89

Shodan references publicly available machines which work like this: Just don't do it. Edit: analogy is relevant ! Shodan connects to machines and asks for their "banner", a publicly available text which may simply say: "to enter, use this default password: 1234". You might want to avoid people knocking at the door by the simple expedient of installing a ...


63

The Shodan project is pretty cool, but at its core isn't much more than a big honkin nmap database. The project has scanners that routinely scan the Internet and publish the findings into the database. That database is what you're searching. Since they are using standard detection routines the protections you would put in for a normal scan should protect you ...


61

Absolutely not. The BIOS password is only an authentication mechanism presented when the system boots or when a manual change to the configuration is made during boot. Malware which overwrites the BIOS typically does so by writing over SPI, the interface which the BIOS resides on. If malware gets enough privileges to write to SPI, and your BIOS does not set ...


40

For most home users, the only internet-facing device is their router. So, how do you secure the router from stuff like Shodan? Firstly, change the default password. Anyone armed with an IP scanning tool (Angry IP Scanner is the one I've tried) can find you if they input the relevant IP range and break in with the bog standard admin/admin login. What can ...


38

Please keep in mind the Holy Trinity of Information Security: C(onfidentiality), I(ntegrity), and A(vailability). So when we talk about configuration hardening you need to consider the technology you're working with, the information being protected, how the information is used within the organization, and the threats. Based on those answers, and possibly ...


29

You have a good discussion here: https://wiki.mozilla.org/Security/Guidelines/OpenSSH On modern OpenSSH they recommend: KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,...


27

Although the details greatly vary between architectures, what I say here applies equally well to 32-bit x86, 64-bit x86, but also ARM and PowerPC: faced with the same issues, about all architecture designers have used similar solutions. There are (roughly speaking) four kinds of "accesses", at assembly level, which are relevant to the "position-independent" ...


26

Your question is rather broad, touching on several different subjects. It may be better to take some of the details and put them in a separate question. Is it enough to forbid su and allow sudo in order to keep the traceability of the administrator actions? ... can sudo command have utility without a strong sudoer configuration ? which ones ? Unrestricted ...


26

To be honest, I don't understand these things too much, I just want strong encryption and everything I don't know what you mean by "everything" but if you just want strong encryption then don't mess with the default settings - its possible they could be more secure but you are more likely to break the security than improve it if you don't know what you are ...


23

It's a long question but I think your main point is this: We wish to simplify the accessing of the cameras over multiple devices (tablet, phone, PC?). First have a look how SSH keys work. That would work for you mostly as it is. At first the customers public key is added into his camera during the initial configuration. He can authenticate himself using ...


15

So the short answer is that if you're providing a publicly available service (e.g. to the general Internet) your service has to be accessible and therefore search engines like shodan can find it, and all shodan does it to index publicly available information. What you can do is minimize the information that shodan finds, by removing banners from ...


13

Data in L1 cache will not remain in L1 cache only; the hardware will copy it to main RAM transparently and almost immediately. At least so operate modern CPU. If you want to keep sensitive data out of RAM, then you must keep it in registers only. Context switches will be a problem, also, since they automatically flush registers to a designated RAM space. ...


13

Any bug in the handling of USB devices can be exploited by malicious hardware. That's how the PS3 Jailbreak worked. Remember that when you plug a "USB Flash drive" in a machine, you cannot be sure that what you plug is really "just a Flash drive". The machine sees it as a "USB device" which may claim to be a keyboard, a mouse, a network interface... A ...


12

The split into one or several partitions is not really a problem of security but of reliability. The idea is that if one of your partitions is crashed, then you lose the contents of that partition, but the other partitions are fine. Also, if you fill up that partition, then other partitions are unaffected. Each partition can have its own filesystem, and not ...


12

You're probably using one of the possible tools right now. Both Firefox and Chrome have developer tools that allow you to see both the request and response headers for any request that is made. In Firefox go to Tools -> Web Developer -> Network and then make a new request by clicking on a link or refreshing the page. In Chrome, go to the menu -> Tools -> ...


