Hot answers tagged

25

I have one specific package (moodle) which is not available on newer versions of aforementioned OS (last version of moodle was available on OpenBSD 5.3) which is more than 4 years old. In my opinion you ask the wrong question. The problem is less the old version of OpenBSD but more the old version of Moodle you want to run on this OpenBSD version. Although ...


20

No. OpenBSD has measures (specifically, malloc() guard pages and wiping of deallocated memory) that should have turned Heartbleed into a crash or a leak of a whole bunch of "0x0d" bytes. However, as noted in a blog post here, OpenSSL uses its own custom memory-management system which acts to defeat those measures.


11

A secure OS is an OS that is maintained by a sysadmin who knows his job. This trumps everything else. So, basically, when the sysadmin knows all the internal details of BSD, and not of Linux, then BSD will be more secure than Linux. However, if the converse holds (sysadmin knows Linux better than BSD), then Linux wins. In the quasi-mythical case where a ...


9

Virtualization offers some layer of isolation. In your "B" case, if (for instance) there is a remotely exploitable hole in the SMTP server, then an attacker who exploits it may gain full control of the virtual machine which runs that SMTP server, but he will still be "outside" of the two other machines (the guest with the Web server, and the host). This may ...


8

People do use Signal, and even less secure systems like Whatsapp, to do the kind of communication that has traditionally relied on burner phones. Let's dispense with the spy fantasies first, though: the majority of people who use or have used burner phones are not spies or high value targets,. As you can guess, not all criminals are technically-minded ...


6

BSD has nothing to do with it (but it's a good choice). Running older software is quite possible if properly patched. Google and the CVE DB is your friend https://www.google.com/search?q=open+bsd+5.3+vulnerabilities https://www.cvedetails.com/vulnerability-list/vendor_id-97/product_id-585/version_id-121223/Openbsd-Openssh-5.3.html Determine the nine ...


6

There is one major category of home hardening that you missed, at least in part. 'Vectors downloaded by the user' is a huge category. It is the most used attack vector today. A lot of attacks don't require any user interaction to run. See drive-by downloads for an example. While you are correct that safe browsing habits are a good way to address this ...


5

Most of these security issues arise when a host accepts IPv4-mapped IPv6 traffic over the network, rather than accepting IPv4 traffic and presenting it to an application on an IPv6 socket with a mapped address. An application may have no good way to tell the difference and detect a potential attack in progress. Of course no host should ever be accepting ...


5

There seem to be some misconceptions here about how memory management in OpenSSL works. OPENSSL_malloc and OPENSSL_free by default just call the system malloc and free (there is some indirection, so an application can redefine these functions if it wants, but OpenSSL doesn't do that itself). However, for some data structures, notably input buffers, it keeps ...


5

The issue is now addressed in the paper signify: Securing OpenBSD From Us To You by Ted Unangst (BSDCan, 2015). In summary: Requiring mirrors to use HTTPS, and any other reliance on HTTPS, was rejected. As noted by other answers here, securing only the connection between users and mirrors does not secure the transit of artifacts from developers to users. (...


5

From what I understand, this is a step beyond KASLR. For memory location inferences at a finer granularity than what KASLR protects. With KASLR, you make it harder for ROP gadgets to overwrite (e.g., heap spray) areas of memory that will eventually yield control to injected/known code. However, this being an arms race, counter moves such as JIT spray have ...


5

Yes, it's relevant, but you have to understand the context. There are several ways a platform can achieve a low rate of exploitation such as code quality, a hardened configuration, a limited feature set, and obscurity. There's no doubt that OpenBSD benefits from obscurity to some degree - if it were as popular as Linux or Windows, many more people would be ...


5

Altough OpenBSD made some enhancement to improve the security of X11 the problem is the underlying architecture of the X11 system which has no real (i.e. secure) concept of screen locking. This means screen locking is mainly realized by a process which grabs input and has a full screen window and if this process exits (normally or by crashing) the screen is ...


5

Best practice would be to use a burner android phone along with Signal or another encrypted communications app with an outgoing firewall blocking everything else. Remove all unneeded apps especially the Google ones. But keep in mind there is another lesser-known attack on burner phones that most people are unaware of: Proximity Keeping your burner phone ...


