89

Shodan references publicly available machines which work like this: Just don't do it. Edit: analogy is relevant ! Shodan connects to machines and asks for their "banner", a publicly available text which may simply say: "to enter, use this default password: 1234". You might want to avoid people knocking at the door by the simple expedient of installing a ...


67

Blocking outbound traffic is usually of benefit in limiting what an attacker can do once they've compromised a system on your network. So for example if they've managed to get malware onto a system (via an infected e-mail or browser page), the malware might try to "call home" to a command and control system on the Internet to get additional code downloaded ...


62

The Shodan project is pretty cool, but at its core isn't much more than a big honkin nmap database. The project has scanners that routinely scan the Internet and publish the findings into the database. That database is what you're searching. Since they are using standard detection routines the protections you would put in for a normal scan should protect you ...


62

Absolutely not. The BIOS password is only an authentication mechanism presented when the system boots or when a manual change to the configuration is made during boot. Malware which overwrites the BIOS typically does so by writing over SPI, the interface which the BIOS resides on. If malware gets enough privileges to write to SPI, and your BIOS does not set ...


40

For most home users, the only internet-facing device is their router. So, how do you secure the router from stuff like Shodan? Firstly, change the default password. Anyone armed with an IP scanning tool (Angry IP Scanner is the one I've tried) can find you if they input the relevant IP range and break in with the bog standard admin/admin login. What can ...


36

Please keep in mind the Holy Trinity of Information Security: C(onfidentiality), I(ntegrity), and A(vailability). So when we talk about configuration hardening you need to consider the technology you're working with, the information being protected, how the information is used within the organization, and the threats. Based on those answers, and possibly ...


31

You don't need to find out how they got your IP - the entire Internet is constantly being scanned by malicious individuals, bots etc. If you have an FTP server on the Internet, one of these scans will find it and a whole series of attack attempts will commence. Your downside is - you can't secure an FTP server. FTP just wasn't designed to provide encryption ...


30

You have a good discussion here: https://wiki.mozilla.org/Security/Guidelines/OpenSSH On modern OpenSSH they recommend: KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,...


29

This issue has come up on a couple SE forums already, so most of this is going to just be echoing my existing answers. How can I prevent someone from accessing a Windows XP system via boot disk? How to secure my Windows 7 PC? A couple of fairly major issues exist here, which are really working against you: Unless there's something you haven't mentioned, ...


26

Although the details greatly vary between architectures, what I say here applies equally well to 32-bit x86, 64-bit x86, but also ARM and PowerPC: faced with the same issues, about all architecture designers have used similar solutions. There are (roughly speaking) four kinds of "accesses", at assembly level, which are relevant to the "position-independent" ...


25

NoSQL databases are relatively new (although arguably an old concept), I haven't seen any specific MongoDB hardening guides and the usual places I look (CISSecurity, vendor publications, Sans etc all come up short). Suggests it would be a good project for an organisation, uni student, infosec community to write one and maintain it. There is some basic ...


25

Coming from a security role, particularly if you've ever been involved in incident response, the idea of outbound filtering would seem a natural course in a high security environment. However, it is a very large and complex undertaking. Mention the words "egress filtering" to a firewall, network, or systems administrator and you'll likely get this response. ...


25

To be honest, I don't understand these things too much, I just want strong encryption and everything I don't know what you mean by "everything" but if you just want strong encryption then don't mess with the default settings - its possible they could be more secure but you are more likely to break the security than improve it if you don't know what you are ...


23

Your question is rather broad, touching on several different subjects. It may be better to take some of the details and put them in a separate question. Is it enough to forbid su and allow sudo in order to keep the traceability of the administrator actions? ... can sudo command have utility without a strong sudoer configuration ? which ones ? ...


22

First let me say, I'm not a security expert by any means. While you ask about securing linux desktops, I take your question to mean "how do I implement overall security using free unixes as a person who does personal computing as opposed to web serving." So I thought I would gather my thoughts on the subject and see what other people have to say about it....


22

It's a long question but I think your main point is this: We wish to simplify the accessing of the cameras over multiple devices (tablet, phone, PC?). First have a look how SSH keys work. That would work for you mostly as it is. At first the customers public key is added into his camera during the initial configuration. He can authenticate himself using ...


21

Some commentary: Defending from common thieves Rather than wiping Windows 7, I've left it as a honeypot operating system. If a thief steals the laptop, when they turn it on, it will automatically boot up into Windows, without so much as even being prompted for a password. I installed a free application called Prey which will allow me to grab ...


19

Unless you block all outgoing traffic other than a whitelist of legitimate websites you visit (and/or use a proxy that does whitelisting and security scanning), there's little additional security to be gained from blocking all ports except 80/443. Well, blocking port 25 might be good to keep your network from being used to send spam. Many botnets already ...


18

The other answers focus on securing the server -- which is important, but the client side deserves some protection too: In /etc/ssh/ssh_config (or ~/.ssh/config) set StrictHostKeyChecking to yes or ask. This provides some protection against man-in-the-middle attacks by checking that the server you are connecting to is the one you expect. If you can add ...


17

Another thing you can do is add an iptables 'bruteforce' rule. This will allow ip's to make NEW connections x times within y seconds. After these limits have been reached the packets will be dropped. This prevents brute-forces from continuously attacking your server. I have such protection on common scanned ports like FTP, SSH, IMAP, POP3, SMTP, etc.... ...


15

There are lots of programs trawling the internet looking for vulnerable hosts. Certainly there are people who target their attacks - but starting from torrent logs will not yield very interesting targets. Have a look at the sans.org site for basic checklists on securing your server.


15

grsecurity (a.k.a. grsec) isn't really a program - it's a hardening suite for Linux. It includes the following: A fully comprehensive Role-Based Access Security (RBAC) system. grsec-hardened kernel patches. Enhanced PaX implementation. chroot restrictions (misc features to prevent malware from escaping a chroot jail) General system security improvements. ...


15

So the short answer is that if you're providing a publicly available service (e.g. to the general Internet) your service has to be accessible and therefore search engines like shodan can find it, and all shodan does it to index publicly available information. What you can do is minimize the information that shodan finds, by removing banners from ...


14

HTTP TRACE method basically replies the request, together with all the headers in response. Cookie header will also be included in response. Session cookies should have httpOnly flag for preventing Session Hijacking attacks. This flag blocks access to the cookie value from Javascript. Basically this ensures that even if attacker will exploit a XSS flaw in a ...


14

I've had to tackle this problem before, when approached by a client wanting to keep 'private messages' secure between users on a website. It's possible to protect some data in some circumstances, but this is reasonably limited. My approach was to simply store an encrypted version of the note on the server, and have it sent to them (once authenticated of ...


13

Data in L1 cache will not remain in L1 cache only; the hardware will copy it to main RAM transparently and almost immediately. At least so operate modern CPU. If you want to keep sensitive data out of RAM, then you must keep it in registers only. Context switches will be a problem, also, since they automatically flush registers to a designated RAM space. ...


12

I'm guessing that uninstalling IE is impossible or impractical. Go to Control Panel -> Uninstall a program -> Turn Windows features on or off. There you can deselect Internet Explorer. You need to harden IE as well. An application could launch or embed an IE window that could then be used to gain control of the system. Consider this attack: an attacker ...


Only top voted, non community-wiki answers of a minimum length are eligible