Elamb Cybersecurity

Category: Internet and Information Technology Security

  • Home made Homemonkey: HoneySpider

    In my quest to find more viruses, trojans, and worms (which I find fastinating)  I started building my own HoneyMonkey server which I call a “HoneySpider.”

    What the hell is a HoneyMonkey?

    You've heard of HoneyPots, right?  A server that is set up to trick and track potential malicious hackers who think they have found the goods but have in fact been seduced by a decoy.  Brilliant defense however it is very passive as you must wait for the bastard hackers to come to your decoy system.  The HoneyMonkey is active in that it actively locates sites, pages and weblinks that seek to exploit systems.  The Microsoft's Strider HoneyMonkey Exploit Detection system is great evolutionary step for a proactive method of Internet security (something I've been waiting for a while).  It actually crawls the web to locate these evil boxes and maps out there location on the Web.

    I thought the concept seems pretty self explanatory:  set up a server that crawls the web specifically looking for offending sites.  This can be down with and old box you happen to have laying around and a web crawler like Zeus.

     

    I'm still working on it.  I'll keep you posted.

     

  • Strategies To Protect Yourself Against Identity Theft

    Identity theft is a serious crime that is growing each year. If you're a victim of identity theft you may spend months, even years, trying to repair a ruined credit history. A seriously damaged credit report can compromise your chances of getting a new job, a bank loan, insurance or even rental housing. It's even possible to be arrested for a crime you didn't commit if someone else has used your identity to break the law.

    Unfortunately, many of the methods that thieves use to steal identities are beyond your control to guard against. Although it's rare, even store clerks have been known to use their position to pass along information to identity thieves. There are some measures you can take, however, that will make it harder for a thief to steal your identity.

    Protect Your Credit Card Number When Making Purchases

    After you make a purchase and your credit or debit card has been swiped through a credit card terminal, check to make sure that the printed receipt hides all but the last 4 digits of your credit card account number (usually there will be Xs in place of the first 12 digits). Some terminals still print receipts that show all 16 digits of an account number, and may even include the expiration date as well. After your card is swiped, you're permitted by law to hide the first 12 digits of your account number on the copy of the receipt that the vendor keeps. Use any marking pen that will do the job.

    When you go to a restaurant, it's especially important to make sure that the first 12 digits of your credit card number are hidden on your receipt. You might be in the habit of signing it and then leaving the restaurant's copy on the table after your meal. An identity thief can easily steal the signed receipt before the waitperson comes back around to pick it up from the table. Don't take any chances.

    Do You Really Need To Give Your Social Security Number?

    Another important way that you can guard against identity theft is to avoid giving out your social security number unless it's absolutely required. Although you need to share your social security number when you apply for credit or for a bank account, sometimes a store or an organization will want to use it as an ID number, simply to identify you within their system. This is a common practice even though the law says that social security numbers aren't to be used as ID numbers. In these situations, use your judgment. There's usually an alternative if you ask.

    Destroy Documents That Contain Sensitive Personal Information

    Buy a paper shredder and use it to destroy documents you're throwing away which contain personal information such as credit card numbers, social security numbers, phone numbers and dates of birth. This is important to do both at home and at work. Identity thieves aren't above going through someone's trash to find valuable personal information that can help them obtain credit in your name.

    If The Worst Happens

    If you do become a victim of identity theft, take the following steps immediately:

    • Contact your credit card companies, close your accounts and ask to have new cards issued to you.
    • Place a fraud alert on your file with any one of the three major credit bureaus. The other two will be notified automatically.
    • File a police report. You may need it to show to creditors as proof of the crime.
    • File a complaint with the FTC, which maintains a database of identity theft cases used by law enforcement agencies for their investigations.

  • Information Security vs. Information Technology

    In my experience Information Security as a career field is far superior
    to Information Technology (IT).  I've done both for a number of
    years.  IT seems to get worse every year and Information Security
    seems to get better.

    Overall Information Security pays better, has less competition from
    competent professionals and usually doesn't have a lot of out of
    country competition.  There are exceptions such as highly
    specialized IT jobs and management posistions.  When I refer to
    “IT” I'm speaking of basic network engineers and
    System Administors not WAN engineering CCIE's, or IT guys with running
    their own business contracts or very specialized software coders that
    know assembly.  I used to be very excited about IT until I went
    into the private sector for about a year.

