253
votes
Accepted
Why is "fhepfcelehfcepfffacacacacacacabn" a top DNS query from my devices?
That domain is an encoded form of the string "WORKGROUP". It is using a variant of hex encoding that uses the letters A-P, instead of the numbers 0-9 followed by A-F.
$ echo ...
- 866
140
votes
Accepted
Mac OS X terminal prompt displaying foreign hostname (or: What is Stacey's iPhone doing in my Terminal?)
At some point, your network assigned StaceysiPhone6s an IP address. Then, your laptop got that IP address. Your Mac then looked up the DHCP logs to find out who 'owned' that IP and found "...
- 132k
102
votes
Accepted
Should the sole user of a *nix system have two accounts?
Updated dramatically after 69 upvotes, see answer history for original answer. Thanks to @JimmyJames for the discussion.
First, let's talk about threat model: what are you trying to stop the ...
- 59.2k
75
votes
Accepted
Is it insecure to send a password in a `curl` command?
Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.
Locally this might be less secure, because:
The password gets saved to the ...
- 19.2k
66
votes
Accepted
Can you create a fake (malicious) Ubuntu iso
If an OS is open source or not is not the important factor if someone could build a malicious installer image.
Recent versions of Windows use a technique that bases on WIM images which can be ...
- 1,461
47
votes
Accepted
How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)
At a high level, disk encryption is implemented using a data encryption key (DEK) and a key encryption key (KEK). The DEK is generated randomly and used to encrypt the drive, the KEK is derived from ...
- 15.8k
44
votes
How can a non-admin program cover your entire screen with a window?
Fullscreen is easy: The vast majority of video games, for example, do it. I don't know if Windows has a dedicated API call for this, but if it doesn't, it's easy to fake: Just make a screen-sized ...
- 34.8k
38
votes
How can a non-admin program cover your entire screen with a window?
A fullscreen app in C#:
using System;
using System.Windows.Forms;
namespace FullScreen
{
static class Program
{
[STAThread]
static void Main()
{
...
- 3,424
36
votes
Accepted
Stolen MacBook: should I worry about my data?
Your data is probably* safe if the following three criteria are met:
You have FileVault turned on (full disk encryption).
Your laptop requires a password on boot and every time you open the lid (auto ...
- 2,366
34
votes
Why is "fhepfcelehfcepfffacacacacacacabn" a top DNS query from my devices?
Update: The explanation given by NextDNS support is wrong, see this answer by Miles instead.
I contacted NextDNS support asking for more details and they said this is Google Chrome testing internet ...
- 862
31
votes
Can you create a fake (malicious) Ubuntu iso
First of all:
This would require a faked checksum as well, but that is somewhat besides the point because it can be faked too.
What do you mean by faked? If the user checks the checksum against the ...
- 583
26
votes
Should the sole user of a *nix system have two accounts?
In most situations, requiring a password with sudo is sufficiently enough protection.
The primary difference between suing to another account and sudoing to gain privileges is that with sudo you ...
- 9,452
20
votes
Accepted
hashcat specify number of characters
Let me break down, what you want and what the equivalent hashcat options are.
Hash-Type
You want to crack a OSX v10.8+ hash, which according to the hashcat example hashes page (https://hashcat.net/...
- 3,848
20
votes
Stolen MacBook: should I worry about my data?
I unlocked a Mac laptop that a friend "found in a bin" without knowing the password and accessed all data on it. After a quick bit of googling I created a new account and reset the existing account ...
- 301
18
votes
Accepted
What encryption method is used by the zip program in macOS?
It's using the original PKZIP 2.0 encryption (variously referred to as "traditional" or "legacy" encryption), described in section 6 of the .ZIP file format specification. It's ...
- 2,611
17
votes
Accepted
HTTPS connection to specific sites fail with cURL on macOS
Root CA certificates used by the mentioned sites (Comodo and USERTrust) have expired this morning (UTC time). While I find it remarkable that two different Root CA certs would expire at the exact same ...
- 451
17
votes
Accepted
Understanding ssh-rsa not in PubkeyAcceptedAlgorithms
The name ssh-rsa has two different meanings here.
There's the key type ssh-rsa which you can see in the first column of your authorized_keysfile. RSA keys are perfectly fine and widely supported.
...
- 17.1k
14
votes
Accepted
What are the security implications of homebrew and macports?
If I am understanding your question correctly, it boils down to:
Homebrew changes the permissions of /usr/local/bin from the default drwxr-xr-x root wheel to the less secure drwxrwxr-x myuser admin....
- 59.2k
14
votes
How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)
I completely agree with AndrolGenhald's high-level answer. In case you are interested in a complementary low-level walk-through of Android's storage encryption implementation:
Android can do File-...
12
votes
Is Mac OS safer to use as far as firmware rootkits, cold boot attacks and evil maid?
Are there any things like TPM and Secure boot for Mac to protect against these security problems?
Short version: Yes, and recent Macs have some very good security features like hardware-based RAM ...
- 50.3k
11
votes
Are X.509 nameConstraints on certificates supported on OS X?
Yes, OS X / macOS supports this since 10.13.3.
According to the https://nameconstraints.bettertls.com archived tests, 10.13 failed some tests but 10.13.3 passes all in with both Safari and Chrome.
...
- 163
11
votes
macOS and .ssh/id_rsa security
Yes, malicious software running as your user can do anything that you can do as a user. There is no privilege separation between different applications running as the same user. This has also been ...
- 16.1k
11
votes
Is it insecure to send a password in a `curl` command?
But is this method less secure?
No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted. But as @Esa mentioned it is insecure locally which you can avoid adding ...
- 1,166
8
votes
How secure is "Secure Keyboard Entry" in Mac OS X's Terminal?
There's somethig else worth keeping in mind—and, it appears to me, not widely appreciated: On POSIX systems, any terminal has its own 'teletype' device. And every process you run can read from that ...
- 81
8
votes
Accepted
Does Dirty COW Affect OSX Kernel?
DirtyCow is a linux kernel vulnerability - an error in implementation. MacOS X is BSD based - completely different code base. While in principle there could be a similar vulnerability, it is very ...
- 6,381
8
votes
Accepted
Does karabiner elements on Mac OSX contain, or potentially contain, malware?
I am not sure anyone here would be willing to read through it but my advice would be:
Read through the bug reports
Research information on it and read as many reviews as you can. It has a lot of ...
- 4,345
8
votes
Can you create a fake (malicious) Ubuntu iso
I strongly believe that open source software is more vulnerable to hackers point blank!
Windows is a closed source software, yet there exists Windows XP Gold and Vision Ultimate which are unofficial ...
- 300
7
votes
Accepted
Entropy on native memorable password on macosX keychain
Anders Bergh reverse-engineered the OS X Password Assistant and wrote a command-line utility which does the same job. From its source you can find out that all of the password generation is done by a ...
- 3,486
7
votes
gpg: decryption failed: No secret key
This message can also happen if your key is protected with a passphrase, and your pinentry program isn't working properly.
In this case, gpg can't get the passphrase to unlock the decryption key. If ...
- 171
7
votes
Freaked out by "impossible click" in logs
It might be some security software on your system or in your network which inspects if the URL's you visit are harmful. They often do their visits from systems which are not obviously associated with ...
- 205k
Only top scored, non community-wiki answers of a minimum length are eligible