Tag Info

Hot answers tagged

24

If you think you're being hacked personally, below you can find a few very stringent rules to make hacker's lives extremely difficult. Remain calm Turn off all hardware you don't need to be a developer in the BIOS (this includes: microphones & speakers as they have been shown in the past to be used as communication channels once the PC was hacked, ...


16

I am basing much of this on the original post (except for the title). I think my PC is being hacked. What should I do? ... How should I proceed? The first thing you should do is remain calm verify that this is the case. Constructively: Many of the comments in your original post indicate a fundamental lack of understanding of how many of the concepts ...


12

It is important to install the latest security updates to help protect your system. Ubuntu base is the collective name for the tools and services and core parts of the Operating System and the following applies equally to any software installed, including what is categorised as Ubuntu based as mentioned in the question. There are situations where NOT ...


4

This ip address, 106.49.174.61, belongs CHINACACHE. xxx@xxx ~ $ whois 106.49.174.61 % [whois.apnic.net] % Whois data copyright terms http://www.apnic.net/db/dbcopyright.html % Information related to '106.48.0.0 - 106.49.255.255' inetnum: 106.48.0.0 - 106.49.255.255 netname: CHINACACHE descr: Beijing Blue I.T Technologies ...


4

This happens because chkrootkit looks for an executable named syslogd in several common locations, but since Ubuntu uses rsyslog, its syslog daemon is instead called rsyslogd. To check that the syslog daemon on your machine specifically is called rsyslogd rather than syslogd, you can run locate syslogd (though of course, if you did have a rootkit, it could ...


3

From http://www.chkrootkit.org/README: "not tested": the test was not performed -- this could happen in the following situations: a) the test is OS specific; b) the test depends on an external program that is not available; c) some specific command line options are given. (e.g. -r ). Assuming you did not pass a specific command ...


3

Is it bad to have at all times (one) terminal logged in as root? If so, why? Yes. Well. The idea of logging out your root terminal is due to the fact that Linux is a multi-user system. So other users could walk to your terminal and issue commands you do not want them to issue. With the introduction of desktops (that are often single user) this is less ...


2

Is it bad to have at all times (one) terminal logged in as root? If so, why? I can only say that I worked the same way as you, until I made a huge mistake... most of the time I forgot to add sudo in front of my commands to get the privilege for systemuser. Then on one day I executed as root the command rm -rf / var/www/filenotneeded.html ... as you ...


2

You could try to start here. Example how to start There is line of code: #define X86_FEATURE_NX ( 1*32+20) /* Execute Disable */ I already has cloned git repo of linux kernel, it was cloned when the last commit in master branch was 14186fea0cb06bc43181ce239efe0df6f1af260a. So something may be changed right now. Trying to find all files that use ...


2

Type the following command: gedit ~/.Skype/YourUserName/config.xml Search for <Account> and add in that section: <PrivateSkypeMode>1</PrivateSkypeMode>


2

The security updates are updates that fixes security bugs that can compromise the system, the rest are updates of improvement that fixes non-critic bugs or adds new features to a program. However, its recommended to install all updates. When do you see this: 35 packages can be updated. 22 updates are security updates. Yes, you think correctly, there is a ...


2

I don't know if there's a one-to-one correspondence, but you can use the Ubuntu CVE trackers, maintained by the Ubuntu Security team. For example, the tracker for software in main is http://people.canonical.com/~ubuntu-security/cve/main.html:


2

You need to track down each program that is running on those ports. Are you running xmpp yourself? Are you running a webbrowser? Specifically what is connecting to port 40016 and 12350? lsof -i TCP:40016 lsof -i TCP:12350 lsof -i TCP:xmpp-client you might need to sudo those.


2

Yes, any process running with the privileges of one user is allowed do anything that user is allowed to do herself. As you correctly state, this is less of a problem, if that user doesn't have super-user privileges, which would allow him and any of her processes to modify the system configuration. Installing system-wide packages through a front-end like ...


2

I think it's not possible without configuring sudo to let the user launch the program without a password (through /etc/sudoers and the NOPASSWD option), which can be considered like a more or less important security risk depending on the program involved. The best that can be done is to instruct sudo to restrict this to a single user, and only for that ...


