How Secure Is Ubuntu

[bostonman]

I have an old laptop with XP and Ubuntu (dual OS obviously).

Is using Ubuntu for secure stuff safe, or, because it's an open-source it is vulnerable to hackers stealing information as I'm typing it?

[grumpydoc]

A hard question to answer - security is usually a compromise and you have to understand the trade-offs you are making.

If you store data which needs to be kept secure on a laptop with Ubuntu install and make sure it is locked in a safe when you are not using it, and never connect it to any networks it will be perfectly secure - and some environments might actually require that approach. Some might need even more such as using it in a soundproofed environment within a Faraday cage.

What is the cost of losing the data? What is your threat model?

[tunk]

Is your Ubuntu an (LTS) version that still get updates?
If yes, then it is (at least compared to XP which hasn't
got updates for almost 7 years).

[grumpydoc]

Is your Ubuntu an (LTS) version that still get updates?
If yes, then it is (at least compared to XP which hasn't
got updates for almost 7 years).

I'd certainly start by wiping XP 

If the threat model is the laptop & hard disk being stolen Ubuntu (certainly current versions) supports disk encryption.

If the threat model is dodgy websites stealing your personal data then you need to think about hardening the browser - and your own browsing practices as much as the OS.

If the threat model is data being siphoned in flight across the internet then use HTTPS (but be aware this risk vector is tiny to the point of not existing for ordinary individuals).

[bostonman]

I wasn’t thinking about including a threat model. I need to look at which version of Ubuntu but it does get updates.

Threat model would be just Internet. If I log into a secure site like my credit card or similar, and assuming no virus (or the possibility XP vulnerability bleeding into Ubuntu - something I’m uncertain of), is that safe?

[ataradov]

It is perfectly safe. I'm not even sure why this question comes up. There is such a bigger market for Windows vulnerabilities that not having the source code is not a factor at all. Even with the source code nobody cares to put a whole lot of effort into OS that holds 1% of the market (not that holes are much easier to find with the code).

[Marco]

Is using Ubuntu for secure stuff safe, or, because it's an open-source it is vulnerable to hackers stealing information as I'm typing it?

On any desktop OS it's best to assume local root exploits are infinite.

It's all about keeping attacks away from the OS, ie. using an up to date browser, not installing malware, not allowing inbound traffic to anything with a significant attack surface (ie. more than 10 lines of C code, which unfortunately includes the TCP/IP stack, so compromises have to be made).

[golden_labels]

Is using Ubuntu for secure stuff safe,

Using anything is as secure as the weakest link, which is nearly always YOU. So the answer is: if YOU use it in a secure manner, it is secure. Certainly much more secure than unmaintained software past its EOL, which comes from time before Microsoft was even caring about security in their consumer OS.

because it's an open-source it is vulnerable to hackers stealing information as I'm typing it?

Why do you think cryptographic primitives are open? Closed designs are never more secure: they are merely unverifiable.

[bostonman]

Even with the source code nobody cares to put a whole lot of effort into OS that holds 1% of the market (not that holes are much easier to find with the code).

I understand and agree, but why would hackers not attempt Apple products since it's a popular product?

[bostonman]

Merely disabling root account has made such huge an improvement that modern OSes are equally secure for common users.

Seriously, don't disable UAC, and only give privilege to trusted programs, then for laymen hackers Windows is just as safe.

Sadly enough, although I'm knowledgeable when it comes to being careful while online, sadly, I don't know enough about computer security to know what a "root account" is, and UAC.

My guess is that Windows has layer upon layer and it's easier for hackers because a plethora of ways exist to compromise a system.

[madires]

Macs and linux PCs/servers get hacked too. However, most attempts are simple dictionary attacks and scans for known vulnerabilities. The real fun starts when you're running a web server with CMS', blogs, forums, and tons of plugins.

[madires]

Sadly enough, although I'm knowledgeable when it comes to being careful while online, sadly, I don't know enough about computer security to know what a "root account" is, and UAC.

In Windows terminology it's the administrator account or any other one with admin rights.

[rdl]

I have no experience with Windows 8 or 10, but up through Windows 7 the default setup starts with an administrator account and it's easy to skip adding a password. Best thing is to use a strong password for the default admin account then set up a secondary account with limited privileges for day to day use. Having said that, I have to admit I never do it.

