Dismissing a few myths about security

[FindersKeepers]

Dismissing a few myths about platform security ... or lack of. There is not a mainstream platform that is fully secured that allows users the freedom to go and do anything allowed by the click of a mouse or keyboard. Windows has been dethroned as the king of leaks - but microsoft is still the champ.

2017 has raised the bar in total vulnerabilities (and we're only halfway through) ... #w00t!!!!
https://www.cvedetails.com/vulnerabilities-by-types.php

Top 50 by products - Linux is now king of the leak stack (driven by increased uptake/popularity)
http://www.cvedetails.com/top-50-products.php?year=2017

=> details https://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/year-2017/Linux-Linux-Kernel.html

Top 50 by vendor - Microsoft's honorary role as lifetime chairman is coming under threat
https://www.cvedetails.com/top-50-vendors.php

In terms of applications .. the undesputed heavyweight champ with lifetime membership surely is Adobe - with flash and pdf the preferred vehicle of choice. If Mozilla (firefox) stats were up to date it might be the title holder.

Pays to keep in touch with reality. Look for your favourite browser and gauge just how vulnerable you might be. Think about that next time you do your internet banking. It comes down to maintaining a bit of discipline and having a *whole lot* of trust.

One of the simplest and most accessible online browser checks is at GRC.com (Steve Gibson has run this for years)
https://www.grc.com/default.htm
https://www.grc.com/x/ne.dll?bh0bkyd2 <= the shields up browser open port check

[Dataman]

One of the simplest and most accessible online browser checks is at GRC.com (Steve Gibson has run this for years)
https://www.grc.com/default.htm
https://www.grc.com/x/ne.dll?bh0bkyd2 <= the shields up browser open port check

Yep, I have used GRC for years.

[FindersKeepers]

The attached document I used personally when reviewing the attack surface of my windows 7 machines ... the entirety of it applies to Linux in principle except that there are far fewer checks and balances in Linux. The Linux kernel might be considered secure, but Linux systems leave a lot to be desired. The beauty of the examination that windows went through meant a lot of tools were designed to allow users to audit their windows boxes. The same thing will happen to Linux.

Windows 7 analysis - https://www.dropbox.com/s/91x3e1v01o258az/Windows%20structure%202013Sep15%20-%20rev3.pdf

[FindersKeepers]

Lulz .. this is way off topic but I wonder how many Linux users in there late 40's had this epiphany ...

sudo echo take me to >funky.town

 

[FindersKeepers]

On a more serious note, and back on topic - here are some auditing scripts with a compilation of various Linux system commands to capture status/audit with a time/date stamp.

Add/change/delete what you want - rename these files to *.sh and chmod to run from terminal.
They are a collection of bash commands to get system information in various formats.

change the 'username' to your username in
myUSER=username

HINT: you need to log in to see the scripts (txt) attached below ...


[attachment deleted by admin]

[FindersKeepers]

Doing some testing on a Linux security system based on snort, suricata, oinkmaster (rules based). In theory it is a great system that rivals anything windoze based.

Have set up a single front end node dedicated to firewall/security and intrusion detection using the above.

Anyone had any experience with snort?

[Dingo]

Never used any of those but I found a how to online  http://www.aboutdebian.com/snort.htm

But it does not support newer versions of Debian. 

NOTE:  There is no Snort package in Jessie (8.x) or Acidbase package in 7.x or 8.x. However, OSDisc.com has agreed to continue offering the Squeeze (6.0) DVD set if you want to set up a Snort IDS.

[FindersKeepers]

Will be trialling mine using a Fedora O/S Dingo.
There seems to be more support for it ... plus Fedora has a nice sleek GUI with pretty good speed.

Am using it as a watchdog, so it can run on a slow i5.

{edit} Dingo - for clarity I am building an IDS type watchdog using a bare bones i5 box. It will be based on whatever I can get to work on a Fedora 25 Xfce for filtering/monitoring/logging. There is an open source community (funded by da da daaaah .. the usgov ... *sigh*) which at least tries to improve security (note: low hanging fruit only). As a minimum maintaining iptables and firewall rules.

Emerging Threats.net Open Rulesets
https://rules.emergingthreats.net/  <= lists firewall rules and hosts snort/suricata filters
Ref: http://people.clarkson.edu/~jmatthew/publications/SPIE_SnortSuricata_2013.pdf

[FindersKeepers]

Hey so the good news??? ... those CVE stats above represent *less than* 50% of current active internet/software/hardware vulnerabilities.

The good new is now you know how bad this is. So do something about it.
http://www.csoonline.com/article/3204568/application-security/closing-the-cve-gap-is-mitre-up-to-it.html

"For all vulnerabilities disclosed anywhere, commercial databases currently track about 80 percent. CVE tends to have 60 percent of that 80 percent," he said. "So when you make a risk decision, you're doing it with a blind spot of about 50 percent. This is a too-big-to-fail thing. It's like our bridges and tunnels collapsing,"

Nothing to see here. Move along.

[FindersKeepers]

I've just finished testing 2 (only 2 out of about 2,500) simple windows system bypasses that are truly absurd - read about them on the weekend and I thought they were too bizarre to be real. 1 is a powershell standard execution script bypass and the other is intel AMT (management engine) that you can remotely access from a permanent web address anywhere in the world. No skill necessary - works on any version of windows 7/8/10 and on any intel box with AMT.

Made possible by 1) static IP addresses and 2) hardcoded port addresses.

Don't worry, AMD chipsets have something similar so you don't miss out.

To see if you have an issue with the intel AMT copy and paste this into a windows command shell (cmd)
netstat -na | findstr "\<16992\> \<16993\> \<16994\> \<16995\> \<623\> \<664\>"  <= include the quotes, right click paste, press enter

If anything returns 'LISTENING' - congratulations, your machine is accessible to anyone on the planet. You and at least 5740 other PC's as of about 1 hour ago. Now you know.

[FindersKeepers]

Just FYI - weighing up what I know about Linux security so far, Manjaro is fast but it lacks the security features of Fedora. This is confirmed by the Lynis auditing tool (cisofy) - at 70% rating for Manjaro, a 75% rating for Fedora (stock out of the box installs).

If security is a priority (and it should be) then do your research on kernels, selinux, firewalls and configurations. #justsaying

[FindersKeepers]

Ok so updating where I am at - the security landscape being dynamic as it is means containers and sandboxes are the preferred security solution/trend/favourite (for now). Open boxes like legacy windows (vista/win7) are done. Most Linux boxes default to this configuration. So am trying to source a decent app container solution ... of which there are many .... Docker, Amazon Linux (amazon has a Linux), kubernetes, OCI, Mesos, CoreOS .. including clustering many devices.

Minimalism is going to be a thing. Small secure kernels running containers is taking up a lot of interest. Windows 7 and 8 are now legacy platforms - something you run all your hard earned investment on. Windows 10 is trying to be everyone's friend and failing dismally. It does not mean these cannot be secured (by default they aren't) - it just means it is very freaking difficult. If you are not using Applocker on Win10 you have already lost the battle (win10 is a joke for many).

Windows is done (as you know it) so stick a fork in it - the attack surface is massive and full of holes. Firmware is the next fruit to be harvested come picking season as operating systems are waking up to modern opportunities created by connecting to a public internet.

Happy days. Just my opinions.