Hot answers tagged

253 votes
Accepted

Why is "fhepfcelehfcepfffacacacacacacabn" a top DNS query from my devices?

That domain is an encoded form of the string "WORKGROUP". It is using a variant of hex encoding that uses the letters A-P, instead of the numbers 0-9 followed by A-F. $ echo ...
Miles's user avatar
  • 846
139 votes
Accepted

Mac OS X terminal prompt displaying foreign hostname (or: What is Stacey's iPhone doing in my Terminal?)

At some point, your network assigned StaceysiPhone6s an IP address. Then, your laptop got that IP address. Your Mac then looked up the DHCP logs to find out who 'owned' that IP and found "...
schroeder's user avatar
  • 129k
101 votes
Accepted

Should the sole user of a *nix system have two accounts?

Updated dramatically after 69 upvotes, see answer history for original answer. Thanks to @JimmyJames for the discussion. First, let's talk about threat model: what are you trying to stop the ...
Mike Ounsworth's user avatar
97 votes
Accepted

Isn't OS X's Single-User Mode a bad idea?

Physical access is total access, right? How is this any worse than a boot CD or yanking the hard drive and popping it into another system? Not that I'm a fan of OSX or this particular feature, but ...
HopelessN00b's user avatar
  • 3,407
75 votes
Accepted

Is it insecure to send a password in a `curl` command?

Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS. Locally this might be less secure, because: The password gets saved to the ...
Esa Jokinen's user avatar
  • 18.9k
66 votes
Accepted

Can you create a fake (malicious) Ubuntu iso

If an OS is open source or not is not the important factor if someone could build a malicious installer image. Recent versions of Windows use a technique that bases on WIM images which can be ...
Robert's user avatar
  • 1,441
60 votes
Accepted

Why is Firewire a bigger threat than USB?

Firewire and also Thunderbolt provide direct access to the OS memory, thus bypassing the operating system. See Wikipedia: DMA attack for more details on the possible attacks. USB does not provide ...
Steffen Ullrich's user avatar
47 votes
Accepted

How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)

At a high level, disk encryption is implemented using a data encryption key (DEK) and a key encryption key (KEK). The DEK is generated randomly and used to encrypt the drive, the KEK is derived from ...
AndrolGenhald's user avatar
44 votes

How can a non-admin program cover your entire screen with a window?

Fullscreen is easy: The vast majority of video games, for example, do it. I don't know if Windows has a dedicated API call for this, but if it doesn't, it's easy to fake: Just make a screen-sized ...
Mark's user avatar
  • 34.6k
38 votes

How can a non-admin program cover your entire screen with a window?

A fullscreen app in C#: using System; using System.Windows.Forms; namespace FullScreen { static class Program { [STAThread] static void Main() { ...
Thomas Weller's user avatar
37 votes
Accepted

Stolen MacBook: should I worry about my data?

Your data is probably* safe if the following three criteria are met: You have FileVault turned on (full disk encryption). Your laptop requires a password on boot and every time you open the lid (auto ...
Jonathan's user avatar
  • 2,346
35 votes

Why is "fhepfcelehfcepfffacacacacacacabn" a top DNS query from my devices?

Update: This answer by Miles is a better insight, the explanation given by NextDNS support seems wrong. I contacted NextDNS support asking for more details and they said this is Google Chrome testing ...
Etheryte's user avatar
  • 852
31 votes

Can you create a fake (malicious) Ubuntu iso

First of all: This would require a faked checksum as well, but that is somewhat besides the point because it can be faked too. What do you mean by faked? If the user checks the checksum against the ...
user9123's user avatar
  • 573
30 votes

Isn't OS X's Single-User Mode a bad idea?

If FileVault is enabled, then you would need the FVDE credentials for one of the FVDE users in order to access single-user mode, even if you move the solid-state drive to a new machine. However, if ...
atdre's user avatar
  • 19.1k
26 votes

Should the sole user of a *nix system have two accounts?

In most situations, requiring a password with sudo is sufficiently enough protection. The primary difference between suing to another account and sudoing to gain privileges is that with sudo you ...
Xiong Chiamiov's user avatar
24 votes
Accepted

Running windows in virtual machine, should I bother with security?

Your virtual Windows is on the same network with your OSX, so the same threats of having an infected device on a network applies to this VM. Your VM is equivalent to a PC in your network its not much ...
Silverfox's user avatar
  • 3,397
20 votes

Stolen MacBook: should I worry about my data?

I unlocked a Mac laptop that a friend "found in a bin" without knowing the password and accessed all data on it. After a quick bit of googling I created a new account and reset the existing account ...
stevieg's user avatar
  • 301
19 votes
Accepted

hashcat specify number of characters

Let me break down, what you want and what the equivalent hashcat options are. Hash-Type You want to crack a OSX v10.8+ hash, which according to the hashcat example hashes page (https://hashcat.net/...
Denis's user avatar
  • 3,828
18 votes
Accepted

What encryption method is used by the zip program in macOS?

It's using the original PKZIP 2.0 encryption (variously referred to as "traditional" or "legacy" encryption), described in section 6 of the .ZIP file format specification. It's ...
Gordon Davisson's user avatar
17 votes

Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?

This could get dangerous if you have autorun enabled. Malware can get executed automatically this way. "Fortunately" autorun isn't possible in vanilla Mac OS X, so you shouldn't be too worried. (Of ...
licklake's user avatar
  • 1,072
17 votes
Accepted

HTTPS connection to specific sites fail with cURL on macOS

Root CA certificates used by the mentioned sites (Comodo and USERTrust) have expired this morning (UTC time). While I find it remarkable that two different Root CA certs would expire at the exact same ...
F30's user avatar
  • 451
16 votes

Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?

Yes, but you can mitigate the risk by using a USB condom that does not connect the cables that convey data and communication, but leaves the charging pins live. You would still be exposed to attacks ...
Cory Klein's user avatar
14 votes
Accepted

What are the security implications of homebrew and macports?

If I am understanding your question correctly, it boils down to: Homebrew changes the permissions of /usr/local/bin from the default drwxr-xr-x root wheel to the less secure drwxrwxr-x myuser admin....
Mike Ounsworth's user avatar
14 votes

How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)

I completely agree with AndrolGenhald's high-level answer. In case you are interested in a complementary low-level walk-through of Android's storage encryption implementation: Android can do File-...
f9c69e9781fa194211448473495534's user avatar
14 votes
Accepted

Understanding ssh-rsa not in PubkeyAcceptedAlgorithms

The name ssh-rsa has two different meanings here. There's the key type ssh-rsa which you can see in the first column of your authorized_keysfile. RSA keys are perfectly fine and widely supported. ...
Ja1024's user avatar
  • 4,659
12 votes

Is Mac OS safer to use as far as firmware rootkits, cold boot attacks and evil maid?

Are there any things like TPM and Secure boot for Mac to protect against these security problems? Short version: Yes, and recent Macs have some very good security features like hardware-based RAM ...
CBHacking's user avatar
  • 47.6k
11 votes

Are X.509 nameConstraints on certificates supported on OS X?

Yes, OS X / macOS supports this since 10.13.3. According to the https://nameconstraints.bettertls.com archived tests, 10.13 failed some tests but 10.13.3 passes all in with both Safari and Chrome. ...
Gabriel's user avatar
  • 163
11 votes

macOS and .ssh/id_rsa security

Yes, malicious software running as your user can do anything that you can do as a user. There is no privilege separation between different applications running as the same user. This has also been ...
David's user avatar
  • 16.1k

Only top scored, non community-wiki answers of a minimum length are eligible