60 votes
Accepted

Does adding a password to BIOS prevent malware from infecting it?

Absolutely not. The BIOS password is only an authentication mechanism presented when the system boots or when a manual change to the configuration is made during boot. Malware which overwrites the ...
  • 506
30 votes
Accepted

What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings?

You have a good discussion here: https://wiki.mozilla.org/Security/Guidelines/OpenSSH On modern OpenSSH they recommend: KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-...
26 votes
Accepted

Best practices for hardening sudo?

Your question is rather broad, touching on several different subjects. It may be better to take some of the details and put them in a separate question. Is it enough to forbid su and allow sudo in ...
  • 13.9k
26 votes

What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings?

To be honest, I don't understand these things too much, I just want strong encryption and everything I don't know what you mean by "everything" but if you just want strong encryption then don't mess ...
  • 18.3k
23 votes
Accepted

Storing plaintext passwords for cameras - Security concerns?

It's a long question but I think your main point is this: We wish to simplify the accessing of the cameras over multiple devices (tablet, phone, PC?). First have a look how SSH keys work. That ...
  • 5,414
15 votes
Accepted

Why does checksec.sh highlight rpath and runpath as security issues?

TL;DR: R*PATH has an unfortunate history of introducing new ways of running untrusted (attacker-controlled) libraries. RPATH/RUNPATH is usually avoidable and should be avoided. Firstly, it might be ...
  • 166
12 votes
Accepted

LogJam hardening OpenSSH and testing it

Throw out < 2048 bit builtin moduli On the server: Have a look at your sshd_config and throw out the diffie-hellman-group1-sha1 if it appears in the KexAlgorithms section. And restart SSHD. Check ...
11 votes

What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings?

Following config can provide higher security level while keeping some degree of compatibility and reduce configuration complexity. WARNING: The following configuration is not compatible with all ...
  • 426
11 votes
Accepted

Securing a Laptop from a Foreign Intelligence Agency

I am assuming that there is some reason you can't use a dozen different laptops in multiple countries or jurisdictions doing the same activities to provide extremely high redundancy (as pointed out in ...
  • 65k
11 votes
Accepted

Hardening NFC tags for authentication

First and foremost: if you want security, don't use MIFARE cards. They aren't the best at security. Even if a card isn't vulnerable to something like a hardnested attack or a brute-force attack, the ...
  • 382
9 votes
Accepted

How to securely encrypt data with a public-private key encryption scheme, but also allow decryption if the private key is lost?

There are a few ways to solve this situation. One is to have the camera always encrypt one of the session keys to a camera backup key. The camera backup key is generated on account setup of the ...
  • 31.2k
9 votes
Accepted

Hardening/reducing attack surface for a Docker container

I'd refer you to the CIS Benchmarks for hardening guidelines. The current CIS Benchmark for Docker can be found here. These are an accepted industry standard for baseline hardening. They also offer ...
  • 5,125
8 votes

Storing plaintext passwords for cameras - Security concerns?

You should at least hash the passwords. Use a secure hash function, e.g. SHA-256 to hash a password and store it like this. When generating a new password, you can send the user the new password, ...
8 votes

Filter TLS in Wireshark or other monitoring tool

Try filtering by ssl.record.version For example, if you wanted to only display TLS v1.2 traffic then you could run ssl.record.version == 0x0303 You can choose from the hex values below for the ...
  • 1,006
7 votes
Accepted

Security essentials for a embedded Linux device

Your considerations Using dm-verity is a very good idea, especially if you are able to fuse a key in hardware to reduce the TCB further. This can greatly help prevent a system from being persistently ...
  • 65k
7 votes

Where to find the security hardened docker images

I would consider the Center For Internet Security (CIS) Benchmarks the current gold standard for hardening. I'd caution against a pre-hardened image and instead recommend that you harden it yourself ...
  • 5,125
7 votes

What are some examples of viruses/exploits with benevolent purposes?

I doubt you'll find any virus which is completely benign (even fixing a vulnerability after exploiting it is still malicious behavior, even if it is intended to be beneficial), but there are plenty of ...
  • 65k
6 votes

Why block outgoing network traffic with a firewall?

Blocking outgoing DNS queries so that DNS can only be routed through your preferred DNS server (enterprise DNS server, OpenDNS, Quad9, Google Public DNS, etc) is fairly commonplace on a network that ...
6 votes

Storing plaintext passwords for cameras - Security concerns?

What I would consider a proper design is one in which the services you host and the hardware you sell are not too tied to each other. The customers should be able to use those two products separately ...
  • 5,412
6 votes
Accepted

Hardening SSH security on a Debian 9 server

There are a number of things you can do: Set up a private key that uses a key-stretching algorithm to protect brute-forcing the passphrase. Configure AllowUsers in sshd so only named accounts can ...
6 votes

Difference between Lynis and Nessus and yet another hardening tool

Author of Lynis here. Nessus is vulnerability scanning, Lynis is system auditing with some overlap in vulnerability discovery. I'm curious why you want to start a new project. So let me answer by ...
6 votes
Accepted

Is zeroing out values on the stack and arguments overkill?

The C standard specifies the behavior of code in terms of an abstract machine. This specification does not know about concepts such as "the stack". It knows variables with "automatic ...
5 votes

Secure environment for servers with sensitive private data

Seek professional advice...seriously, if the data is as sensitive as you say and the consequences are truly fatal, it would be negligent to rely on advice from here upon which to base a solution. ...
  • 2,933
5 votes
Accepted

What's the distinction between a missed hardening opportunity and security flaw?

It is always risk that defines that criteria. What's the likelihood of the problem being exploited, what are the mitigations in place to prevent or limit the impact, and what are the impacts of a ...
  • 125k
5 votes
Accepted

Was my phpMyAdmin hacked?

Those log entries look like normal scanning activity. You can also notice that the scanner did not target your setup specifically, because multiple versions and directories are tried. And as you ...
  • 29.1k
5 votes
Accepted

Node.js REST server running as root

I would recommend splitting your app into multiple components communicating through standardized REST APIs. In this case you'd have a storage manager app which runs as a user with enough privileges ...
  • 12.7k
5 votes
Accepted

Does Linux support the NX-bit on ARM processors?

The NX-bit implementation its supported since ARMv6, and yes, linux also has support for it. (NX implementations needs both OS support and CPU support) Now if you want to check the nx bit, you can do ...
  • 854
5 votes

Does adding a password to BIOS prevent malware from infecting it?

BIOS passwords offer absolutely no protection against viruses. Its just there to slow people down who are trying to use your computer without your permission. Most computers have a "bios password ...
  • 51

Only top scored, non community-wiki answers of a minimum length are eligible