61

Absolutely not. The BIOS password is only an authentication mechanism presented when the system boots or when a manual change to the configuration is made during boot. Malware which overwrites the BIOS typically does so by writing over SPI, the interface which the BIOS resides on. If malware gets enough privileges to write to SPI, and your BIOS does not set ...


29

You have a good discussion here: https://wiki.mozilla.org/Security/Guidelines/OpenSSH On modern OpenSSH they recommend: KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,...


28

Although the details greatly vary between architectures, what I say here applies equally well to 32-bit x86, 64-bit x86, but also ARM and PowerPC: faced with the same issues, about all architecture designers have used similar solutions. There are (roughly speaking) four kinds of "accesses", at assembly level, which are relevant to the "position-independent" ...


26

Your question is rather broad, touching on several different subjects. It may be better to take some of the details and put them in a separate question. Is it enough to forbid su and allow sudo in order to keep the traceability of the administrator actions? ... can sudo command have utility without a strong sudoer configuration ? which ones ? Unrestricted ...


26

To be honest, I don't understand these things too much, I just want strong encryption and everything I don't know what you mean by "everything" but if you just want strong encryption then don't mess with the default settings - its possible they could be more secure but you are more likely to break the security than improve it if you don't know what you are ...


23

It's a long question but I think your main point is this: We wish to simplify the accessing of the cameras over multiple devices (tablet, phone, PC?). First have a look how SSH keys work. That would work for you mostly as it is. At first the customers public key is added into his camera during the initial configuration. He can authenticate himself using ...


13

Any bug in the handling of USB devices can be exploited by malicious hardware. That's how the PS3 Jailbreak worked. Remember that when you plug a "USB Flash drive" in a machine, you cannot be sure that what you plug is really "just a Flash drive". The machine sees it as a "USB device" which may claim to be a keyboard, a mouse, a network interface... A ...


12

You're probably using one of the possible tools right now. Both Firefox and Chrome have developer tools that allow you to see both the request and response headers for any request that is made. In Firefox go to Tools -> Web Developer -> Network and then make a new request by clicking on a link or refreshing the page. In Chrome, go to the menu -> Tools -> ...


12

Throw out < 2048 bit builtin moduli On the server: Have a look at your sshd_config and throw out the diffie-hellman-group1-sha1 if it appears in the KexAlgorithms section. And restart SSHD. Check with Nmap how can I test if that is good enough? Get Nmap and run the `ssh2-enum-algos' script against the SSH server. The diffie-hellman-group1-sha1 must not ...


11

One reason why some Linux distributions may be hesitant to compile all executables as Position-Independent Executables (PIE), so the executable code is randomized, is because of concerns about performance. The thing about performance concerns is that sometimes people worry about performance even when it's not an issue. So, it would be nice to have detailed ...


11

Following config can provide higher security level while keeping some degree of compatibility and reduce configuration complexity. WARNING: The following configuration is not compatible with all clients # Change the port number avoid automated attack Port 2222 # Limit to SSH2 only (the default value) Protocol 2 # Use RSA and Ed25519 host key only HostKey ...


11

I am assuming that there is some reason you can't use a dozen different laptops in multiple countries or jurisdictions doing the same activities to provide extremely high redundancy (as pointed out in a comment on the question). If any of the laptops have results that differ, at least one of them can be assumed compromised and incident response can kick in. ...


10

TL;DR: R*PATH has an unfortunate history of introducing new ways of running untrusted (attacker-controlled) libraries. RPATH/RUNPATH is usually avoidable and should be avoided. Firstly, it might be worth reviewing the non-security reasons for why we want these binaries flagged: distros (Eg. Debian Wiki on RPATH) don't like that it takes precedence over the ...


10

First and foremost: if you want security, don't use MIFARE cards. They aren't the best at security. Even if a card isn't vulnerable to something like a hardnested attack or a brute-force attack, the card's data can still be sniffed over-the-air (which will include the keys or allow keys and data to be easily recovered). Generally, most "secure" ...


