89

Shodan references publicly available machines which work like this: Just don't do it. Edit: analogy is relevant ! Shodan connects to machines and asks for their "banner", a publicly available text which may simply say: "to enter, use this default password: 1234". You might want to avoid people knocking at the door by the simple expedient of installing a ...


65

Blocking outbound traffic is usually of benefit in limiting what an attacker can do once they've compromised a system on your network. So for example if they've managed to get malware onto a system (via an infected e-mail or browser page), the malware might try to "call home" to a command and control system on the Internet to get additional code downloaded ...


62

The Shodan project is pretty cool, but at its core isn't much more than a big honkin nmap database. The project has scanners that routinely scan the Internet and publish the findings into the database. That database is what you're searching. Since they are using standard detection routines the protections you would put in for a normal scan should protect you ...


61

Absolutely not. The BIOS password is only an authentication mechanism presented when the system boots or when a manual change to the configuration is made during boot. Malware which overwrites the BIOS typically does so by writing over SPI, the interface which the BIOS resides on. If malware gets enough privileges to write to SPI, and your BIOS does not set ...


40

For most home users, the only internet-facing device is their router. So, how do you secure the router from stuff like Shodan? Firstly, change the default password. Anyone armed with an IP scanning tool (Angry IP Scanner is the one I've tried) can find you if they input the relevant IP range and break in with the bog standard admin/admin login. What can ...


38

Please keep in mind the Holy Trinity of Information Security: C(onfidentiality), I(ntegrity), and A(vailability). So when we talk about configuration hardening you need to consider the technology you're working with, the information being protected, how the information is used within the organization, and the threats. Based on those answers, and possibly ...


29

You have a good discussion here: https://wiki.mozilla.org/Security/Guidelines/OpenSSH On modern OpenSSH they recommend: KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,...


26

Coming from a security role, particularly if you've ever been involved in incident response, the idea of outbound filtering would seem a natural course in a high security environment. However, it is a very large and complex undertaking. Mention the words "egress filtering" to a firewall, network, or systems administrator and you'll likely get this response. ...


26

Although the details greatly vary between architectures, what I say here applies equally well to 32-bit x86, 64-bit x86, but also ARM and PowerPC: faced with the same issues, about all architecture designers have used similar solutions. There are (roughly speaking) four kinds of "accesses", at assembly level, which are relevant to the "position-independent" ...


26

To be honest, I don't understand these things too much, I just want strong encryption and everything I don't know what you mean by "everything" but if you just want strong encryption then don't mess with the default settings - its possible they could be more secure but you are more likely to break the security than improve it if you don't know what you are ...


25

Your question is rather broad, touching on several different subjects. It may be better to take some of the details and put them in a separate question. Is it enough to forbid su and allow sudo in order to keep the traceability of the administrator actions? ... can sudo command have utility without a strong sudoer configuration ? which ones ? ...


23

It's a long question but I think your main point is this: We wish to simplify the accessing of the cameras over multiple devices (tablet, phone, PC?). First have a look how SSH keys work. That would work for you mostly as it is. At first the customers public key is added into his camera during the initial configuration. He can authenticate himself using ...


21

Some commentary: Defending from common thieves Rather than wiping Windows 7, I've left it as a honeypot operating system. If a thief steals the laptop, when they turn it on, it will automatically boot up into Windows, without so much as even being prompted for a password. I installed a free application called Prey which will allow me to grab ...


20

Unless you block all outgoing traffic other than a whitelist of legitimate websites you visit (and/or use a proxy that does whitelisting and security scanning), there's little additional security to be gained from blocking all ports except 80/443. Well, blocking port 25 might be good to keep your network from being used to send spam. Many botnets already ...


15

grsecurity (a.k.a. grsec) isn't really a program - it's a hardening suite for Linux. It includes the following: A fully comprehensive Role-Based Access Security (RBAC) system. grsec-hardened kernel patches. Enhanced PaX implementation. chroot restrictions (misc features to prevent malware from escaping a chroot jail) General system security improvements. ...


