in Linux kernel?

From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
sherlock's user avatar
  • 569
2 votes
0 answers
465 views

Can maliciously modified ACPI AML be executed without a reboot?

ACPI tables contain ACPI Machine Language, or AML, which is executed by an interpreter in the kernel at boot. Certain ACPI tables, such as the DSDT, are necessary to support hardware ACPI events such ...
forest's user avatar
  • 66.8k
2 votes
2 answers
3k views

Files on external drives executable by default with exFAT or NTFS under Ubuntu

On Ubuntu, if you use (external) drives formatted as exFAT or NTFS, i.e. not ext4 or something made for the UNIX world, you may end up with a situation where all files are executable. This is because ...
caw's user avatar
  • 229
2 votes
0 answers
533 views

Linux memory acquisition issues

I am reaching out for possible assistance regarding memory acquisition of a linux system. As of yet I have been unable to either acquire or inspect the memory dump with known tools. The following ...
jas-'s user avatar
  • 939
2 votes
0 answers
181 views

Combining passwords and PAM

I'm researching the ways to implement an authentication server capable of 2FA - I want to be able to validate a short password along with a TOTP (probably Google authenticate). But I want to support ...
symcbean's user avatar
  • 18.6k
2 votes
0 answers
210 views

Protecting the password in a PBE scheme for an application

I am currently formulating security best practices and requirements for ongoing Java software development in my department and have settled with a recommendation of using the Jasypt framework for ...
maple_shaft's user avatar
  • 1,092
2 votes
0 answers
497 views

Setting up Yubikey for GnuPG on Linux Mint: Unsupported certificate

I am trying to set up my Yubikey 4 for GnuPGP following the Yubico documentation. I plugged in my Yubikey and it is recognized: $ lsusb ... Bus 001 Device 005: ID 1050:0407 Yubico.com ... However, ...
arne.z's user avatar
  • 137
2 votes
0 answers
1k views

web view addjavascriptinterface exploit

I have been banging my head around this for almost 56 hours now (+/- a few that I took out to have a couple of naps and RedBulls) and have not been able to get anywhere with it so far. I am trying ...
qre0ct's user avatar
  • 1,522

1
2 3 4 5