Hacker News Reader

Comment by arkitaip | Hacker News Reader

So how do you protect yourself from these highly-targeted attacks?

How about running the browser in a sandbox that resets all changes on exit? I've actually set up Firefox (hardened) + Sandboxie on Win7 but exactly how good is this setup?

View on HN

Hmmm... Well... there are ways:

a) disable flash

b) disable java

c) disable any plugins really.

d) use chrome (at least)

e) do not allow downloading of any file. Instead use chrome's plugin to open any word/etc files in google docs.

f) Use a chromebook. Chromebooks can't really execute programs like windows machines can, so it's fairly safe. And worst case is you expose a sandbox machine with no private data other than caches, that can be set to be cleared on sleep or whatever. Bonus security points:

- if a chromebook is hijacked, it will only be hijacked until a reboot during which time the chromebook does a sanity check ensuring the OS is exactly intact. If it is not it just reinstalls the OS from ROM. Basically no long-term compromised machines.

- The only time chrome's sandbox was ever completely bypassed allowing arbitrary code execution was using a combination of multiple chrome exploits (now closed) and a windows data execution prevention bug. That can't happen on linux (and the chrome team works to further solidify that sandbox). Pretty much almost impossible. And if it is quickly patched and vuala.

g) browse in private browsing mode only

h) When visiting links (like facebook) manually type in the url to ensure nothing is spoofed.

I think you will be fairly safe. However... I doubt most people will go that far.

As sltkr said:

So to avoid leaking any private data to third parties, I should send all my private data to a third party using a proprietary protocol?

Also, I 'd recommend using noscript, with no plugins. Don't bother opening word files, get them to send it to you in plain text. Or run around with usb drives (no one ever said it would be easy).

USB drives aren't a solution either. How do you think Stuxnet got started? http://en.wikipedia.org/wiki/Stuxnet#Windows_infection

> c) disable any plugins really.

embarrasing to admit, but I've always wanted to believe one could at least trust plugins like Adblock Plus or Ghostery to protect ones mind and privacy a little.. now, reading Hacker News almost every day, I'm getting paranoid. is it a vulnerability to even use them?

First of all, in Firefox (and I believe in Chrome too) there is a distinction between "addons" (such as adblock plus) and "plugins" (such as flash). The main difference being that plugins are DLLs containing native code, and thus have all the privileges the browser has. In comparison, addons are mostly JavaScript, and run inside the browser with somewhat limited access to the rest of the system.

Thank you for pointing it out and for a well-written explanation. Took a quick look and Chromium seems to call them all 'extensions'.

In Chrome they're different - chrome://plugins/ vs chrome://extensions/

In Firefox extensions have the same access to the rest of the system as Firefox itself including full file system access.

Addons is more generic term, it includes extensions, plugins and themes.

The more people you trust, the more susceptible you are to having that trust broken.

Let's say you trust Chrome, you can't trust AdBlock just because you trust Chrome. The install on the Chrome store could get compromised, somehow.

In this specific case though, you also have to weigh the risk of an attack being delivered from an ad. What's more likely? One of the thousands of ads you view a day launches an attack, or installing a Chrome extension does? Which would be more damaging?

Security is not an exact science. It's all about weighing options and making informed decisions.

You're still not necessarily safe here from spoofing.

If an attacker can gain access to your network (splicing a network cable somewhere, long term hacks against wifi keys, etc) then they can run DNS or arp poisoning, and redirect all of your traffic through a transparent proxy that can strip off HTTPS and log all cookies and form submission.

Many people will then type in 'www.facebook.com' into the address bar, and will see facebook as normal (minus the padlock, which most people wouldn't notice is missing).

So: don't just type in 'www.facebook.com' ALWAYS type in 'https://www.facebook.com manually, or make a habbit of checking the padlock on every page view (perhaps there is a chrome addon for this?)

EDIT: and if you're being spoofed by a government or syndicate who has the ability to sign global certificates, then there is probably not much you can do.

e) do not allow downloading of any file. Instead use chrome's plugin to open any word/etc files in google docs.

I'm interested to know how google's cloud is going to implement my updated video card drivers.

I'd say E-Mail signatures. Officials should get a big fat warning sign for E-Mails that contain either no signature or a signature issued by an untrusted party. The private keys to sign mails would also have to be encrypted in a way that infected systems could still not send signed E-Mails. I'm thinking a hardened USB stick with some kind of biometric scanner as the only place to store the key. You'd send a blob of data to that appliance, it waits for your authentication and then it sends the signed version back to the E-Mail client.

