5 ms·

It seems most vulnerabilities published by shadow brokers are on Windows. What percentage of vulnerabilities are focused on Linux or macOS? What can ordinary

by aborsy 5y ago

It seems most vulnerabilities published by shadow brokers are on Windows. What percentage of vulnerabilities are focused on Linux or macOS? What can ordinary users do to protect themselves other than patching?

adriancr 5y ago
Rootkits/exploits appear on any operating system. Wipe and reinstall often, rotate passwords at same time, also teaches good backups. ad blocker by default and always up to date system. Use VMs or other machines for dubious websites and wipe those often (like a raspberry?) Careful what you execute on your machine Then if you're really paranoid: Some external firewall running suricata for alerting Logging to an external system so you can review things in case of issues.
- CaptainJustin 5y ago
  In this spirit I've been playing with spun up Firefox instances in a Google Cloud Run. The container is stateless and goes away after I close the page that connects to video stream of the other container in my browser.
  - 3np 5y ago
    Do you find the performance satisfactory enough for daily browsing?
    - genewitch 5y ago
      Way back in 2009 I helped design and implement basically "Firefox on AWS EC2" - I had YouTube audio and "video" working, in the subwindow, not Fullscreen. It was roughly 5-10FPS, about what you'd get with VNC, with perfect audio. I had an idea that thin clients were going to be big - and I stupidly pitched ideas for cloud based software to Adobe, Newtek, and Autodesk. Never gunna do that again.
  - jmnicolas 5y ago
    For all intents and purposes Google is the civilian NSA, I'm not sure you're gaining anything by creating VM in their cloud!
    - 1f60c 5y ago
      I'm assuming they want some protection against adtech companies or the local coffee shop sysadmin. Running Firefox in the cloud "to avoid detection by the NSA" would indeed be quite foolish.
    - deleted 5y ago
      [deleted]
adam0c 5y ago
- gambiting 5y ago
  You didn't even read the article, did you?
aeyes 5y ago
Most ordinary users will connect to the internet using a router provided by their ISP so port knocking does not work. Unless they plant the malicious code on the router - that would be even harder to detect.
- deleted 5y ago
  [deleted]
- bobbob1921 5y ago
  This is correct, almost all user side traffic is nat’d (masquerade/Src-nat) thus port knocking nor any ports externally being open, does not apply. (NAT , in general, = how the multiple devices at your home all share a single public IP address from your ISP) This article mainly addresses servers / public facing services (which do not make use of nat)
beermonster 5y ago
From the article: “.. a port knocking backdoor with multiple targets such as Solaris, Linux, FreeBSD, HP-UX, JunOS, OS X” So this was far more reaching than Windows. To answer what ordinary users can do: Against a well funded adversary hell bent on getting access to your systems/data - probably not a lot! In the case of NSO group even a fully patched iPhone wasn’t going to help you. However, on reading this article my first thoughts are if this method evades detection by not having a listening port that a network scan or locally using ss/netstat can detect then perhaps you would still be able to benefit from egress filtering (only allowing outbound connections to things you need and blocking the rest). On a router most connections are through the router (FORWARD table) as opposed to directly locally originated and outbound (OUTPUT table).
- aborsy 5y ago
  The NSO could get root on anyone’s device knowing only the phone number. If NSO does it, so could the intelligence agencies of dozens of countries. Looks like a hopeless situation, where a small percentage of population have access to anyone’s data (but not conversely). This is posing a threat to the democratic society. There ought to be a way to make a secure device.
  - Jerrrry 5y ago
    This is correct, and why many lawyers do not maintain online presences, and do not conduct business online, in any capacity.
  - hnthrowaway0315 5y ago
    I think one way to add the difficulty is to conduct everything offline. Since they don't have a full profile for you online, they have to mobilize field teams which are scarce and expensive. On the other hand, if they can sniff you online, it's going to be automated and almost free. But again, maintaining an offline life could be very tricky given that the society as a whole is moving everything online. For example, if you earn salaries like me, there is no way to avoid a bank account and a mobile number.
- Sebb767 5y ago
hnthrowaway0315 5y ago
I don't really think ordinary people (and rich people TBF) can completely defend themselves against any state player. Anonymous guides I read mostly recommend Tor, anonymous sim card and purchasing electronics with cash. But I don't think it's going to render any state player's work impossible. I mean if they are really onto you. On the other side, three char agencies cannot waste resources on every individual, so the best way is to stay out of the radar.

by aborsy 5y ago

adriancr 5y ago

Rootkits/exploits appear on any operating system. Wipe and reinstall often, rotate passwords at same time, also teaches good backups. ad blocker by default and always up to date system. Use VMs or other machines for dubious websites and wipe those often (like a raspberry?) Careful what you execute on your machine Then if you're really paranoid: Some external firewall running suricata for alerting Logging to an external system so you can review things in case of issues.