2

Those users are users created for OSSEC and you should not change them. They are disabled because you need not see them and need not use them. Very simple: this software locks down these users so a normal user can not mess with them. If someone knows your admin password and gets access you are in deep problems anyeways and a normal user can not change these ...


2

Yes, signed with the same key as the other Ubuntu releases. E.g. Download both the checksum files and the detached signature: http://cdimage.ubuntu.com/kubuntu/releases/14.04.2/release/SHA256SUMS http://cdimage.ubuntu.com/kubuntu/releases/14.04.2/release/SHA256SUMS.gpg Then verify it against the preinstalled APT keyring which should have this key: ⟫ ...


2

Stop worrying! You'll have a heart attack before your time! ;-) Promiscuous mode on a computer has nothing to do with catching nasty viruses like AIDS... It just means that your network adapter will be able to read TCP/IP packets that are meant for other adapters. (A.k.a. "sniffing" and that's a great tool to find obscure TCP/IP communication bugs)


2

It is a very vague question because Ubuntu Security is pretty good out of the box, and if I would have hacked your computer, you would not be able to actually check that you were hacked as I would have installed a rootkit, and the only way to get me out of your computer would be by restoring a back-up since before you were hacked... The best way not to get ...


1

Lots of ssh brute force attacks taking place. It is possible you have an obsolete ssh package and they got in that way. Check for ssh failures in the logs, he maybe simply doing a brute force against you. go to /tmp and post its output from ls -al, if there is a root kit it might show up there. You can set allow users in ssh and fail2ban is useful as ...


1

Can we say with certainty that an IP from china somehow SSH'd into my machine? Even though it only accepted RSA key authorization? It is unlikely they were authenticated, unless they managed to obtain a valid key. Try connecting from a host you control without a key and check the running processes. They should be similar to what you saw. The fact the ...


1

You should have the tool cryptsetup already installed. To show details of the current cipher you can run the following command: sudo cryptsetup status sda5_crypt Replacing sda5_crypt with the name of your encrypted volume. You should see an output similar to this: type: LUKS1 cipher: aes-xts-plain64 keysize: 512 bits device: /dev/sda5 ...


1

Attack Vectors The Ubuntu installer brings (equally to pretty much all other Linux distributions) a set of OpenPGP keys trusted by the package manager. Given you download/get hold of a tampered ISO image, different things might happen based on what was changed. If the OpenPGP keys have been changed, you might either not be able to install updates any ...


1

Use this: gpg --decrypt /tmp/directory.tar.gz.gpg | tar xzvf -


1

To answer the actual question: Yes, a software can write to a device directly but contrary to your assumption this doesn't destroy a file system since software also can read directly from the file system. If the software does everything right it would just be like reading and writing the usual (indirect) way. Remember that it just had to do what your system ...


1

I don't think it's your fault. Version 2.8.98-0ubuntu2 (present in Ubuntu 14.10) of apparmor-utils seems to be buggy. aa-genprof crashes regularly (python errors) and I noticed a similar behavior as described by you with aa-logprof. It fills up some of the rules but others seem to be left out. Hopefully next version will be better. Newer versions are ...


1

Here you can find information about how to make a cronjob. Make one with the timing you want and this command: /usr/bin/update-manager This will open the graphic update manager which then searches for updates. If you like graphical applications, you can just install a graphical cronjob manager with this command: sudo apt-get install gnome-schedule Its ...


1

By default there are "no open ports" Default installations of Ubuntu must have no listening network services after initial install. See https://wiki.ubuntu.com/Security/Features#ports SSH opensh server is not installed by default. If you install or configure a server, or servers, then, by default, the firewall (iptables/ufw) will accept new ...


1

a lot of security holes allow "arbitrary code" and many applications, firefox for example, or vim, allow you to start external programs or a shell or other code. Once a malicious user gets a shell they can do damage without root access or they can try to escalate privileges. This is where one would use something such as apparmor or selinux to prevent ...


1

It never rarely happens in Ubuntu, because: all the most of the trojans and remote spy tools are programmed for windows systems. If anyone infects you with one of these tools for Linux, it will be interested particularly by you, and will take a very hard work to hack your Linux computer. 1.1. There is a good collection of fake apps and other resources ...



Only top voted, non community-wiki answers of a minimum length are eligible