The Five Most Important Concepts of Computer Security

It seems like every day that there is some new security threat to that the computer systems that we rely upon. Those of us that are responsible for maintaining and ensuring security of systems need to be aware of how to approach these advanced threats. This article describes five important concepts to assist with keeping your computer systems secure.

#1Understand Your System

When you start the engine of your car you know how it _should sound. If there is a noise you do not recognize it sets of alarms that you mentally proceed with to decide on the next course of action. In the same way we can approach all our systems in the same manner. For example if you run the top command on any server what is the expected memory and CPU usage.

For any system unless you _know what is expected on your system its difficult to recognize when there is an issue.

#2 Principle of least privilege

This is a principle that has been around a long time but is vital to ensuring systems do not get compromised. In essence this principle means that a user is _only given the rights required to perform a job and no more. For example a backup use should only be allowed to have rights to backups and not for example to install software.

Other options can exist for users like using sudo or even providing a VM that a user can use for performing certain operations. For some situations using chroot or a jail environment may mitigate some effects for privilages.

#3 Defence in protection rings

For security having multiple layers of protection is vital. Often called protection rings these are methods to protect data by having many layers of security. Looking back to medieval times castles had many levels of defences e.g. moats, high locations, portcullis etc. Its important to have more than one defence e.g. not just a firewall or anti virus.

An example of 4 rings of defence are :

A). Block network based attacks

B). Block host based attacks

C). Eliminate security vulnerabilities : this will include removing any unrequited services which in turn reduces the attack surface

D). Safely support authorized users

#4 Detection is vital

In the end having all the defences in the world is one thing but detection is a must. The difference between one hour and one moth for a detection of a breach in your system is massive. Having an Intrusion Detection System (IDS) is like having a burglar alarm for your computer network. It monitors the flow of traffic and enables information systems to deal with the attacks. This system protects your environment by identifying, logging, reporting and sending alarm whenever there is a probe.

#5 Know your enemy

We can try to guess what hackers are attempting to get up to in our systems but knowledge is power. To stand any chance of protecting your system you need to

- First understand know who your enemies are

- How they might they attack

- When they might attack

- Potentially most important of all, why they attack.

Check your Public IP address Geo Location using the command line on Linux

If you are using VPN connections it can be important and useful to be able to check your current public IP. For me going to one of the many web sites that offer such a service is slow. As always on Linux the command line is the fastest way. Searching around I found geoiplookup which did exactly what I wanted. It uses the GeoIP library and database to find the Country that an IP address or hostname originates from.

Example

$ geoiplookup 80.60.233.195

Displays the country that 80.60.233.195 originates from e.g.

NL, Netherlands

You can have a simple bash script like :

#!/bin/bash
clear
echo "Current Public IP is :"
curl -s checkip.dyndns.org | sed 's/.*IP Address: \([0-9\.]*\).*/\1/g'
sleep 1
PUBLICIP=$(curl -s checkip.dyndns.org | sed 's/.*IP Address: \([0-9\.]*\).*/\1/g')
geoiplookup $PUBLICIP

To install on Arch :

$ sudo pacman -S geoip

To install on Ubuntu, Linux Mint or Debian

$ sudo apt-get install geoip-bin

By default the IP to country database is located at /usr/share/GeoIP/GeoIP.dat

How to stop embedded images tracking your location on Gmail

You may think that the only way people can tell if you opened an email is the good old 'read receipt' but there is another more subtle method. That method is by using embedded images to track individuals. Currently this method is used by phishers, marketers and spammers to track where people open emails and to track other useful information.

The most common method used for email tracking is embedded images. The process is relatively simple :

- Email is created in HTML

- Included is a reference on a remote server that the sender owns or has access to

- Each email can be given a unique URL to track what individual opens emails

- Contained within the HTTP request from your email client to obtain the referenced image will be your IP address (which can track your location unless you are on a VPN) to at least to your city, your browser and Operating System.

All very useful information that can be used to draw a number of conclusions about the reader :

- Where was the email opened

- What time was the email opened

- How long from when the email was sent was it opened

- What type of device was the email opened on

- Prove that it made it past any spam filters in place

- Show that the email is valid and in active use

Gmail Solution

With Gmail like most privacy features from Google you must opt-out which can be done as follows :

Browser Client

- Select Gear icon then Settings

- Under the General tab look for Images (Fourth down currently in the list)

- Select 'Ask before displaying external images'

- Scroll to bottom of screen

- Select Save Changes

Android

- Within the Gmail App on Android

- Select menu on left and scroll down to the bottom (may take a while if you have lots of labels) until you see Settings   

- Select each email address in turn (if your have multiple) and scroll to bottom and select Images

- Change to Ask before showing

OpenWRT : Use Google Public DNS

By default you will be using the DNS servers supplied by the ISP you subscribe with. With OpenWRT its easy to change the DNS service that you use to an alternative option. A popular option is the Google Public DNS service.

Advantages of using Google's DNS are :

• Faster web browsing
• Improved security
• No redirection

Note - depending on your location it could be slower. Your geographic location will determine the closest Google DNS server you will be directed to.