4

Running X.org as non-root is now possible as of Feb. 22, 2014 (my emphasis): In OpenBSD-current, after this commit users of Intel and ATI Radeon graphics which support kernel mode setting (almost all of them) can set machdep.allowaperture back to 0 in the /etc/sysctl.conf configuration and still run the X server. This means that the X server requires no ...


3

(Note that I know nothing about the design of OpenBSD ntpd, I'm just answering the generic question about separating processes.) From your quote, I gather that the separation the UDP process from the DNS process was not motivated by security concerns, but by architectural concerns: “because... it's... it just didn't make sense”. The UDP process and the DNS ...


3

You can leverage arpwatch to notify you the second it broadcasts on your network again and also use a tool like Wireshark to capture traffic and see what the device is communicating to (logging DNS queries sometimes works too). Sometimes IoT devices like thermostats, toys, equipment or even certain operating systems will call home on a regular basis looking ...


3

OpenBSD has plenty of issues against the base system (see their patches section), past and present. It is not an obscure OS - it is exceedingly well documented, and very popular with people who build infrastructure. And others. But I suppose the text install program puts people off. It is my understanding that its standard services (not ports) are ...


3

Ideally, I'd like to be able to leave my laptop unattended, and know that after a few minutes, it'll screen lock itself, so it gets as safe as if the laptop had been powered off and full disk encrypted (all disks including swap). This is absolutely impossible. No matter how secure the screen lock is, as long as the computer is booted, it is potentially ...


3

All other things being equal, simplicity is good for security. But let's not reverse the paradigm. Software is secure because it is maintained. Complex software is harder to maintain, but, on the other hand, Apache and Nginx have a huge market share, are very active project, and thus benefit from about the best level of maintenance that can be hoped for. ...


2

http://unix4lyfe.org/darkhttpd/ (no HTTPS) Also, custom compile of Nginx with no optional components, except for SSL, is also a very minimal server. Python SimpleHTTPServer source code is not 1 line long, you simply call it with one line.


2

There are a number of ways you could approach this, but the most direct would probably be to set up an intrusion detection system, such as Snort. It monitors all traffic to the server and can warn you of suspicious activity. https://www.snort.org/


2

As OpenBSD documentation clearly states it in bold red characters in their introduction about ports: The packages and ports collection does NOT go through the same thorough security audit that is performed on the OpenBSD base system. Although we strive to keep the quality of the packages collection high, we just do not have enough human resources to ...


2

OpenBSD does not require a "live" cd and if you want to err on the paranoid side you should consider creating your own "live" medium by following their own FAQs: It is very easy to create a bootable USB flash (or other!) drive that can be used as a "live" OpenBSD system without installing OpenBSD on the local hard disk of a machine. Obviously, the target ...


2

I would recommend changing the password for the admin page for your router along with the wireless passwords. Might be a bit of a pain since you have to reconnect any wireless devices but depending on the complexity of the original wireless password someone might've been able to capture the WPA handshake and crack the password. If you have WPS enabled on the ...


2

Let's assume that pledge doesn't exist (this design predates it, as I understand it). Obviously this design is pretty pointless on its own, as if the network-facing service is compromised the attacker has root on the system. Even without pledge the design isn't pointless. If the network-facing service is compromised the attacker does not have root on the ...


2

Some developers are working on a sandboxed version of Chromium. I don't know if there is a public diff or not. With pledge and unveil, they can limit the syscalls used and the directories viewed by Chromium. Firefox only uses pledge, so it has not whitelisted/blacklisted directories.


2

Another reason to use a burner phone is that an attacker can theoretically get complete access to it, and they will not find any information regarding your personal life. For example, a lot of people use burner phones when going to conferences like DEFCON or Blackhat. The idea is that you leave your regular phone at home, and use the burner phone to perform ...


2

The main point of a burner phone is not the privacy of the communications, but to avoid to tie a phone number to an identity. So that when an accomplice is busted by the police and its phone contacts are revealed (through the mobile network operator or by accessing the phone history) it can only reveal burner numbers not tied to your identity (they can only ...


1

if anyone interested, correction for the pax topic Sent: Tuesday, October 11, 2016 at 3:57 PM From: "W. Dean Freeman" To: "'Peter Janos'" Subject: RE: RE: OpenBSD PaX Test question Increasing the stack gap size isn't necessarily bad or good. Basically, you're adjusting the run-time value of a gap page that gets inserted at the top of a new ...


Only top voted, non community-wiki answers of a minimum length are eligible