6 ms·

So how do you protect yourself from these highly-targeted attacks? How about running the browser in a sandbox that resets all changes on exit? I've actually se

So how do you protect yourself from these highly-targeted attacks? How about running the browser in a sandbox that resets all changes on exit? I've actually set up Firefox (hardened) + Sandboxie on Win7 but exactly how good is this setup?

jgrahamc 14y ago
Use a browser that's not on your machine. See, for example, https://www.authentic8.com https://www.authentic8.com
- Luc 14y ago
  Interesting, but despite some searching I couldn't find a price for this service. Has anyone tried it?
- wslh 14y ago
  It's running on their servers! I prefer to have a VM on my side. In terms of security I don't trust third parties. Or saying it in a different way: can I look at their server configurations before acquiring their services?
- superbaconman 14y ago
  Does this really solve the problem though? If a file that contains the attack appears legitimate, it could potentially be shared. If the file is saved to google docs or dropbox everyone who tracks that folder is compromised also.
- sltkr 14y ago
  So to avoid leaking any private data to third parties, I should send all my private data to a third party using a proprietary protocol?
- newman314 14y ago
  I know not everyone can do this but fire up a VM for browsing and reset after every session.
snowwrestler 14y ago
This is what Invincia offers. The browser runs in a VM with a "watcher" that compares its activity to typical browsing activity. If it sees something unusual it kills the whole VM and loads a fresh one. The problem with this sort of approach is that it is slow on most office machines. A lot of companies are still running XP desktops with 1GB RAM.
capnrefsmmat 14y ago
The laboratory I work in has all Internet access routed through browsers on a separate server, accessed via RemoteApp. The browser server is supposed to be reimaged regularly.
DeepDuh 14y ago
I'd say E-Mail signatures. Officials should get a big fat warning sign for E-Mails that contain either no signature or a signature issued by an untrusted party. The private keys to sign mails would also have to be encrypted in a way that infected systems could still not send signed E-Mails. I'm thinking a hardened USB stick with some kind of biometric scanner as the only place to store the key. You'd send a blob of data to that appliance, it waits for your authentication and then it sends the signed version back to the E-Mail client.
- Justsignedup 14y ago
  That is indeed a good point. However it won't prevent the ideas of hijacking little league sites that your employees may visit which would be maintained by one web designer one day a year, on that employee's home computer, which then goes on to use it as a vector to attack the company. Yeah. Technology to hack someone is getting better by the minute.
- niels_olson 14y ago
  What's really sad about this is that many government resources have certificates that the browsers available to their users (i.e., IE 6/7/8) don't trust, so the users are conditioned to blow through the clearest warnings they will ever get. eg, here's the DoD global phone book (in case I want to email somebody). Server requires CAC token from the client, but the client's browser doesn't trust the server! https://dod411.chamb.disa.mil/ https://dod411.chamb.disa.mil/ I don't even know what to call this level of broken, Chomsky-esque?
  - mpyne 14y ago
    Just install the goddamn DoD root certificates and the client browser will work just fine. I've used approximately zero DoD computers since 2005 that had the SSL CA chain misconfigured for use on DoD websites. It's really not that hard, even my Linux box here works fine.
    - niels_olson 14y ago
      Are you on NMCI? Because I have used approximately zero DoD computers since 1994 that had the SSL CA chain configured properly on delivery. In my humble experience, installing DoD roots is a journey: there are at least a few dozen and they are constantly being retired and superseded. Meanwhile, to get the DoD root certs, one has to trust A) DNS B) whomever is in charge of access control to the cert servers. Clearly, access control is a major problem for the DoD, that's the whole problem to begin with.
fnordfnordfnord 14y ago
Using a live CD based OS for sensitive transactions is one pretty simple way.
- jfrm 14y ago
  The DoD agrees with you. http://www.spi.dod.mil/lipose.htm http://www.spi.dod.mil/lipose.htm
Justsignedup 14y ago
Hmmm... Well... there are ways: a) disable flash b) disable java c) disable any plugins really. d) use chrome (at least) e) do not allow downloading of any file. Instead use chrome's plugin to open any word/etc files in google docs. f) Use a chromebook. Chromebooks can't really execute programs like windows machines can, so it's fairly safe. And worst case is you expose a sandbox machine with no private data other than caches, that can be set to be cleared on sleep or whatever. Bonus security points: - if a chromebook is hijacked, it will only be hijacked until a reboot during which time the chromebook does a sanity check ensuring the OS is exactly intact. If it is not it just reinstalls the OS from ROM. Basically no long-term compromised machines. - The only time chrome's sandbox was ever completely bypassed allowing arbitrary code execution was using a combination of multiple chrome exploits (now closed) and a windows data execution prevention bug. That can't happen on linux (and the chrome team works to further solidify that sandbox). Pretty much almost impossible. And if it is quickly patched and vuala. g) browse in private browsing mode only h) When visiting links (like facebook) manually type in the url to ensure nothing is spoofed. I think you will be fairly safe. However... I doubt most people will go that far.
- BCM43 14y ago
  As sltkr said: So to avoid leaking any private data to third parties, I should send all my private data to a third party using a proprietary protocol? Also, I 'd recommend using noscript, with no plugins. Don't bother opening word files, get them to send it to you in plain text. Or run around with usb drives (no one ever said it would be easy).
  - mark-r 14y ago
    USB drives aren't a solution either. How do you think Stuxnet got started? http://en.wikipedia.org/wiki/Stuxnet#Windows_infection http://en.wikipedia.org/wiki/Stuxnet#Windows_infection
- mariallery 14y ago
  > c) disable any plugins really. embarrasing to admit, but I've always wanted to believe one could at least trust plugins like Adblock Plus or Ghostery to protect ones mind and privacy a little.. now, reading Hacker News almost every day, I'm getting paranoid. is it a vulnerability to even use them?
trotsky 14y ago
pretty much air gapped networks, build yourself a computer with a MIPS CPU, or just buy a laptop every monday and throw it away on friday. Chrome OS is probably the only commercial platform that is designed with this era of threats in mind. It's at least a generation ahead of everybody else. They're actually building their own embedded controller (controls the fans, battery etc.) to go along with their open source firmware so they can worry less about bad guys in the supply chain.
- zby 14y ago
  How about Qubes OS? http://qubes-os.org/trac http://qubes-os.org/trac
  - trotsky 14y ago
    Invisible things is awesome, they're right up front too. Outside of the mainstream players my claim isn't worth much.
- ChuckMcM 14y ago
  You can do some of this with VM's, Build a machine, use it for web access, delete it when done. With a carefully constructed virtual drive, you can just clone the drive, start the machine, discard when done. Not at all a "friendly" way to go but one which adds another layer to the puzzle for your attacker.
InclinedPlane 14y ago
Digitally sign all your email, and only accept mail that is digitally signed from people you know.
- msh 14y ago
  Most people need to receive emails from unknown parties.
  - lutusp 14y ago
    That may be, but no one needs to receive emails from people pretending to be someone they aren't.
    - msh 14y ago
      Yes, but that is not solved by the above, for that all email infrastructure in the world need to be changed.
Tloewald 14y ago
If we just had proper encryption integrated with email...

