89

Shodan references publicly available machines which work like this: Just don't do it. Edit: analogy is relevant ! Shodan connects to machines and asks for their "banner", a publicly available text which may simply say: "to enter, use this default password: 1234". You might want to avoid people knocking at the door by the simple expedient of installing a ...


66

Blocking outbound traffic is usually of benefit in limiting what an attacker can do once they've compromised a system on your network. So for example if they've managed to get malware onto a system (via an infected e-mail or browser page), the malware might try to "call home" to a command and control system on the Internet to get additional code downloaded ...


62

The Shodan project is pretty cool, but at its core isn't much more than a big honkin nmap database. The project has scanners that routinely scan the Internet and publish the findings into the database. That database is what you're searching. Since they are using standard detection routines the protections you would put in for a normal scan should protect you ...


61

Absolutely not. The BIOS password is only an authentication mechanism presented when the system boots or when a manual change to the configuration is made during boot. Malware which overwrites the BIOS typically does so by writing over SPI, the interface which the BIOS resides on. If malware gets enough privileges to write to SPI, and your BIOS does not set ...


40

For most home users, the only internet-facing device is their router. So, how do you secure the router from stuff like Shodan? Firstly, change the default password. Anyone armed with an IP scanning tool (Angry IP Scanner is the one I've tried) can find you if they input the relevant IP range and break in with the bog standard admin/admin login. What can ...


38

Please keep in mind the Holy Trinity of Information Security: C(onfidentiality), I(ntegrity), and A(vailability). So when we talk about configuration hardening you need to consider the technology you're working with, the information being protected, how the information is used within the organization, and the threats. Based on those answers, and possibly ...


29

You have a good discussion here: https://wiki.mozilla.org/Security/Guidelines/OpenSSH On modern OpenSSH they recommend: KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,...


27

Coming from a security role, particularly if you've ever been involved in incident response, the idea of outbound filtering would seem a natural course in a high security environment. However, it is a very large and complex undertaking. Mention the words "egress filtering" to a firewall, network, or systems administrator and you'll likely get this ...


27

Although the details greatly vary between architectures, what I say here applies equally well to 32-bit x86, 64-bit x86, but also ARM and PowerPC: faced with the same issues, about all architecture designers have used similar solutions. There are (roughly speaking) four kinds of "accesses", at assembly level, which are relevant to the "position-independent" ...


26

To be honest, I don't understand these things too much, I just want strong encryption and everything I don't know what you mean by "everything" but if you just want strong encryption then don't mess with the default settings - its possible they could be more secure but you are more likely to break the security than improve it if you don't know what you are ...


25

Your question is rather broad, touching on several different subjects. It may be better to take some of the details and put them in a separate question. Is it enough to forbid su and allow sudo in order to keep the traceability of the administrator actions? ... can sudo command have utility without a strong sudoer configuration ? which ones ? Unrestricted ...


23

It's a long question but I think your main point is this: We wish to simplify the accessing of the cameras over multiple devices (tablet, phone, PC?). First have a look how SSH keys work. That would work for you mostly as it is. At first the customers public key is added into his camera during the initial configuration. He can authenticate himself using ...


22

Unless you block all outgoing traffic other than a whitelist of legitimate websites you visit (and/or use a proxy that does whitelisting and security scanning), there's little additional security to be gained from blocking all ports except 80/443. Well, blocking port 25 might be good to keep your network from being used to send spam. Many botnets already ...


21

Some commentary: Defending from common thieves Rather than wiping Windows 7, I've left it as a honeypot operating system. If a thief steals the laptop, when they turn it on, it will automatically boot up into Windows, without so much as even being prompted for a password. I installed a free application called Prey which will allow me to grab loads of ...


15

grsecurity (a.k.a. grsec) isn't really a program - it's a hardening suite for Linux. It includes the following: A fully comprehensive Role-Based Access Security (RBAC) system. grsec-hardened kernel patches. Enhanced PaX implementation. chroot restrictions (misc features to prevent malware from escaping a chroot jail) General system security improvements. ...


