Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 3 down vote favorite

Single computer with dynamic IP assigned by ISP, running on Ubuntu 9.04 Live CD, using Firefox, all ports in stealth mode, does not repond to pinging. How safe is this machine from intrusion when connected to the Internet and only accessing trusted sites?

share|improve this question
Are we talking about Data-Protection or just Intrusion/Virus-Infection here? – Bobby Oct 8 '09 at 15:26
Any type of intrusion, especially with the potential to access data. I’m guessing that lack of intrusion would cover all bases. – The Guy Oct 8 '09 at 15:34

6 Answers

up vote 5 down vote

You are vulnerable to all security issues that have been patched since the release of the LiveCD. Many of the patches may seem like they're not applicable to you, but the desktop uses many libraries and the kernel can also have vulnerabilities.

If you read through the list, you'll see many instances of Firefox and Xulrunner vulnerabilities, these are likely the highest threat from the usage pattern your described.

I highly recommend installing Ubuntu and updating your system so that you're protected from those vulnerabilities.

share|improve this answer
Got it. Is it a safe assumption that these will be taken care of in the next version? Any particular vulnerability you can see in my system? – The Guy Oct 8 '09 at 15:52
The ones I link to for Firefox and Xulrunner are fairly serious. If you go to a site that's crafted to exploit them, they can essentially run anything with the privileges of the current user, which is a sudoer with no password on the LiveCD, they can essentially run anything as root. – Ben S Oct 8 '09 at 16:00
My question in related exclusively to “trusted sites.” I use this method dedicated solely for Internet banking and set it up every time for each site, on the assuption that nobody can install anything on a CD. Still, I need the input from those more knowledgeable than me. Better safe than sorry. Thank you, everybody. – The Guy Oct 8 '09 at 16:17
Can't install to CD, but can install and run in memory until you reboot. That's why everyone says to keep your computer patched, no matter what os you use. – Tom Oct 8 '09 at 16:19
1  
@The Guy: Even if you only visit trusted sites you may be vulnerable to attacks. For example the null-prefix SSL certificate vulnerability. Someone could highjack the DNS entry for your bank and conduct a man-in-the-middle attack. The SSL certificate would validate due to your system not being patched. A patched system would display the certificate as untrusted in this case. – Ben S Oct 8 '09 at 18:02
up vote 3 down vote

You're totally safe as long as you don't access the Internet.
The moment you start browsing or receive email, you open yourself to :

  • All the vulnerabilities that exist in your browser, either known or not, either patched or not
  • All phishing scams that exist on the Internet, either while browsing or via email

Which just goes to say that the weakest link is yourself and no other.
It's your responsibility to keep your system always fully patched, be careful which sites you visit, and multiply your precautions as regarding anti-virus, anti-intrusion and anti-spam, and have a good bank insurance cover if things go bad.

The Web is a dangerous place, no doubt about it.
Do you know that today the Web is the best source of income for organized crime, better than any other activity?
And that means you!

share|improve this answer
2  
I’ve considered becoming a hunter/gatherer and living in a cave already, but my girlfriend is not too crazy about it. – The Guy Oct 8 '09 at 16:39
Even though the weakest link is the user, it's worth noting that these days, even the most vigilant and paranoid user will get infected by something, especially if your computer is connected directly to the internet, but just as likely from some website you browse to. I know this, because I am that most vigilant and paranoid user, and I had to start running an Antivirus program on my computer about three years ago. I had done nothing wrong, yet my computer still got infected. – Ernie Dunbar Oct 8 '09 at 17:51
@erniedwork: I'm much more paranoid and have several antivirus and anti-intrusion etc., and I run update-checkers every week on all installed products, and I do visit sometimes dangerous sites (curiosity, curiosity...). I believe I've not been infected for years now, so this must be working. – harrymc Oct 8 '09 at 18:08
up vote 0 down vote

The only drawback I can see is the Live CD. Running from here pretty much guarantees a static operating system, but what security patches are you depriving yourself of? I run Ubuntu 9.04 myself, installed to my hd, with a similar setup but with firestarter included and no-script for firefox, and haven't had any issues. not that I won't have issues, but I do get updates and can do a lot more than I could with running from a live cd.

share|improve this answer
It is somewhat of a hassle to set it up every time, but security is the primary concern. – The Guy Oct 8 '09 at 15:40
1  
If security is that big of a concern, then get yourself a hardware firewall to go between your computer and your connection. Properly set up and configured, a good firewall will do a lot more for protecting you than just running off the live cd all the time since you're still vulnerable to unpatched flaws until you reboot, then you're vulnerable again – Tom Oct 8 '09 at 15:46
Ubuntu has a very good firewall installed by default (the same used in many routers actually), named iptables. It's difficult to configure manually, but GUI tools exist to make it easy to setup. – Ben S Oct 8 '09 at 15:49
Yes, Firestarter provides an excellent front end for iptables. The advantages to a hardware firewall is that you can configure it to do a lot more than just port and service blocking. The sonicwall firewall we use gives us the capability to block specific domain levels, services, ports, hosts, and completely stealth everything. True, sonicwall is expensive, but for the paranoid, it is a good choice. – Tom Oct 8 '09 at 15:52
Speaking of iptables, I try setting up a whitelist blocking every IP except that of the site I want to access (bank’s), but the site seems to have several layers of security, and probably more than one server and/or IP, so I get stuck along the way. Somebody may have a suggestion about this. For some reason, ufw does not work with the CD, perhaps because it may need files that are not available with such a setup. – The Guy Oct 8 '09 at 16:24
up vote 0 down vote

You didn't mention anything about router configuration. Do you have a direct connection to the internet or are you behind a router? A router can also provide another layer of security via NAT. Although your current setup is significantly more secure than most people browsing the internet right now.

share|improve this answer
Direct connection. – The Guy Oct 8 '09 at 15:27
up vote 0 down vote

It is relative. It depends what you do, if you access the internet, if you visit certain websites etc. There are many variables in computer security, that is why there are always vulnerabilities despite practicing "best practices."

The key is, you have already made yourself much more secure by taking a few easy steps that the majority of people do not take. That alone, even though it is not 100% secure (since nothing is) it leaves you leaps more secure than the person not doing anything for security on their machine, what I like to call, "non-security conscious."

share|improve this answer
up vote 0 down vote

Pretty much not at all. Although noone can access your hard drive in this configuration, people love to take over computers just to use their internet connection to send spam these days. Your only benefit is that when you reboot, it all goes away.

Get a router. And then install your OS to your hard drive and keep it updated. Then you will have a secure computer. At least, as secure as it can be. There's still a small possibility that you'll still get a virus or two, but since you're running Linux instead of Windows, you're not part of the largest possible audience virus authors chase.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.