12

Throw out < 2048 bit builtin moduli On the server: Have a look at your sshd_config and throw out the diffie-hellman-group1-sha1 if it appears in the KexAlgorithms section. And restart SSHD. Check with Nmap how can I test if that is good enough? Get Nmap and run the `ssh2-enum-algos' script against the SSH server. The diffie-hellman-group1-sha1 must not ...


11

Following config can provide higher security level while keeping some degree of compatibility and reduce configuration complexity. WARNING: The following configuration is not compatible with all clients # Change the port number avoid automated attack Port 2222 # Limit to SSH2 only (the default value) Protocol 2 # Use RSA and Ed25519 host key only HostKey ...


11

I am assuming that there is some reason you can't use a dozen different laptops in multiple countries or jurisdictions doing the same activities to provide extremely high redundancy (as pointed out in a comment on the question). If any of the laptops have results that differ, at least one of them can be assumed compromised and incident response can kick in. ...


10

One reason why some Linux distributions may be hesitant to compile all executables as Position-Independent Executables (PIE), so the executable code is randomized, is because of concerns about performance. The thing about performance concerns is that sometimes people worry about performance even when it's not an issue. So, it would be nice to have detailed ...


10

TL;DR: R*PATH has an unfortunate history of introducing new ways of running untrusted (attacker-controlled) libraries. RPATH/RUNPATH is usually avoidable and should be avoided. Firstly, it might be worth reviewing the non-security reasons for why we want these binaries flagged: distros (Eg. Debian Wiki on RPATH) don't like that it takes precedence over the ...


10

First and foremost: if you want security, don't use MIFARE cards. They aren't the best at security. Even if a card isn't vulnerable to something like a hardnested attack or a brute-force attack, the card's data can still be sniffed over-the-air (which will include the keys or allow keys and data to be easily recovered). Generally, most "secure" ...


9

Stricto sensu, you cannot really have a generic test. In HTTP, the client announces whether it supports compression with an Accept-Encoding header line. The server will then feel allowed to use these compression schemes. @Adnan points to this blog post which describes how one can manually send a HTTP request to a server and see what the server responds with. ...


9

There is some good information here. Apparently, a DLL can be subject to ASLR only if it is tagged as such, because of "backward compatibility issues". Although a DLL is, by nature, meant to be relocated, I can imagine that some (poorly) written software may do some tricks which rely on the DLL ending up in a relatively small range of the address space (a ...


9

There are a few ways to solve this situation. One is to have the camera always encrypt one of the session keys to a camera backup key. The camera backup key is generated on account setup of the camera and a password is generated that is used to encrypt the backup key. This password is never stored on the camera itself. Your online storage would store the ...


9

I'd refer you to the CIS Benchmarks for hardening guidelines. The current CIS Benchmark for Docker can be found here. These are an accepted industry standard for baseline hardening. They also offer guidelines for Linux et al, Web servers, DBs, etc.


8

The Wikipedia page shows that the answer is "it depends". There are multiple implementations and patches around. The important points to consider are the following: A Linux executable consists in a main binary, and DLL (shared objets) loaded dynamically. In traditional Linux, the main binary is at a fixed address chosen at link time, while DLL are position-...


8

You should at least hash the passwords. Use a secure hash function, e.g. SHA-256 to hash a password and store it like this. When generating a new password, you can send the user the new password, but hash it and store the hashed version in the camera/database. When checking if password is correct, hash the password that has been input and compare it to ...


8

Try filtering by ssl.record.version For example, if you wanted to only display TLS v1.2 traffic then you could run ssl.record.version == 0x0303 You can choose from the hex values below for the version that fits your needs. Versions: 0x0300 SSL 3.0 0x0301 TLS 1.0 0x0302 TLS 1.1 0x0303 TLS 1.2 To avoid using the GUI or to automate this further you could ...


8

I doubt you'll find any virus which is completely benign (even fixing a vulnerability after exploiting it is still malicious behavior, even if it is intended to be beneficial), but there are plenty of examples of exploits which are. The most well-known would have to be jailbreak exploits, where a vulnerability in a proprietary and closed system is attacked ...


Only top voted, non community-wiki answers of a minimum length are eligible