Is Linux Secure or Vulnerable?

[niowluka]

How is that relevant to the topic?

But - even better - you could also try to answer my questions about mitigation technologies.

I don't know how to answer either of those, although for vastly different reasons...

EDIT
I'll answer the first one, as I think I misunderstood it (it's way past my bed time here).
Not relevant at all. He initially created it for himself, but as he put it himself, it very quickly became popular and people started contributing code. It's not who he wrote it for, it's who he expected would use it.
In any case, I feel I'm repeating myself...

[mike acker]

Apparmor would allow me to confine Dropbox to accessing my /Dropbox folder only.

Apparmor for Dropbox. Isn't that a little... extreme ? You can achieve that with right permissions.{ snip }

one of the serious security threats in desk-top operating systems is that permissions are granted to the system operator without regard to which program is being used.

let us consider my /Documents/Correspondence directory as an example: I want to restrict access to this area to the document scanner and the pdf viewer only. But I really can't do that: if I grant myself permission to update that directory I am then permitted to update using any program I choose. This increases the attack surface and therefore the risk. Web browsers are notorious for extra-curricular activity... particularly when the attacker gets code execution by exploiting some kind of software error found in the browser.

One should note that the above scenario is not a Linux defect; it is simple exploitation of a CVE item...

at times we speak of "Defense in Depth": providing more than one barrier against exploit. Linux gives us the tools to start,-- and critically so. The starting point must be a secured O/S. But from that point there is more to be done and I think protecting against exploits that operate under the authority of the operator's permissions is a key area. Much will be guarding against CVE that exploit software defects. Careful vetting of software prior to installation is an important key. But we may need to consider a second safety based on asking the question? you want to update File "X", -- OK, -- but using what program ??

at times I've played with creating a second user ID for myself in order to get a finer definition on my file permissions. The possibility of allowing a user to run a second "workspace" using a second logon is...... interesting.....

[xenopeek]

You can use firejail to run an application with restricted filesystem permissions. You can achieve what you want to jail your browser with a few steps. They have an article showing examples for jailing browsers: https://l3net.wordpress.com/2014/09/19/ ... a-firefox/. The article's examples make clear how to disallow your browser accessing part of your home folder.

I've linked you that before I think.

[mike acker]

You can use firejail to run an application with restricted filesystem permissions. You can achieve what you want to jail your browser with a few steps. They have an article showing examples for jailing browsers: https://l3net.wordpress.com/2014/09/19/ ... a-firefox/. The article's examples make clear how to disallow your browser accessing part of your home folder.

I've linked you that before I think.

yes you did.
I think I need to take some serious training on this program for my personal education.
Thanks for the reminder

[niowluka]

Apparmor would allow me to confine Dropbox to accessing my /Dropbox folder only.

Apparmor for Dropbox. Isn't that a little... extreme ? You can achieve that with right permissions.{ snip }

one of the serious security threats in desk-top operating systems [...]

That's an interesting read, and valid points, one cannot disagree. Still doesn't answer my question.

If it's for hobby, learning, poc, etc purposes then by all means, but if it's purely for security reasons, that's beyond extreme...

[r00t]

The possibility of allowing a user to run a second "workspace" using a second logon is...... interesting.....

I'm not sure if anyone would slap me on the wrist for saying this on the Mint forums, but there is another distro that does things similar to that.

https://qubes-os.org/ - Qubes OS uses 'Security by compartmentalization' so (in a nutshell) it runs programs in "AppVMs" completely isolated from the other AppVMs. But having all these AppVMs doesn't take up much space, because they get their filesystem from "TemplateVMs" (read-only, of course). The file system on AppVMs aren't saved after they're rebooted, so if one were compromised, it would only take a reboot of that AppVM to get it right again (assuming the TemplateVM isn't compromised).

Really neat stuff. You should check it out.

[mike acker]

{ snip } ...
That's an interesting read, and valid points, one cannot disagree. Still doesn't answer my question.

If it's for hobby, learning, poc, etc purposes then by all means, but if it's purely for security reasons, that's beyond extreme...

I think your question is answered in our current circumstances. Hackers are like wolves: they are patient, cunning, watchful, and constantly probing. Their question is: (1) how can I get execution, and (2d) how can I get privilege escalation -- or -- take control of a program that has the permissions I need to exploit... The Question then becomes: what happens when they succeed?

something like the Dropbox daemon would make an ideal target: it has RW permission for anything in the mounted file system belonging to the signed on operator, and it has access to the internet for uploading. the thing for the attacker to do then is to study: how are updates applied to that program, and how can I acquire the permissions I need to provide an update ? these are fundamental questions. what do I need and how can I get it ?

experience shows we will be attacked. I'm thinking guard dogs would be good in addition to the fence... ie. "defend in depth". remember: programmers make dumb mistakes from time to time... another reason to defend in depth.