jgrahamc 14y ago

Use a browser that's not on your machine. See, for example, https://www.authentic8.com https://www.authentic8.com

Luc 14y ago
Interesting, but despite some searching I couldn't find a price for this service. Has anyone tried it?
wslh 14y ago
It's running on their servers! I prefer to have a VM on my side. In terms of security I don't trust third parties. Or saying it in a different way: can I look at their server configurations before acquiring their services?
superbaconman 14y ago
Does this really solve the problem though? If a file that contains the attack appears legitimate, it could potentially be shared. If the file is saved to google docs or dropbox everyone who tracks that folder is compromised also.
sltkr 14y ago
So to avoid leaking any private data to third parties, I should send all my private data to a third party using a proprietary protocol?
newman314 14y ago
I know not everyone can do this but fire up a VM for browsing and reset after every session.

snowwrestler 14y ago

This is what Invincia offers. The browser runs in a VM with a "watcher" that compares its activity to typical browsing activity. If it sees something unusual it kills the whole VM and loads a fresh one. The problem with this sort of approach is that it is slow on most office machines. A lot of companies are still running XP desktops with 1GB RAM.

capnrefsmmat 14y ago

The laboratory I work in has all Internet access routed through browsers on a separate server, accessed via RemoteApp. The browser server is supposed to be reimaged regularly.

DeepDuh 14y ago

I'd say E-Mail signatures. Officials should get a big fat warning sign for E-Mails that contain either no signature or a signature issued by an untrusted party. The private keys to sign mails would also have to be encrypted in a way that infected systems could still not send signed E-Mails. I'm thinking a hardened USB stick with some kind of biometric scanner as the only place to store the key. You'd send a blob of data to that appliance, it waits for your authentication and then it sends the signed version back to the E-Mail client.