9

There is some good information here. Apparently, a DLL can be subject to ASLR only if it is tagged as such, because of "backward compatibility issues". Although a DLL is, by nature, meant to be relocated, I can imagine that some (poorly) written software may do some tricks which rely on the DLL ending up in a relatively small range of the address space (a ...


9

There are a few ways to solve this situation. One is to have the camera always encrypt one of the session keys to a camera backup key. The camera backup key is generated on account setup of the camera and a password is generated that is used to encrypt the backup key. This password is never stored on the camera itself. Your online storage would store the ...


9

I'd refer you to the CIS Benchmarks for hardening guidelines. The current CIS Benchmark for Docker can be found here. These are an accepted industry standard for baseline hardening. They also offer guidelines for Linux et al, Web servers, DBs, etc.


8

The Wikipedia page shows that the answer is "it depends". There are multiple implementations and patches around. The important points to consider are the following: A Linux executable consists in a main binary, and DLL (shared objets) loaded dynamically. In traditional Linux, the main binary is at a fixed address chosen at link time, while DLL are position-...


8

You should at least hash the passwords. Use a secure hash function, e.g. SHA-256 to hash a password and store it like this. When generating a new password, you can send the user the new password, but hash it and store the hashed version in the camera/database. When checking if password is correct, hash the password that has been input and compare it to ...


8

Try filtering by ssl.record.version For example, if you wanted to only display TLS v1.2 traffic then you could run ssl.record.version == 0x0303 You can choose from the hex values below for the version that fits your needs. Versions: 0x0300 SSL 3.0 0x0301 TLS 1.0 0x0302 TLS 1.1 0x0303 TLS 1.2 To avoid using the GUI or to automate this further you could ...


8

I doubt you'll find any virus which is completely benign (even fixing a vulnerability after exploiting it is still malicious behavior, even if it is intended to be beneficial), but there are plenty of examples of exploits which are. The most well-known would have to be jailbreak exploits, where a vulnerability in a proprietary and closed system is attacked ...


7

It is totally feasible to write appreciable amounts of data in a "covert" fashion under these conditions. What is written on the disc is a filesystem: a sequence of bytes which encodes a number of files and directories. There are two main places where covert data would be hidden: In the "holes" in the filesystem. In particular, files will use an integral ...


7

Anything can be compromised, however traditional mainframe configurations are very well structured so generally it is considered much harder than, for example, an average server running PHP:-) Start with one of the security hardening guides for your mainframe. If you are running IBM, the manuals on IBM mainframe security will give you 95% of what you need....


7

I think you'll have fun getting to grips with Mainframe security, it's quite a different world. As @roryalsop says be very careful before you test a live mainframe, they tend to run very high value apps and can be fragile (i.e. if you break it, the test will likely end pretty quickly) Some resources I would recommend mainframes for security people ...


7

Your considerations Using dm-verity is a very good idea, especially if you are able to fuse a key in hardware to reduce the TCB further. This can greatly help prevent a system from being persistently compromised, as well as ensure integrity, making tampering highly evident. A quick web search shows several TPM implementations for Raspberry Pi, which will ...


6

Sure, browsers work, but I think they're a bit overkill for this task. My favorite method is using the curl command line utility, which is available on almost all Unix-like systems. Use the -I flag, which tells curl to make an HTTP HEAD request and print just the headers: $> curl -I http://example.com/ HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: ...


6

What generally is done is to hire a security expert who creates a custom webserver hardening standard and baseline, adjusted to your company's needs. The standard defines which security controls should be in place, technology independant. Then the baseline can be technology specific, e.g. IIS or Apache,... The baseline can be implemented by your system ...


6

The first repository that comes to my mind for secure baselines is NIST. You can review the baselines for various software and operating systems, inluding Apache here: http://web.nvd.nist.gov/view/ncp/repository


6

One option for this would the Center for Internet Security . Their Security Benchmarks cover a relatively wide range of systems and generally have some useful information in there.


Only top voted, non community-wiki answers of a minimum length are eligible