[retiredcaps]

Sadly enough, although I'm knowledgeable when it comes to being careful while online, sadly, I don't know enough about computer security to know what a "root account" is, and UAC.

If this is a really old laptop, I suggest Lubuntu 20.04.  It's Ubuntu, but stripped down so it runs on older computers that have less DRAM and a slower CPU.  It will happily run with 1GB DRAM, 10GB hard drive and P4 or better.

I have been running Lubuntu since 2014 on all my computers at home.  It has automatic updates so it downloads security patches and updates itself.  I have never had a problem with the updates going wrong in almost 7 years.  Updates take only minutes.

I use the Brave browser + ublock origin.  With this combination, your exposed surface attack vector will be smaller than the majority.  Or you can use Firefox + ublock origin.  Firefox comes preloaded with Lubuntu.

Also, I use the simple built in firewall on Lubuntu.  Open a terminal and type in

sudo ufw enable

It's disabled by default.  Or you can enable it via some GUI, but I'm comfortable using CLI vs GUI.

[retiredcaps]

Lubuntu's default desktop, LXQT, looks similar to XP's start menu so the learning curve is easier for newbies.  If you spend most of your time in a browser, Lubuntu + browser + ublock origin will be very easy for you to use.  Then, if you like it, you can learn the more advanced things with Linux.

I also lock down all my browser settings by turning off pretty much everything.

[Doctorandus_P]

What is the origin of this Laptop?
Do you know and trust it's source?

If I'd use it for anything personal I'd start by wiping the whole disk, re partitioning it and installing a fresh Linux OS.

What sort of hardware is in the laptop?
My previous PC, which I used until about half a year ago was a 12 year old Dualcore E6550 with a Passmark rating of around 1500 and 4GB of RAM and it was still adequate when I upgraded it for an i7-680 (That's probably first gen) I got for free and has about 2x the speed and better video too.

[janoc]

Even with the source code nobody cares to put a whole lot of effort into OS that holds 1% of the market (not that holes are much easier to find with the code).

I understand and agree, but why would hackers not attempt Apple products since it's a popular product?

Why do you think they don't?

https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

(and that's only the most recent one)

Macs don't get as many pieces of malware and hacks as Windows does but that's merely because Windows is so much easier and bigger target than Mac (or Linux).

[jmelson]

I have a web server running Ubuntu, it has not been broken into in over a decade.  Back then, I learned a few tricks.
1.  Have an absolute minimum number of user accounts on the machine, like ONE.
  (If the user password can be guessed on a non-privileged account, that can be used to try cracking the root password 10,000 times faster than over the net.)

2.  Run denyhosts with pretty restrictive settings.  Most importantly, do not re-enable attacking IPs in less than 2 weeks.
  (I used to have 1000 login attempts/day.  2 weeks after I set up denyhosts, to the exact hour, the attacks dropped to 3/day.  Obviously,
the hackers have a net where they compare notes on who has hard security and who is a soft target.)

Once I put in these two protections, I have not been hacked in a decade.  The hackers are contantly trying to ssh in, do SQL injection to my web server, etc. but it doesn't work.

Any user computer behind a firewall with NAT,  using a little common sense, is fairly safe.  I routinely open suspicious emails, and when I click on attachments, I can see "badprogram.exe" as the contents of the archive, and dump it right there.  Corrupt archives and documents with macros are flagged by sane software in Linux.

Jon

[nigelwright7557]

Security is a real pain from two viewpoints.
1/ Using dodgy downloaded software.
2/ But also from the other direction where you write software but then its gets sand pitted despite having no threats in it.
I spend half my life updating software then having to get it whitelisted which means uploading it to Norton etc.
Then the poor old user gets it and is bombed out by Windows defender which needs it to be verified as safe.

I sell systems with software and you would be gobsmacked how many people still use XP.

I use Win 10 and Norton internet security and havent been badly hit yet.
Downloading free software off the internet is my biggest threat.

[james_s]

Even with the source code nobody cares to put a whole lot of effort into OS that holds 1% of the market (not that holes are much easier to find with the code).

I understand and agree, but why would hackers not attempt Apple products since it's a popular product?

Apple products are not immune, but Windows is still 80-90% of the PC market. Hackers are going to go for the biggest/most common target and that is Windows.

