New answers tagged

0

To prevent accidental direct execution of exes from console like /path/to/program.exe when they have executable bit set (like via chmod +x), you can setup binfmt_misc kernel module with the following command: sudo update-binfmts --disable wine This will disable support for direct execution of files with magic MZ. CAVEAT: this appears to be undone on ...


0

As far as defeating the encryption on an otherwise locked down machine, look up the liquid nitrogen RAM attacks. It's always a question of how secure you want to be, not being undefeatable. If an attacker needs a dewer of LN on hand to defeat you, you're fairly likely to see him coming.


0

Any way? Yes, look up the liquid nitrogen RAM attacks. It's always a question of how secure you want to be, not being undefeatable. If an attacker needs a dewer of LN on hand to defeat you, you're fairly likely to see him coming.


0

They could try to brute-force your password, you might want to set it up so accounts are locked out after too many failed attempts. You didn't ask how, but if you're interested you can read more here http://blog.bodhizazen.net/linux/ubuntu-how-to-faillog/) Edit : including steps as requested Open /etc/pam.d/common-auth and add the line AT THE TOP OF THE ...


0

Very unlikely to infect Linux with something like that. You would have to provide root's password to allow it to actually break something in system. IF it did something, probably only for user's stuff that can be easily re-installed or fixed.


0

open terminal and edit files.scope sudo gedit '/usr/share/unity/scopes/files.scope' search for lines like these [Category recent] Name=Recent Icon=/usr/share/icons/unity-icon-theme/places/svg/group-recent.svg DedupField=uri comment or cut to external .txt as a backup save and logout


1

Setting up P2P systems like bittorrent is a PITA and problems seem to recur even after things start working (especially with port forwarding). Anything is possible, but it is very unlikely that your ISP even looks at your OS in this situation. The usual problem is port forwarding. Bittorrent uses a port for incoming requests from other peers. Usually, this ...


1

You have a couple of options - there is a commercial product called Tripwire which can watch folders or files for changes, or, as per this post on ServerFault you have OSSEC. There are others that do the same sort of thing. Have a search for Tripwire alternatives.


0

I made the mistake of trying to edit the conf I found in the /etc/mosquitto directory. The answer is to leave that .conf alone and to go to the conf.d directory and to create your custom directory there.


3

PUA stands for potentially unwanted application. Clamtk is able to detect them -see the options. The packer stands for a code that is extracting the main code during the run. If you are unsure about the binary file, you can upload it to virustotal.com to see what other antivirus engines are saying.


0

I think you should run firefox as root too because you run apparmor as root. maybe thats why it says Premission denied sudo firefox


0

.exe files are built specifically for Windows platforms. They are compiled using Windows libraries and executed natively only in Windows. Same applies to viruses since they are compiled specifically for Windows. Hence, Ubuntu, due to its completely different set of libraries and structure, is shielded from threats arising from .exe ...


2

Files are just a way to represent data on the computer side, the file system of Windows is supported by Ubuntu and that is obvious, if you can open a jpg photo on windows then you can open it on Ubuntu. But, if you mean that a virus on Windows does it effect the system on Ubuntu, and the answer is no because executable files on windows are considered as ...


2

I don't know of a way to do this through binfmt-misc and xattrs, but I'll propose a different approach. I haven't tried it out but I can't see why it wouldn't work. The idea is to use a union mount to hide the real binaries by a wrapper script that calls the sandbox. We need a union mount where the upper directory is mostly read and writes to a non-shadowed ...


2

Seems to be a reported bug (#1554803) It can be solved installing apparmor-easyprof-ubuntu or creating the folders by hand. sudo apt-get install apparmor-easyprof-ubuntu


-1

You just need to edit this line from file /etc/ssh/sshd_config from yes to no: #ChallengeResponseAuthentication yes ChallengeResponseAuthentication no


0

The "suspicious" activity is explained by the following: my laptop no longer suspends when the lid is closed, the laptop is a touch screen and reacted to applied pressure (possibly my cats). The provided lines from /var/log/auth.log, and the output of the who command are consistent with a guest session login. While I disabled guest session login from the ...


20

The current version does indeed include the mitigations for these vulnerabilities. Rather than keeping up with the OpenSSL releases, the security team prefers to backport fixes. You can confirm that the package contains the mitigation for the CVEs listed in the question by downloading the Debian packaging for the openssl package: apt-get source openssl ...