That is indeed a good point. However it won't prevent the ideas of hijacking little league sites that your employees may visit which would be maintained by one web designer one day a year, on that employee's home computer, which then goes on to use it as a vector to attack the company.

Yeah. Technology to hack someone is getting better by the minute.

What's really sad about this is that many government resources have certificates that the browsers available to their users (i.e., IE 6/7/8) don't trust, so the users are conditioned to blow through the clearest warnings they will ever get.

eg, here's the DoD global phone book (in case I want to email somebody). Server requires CAC token from the client, but the client's browser doesn't trust the server!

https://dod411.chamb.disa.mil/

I don't even know what to call this level of broken, Chomsky-esque?

Just install the goddamn DoD root certificates and the client browser will work just fine.

I've used approximately zero DoD computers since 2005 that had the SSL CA chain misconfigured for use on DoD websites. It's really not that hard, even my Linux box here works fine.

Are you on NMCI? Because I have used approximately zero DoD computers since 1994 that had the SSL CA chain configured properly on delivery.

In my humble experience, installing DoD roots is a journey: there are at least a few dozen and they are constantly being retired and superseded. Meanwhile, to get the DoD root certs, one has to trust A) DNS B) whomever is in charge of access control to the cert servers. Clearly, access control is a major problem for the DoD, that's the whole problem to begin with.

Yes, NMCI.

But like I said, it works on my home computer too. Google for DISA InstallRoot (or try going here and running through the steps http://iase.disa.mil/pki-pke/getting_started/index.html)

It is true that they go through the intermediate CAs fairly quickly, but the actual root is still at CA-2 from what I can tell.

DNS security is certainly a concern, but not the kind of concern that leads to SSL warning popups unless there's something else screwy going on. But then maybe Chrome is seeing screwy stuff that MSIE doesn't know to check for...

For DoD it's already a requirement that any emails with URLs or other "clickable links" are digitally signed (possibly this is true for attachments too, I'm not sure).

However this is a policy which is not computer-enforced, which means of course that it's fairly useless in practice.

Use a browser that's not on your machine.

See, for example, https://www.authentic8.com

Interesting, but despite some searching I couldn't find a price for this service. Has anyone tried it?

It's running on their servers! I prefer to have a VM on my side. In terms of security I don't trust third parties. Or saying it in a different way: can I look at their server configurations before acquiring their services?

Does this really solve the problem though? If a file that contains the attack appears legitimate, it could potentially be shared. If the file is saved to google docs or dropbox everyone who tracks that folder is compromised also.

So to avoid leaking any private data to third parties, I should send all my private data to a third party using a proprietary protocol?

I know not everyone can do this but fire up a VM for browsing and reset after every session.

pretty much air gapped networks, build yourself a computer with a MIPS CPU, or just buy a laptop every monday and throw it away on friday.

Chrome OS is probably the only commercial platform that is designed with this era of threats in mind. It's at least a generation ahead of everybody else. They're actually building their own embedded controller (controls the fans, battery etc.) to go along with their open source firmware so they can worry less about bad guys in the supply chain.

How about Qubes OS? http://qubes-os.org/trac

Invisible things is awesome, they're right up front too. Outside of the mainstream players my claim isn't worth much.

You can do some of this with VM's, Build a machine, use it for web access, delete it when done. With a carefully constructed virtual drive, you can just clone the drive, start the machine, discard when done. Not at all a "friendly" way to go but one which adds another layer to the puzzle for your attacker.

Using a live CD based OS for sensitive transactions is one pretty simple way.

The DoD agrees with you. http://www.spi.dod.mil/lipose.htm

This is what Invincia offers. The browser runs in a VM with a "watcher" that compares its activity to typical browsing activity. If it sees something unusual it kills the whole VM and loads a fresh one.

The problem with this sort of approach is that it is slow on most office machines. A lot of companies are still running XP desktops with 1GB RAM.

The laboratory I work in has all Internet access routed through browsers on a separate server, accessed via RemoteApp. The browser server is supposed to be reimaged regularly.

If we just had proper encryption integrated with email...

Digitally sign all your email, and only accept mail that is digitally signed from people you know.

Most people need to receive emails from unknown parties.

That may be, but no one needs to receive emails from people pretending to be someone they aren't.

Yes, but that is not solved by the above, for that all email infrastructure in the world need to be changed.

Reply on news.ycombinator.com