    Why does Information Technology suck as a career field?
    Well it doensn't necessarily SUCK, but there are several reasons why I
    will more than likely never go back to vanilla flavored IT: Too much work, Slave wages, competition.

    Lets start with too much work.  Many business' that rely heavily
    on their servers, routers, Data bases and other information systems
    want their systems to be up 24/7 which requires on call workers. 
    I used to be excited about getting the pager and/or corporate cellphone
    until I got called a few times at the crack of ASS
    on a weekend.  When a critical system goes down, the IT persons'
    pager blows up.  This sometimes means working long hours. 
    When you are on call, your free time is completely dependent on the
    status of the Information System.  FYI, the system hardly
    ever goes down when you're sitting at home thinking, “Damn, I'm bored!
    I wish I could fix the server.”  It usually goes off when your
    at your daughter graduation or in the middle of your mariage about to say “I DO” or in mid-stroke when you're about to orgasm.

    Information Security specialists can also have a “digital leash.” 
    But major virus' taking down an entire network is much more rare than a
    system crash or user error.. especially if you have Windows
    behind a good robust firewall.

    Slave wages.. o.k. thats an overstatement, but unless you are
    specialized, as stated above, you will be hard pressed to make over 55k
    in a basic IT job.  Now 55k is pretty good, but in security you
    can make as much as 100k (particulary in forensics).

    The low wages are directly related to the amazing amount of competition
    you will face as an IT guy.  Where I live there are a hand full of
    military installations which crank out bright young service who are
    willing to take the minimum that most companies will pay.  One of
    the biggest competitors may not even come from your country of
    origin.  In the U.S., global outsourcing has become an
    epidemic.  India is one of the biggest competitors for American IT
    jobs including help desk and software engineering.

    Information Security typically hires within the host coutries
    borders.  Many even require a secuirty clearance which greatly
    limits not only international competition, but local competition as
    well.  

    The bottom line in Information Technology and Information Security is
    specialization.  The more skilled you are at one particular trade,
    the more certifications, licenses and degrees you have focusing on one
    specialized skill that are in demand the better. They may just be
    pieces of paper but consider them ammunition against the competition
    that want YOUR job.  The specialization doesn't have to be in
    Security it could be in Database Analysis or Network Management or some
    programming language.         

  • CISCO LEAP (lightweight Extensible Authentication Protocol) Weak?

    Light weight EAP is Cisco's proprietary version of Extensible Authentication Protocol (EAP, used mainly for wireless LANs).  Cisco graciously allowed vendors to support LEAP using Cisco Certified Extenstion (CCX). 

    Cisco owns about 60% of the wireless market with 46% of those using Light Weight Extensible Authentication Protocol according to the research group nemertes. 

    HAZZAAA!! Cisco is secure…

    (except against Dictionary Attacks)

    With such a large piece of the wireless market using LEAP, Cisco had sucessfully advertised LEAP as a secure protocol.  Unfortunately, LEAP is weak against Dictionary Attacks (Brewin).

    At DEFCON 11, on August 1, 2003, Joshua Wright did a presentation on the weakness of LEAP. 

     

    Here is Cisco's response to Leap Dictionary attacks:

    To help our customers respond to the possibility of dictionary attacks, Cisco strongly recommends that all of our customers to review their security policies and institute the previously published best practices that are outlined below and in the Cisco SAFE White Papers.

    •Use a strong password policy (as detailed below) and periodically expire user passwords (recommended at least every three months) giving users advanced warning to change passwords before they expire.

    •If unable to implement a strong password policy, consider migrating to another EAP type like EAP-FAST, PEAP or EAP-TLS whose authentication methods are not susceptible to dictionary attacks:

    –EAP-FAST is an authentication protocol that creates a secure tunnel without using certificates.

    –PEAP is a hybrid authentication protocol that creates a secured TLS tunnel between the WLAN user and the RADIUS server to authenticate the user to the network.

    –EAP-TLS uses pre-issued digital certificates to authenticate a user to the network.