15

So the short answer is that if you're providing a publicly available service (e.g. to the general Internet) your service has to be accessible and therefore search engines like shodan can find it, and all shodan does it to index publicly available information. What you can do is minimize the information that shodan finds, by removing banners from ...


13

Data in L1 cache will not remain in L1 cache only; the hardware will copy it to main RAM transparently and almost immediately. At least so operate modern CPU. If you want to keep sensitive data out of RAM, then you must keep it in registers only. Context switches will be a problem, also, since they automatically flush registers to a designated RAM space. ...


12

I'm guessing that uninstalling IE is impossible or impractical. Go to Control Panel -> Uninstall a program -> Turn Windows features on or off. There you can deselect Internet Explorer. You need to harden IE as well. An application could launch or embed an IE window that could then be used to gain control of the system. Consider this attack: an attacker ...


12

The split into one or several partitions is not really a problem of security but of reliability. The idea is that if one of your partitions is crashed, then you lose the contents of that partition, but the other partitions are fine. Also, if you fill up that partition, then other partitions are unaffected. Each partition can have its own filesystem, and not ...


12

Any bug in the handling of USB devices can be exploited by malicious hardware. That's how the PS3 Jailbreak worked. Remember that when you plug a "USB Flash drive" in a machine, you cannot be sure that what you plug is really "just a Flash drive". The machine sees it as a "USB device" which may claim to be a keyboard, a mouse, a network interface... A ...


12

You're probably using one of the possible tools right now. Both Firefox and Chrome have developer tools that allow you to see both the request and response headers for any request that is made. In Firefox go to Tools -> Web Developer -> Network and then make a new request by clicking on a link or refreshing the page. In Chrome, go to the menu -> Tools -> ...


12

Throw out < 2048 bit builtin moduli On the server: Have a look at your sshd_config and throw out the diffie-hellman-group1-sha1 if it appears in the KexAlgorithms section. And restart SSHD. Check with Nmap how can I test if that is good enough? Get Nmap and run the `ssh2-enum-algos' script against the SSH server. The diffie-hellman-group1-sha1 ...


11

When it comes to something like a hardening guide, RHEL 6 is still considered fairly new. As sad as it seems, many of these types of guides take several months or years to produce. That being said, by and large, for your purposes the difference between EL 5 and EL 6 should be fairly minimal. When I began supporting EL 6, most of my changes were rather ...


11

To focus on your individual cases: Absolutely anything he wants. Malware, rootkits, backdoors, keyloggers, the whole shebang. Again, absolutely anything. It's exactly the same as having the USB disk, because he can set up a site where he can download the files he needs, or just download them from existing sites. Wipe the disk, delete system files, write ...


11

Following config can provide higher security level while keeping some degree of compatibility and reduce configuration complexity. WARNING: The following configuration is not compatible with all clients # Change the port number avoid automated attack Port 2222 # Limit to SSH2 only (the default value) Protocol 2 # Use RSA and Ed25519 host key only HostKey ...


11

I am assuming that there is some reason you can't use a dozen different laptops in multiple countries or jurisdictions doing the same activities to provide extremely high redundancy (as pointed out in a comment on the question). If any of the laptops have results that differ, at least one of them can be assumed compromised and incident response can kick in. ...


10

Restrict the daemon with MAC No matter how you cut it, wrapping Apache in a mandatory access control layer like AppArmor or SELinux is a good first step. That will allow you to restrict the daemon's allowable operations even if otherwise has permissions to do so. That will prevent Apache from ever modifying your files. Use version control with automatic ...


10

Incoming traffic blocking can only prevent unsolicited traffic from reaching your internal network. However, if you get malware on an internal machine (via running an untrusted executable, or through an exploit) you can still be hit. Blocking outgoing traffic helps limit the damage, by preventing the malware from connecting to a command & control server ...


9

Fail2ban does exactly what you ask. It monitors your log files looking for certain patterns and then executes whatever action you specify. You can block an IP for a length of time. It does require some skill in regex, but it comes packaged with regex testers.


Only top voted, non community-wiki answers of a minimum length are eligible