15

So the short answer is that if you're providing a publicly available service (e.g. to the general Internet) your service has to be accessible and therefore search engines like shodan can find it, and all shodan does it to index publicly available information. What you can do is minimize the information that shodan finds, by removing banners from ...


13

Data in L1 cache will not remain in L1 cache only; the hardware will copy it to main RAM transparently and almost immediately. At least so operate modern CPU. If you want to keep sensitive data out of RAM, then you must keep it in registers only. Context switches will be a problem, also, since they automatically flush registers to a designated RAM space. ...


13

Any bug in the handling of USB devices can be exploited by malicious hardware. That's how the PS3 Jailbreak worked. Remember that when you plug a "USB Flash drive" in a machine, you cannot be sure that what you plug is really "just a Flash drive". The machine sees it as a "USB device" which may claim to be a keyboard, a mouse, a network interface... A ...


12

Incoming traffic blocking can only prevent unsolicited traffic from reaching your internal network. However, if you get malware on an internal machine (via running an untrusted executable, or through an exploit) you can still be hit. Blocking outgoing traffic helps limit the damage, by preventing the malware from connecting to a command & control server ...


12

The split into one or several partitions is not really a problem of security but of reliability. The idea is that if one of your partitions is crashed, then you lose the contents of that partition, but the other partitions are fine. Also, if you fill up that partition, then other partitions are unaffected. Each partition can have its own filesystem, and not ...


12

You're probably using one of the possible tools right now. Both Firefox and Chrome have developer tools that allow you to see both the request and response headers for any request that is made. In Firefox go to Tools -> Web Developer -> Network and then make a new request by clicking on a link or refreshing the page. In Chrome, go to the menu -> Tools -> ...


12

Throw out < 2048 bit builtin moduli On the server: Have a look at your sshd_config and throw out the diffie-hellman-group1-sha1 if it appears in the KexAlgorithms section. And restart SSHD. Check with Nmap how can I test if that is good enough? Get Nmap and run the `ssh2-enum-algos' script against the SSH server. The diffie-hellman-group1-sha1 must not ...


11

To focus on your individual cases: Absolutely anything he wants. Malware, rootkits, backdoors, keyloggers, the whole shebang. Again, absolutely anything. It's exactly the same as having the USB disk, because he can set up a site where he can download the files he needs, or just download them from existing sites. Wipe the disk, delete system files, write ...


11

Following config can provide higher security level while keeping some degree of compatibility and reduce configuration complexity. WARNING: The following configuration is not compatible with all clients # Change the port number avoid automated attack Port 2222 # Limit to SSH2 only (the default value) Protocol 2 # Use RSA and Ed25519 host key only HostKey ...


11

I am assuming that there is some reason you can't use a dozen different laptops in multiple countries or jurisdictions doing the same activities to provide extremely high redundancy (as pointed out in a comment on the question). If any of the laptops have results that differ, at least one of them can be assumed compromised and incident response can kick in. ...


10

One reason why some Linux distributions may be hesitant to compile all executables as Position-Independent Executables (PIE), so the executable code is randomized, is because of concerns about performance. The thing about performance concerns is that sometimes people worry about performance even when it's not an issue. So, it would be nice to have detailed ...


10

TL;DR: R*PATH has an unfortunate history of introducing new ways of running untrusted (attacker-controlled) libraries. RPATH/RUNPATH is usually avoidable and should be avoided. Firstly, it might be worth reviewing the non-security reasons for why we want these binaries flagged: distros (Eg. Debian Wiki on RPATH) don't like that it takes precedence over the ...


10

First and foremost: if you want security, don't use MIFARE cards. They aren't the best at security. Even if a card isn't vulnerable to something like a hardnested attack or a brute-force attack, the card's data can still be sniffed over-the-air (which will include the keys or allow keys and data to be easily recovered). Generally, most "secure" ...


9

Polynomial has already written a very good analysis, but there are a few extra points worth mentioning. Partial analysis Defending from common thieves Case 1: the thief is after the hardware. He's going to fence it and reinstall the OS first thing. The odds that he'll boot into Windows and try using it are low (not zero: there is such a thing as a dumb ...


Only top voted, non community-wiki answers of a minimum length are eligible