Linux is capable of being very secure, it runs a large portion of the back end of the internet where security is important. Unix and later Linux were built from the ground up to be multi-user networked operating systems, Unix had decades to mature before it was ever common for Windows PCs to be networked to the outside world.

[madires]

2.  Run denyhosts with pretty restrictive settings.  Most importantly, do not re-enable attacking IPs in less than 2 weeks.
  (I used to have 1000 login attempts/day.  2 weeks after I set up denyhosts, to the exact hour, the attacks dropped to 3/day. 

There's a much simpler solution, simply use IPv6 and drop all ssh connections via IPv4 (maybe allow some safe networks). So far I haven't seen any dictionary attacks from IPv6 addresses.

[bostonman]

I sell systems with software and you would be gobsmacked how many people still use XP.

Guilty of this. I've wanted to buy pieces to build a PC, and, each time I attempt to do so, I get caught up with trying to figure out if I'm overspending or whether I'll be happy with my selections (I've been using PCpartpicker.com). After getting frustrated (or busy doing other stuff), I give up because I'm uncertain what to get.

The laptop that has Ubuntu also runs XP (dual OS), but it has XP only because it can't be upgraded and I never really use XP, just Ubuntu.

Sadly I know little about methods to protect my systems (ignoring that I use outdated OS's). Sometimes I've been known to find a keygen or accidentally go on a torrent site, so I also fear that I'll infect a new PC if I'm not careful. I figure I'll use maybe a Raspberry Pi for questionable sites, but this too has hindered my progress on getting a new PC because I had this plan years ago, got lazy with trying to use dual PCs (one for regular stuff and the other for going on questionable sites), and basically depended on Norton (which Comcast is no longer giving for free) to save me from hacks.

[janoc]

Downloading free software off the internet is my biggest threat.

FOSS is not your threat. They are constantly monitored by many eyes, and generally the binary packer is a highly ranked person in the R&D team.

Pirate software is, particularly those dodgy keygens. I hacked my Siglent scope with a keygen, but I wouldn't do it without it being distributed in an unencrypted Python script format so I could take a look at it before running it.

He means free as in beer, not freedom.

And he probably never got a drive-by download in Windows or never saw a Windows worm/virus neither ...

[james_s]

Guilty of this. I've wanted to buy pieces to build a PC, and, each time I attempt to do so, I get caught up with trying to figure out if I'm overspending or whether I'll be happy with my selections (I've been using PCpartpicker.com). After getting frustrated (or busy doing other stuff), I give up because I'm uncertain what to get.

Is there a particular reason you want to build one instead of just buying a ready made system? It's still fun to build, and you can get exactly what you want, but it sounds like you don't know exactly what you want, so maybe just buy one that is already put together and guaranteed to work. The most low end crappy thing you can buy today is going to be so much faster than anything that came with XP that there is no comparison, we're talking an order of magnitude or more. You can even get good used stuff, core i3 or i5 Lenovo desktop for maybe $150. Pop in a SSD and install the OS of your choice.

[golden_labels]

1.  Have an absolute minimum number of user accounts on the machine, like ONE.

That is a very bad idea. If you have only the root user, it means three things: that you are logging in as root, that the root user is accessible from internet and that you have services running as root. Triple tragedy.

Even if you have multiple users, but artificially limit their number, it means you share users between services. This is the problem with the nobody user, which was once very popular as “secure, restricted” account. Until someone has noticed that many servers pack a dozen different services into that single user, so if an adversary gets access through one of them, they have access to practically everything that matters. The best approach is to have a separate user for every service, which is opposite of the suggestion above. Of course that is not always worth the effort too.

If the user password can be guessed on a non-privileged account, that can be used to try cracking the root password 10,000 times faster than over the net.

It should not be possible to log in using a password in the first place. Preferably only SSH key should be allowed for accounts that need external access. And no access at all for other accounts.

There's a much simpler solution, simply use IPv6 and drop all ssh connections via IPv4 (maybe allow some safe networks). So far I haven't seen any dictionary attacks from IPv6 addresses.

Security by obscurity is never a good idea. However, that is useful in reducing noise in logs.

The reason you do not see attacks on IPv6 is probably because so far it’s cheaper to attack IPv4. The whole IPv4 internet can be enumerated in a matter of minutes, while IPv6 machines must be discovered one by one. But it’s a matter of probability, not a real security feature.