CaptainJustin 5y ago
In this spirit I've been playing with spun up Firefox instances in a Google Cloud Run. The container is stateless and goes away after I close the page that connects to video stream of the other container in my browser.
- 3np 5y ago
  Do you find the performance satisfactory enough for daily browsing?
  - genewitch 5y ago
    Way back in 2009 I helped design and implement basically "Firefox on AWS EC2" - I had YouTube audio and "video" working, in the subwindow, not Fullscreen. It was roughly 5-10FPS, about what you'd get with VNC, with perfect audio. I had an idea that thin clients were going to be big - and I stupidly pitched ideas for cloud based software to Adobe, Newtek, and Autodesk. Never gunna do that again.
- jmnicolas 5y ago
  For all intents and purposes Google is the civilian NSA, I'm not sure you're gaining anything by creating VM in their cloud!
  - 1f60c 5y ago
    I'm assuming they want some protection against adtech companies or the local coffee shop sysadmin. Running Firefox in the cloud "to avoid detection by the NSA" would indeed be quite foolish.
  - deleted 5y ago
    [deleted]

adam0c 5y ago

gambiting 5y ago
You didn't even read the article, did you?

aeyes 5y ago

Most ordinary users will connect to the internet using a router provided by their ISP so port knocking does not work. Unless they plant the malicious code on the router - that would be even harder to detect.

deleted 5y ago
[deleted]
bobbob1921 5y ago
This is correct, almost all user side traffic is nat’d (masquerade/Src-nat) thus port knocking nor any ports externally being open, does not apply. (NAT , in general, = how the multiple devices at your home all share a single public IP address from your ISP) This article mainly addresses servers / public facing services (which do not make use of nat)

beermonster 5y ago

From the article: “.. a port knocking backdoor with multiple targets such as Solaris, Linux, FreeBSD, HP-UX, JunOS, OS X” So this was far more reaching than Windows. To answer what ordinary users can do: Against a well funded adversary hell bent on getting access to your systems/data - probably not a lot! In the case of NSO group even a fully patched iPhone wasn’t going to help you. However, on reading this article my first thoughts are if this method evades detection by not having a listening port that a network scan or locally using ss/netstat can detect then perhaps you would still be able to benefit from egress filtering (only allowing outbound connections to things you need and blocking the rest). On a router most connections are through the router (FORWARD table) as opposed to directly locally originated and outbound (OUTPUT table).

aborsy 5y ago
The NSO could get root on anyone’s device knowing only the phone number. If NSO does it, so could the intelligence agencies of dozens of countries. Looks like a hopeless situation, where a small percentage of population have access to anyone’s data (but not conversely). This is posing a threat to the democratic society. There ought to be a way to make a secure device.
- Jerrrry 5y ago
  This is correct, and why many lawyers do not maintain online presences, and do not conduct business online, in any capacity.
- hnthrowaway0315 5y ago
  I think one way to add the difficulty is to conduct everything offline. Since they don't have a full profile for you online, they have to mobilize field teams which are scarce and expensive. On the other hand, if they can sniff you online, it's going to be automated and almost free. But again, maintaining an offline life could be very tricky given that the society as a whole is moving everything online. For example, if you earn salaries like me, there is no way to avoid a bank account and a mobile number.
Sebb767 5y ago

hnthrowaway0315 5y ago

I don't really think ordinary people (and rich people TBF) can completely defend themselves against any state player. Anonymous guides I read mostly recommend Tor, anonymous sim card and purchasing electronics with cash. But I don't think it's going to render any state player's work impossible. I mean if they are really onto you. On the other side, three char agencies cannot waste resources on every individual, so the best way is to stay out of the radar.