Pwn2Own results for Wednesday (Day One) • Hacker News Board

Re: Pwn2Own results for Wednesday (Day One)

#21

Post by M2Ys4U » Sat, Mar 15, 2014, 8:47 AM UTC

Ellipsis753 wrote: post #17

sitkack wrote: post #16

What this shows is that if you are using a machine connected to the internet, assume you have been rooted. If you are paranoid, do all of your surfing in a VM over Tor and reset that VM state after every launch.

Good idea but there's quite a lot of exploits in virtual machines that let them infect the host machine too. :P So it's really pretty hard to stay safe. You could always run your OS from a read-only CD? At least you'd be none-infected on each reboot.

Tails[0] would be a good candidate for this.

[0] https://tails.boum.org/

Re: Pwn2Own results for Wednesday (Day One)

#22

Post by Ellipsis753 » Sat, Mar 15, 2014, 2:03 PM UTC

ChuckMcM wrote: post #19

Ellipsis753 wrote: post #17

Earlier quoted context omitted.

Good idea but there's quite a lot of exploits in virtual machines that let them infect the host machine too. :P So it's really pretty hard to stay safe. You could always run your OS from a read-only CD? At least you'd be none-infected on each reboot.

My favorite is you run the browser on a different machine and you place a webcam near it that you can visit on your primary machine. Sending keystrokes and mouse moves to the browser machine using an infrared laser to create a unidirectional serial link to the machine. Air gap AND lasers, how cool is that?

I like this idea.

I guess you might get away with just sshing to a machine if you could secure that.

Re: Pwn2Own results for Wednesday (Day One)

#23

Post by sitkack » Sat, Mar 15, 2014, 6:24 PM UTC

ChuckMcM wrote: post #19

Ellipsis753 wrote: post #17

Earlier quoted context omitted.

Good idea but there's quite a lot of exploits in virtual machines that let them infect the host machine too. :P So it's really pretty hard to stay safe. You could always run your OS from a read-only CD? At least you'd be none-infected on each reboot.

My favorite is you run the browser on a different machine and you place a webcam near it that you can visit on your primary machine. Sending keystrokes and mouse moves to the browser machine using an infrared laser to create a unidirectional serial link to the machine. Air gap AND lasers, how cool is that?

I have a more doable sketch of this, running in a guest account on a raspberry pi over xvnc. Laptop is firewalled from net, raspberry pi is booted from read only media. Would need hardware ethernet firewall between laptop and raspberry pi to only allow VNC traffic.