296
votes
Accepted
Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?
An IP address can be set up in DNS to resolve to any host name, by whoever is in control of that IP address.
For example, if I am in control of the netblock 203.0.113.128/28, then I can set up 203.0....
- 7,765
198
votes
Accepted
Is it theoretically possible to deploy backdoors on ports higher than 65535?
No, the port number field in a TCP header is technically limited to 2 bytes. (giving you 2^16=65536 possible ports)
If you alter the protocol by reserving more bits for higher ports, you're violating ...
- 44.7k
194
votes
Accepted
Isn't Ubuntu's system prompt for my password spoofable?
Your points are all good, and you are correct, but before we get outraged about it we need to remind ourselves how the linux security model works and what it's designed to protect.
Remember that the ...
- 58.8k
141
votes
Accepted
How to investigate an unknown 1.5GB file named "sudo" in my Linux home directory?
You probably made it by accident with a botched shell command. I've done stuff like that myself. As a result it is probably filled with innocuous data. Here are a few reasons why I would guess it is ...
- 31k
137
votes
Accepted
How would disabling IPv6 make a server any more secure?
From a firewall perspective it is important to realize that both IPv4 and IPv6 (if enabled) are configured on a system and this is not always the case.
In my experience, I have been able to bypass (...
- 5,851
120
votes
Accepted
Why are files that are not assigned to a user considered a security risk?
On a Linux system you can easily delete a user without having to delete any files owned by that user. Such a file will stay in place and the file owner's user ID (which is stored as an attribute of ...
- 44.7k
119
votes
Accepted
Is it possible to "fake" being connected to a router?
Well, obviously it's not "foolproof". Depending on your capabilities, there are plenty of ways to cheat.
Your professor has a point in that your standard wireless network card won't simply support a ...
- 44.7k
104
votes
Accepted
What is the point of encrypting the home directory?
The point is to protect against your disk being accessed outside of the OS.
Encryption is useful against attackers who have physical access to your computer. Without it, it would be trivial to read ...
- 29.5k
101
votes
Accepted
Hardening Linux desktop machine against people from my household
Use a strong and difficult password for the root user. Secondly, always login and work from another user with no administrative rights (and also a strong password).
Enable the BIOS password option. ...
- 1,767
101
votes
Accepted
Should the sole user of a *nix system have two accounts?
Updated dramatically after 69 upvotes, see answer history for original answer. Thanks to @JimmyJames for the discussion.
First, let's talk about threat model: what are you trying to stop the ...
- 58.8k
100
votes
Accepted
What is happening now with the Grub backspace key security vulnerability?
The main thing that is happening is that the bug is being seriously overhyped.
Exploiting this vulnerability requires physical access to the computer during startup, and if you've got physical access,...
- 34.6k
100
votes
Accepted
Why is root security enforced but $HOME typically unprotected?
I'm going to disagree with the answers that say the age of the Unix security model or the environment in which it was developed are at fault. I don't think that's the case because there are ...
- 1,618
98
votes
Hardening Linux desktop machine against people from my household
I hate to be this guy, but
Law 3:
If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore.
You are asking how to best lock a plywood door. People are ...
- 2,392
98
votes
Accepted
Reason to not use chmod -R 777 on internal server for project source code?
However, after putting some thought into it I can't come up with a
reason why shared executable code on an internal server shouldn't have
777 permissions.
Because you're not only trusting every ...
- 72.7k
90
votes
Are most Linux systems that allow non-root users to execute code straightforwardly rootable?
No, this is not correct. While one may argue about the relative difficulty of finding and exploiting 0day vulnerabilities on Linux when you have local access, the security architecture itself of a ...
- 66.5k
84
votes
I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?
You could write some Python code to upload an SSH server binary and then run it, this will give you full SSH access under the privileges of the Apache user.
From there you can easily read the Python ...
- 12.8k
80
votes
Program claiming a dedicated user to run itself
Clamav is a daemon. The Linux Standard Base Core Specification recommends that daemons run under individual User IDs. This way you have fine-grained access control for each daemon, and in case one of ...
- 799
77
votes
Accepted
Is running "apt-get upgrade" every so often enough to keep a Web-server secure?
You've removed a lot of problems that normally get you in trouble (namely, assuming that the app you're hosting is completely secure). From a practical perspective, you absolutely have to consider ...
- 9,432
73
votes
Accepted
Can the previewable option in file managers execute malware?
Yes, it is possible for previews to execute malicious code. Previews are created by checking the file type, and generating a thumbnail. For images, it resizes them. For videos, it decodes them, seeks ...
- 66.5k
70
votes
Hardening Linux desktop machine against people from my household
Depending on the performance you require and money you are willing to expend, a removable "Live USB" or completely bootable normal system on a USB "hard drive" (a small ssd would work great) might be ...
- 3,966
66
votes
Accepted
Why is SUID disabled for shell scripts but not for binaries?
There is a race condition inherent to the way shebang (#!) is typically implemented:
The kernel opens the executable, and finds that it starts with #!.
The kernel closes the executable and opens the ...
66
votes
Accepted
Is having a hidden directory under /etc safe?
Yes, that's safe. There's nothing inherently insecure about having a hidden directory under /etc. The only reason rkhunter flags it is that it's uncommon for legitimate programs to do it, and when ...
66
votes
Accepted
Can you create a fake (malicious) Ubuntu iso
If an OS is open source or not is not the important factor if someone could build a malicious installer image.
Recent versions of Windows use a technique that bases on WIM images which can be ...
- 1,423
66
votes
Why do I need the root password when mounting an internal drive in Linux?
Mounting filesystems has multiple very high security risks, and should not be taken lightly.
Having said that, there are multiple tools (like udisks and the user option in fstab) that run with ...
- 1,975
64
votes
Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?
You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) ...
- 66.5k
64
votes
Accepted
What metadata from the Linux file system is in my uploaded photos?
the linux file system itself seems to leave some metadata on a file
User, group etc are meta data stored in the file system. They are not part of the file and thus will not be included when uploading ...
- 199k
63
votes
Accepted
Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?
Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank ...
- 5,734
63
votes
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
/proc/<pid>/fd/0 can only be read by the process owner and root. /proc/<pid>/cmdline can be read by all users.
62
votes
Accepted
Ability To Change Root User Password (Vulnerability?)
You pretty much hit the nail on the head when you said that you need physical access to the machine.
If you have physical access, you don't need to go through the official steps to reset the root ...
- 6,040
61
votes
Accepted
Why is there a need to modify system call tables in Linux?
You can check if they are read-only by looking up the kernel symbols. The "R" means read-only.*
$ grep sys_call_table /proc/kallsyms
0000000000000000 R sys_call_table
0000000000000000 R ...
- 66.5k
Only top scored, non community-wiki answers of a minimum length are eligible