Collaborate Disseminate
Most breaches start with the user performing a risky click Windows 10 and modern browsers are more secure, but still susceptible to risky clicks Bromium’s virtualization-based security seamlessly isolates risky clicks inside unbreakable virtual m… Continue reading Seamlessly Isolate Risky Clicks with Bromium Secure Platform 4.1 [Demo Video]
This is assuming that escaping the hypervisor is the only way the guest OS could compromise the host– e.g. it’s not networked, isn’t sharing folders or the clipboard, etc. Does knowledge about the host’s root password matter… Continue reading Is a host OS more vulnerable to a hypervisor escape if the guest OS knows the root password to the host?
Apparently, the open source router firmware OpenWrt has the option to isolate client traffic. I imagine this is simply a firewall rule which prevents individual IPs on the LAN from communicating with each other. On the face o… Continue reading Threat model for the OpenWrt client isolation feature
TL;DR:
We’re considering disconnecting our manufacturing computers from the outside world. How much less secure would it be to connect them only to a local server, which in turn connected to the internet and/or other comput… Continue reading Islanding vs server lockdown
Currently I have multi-user linux servers where developers access through remote desktop and use the session as work environment.
But I’m a bit concerned about the increasing popularity of applications applications using a l… Continue reading Local server applications using a web frontend on multi-user desktop environments
I have a significant number of untrusted binary applications that need to be executed on a *nix box.
I’m hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could easily be used to isolate a single applicat… Continue reading What is the easiest way to sandbox an application in a *NIX environment?
It looks like i found a way to allow only single application to access files in USB storage.
This script must be run with sudo.
#!/bin/bash
# create namespace
unshare -m<<EOF
# mount device in namespace
mount -U “UUID-here” “/home… Continue reading Allow only single aplication to access files on USB stick with Linux namespaces
my current network setup looks basically like this:
I have another device which is capable to connect to the Internet. What I want is to connect my home router and this device to the “questionmark”-device in such a way tha… Continue reading Hide network devices from each other
Let’s consider the following:
Linux is the platform I am referencing here
There exists a partition on the system that’s encrypted with a strong password (via the LUKS mechanism, if it’s relevant to you)
This partition contains sensitive … Continue reading Protecting folder contents from processes
In discussions around the ongoing transition from X.org to Wayland, I regularly come across comments along the lines of “Linux security is not there yet”. This refers to Wayland’s promise of better (but not perfect) desktop i… Continue reading Do any non-GNU/Linux display managers provide the same isolation as Wayland?