     

    FINAL NOTE:

    “1 month of audits by l33t security companies: No vulnerabilities
    1 month of architecture research by CCIE's: No vulnerabilities
    2 days of hacking by DaBubble, Bishop, and Evol: Root.
    There's some things that fackers should audit (WEBAPPS) for everything else, get a real hacker.” — SecurityFocus

    Why doesn't Cisco become more hacker friendly.  They pissed off the Security Profesionals and Hackers alike with that CiscoGate fiasco, don't have any cool hacker parties at the Defcon.. I mean what is the deal, John Chambers?! 

    John, I doubt you will ever read this blog, but here goes anyway, I think that Cisco has great products.  I believe in Cisco's amazing engineering, but if you guys don't aggressively attack security issues PROACTIVELY, you will drop from first class to third class quickly.  I'm not trying to tell you how to run cisco, I'm just saying, why not use hackers and their finding to your advantage. 

    Take the IE browser as an example: they used to own 95% of the market, consumners got so fed up with its lack of security that now Firefox (co-created by Blake Ross Intern/Hacker) is doing something not even Netscape could do.  

     

    Reference:

    EAP. RFC 2284. Extensible Authentication Protocol.

    EAP, Extensible Authentication Protocol Wiki. Wikipedia.org

    George C. Ou. Leap: A looming disaster in Enterprise Wireless LANs.  Lanarchitecture.net

    nemertes, Cisco Warns its WLAN Security can be Cracked. nemertes.com

    Brewin, Bob. Cisco Warn its WLAN Security can be Cracked. computerworld.com

    Cisco, Abusing 802.11: Weaknesses in LEAP Challenge/Response. Defcon 11/2003

    Cisco. Cisco Response to Dictionary Attacks on Cisco Leap.

  • Using VNC & SSH

    How to use VNC along with SSH to remotely and securely access your computer desktop by way of tunneling.

    VNC is a huge vulnerability on a network without encryption. Particularly on medium to large networks with lots of users. I use it at home but don't see the need for encryption there.

    read more | digg story

  • Use Google To Find Passwords

    Google hackers have been doing this for a while now. Here is a tutorial on finding passwords using google. This could be used to secure your own web server.

    Security Professionals charged with protecting IT infrastrutures would do well to become the most aggressive hacker of their own networks. This would help them to proactively seek out new exploits on their network, webserver, or IS they protect.

    read more | digg story

  • Startup Aims To Overload Spammer Web Sites

    A startup security firm is taking the fight to spammers by enlisting end users to create what's called a Do-Not-Intrude registry whose purpose is to make it too painful for junk mailers to operate.

    This is MY kind of company!  I really despise spam.  My biggest problem is the Spam filth that is actual scams or malware that downloads to your computer.  This is a bigger problem than people realize.  Just look at that virus on those Micheal Jackson emails that nuked thousands of people.

    read more 

  • Google Hacking Explained

    What is Google hacking? How is Google used by hackers as a tool? Read this article for more information.

    Johny Long, author of the official Google Hacking book will be at the Las Vegas, NV Defcon 13 Convention signing books. 

    read more | digg story

  • Secure RSS Syndication

    Solution for making your own private RSS Syndication using bloglines, encryption and Greasemonkey. 

    The way you'd use this is to make an RSS feed that you can access from anywhere.  Then encrypt it and use a Firefox script on Greasmonkey to decrypt it (at least thats the way I understand it).  The cool thing about it is that you could throw it right on pages with all relevent information across the web.  As soon as you updated it, it would reflect in your aggreggator.

    I could see this being used for my many network passwords, but not my accounts.  I'm a little to paranoid for that.

    read more 

  • Whax How to (formerly known as whoppix)

    The WHAX Live CD OS (formerly known as WHOPPIX) has a useful knowledgebase of growing information on how to use its very modular features.

    I notice a few people coming to my blog to find tutorials on WHAX/Whoppix, but where you really want to go is here:

    http://iwhax.net/modules/xoopsfaq/

    If there is something you want to know just ask the WHAX gurus on their interactive site.  The Whoppix webpage looked nice but the creators of this incredible tool made a briliant move in this new interactive, blog howto structure.

    If you Whax guys read this, I suggest getting some trackbacks.

    read more | digg story