I think people have "had it" with cybercrime, especially after the 2014 season. It is interesting to ponder how computing generally will respond. Our Days of Innocence, I think, have past.

[niowluka]

Hackers are like wolves: they are patient, cunning, watchful, and constantly probing. Their question is: (1) how can I get execution, and (2d) how can I get privilege escalation -- or -- take control of a program that has the permissions I need to exploit...

To your dropbox. Riiight...

I've seen from your other posts that you are a lot into security, and I respect that, clearly you have more knowledge about this subject than me. But I think there is one very important question everyone should ask themselves:

what happens when they succeed?

Exactly. Do you honestly believe someone is going spend days or weeks trying to find a 'hack', only to steal your photos from holidays in Greece ? And if you do have some sensitive data there, then I would strongly suggest to reconsider that. As J-Law's nude photos proove, it will probably be easier to hack into your dropbox account, than find a vulnerability in the daemon.

Dropbox daemon would make an ideal target: it has RW permission for anything in the mounted file system belonging to the signed on operator

Again, that's an easy tweak, if you are that concerned. There is one complete, non-hackable, 100% proof method of securing yourself from the dropbox daemon, though. Not run it at all.

This whole chat reminds of an old joke from university:

'Lamer, user and a hacker were asked what passwords they use:
lamer - "#3;2Gu=0" and I change it every week
user - "joanna", nobody will ever know that's my wife's name
hacker - "joanna", if someone wants to hack it, they will anyway'

Feel free to choose 'your' characters

[mike acker]

{ snip }
Exactly. Do you honestly believe someone is going spend days or weeks trying to find a 'hack', only to steal your photos from holidays in Greece ? And if you do have some sensitive data there, then I would strongly suggest to reconsider that. As J-Law's nude photos prove, it will probably be easier to hack into your dropbox account, than find a vulnerability in the daemon.
{ snip }

Days and Weeks? No; that is not how hackers operate. They want to "harvest", i.e. sweep up a bunch of easy to grab, usable data automatically.

this is behind things such as malvertising -- which is a favorite method for launching "drive by" attacks via web browsers.

Javascript is not supposed to be able to read/write anyting on the client system except cookies. But we all know web pages are much more dangerous than that. I think "Ajax" is one method of expanding Javascript capability. Thus, a web page should be treated as an executable file **. This then is the reason for FIREJAIL -- running an application program in a "named space" -- essentially like a virtual machine. I have to learn a lot more about this. *

a drive by attack doesn't want your vacation px. it wants your credentials for your credit union account. Or right about now it is likely looking for TAX INFO.

Online tax programs should provide the option to sign the tax return with PGP/Desktop or Gnu Privacy Guard ( GnuPG ) . But-- to do it you would have to get your public key signed by a reputable party, such as your Credit Union and post it to the keyserver. And you'd need to signal the IRS -- easy to do through your online tax return -- that you will be using a digital signature henceforward.

Document authentication in the digital age! Imagine that!!

DROPBOX

dropbox reportedly got hit a while back but later the report was pretty much debunked

I bought a Q&D reference book "Dropbox in 30 minutes" which is helpful in getting new folks up to speed. the book states Dropbox encrypts stored data. But it also talks about DMCA. It seems apparent to me they generate and keep the encryption keys,-- probably using a symmetric cypher such as AES256. Before I store anything valuable on their server I'll encrypt it,-- probably using the archive manager and .zip format.

* FIREJAIL
I'm "stuck behind the 8-ball" at the moment,-- before I start fussing with named spaces I want to put a second OS disk in my machine. unfortunately I'm on medical restrictions at the moment so I'm not allowed to lift the case out,-- play with speakers, amplifiers, run the snowplough etc etc. project will have to wait until Feb. I should change out my 450W power supply for a 750 so I could run 6 hard drives in my box . I'll do that later, on my next build.

** Documents as Executable Files
This would include documents that can contain macros or scripts or other embedded objects that can transport executable code. e.g. the RSA hack was accomplished by a flash object in cell A1 of a Excel sheet attached to an e/mail. The first thing I would want to expand FIREJAIL to will be e/mail.