294
votes
Accepted
Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?
An IP address can be set up in DNS to resolve to any host name, by whoever is in control of that IP address.
For example, if I am in control of the netblock 203.0.113.128/28, then I can set up 203.0....
- 7,815
198
votes
Accepted
Is it theoretically possible to deploy backdoors on ports higher than 65535?
No, the port number field in a TCP header is technically limited to 2 bytes. (giving you 2^16=65536 possible ports)
If you alter the protocol by reserving more bits for higher ports, you're violating ...
- 45k
195
votes
Accepted
Isn't Ubuntu's system prompt for my password spoofable?
Your points are all good, and you are correct, but before we get outraged about it we need to remind ourselves how the linux security model works and what it's designed to protect.
Remember that the ...
- 59.2k
141
votes
Accepted
How to investigate an unknown 1.5GB file named "sudo" in my Linux home directory?
You probably made it by accident with a botched shell command. I've done stuff like that myself. As a result it is probably filled with innocuous data. Here are a few reasons why I would guess it is ...
- 31.5k
136
votes
Accepted
How would disabling IPv6 make a server any more secure?
From a firewall perspective it is important to realize that both IPv4 and IPv6 (if enabled) are configured on a system and this is not always the case.
In my experience, I have been able to bypass (...
- 5,851
119
votes
Accepted
Why are files that are not assigned to a user considered a security risk?
On a Linux system you can easily delete a user without having to delete any files owned by that user. Such a file will stay in place and the file owner's user ID (which is stored as an attribute of ...
- 45k
117
votes
Accepted
Is it possible to "fake" being connected to a router?
Well, obviously it's not "foolproof". Depending on your capabilities, there are plenty of ways to cheat.
Your professor has a point in that your standard wireless network card won't simply support a ...
- 45k
103
votes
Accepted
What is the point of encrypting the home directory?
The point is to protect against your disk being accessed outside of the OS.
Encryption is useful against attackers who have physical access to your computer. Without it, it would be trivial to read ...
- 29.7k
102
votes
Accepted
Should the sole user of a *nix system have two accounts?
Updated dramatically after 69 upvotes, see answer history for original answer. Thanks to @JimmyJames for the discussion.
First, let's talk about threat model: what are you trying to stop the ...
- 59.2k
99
votes
Accepted
Why is root security enforced but $HOME typically unprotected?
I'm going to disagree with the answers that say the age of the Unix security model or the environment in which it was developed are at fault. I don't think that's the case because there are ...
- 1,608
98
votes
Accepted
Reason to not use chmod -R 777 on internal server for project source code?
However, after putting some thought into it I can't come up with a
reason why shared executable code on an internal server shouldn't have
777 permissions.
Because you're not only trusting every ...
- 73.2k
90
votes
Are most Linux systems that allow non-root users to execute code straightforwardly rootable?
No, this is not correct. While one may argue about the relative difficulty of finding and exploiting 0day vulnerabilities on Linux when you have local access, the security architecture itself of a ...
- 67.1k
80
votes
Program claiming a dedicated user to run itself
Clamav is a daemon. The Linux Standard Base Core Specification recommends that daemons run under individual User IDs. This way you have fine-grained access control for each daemon, and in case one of ...
- 799
77
votes
Accepted
Is running "apt-get upgrade" every so often enough to keep a Web-server secure?
You've removed a lot of problems that normally get you in trouble (namely, assuming that the app you're hosting is completely secure). From a practical perspective, you absolutely have to consider ...
- 9,452
73
votes
Accepted
Can the previewable option in file managers execute malware?
Yes, it is possible for previews to execute malicious code. Previews are created by checking the file type, and generating a thumbnail. For images, it resizes them. For videos, it decodes them, seeks ...
- 67.1k
67
votes
Accepted
Why is SUID disabled for shell scripts but not for binaries?
There is a race condition inherent to the way shebang (#!) is typically implemented:
The kernel opens the executable, and finds that it starts with #!.
The kernel closes the executable and opens the ...
66
votes
Accepted
Can you create a fake (malicious) Ubuntu iso
If an OS is open source or not is not the important factor if someone could build a malicious installer image.
Recent versions of Windows use a technique that bases on WIM images which can be ...
- 1,461
65
votes
Accepted
Is having a hidden directory under /etc safe?
Yes, that's safe. There's nothing inherently insecure about having a hidden directory under /etc. The only reason rkhunter flags it is that it's uncommon for legitimate programs to do it, and when ...
65
votes
Why do I need the root password when mounting an internal drive in Linux?
Mounting filesystems has multiple very high security risks, and should not be taken lightly.
Having said that, there are multiple tools (like udisks and the user option in fstab) that run with ...
- 2,041
64
votes
Accepted
What metadata from the Linux file system is in my uploaded photos?
the linux file system itself seems to leave some metadata on a file
User, group etc are meta data stored in the file system. They are not part of the file and thus will not be included when uploading ...
- 206k
63
votes
Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?
You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) ...
- 67.1k
63
votes
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
/proc/<pid>/fd/0 can only be read by the process owner and root. /proc/<pid>/cmdline can be read by all users.
62
votes
Accepted
Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?
Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank ...
- 5,754
62
votes
Accepted
Ability To Change Root User Password (Vulnerability?)
You pretty much hit the nail on the head when you said that you need physical access to the machine.
If you have physical access, you don't need to go through the official steps to reset the root ...
- 6,080
61
votes
Accepted
Why is there a need to modify system call tables in Linux?
You can check if they are read-only by looking up the kernel symbols. The "R" means read-only.*
$ grep sys_call_table /proc/kallsyms
0000000000000000 R sys_call_table
0000000000000000 R ...
- 67.1k
60
votes
Accepted
How can I prevent a user from copying files to another hard drive?
You can disable USB storage on Linux by blacklisting the module.
modprobe -r usb-storage
echo blacklist usb-storage >> /etc/modprobe.d/10-usbstorage-blacklist.conf
echo blacklist uas >> /...
- 16.9k
59
votes
How "scrambled" is the data on a RAID5 disk?
Raid 5 stripes the data across the disks but the blocks used for striping are typically pretty big. At the very least they will bewhole sectors but normally they will much larger than that. For ...
- 5,337
57
votes
Accepted
Is LUKS still an effective option for consumer FDE considering Elcomsoft can break it?
No, Elcomsoft cannot break LUKS or Veracrypt. What they do is to guess the password. Any password-based encryption mechanism can be broken by guessing the password: this is not a flaw in the ...
55
votes
What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?
It can't be exploited remotely without another vulnerability. You need to be able to execute commands on the system already.
A classic example would be a web shell. Say the server is running a web ...
- 1,253
55
votes
Why is root security enforced but $HOME typically unprotected?
Because the UNIX-based security model is 50 years old.
UNIX underlies most widespread OSs, and even the big exception Windows has been influenced by it more than is apparent. It stems from a time ...
- 907
Only top scored, non community-wiki answers of a minimum length are eligible