2

I just want to mention that "multiple browser tabs/windows open, Software Center open, files downloaded to desktop" is not very consistent with someone logging into your machine via SSH. An attacker logging via SSH would get a text console which is completely separate from what you see on your desktop. They also wouldn't need to google "how to install git" ...


4

find command is the most appropriate for this task, in combination with stat , you can see the owner of the file find $HOME -type f -executable -printf "FILE:%p OWNER: " -exec stat -c "%U" {} \; Or purely with find printf: find $HOME -executable -printf "FILE:%p OWNER:%u\n " And if you're adventurous enough, here's a pythonic solution: import os ...


3

find ~ -type f -executable should work. Maybe add -exec ls -l {} \; to get user and group.


0

Not sure if its what your looking for, but i always install privacy badger on my Firefox to help get rid of potential trackers. Hope i could help. PS. privacy badger is multi browser: https://www.eff.org/privacybadger


1

Your question is pretty broad, but inferring from your first sentence about "different security measurements" for home, etc, I would recommend you try gufw gufw is a GUI front-end to the ufw firewall and it allows you to create profiles for home, etc. sudo apt-get install gufw As a simple solution, you can just set the default Incoming rule to Deny and ...


2

This will be a bit of a simplification, but I'll try to go through the process of accessing a file on an encrypted filesystem. For example, let's say a the beginning of the encrypted filesystem there's a file table; let's say we want to read /foo.bar. So, the first thing we do is read the beginning of the partition, decrypt it, and look through it for the ...


9

hidepid procfs on Linux now supports the hidepid option. From man 5 proc: hidepid=n (since Linux 3.3) This option controls who can access the information in /proc/[pid] directories. The argument, n, is one of the following values: 0 Everybody may access all /proc/[pid] directories. This is the ...


0

Modern computers can do billions of operations per second, so it doesn't surprise me that encryption and decryption are fast. This is how I would intuitively rank how fast computers are at doing things: Doing calculations within memory (especially L1 and L2 memory), extremely fast Reading from local storage, less fast (solid state disks are faster than ...


2

How does AES / Rijndael Encryption in general work? This page has a fun A Stick Figure Guide to the Advanced Encryption Standard (AES) that looks easy to understand, though it looks to be 50+ images, for example these two: and It's far too much to duplicate it all here, but if you have to have an all-in-one image it's this one: Or, there's a ...


-2

Pull out the wireless card/stick and look over the traces. Make a record of your logs so askbuntu can help further. After that wipe your drives and try a different distro, try a live cd leave it running to see if there's a pattern to the attacks.


0

For large numbers of users/certificates consider LDAP integration. Large organizations use LDAP as a repository for user credentials and certificates stored on badges or fobs, whether the certificates are used for authentication or signing emails. Examples include openLDAP, openDJ, Active Directory, Oracle Universal Directory, IBM Directory Server, ...


2

Do you have any friends that like to access your laptop remotely/physically while you're gone? If not: Wipe the HDD with DBAN and reinstall the OS from scratch. Be sure to backup first. Something may have been severely compromised within Ubuntu itself. When you reinstall: Encrypt /home. If the HDD/laptop itself is ever physically stolen, they cannot gain ...


26

It looks like someone opened a guest session on your laptop while you where away from your room. If I were you I'd ask around, that may be a friend. The guest accounts you see in /etc/passwd and /etc/shadow are not suspicious to me, they are created by the system when someone open a guest session. Apr 27 06:55:55 Rho su[23881]: Successful su for ...


33

Wipe the hard drive and reinstall your operating system from scratch. In any case of unauthorised access there is the possibility the attacker was able to get root privileges, so it is sensible to assume that it happened. In this case, auth.log appears to confirm this was indeed the case - unless this was you that switched user: Apr 27 06:55:55 Rho ...


2

The processor uses dedicated instruction set. It is possible because of it, AES-NI. It enables fast encryption and decryption or you can say it cuts the overhead. It is fast because it is hardware implementation, as explained here. You can check about performance impacts here and they are worth it for added security.


2

The easiest and most fail safe way will be to save your files in password protected archive files, 'zip' being the most popular archive file format supporting such protection. This format is supported directly in most OS's including Ubuntu and Windows, without installing any other applications. If you want complete drive encryption you'll have to install a ...


3

Xenial Xerus now has a newer version of irssi: andrew@athens:~$ irssi --version irssi 0.8.19 (20160323 0008) This version has built-in support for SASL and has been set to reject the cap_sasl.pl script with the error message in the question. Easy enough to fix by closing irssi and removing the script and links to it: mv -v ...



Top 50 recent answers are included