In OpenWRT to change is a simple process

• Open Luci web interface
• Select 'Network' -> 'DHCP and DNS'
• Locate 'DNS forwardings'
• Enter '8.8.8.8'
• Press '+' button to enable a second entry
• Enter '8.8.4.4'
• Select 'Save & Apply'

It should look similar to the following :

Using Wireshark to evaluate a packet capture

The tool Wireshark is a fantastic tool for both capturing traffic and evaluating traffic. I typically capture traffic using the Linux command line tool 'tcpdump' but like to use Wireshark for evaluation. In this post I will be focusing on evaluation of packet captures.

If you can quickly view packets of interest e.g. insecure http connections you can right click on the packet and select 'Follow TCP Stream' which can quickly show you the traffic flow.

With a packet capture you have open in Wireshark there is a Filter box along the top which you can use to find packets of interest. I find the filter 'frame contains <search term>' can yield interesting results e.g.

frame contains Password
frame contains password
frame contains login
frame contains test.com

Another method for example to ensure a password is not being sent over clear text is to in Wireshark select Edit -> Find Packet and in the resulting window :

• Select String under Find
• In the Filter field enter a password of interest e.g. secret
• Under 'Search In' select 'Packet bytes'
• Select Find

At the very bottom of the screen if you see 'No packet contained that string' all is good and your password was encrypted before being sent over the network :)


Note : this tool should not be used in a malicious way. It should only be used to ensure your own environment is safe where you have permission to run it e.g. your local network. 

OpenWrt tcpdump packet captures for traffic evaluation

Its really useful to be able to capture traffic on your local network. One common use case would be capturing traffic from a mobile application that you believe may _not be secure. With OpenWrt as our router we can install and use tcpdump to capture the traffic.

I have created a non root account as is best practise to many commands will require 'sudo' to enable the correct privileges.

First we need to update the package manager then install tcpdump :

$ sudo opkg update
$ sudo opkg install tcpdump

Now we can run tcpdump and capture the traffic in a file for evaluation.

Run ifconfig to identify the bridge on your network which typically will have teh IP address 192.168.1.1 :

$ ifconfig

In my case the adaptor is  'br-lan ' which the devices being provisioned by OpenWRT route through.

Check the amount of free disk space you have before writing to file. In this example I have sufficient free space in /tmp.

$ df -h

We can now run a packet capture as the sudo user with the following example syntax changing  'Host IP address' to the IP of your device e.g. phone and 'nameof capture' as an appropriate name.

$ sudo tcpdump -i br-lan -vvv host <Host IP address> -w <nameof capture>.pcap

Generate some network traffic on your device and when complete  press 'Ctrl + C'.

You can then scp the file to your PC for evaluation using a tool like wireshark. Example syntax :

$ scp <nameof capture>.pcap user@<PC IP>:~/tmp

On Arch Linux you can install wireshark with

$ pacman -S wireshark-gtk

How to be secure using the Internet - a simple guide

With the recent publicity surrounding the Heartbleed bug in the media it has highlighted the importance of being secure on-line. Aside from the Heartbleed bug there have been many high profile companies which have had major security issues with massive amounts of credit card records stolen. Target and Adobe are two of the most high profile examples. In the case of Adobe the numbers of users affected is believed to be 38 million.

On-line security can feel like an impossible task but in many ways its similar to a car. There are a number of things you can do to reduce the risk you will have your car broken into. For a car not leaving valuables on display and parking in a well lit area are things we take for granted as common sense. In this article I am going to discuss some simple strategies to help keep you safe on-line.

1. Software Updates

This is the easiest and most underestimated task. If you frequently feel getting updates for Java, Windows or other software is annoying its important to realize that its vital these updates be applied ASAP as they usually contain major security fixes to recently found vulnerabilities. The same is true on any device that is connected to the Internet e.g. smartphone, tablet, TV.

2. Password Manager

Best practise for passwords on the Internet is always to use a different and difficult to guess (numbers + non standard characters) passwords. Over time with more services on the Internet this becomes impossible as how can you remember over 100 unique passwords? The answer is to use a Password Manager. There are many options available on the market and you can research the best password manager for your needs. Many password managers have security alerts and password generators as features.

3. Multiple accounts

Have multiple email, Facebook, Twitter and similar accounts that you can use when you are required to sign up for a service or promotion. In this way it will ensure that your primary email and Facebook account will not be targeted by spam. Also if the service you sign up for is hacked they will not have your primary account information.

4. Personal information

On social networking sites like Facebook set privacy settings as high and do not share birth dates (including the year) as this can make it easier to answer security questions. If you do not require to provide your email or Facebook account to sign up to a new service create a new unique username and password to protect your identity.

5. Restrict use of public WiFi

Never use public WiFi for any financial transactions if at all possible. Anyone who is in the same coffee shop as you are could potentially access your information and you would never know. Restrict usage just for information e.g. Google or a news web site.

6. Be on the lookout for Phishing scams

Be careful on emails that are sent to you and do not open any attachments from people you do not know. Be careful with emails relating to financial information and account information resets.

7. Always use HTTPS when browsing  

When browsing the Internet always use the secure https:// rather than http:// version of a web site/. This ensures that your communications are encrypted. A good plugin that will automatically perform this is HTTPS Everywhere from the Electronic Frontier Foundation.