51
votes
Accepted
How can data from VirtualBox leak to the host and how to avoid it?
You are doing it the wrong way around: you have an untrusted host system running a hypervisor and you are trying to run a trusted environment inside this untrusted host. But, the untrusted host system ...
- 199k
29
votes
How can data from VirtualBox leak to the host and how to avoid it?
The data didn't "leak" onto the host. The data always was on the host to begin with. The files inside the guest are stored in the virtual hard drive file, and the virtual hard drive file is ...
- 391
26
votes
ESTABLISHED TCP connections after opening browser in linux
I'm not going to try and track down the individual connections in that list, but broadly speaking, yeah, it's extremely common for software to automatically make some TCP connections upon starting. ...
- 46.4k
19
votes
Accepted
Escalating user privileges on Linux
There is a very useful site called GTFOBins that has details about lots of different *NIX binaries, and how they can be used to privesc or perform various other actions. Going through the list of SUID ...
- 9,307
13
votes
Escalating user privileges on Linux
There's a fairly well-known exploit on chfn: https://github.com/advisories/GHSA-5896-67mw-rv4j
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The ...
- 237
10
votes
ESTABLISHED TCP connections after opening browser in linux
In most systems, this is the new normal.
There is vendor documentation on why you might find some of them desirable, as well as how to stop most automatic connections made by Firefox. However, as with ...
- 370
10
votes
Escalating user privileges on Linux
Among those binaries, that date is setuid seems very suspicious, as spotted by marcelm
If you look at the options supported by date, it has a -f option which displays the time described by each line ...
- 18.8k
6
votes
How to find and disable specific ciphers on Linux?
You need to configure the application that uses libssl to implement the TLS protocol. you don't need to configure openssl. For example, if you use Apache httpd webserver or nginx webserver or some ...
- 8,434
6
votes
Accepted
User isolation in LAMP
In a production environment, such as a commercial web hosting service, what kind of setup can I expect to find?
In small operations (i.e. not separated virtual instances), I've usually seen this done ...
- 22.8k
3
votes
What is a safer Linux installation mode: dualboot or virtual machine?
Neither one makes much difference, but the non-VM approach is marginally safer. The odds of any Windows malware seeking out and attacking a Linux installation on the same machine are extremely low, ...
- 46.4k
3
votes
ESTABLISHED TCP connections after opening browser in linux
It may be "normal", but it's not okay. At least for Firefox, there is a detailed guide published by Mozilla to disabling all of the huge number of "automatic connections" made for &...
3
votes
What is the most secure way to transfer untrusted data between containers?
An important point in this is to realise that containers are essentially just processes running on a host.
Assuming you're using a solution that will always be single host (e.g. Docker with Docker ...
- 62.1k
3
votes
Accepted
Linux BPFtrace - user switch from suid bit applications not detected
The tracepoints from bpftrace only captures syscalls but does not capture other functions, which are executed inside the Linux kernel.
This is an important difference, because the suid bit is ...
- 1,366
3
votes
Why is the mount option "hidepid=2" not used by default, is there a danger in using it?
Here is an article that discusses some problems with hidepid=1 and hidepid=2, and recommends against using it on RHEL, at least until software like systemd is able to handle it better.
RHEL systemd ...
- 299
3
votes
Accepted
accessing ELF in memory (Unix/Linux)
You can read the copy of the ELF (PT_LOAD) segments loaded in memory through process_vm_ready() and such. You can patch the read-only ELF segments using ptrace PTRACE_POKETEXT. This is used to insert ...
- 1,382
3
votes
Generating a SHA-256 hash from the Linux command line
I know the string "03a3... " generates the SHA-256 hash 4c0b... using https://privatekeys.pw/calc
The string does not result in this hash. What you likely mean is not to treat the string as ...
- 199k
3
votes
NULL dereference - Why does it work?
This is mostly a question about operating system architecture. Fundamentally, though, the reason is simply "because the CPU is allowed to access user-mode addresses even while the current thread ...
- 46.4k
2
votes
Is WSL 2 secure for commercial work?
Updated answer:
In a word: yes and no.
Why?
It can be made more secure to an extent by running as a different user, although this requires some tricky maneuvering..
AccountA is administrator-level
...
- 121
2
votes
user namespaces: do they increase security, or introduce new attack surface?
In general each added feature adds complexity and each added complexity increases the attack surface.
How much complexity is actually added depends both on the feature but also on the design of the ...
- 199k
2
votes
Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C
I would probably think that this is due to you trying to execute code which is stored in the heap (your shellcode table). The heap in x86-64 architecture does not allow executable code.
One way to get ...
- 21
2
votes
Accepted
SSH - What is the relationship between fingerprint and known_hosts file?
In SSH, all servers have at least one key pair (that is, a matching public and private key). In addition, it's possible for the client to authenticate with a key pair, which is completely and totally ...
- 9,294
2
votes
Fake process after Ubuntu install
The one-liner command from the article looks for any process on your system that has an opening square bracket ([) in the process name or arguments. This is a rather naive check, as a process could ...
- 12.7k
2
votes
disabling root login and using rescue mode
Ignore the finding that wants you to make rescue and emergency mode ask for the root password. Instead, protect your data from a local attacker who can reboot your computer by enabling full-disk ...
2
votes
Doing a diff between two keystore files
md5 is a worst idea. If a single bit changes, the hash will change.
You need to export the contents of each keystore and compare the relevant fields of them, not every single bit of information.For ...
- 53.6k
1
vote
How to find and disable specific ciphers on Linux?
You can find the equivalence between the proper RFC name as reported by security and the OpenSSL name (that differs for historical reasons) in the following page: https://wildwolf.name/mapping-openssl-...
- 5,487
1
vote
How can data from VirtualBox leak to the host and how to avoid it?
You don't give much details about the tool you used to discover the sensitive files, but many commercially available data recovery utilities can do much the same. The virtual machine disks are just ...
- 119
1
vote
How to protect files in use on a system powered on from physical theft or tampering?
Your first step is to ensure that the system reliably locks when not in use (sleep mode or session lock).
The laptop may be powered on, but at that point the only ways to access the data are network ...
- 22.8k
1
vote
What're the most common vulnerabilities/weaknesses an attacker would exploit to gain SSH access to a container?
There's a couple of ways that an attacker might get access to a container. First one is by compromising the application running in the container.
Essentially many containers will run things like web ...
- 62.1k
1
vote
Preventing low-skill physical access by creating fake desktop environment
The mitigations to physical access are:
Physical security
User access control (Passwords/smart cards/etc)
Hard drive encryption
Obfuscation will never replace any of these, no matter how tempting it ...
- 2,017
Only top scored, non community-wiki answers of a minimum length are eligible