Justsignedup 14y ago
That is indeed a good point. However it won't prevent the ideas of hijacking little league sites that your employees may visit which would be maintained by one web designer one day a year, on that employee's home computer, which then goes on to use it as a vector to attack the company. Yeah. Technology to hack someone is getting better by the minute.
niels_olson 14y ago
What's really sad about this is that many government resources have certificates that the browsers available to their users (i.e., IE 6/7/8) don't trust, so the users are conditioned to blow through the clearest warnings they will ever get. eg, here's the DoD global phone book (in case I want to email somebody). Server requires CAC token from the client, but the client's browser doesn't trust the server! https://dod411.chamb.disa.mil/ https://dod411.chamb.disa.mil/ I don't even know what to call this level of broken, Chomsky-esque?
- mpyne 14y ago
  Just install the goddamn DoD root certificates and the client browser will work just fine. I've used approximately zero DoD computers since 2005 that had the SSL CA chain misconfigured for use on DoD websites. It's really not that hard, even my Linux box here works fine.
  - niels_olson 14y ago
    Are you on NMCI? Because I have used approximately zero DoD computers since 1994 that had the SSL CA chain configured properly on delivery. In my humble experience, installing DoD roots is a journey: there are at least a few dozen and they are constantly being retired and superseded. Meanwhile, to get the DoD root certs, one has to trust A) DNS B) whomever is in charge of access control to the cert servers. Clearly, access control is a major problem for the DoD, that's the whole problem to begin with.

fnordfnordfnord 14y ago

Using a live CD based OS for sensitive transactions is one pretty simple way.

jfrm 14y ago
The DoD agrees with you. http://www.spi.dod.mil/lipose.htm http://www.spi.dod.mil/lipose.htm

Justsignedup 14y ago

Hmmm... Well... there are ways: a) disable flash b) disable java c) disable any plugins really. d) use chrome (at least) e) do not allow downloading of any file. Instead use chrome's plugin to open any word/etc files in google docs. f) Use a chromebook. Chromebooks can't really execute programs like windows machines can, so it's fairly safe. And worst case is you expose a sandbox machine with no private data other than caches, that can be set to be cleared on sleep or whatever. Bonus security points: - if a chromebook is hijacked, it will only be hijacked until a reboot during which time the chromebook does a sanity check ensuring the OS is exactly intact. If it is not it just reinstalls the OS from ROM. Basically no long-term compromised machines. - The only time chrome's sandbox was ever completely bypassed allowing arbitrary code execution was using a combination of multiple chrome exploits (now closed) and a windows data execution prevention bug. That can't happen on linux (and the chrome team works to further solidify that sandbox). Pretty much almost impossible. And if it is quickly patched and vuala. g) browse in private browsing mode only h) When visiting links (like facebook) manually type in the url to ensure nothing is spoofed. I think you will be fairly safe. However... I doubt most people will go that far.

BCM43 14y ago
As sltkr said: So to avoid leaking any private data to third parties, I should send all my private data to a third party using a proprietary protocol? Also, I 'd recommend using noscript, with no plugins. Don't bother opening word files, get them to send it to you in plain text. Or run around with usb drives (no one ever said it would be easy).
- mark-r 14y ago
  USB drives aren't a solution either. How do you think Stuxnet got started? http://en.wikipedia.org/wiki/Stuxnet#Windows_infection http://en.wikipedia.org/wiki/Stuxnet#Windows_infection
mariallery 14y ago
> c) disable any plugins really. embarrasing to admit, but I've always wanted to believe one could at least trust plugins like Adblock Plus or Ghostery to protect ones mind and privacy a little.. now, reading Hacker News almost every day, I'm getting paranoid. is it a vulnerability to even use them?

trotsky 14y ago

pretty much air gapped networks, build yourself a computer with a MIPS CPU, or just buy a laptop every monday and throw it away on friday. Chrome OS is probably the only commercial platform that is designed with this era of threats in mind. It's at least a generation ahead of everybody else. They're actually building their own embedded controller (controls the fans, battery etc.) to go along with their open source firmware so they can worry less about bad guys in the supply chain.

zby 14y ago
How about Qubes OS? http://qubes-os.org/trac http://qubes-os.org/trac
- trotsky 14y ago
  Invisible things is awesome, they're right up front too. Outside of the mainstream players my claim isn't worth much.
ChuckMcM 14y ago
You can do some of this with VM's, Build a machine, use it for web access, delete it when done. With a carefully constructed virtual drive, you can just clone the drive, start the machine, discard when done. Not at all a "friendly" way to go but one which adds another layer to the puzzle for your attacker.

InclinedPlane 14y ago

Digitally sign all your email, and only accept mail that is digitally signed from people you know.

msh 14y ago
Most people need to receive emails from unknown parties.
- lutusp 14y ago
  That may be, but no one needs to receive emails from people pretending to be someone they aren't.
  - msh 14y ago
    Yes, but that is not solved by the above, for that all email infrastructure in the world need to be changed.

Tloewald 14y ago

If we just had proper encryption integrated with email...