Blog Security Updates

Blog Security Updates....

I have just enabled a forced HTTPS redirect on my blog, unbeknownst to me you could still get to it via an unsecured link!  Thanks google for not making that more obvious.

I've also changed the comment rules to require you to have a google account to comment.

Believe you me I do read every comment, I reply to quite a few.  But for the most part I spent time removing adverts, and I have had some bizarre adverts posted as comments.  However today I had the most in appropriate advert ever for illegal items, which I not only completely disagree with but found abhorrent could be posted anonymously.

So you now need to have a google account.

Thanks for sticking with me!

The most insidious file on Windows....

The most insidious file on Windows....

Microsoft.DataWarehouse.Interfaces.resources.dll?

This particular file lives in my 

D:\Program Files\WindowsApps\Microsoft.Office.Desktop.Excel_16050.11029.20108.0_x86__8wekyb3d8bbwe\Office16\ADDINS\PowerPivot Excel Add-in\sk

folder.... The key feature of that hideous path is that it's in my D drive... this is my second drive and you'd be right to ask why it has a windows installation on it?

Well, that's the drive that came with my laptop, and so it had the spyware, adware riddled carcas of a windows installation I never used, I just installed my own new NVMe drive and went with that.

This installation of windows has been taking up like 15GB or more of Space for over two years to it was time to nuke it.  The problem?  You can't just remove windows trusted installer files.

My way around this is to go into the properties, into advanced, set the owner user and god for that file to be me and remove the other windows junk user groups and such, and make sure everything is inherited down the line.... 

And I did this, removed windows, program files and windows and program data.... all except for this one file.

Which is totally insidious.

It won't disappear despite my being that very user/owner and even having used "runas" to launch explorer and cmd as myself for 100% certain.

The security settings can't be set....

It is literally moments like this where I hate that I can't fully control my operating system.

Sure, this is an edge case, who would really want to let windows delete something critical, but I've clearly worked around the issue, jumped through enough obscure hoops and set myself in the driving seat that the OS must know I'm up to something I know I'm doing... and I'm doing it with their UI, so not with some obscure script, so I'm clearly NOT a baddie.... sort of.

Yet, I can't delete a file, the file is actually zero length... it's just crud and evil.

Sex, Secret or God... Passwords

In the 1990's it was common to have to tell folks not to use "popular" password, like "sex", or "god", believe it or not even "password" and "secret".  Since then times have moved on, folks have become very adept at using other characters in their passwords...

Unfortunately, this is (very seriously) what one of our IT bods here has just found on a machine:

Props to the user for mixing in some numbers, a word and a symbol, however... We can all see the flaw in their storing the password.

(Thanks to our IT Manager for letting me use his picture - it is a lovely left hand, I wonder if he does hand modelling?)

Virgin Media's: Terrible Security

So, in a prior post I made you aware of the situation with myself and Virgin for my services, well... Whilst talking to them they wanted me to give them the "First and Fifth" letter of my security password...

I apparently got this wrong....

"Give me the fourth and the eight"....

I apparently got this wrong....

"Just give me the password...."

No.

This is terrible security, and I said this to them, I asked if they can see my password "yes".  So their system stores my password, in plain text.

I said to the chap "This should be stored as the salted hash of the password, not the actual password, and you should not use it as part of my accessing the account over the phone".  This is the password to access your account, your VirginMedia e-mail, basically everything.

Now, I don't know if this guy was fishing for my whole password bit by bit, or whether he was genuinely looking at the whole thing and just asking for letters, of if he just had some mask of it being shown to him which he asked me the solution to...

But the underlying system clearly stores the plain password, and that's just such a massive security flaw.

Administrator : Show Network Abuse...

As a network boffin it's always very difficult to express to every possible audience quite how busy & complex a job you have, not least in today's environment where you have wired and wireless connectivity from every imaginable device, uPnP, SSDP, ARP, netbios, Active Directory, DHCP, DNS, UDP, TCP... It's a plethora of fields you have to take collectively as knocking on the proverbial door to your network adapter.

Recently we've employed the excellent Solarwinds tools as a method of network node and inter-connectivity debugging, and as much as I enjoy presenting the truly informative flow-charts and information they don't show quite how huge the amount of data and number of packets flying around is.... I therefore set about visualising and displaying just such a situation to an audience...

A Ubuntu VM, with the I3 desktop and a little time later.....

cd~

git clone https://github.com/the-tcpdump-group/libpcap.git

cd libpcap

./configure

make -j4

sudo make install

Then...

cd ~

git clone https://github.com/the-tcpdump-group/tcpdump.git

cd tcpdump

./configure

make -j4

sudo make install

And now, I could... "tcpdump"... to just spew everything into a terminal window...

Open another terminal window and I could "tcpdump | grep 'facebook'" and see how much time people were flying off to facebook, the beauty and simplicity of the i3 desktop along with the raw output of tcpdump soon conveyed far more stark a message from a monitor on my desk than any e-mail could or diagram could communicate.

Just the TCP packet headers were enough, without prying into what was being sent over a company network, in company time to facebook... and ebay... and whatever else... 

Using egrep I could dig even further into the headers and get very specific, laying out the desktop with i3 just further emphasising the flow and pattern of usage... Anonymize it and I'd have a decent techy screen-saver too!

Administrator : Blocking Spammers & Hackers (Basics)

To see whom has been trying to connect to your Debian (or Ubuntu) server, use:

cat /var/log/auth.log | grep "Failed"

This will list out the failed attempts, then add the successful with:

cat /var/log/auth.log | grep "session opened" | grep "LOGIN"

You can note the IP addresses for the unwanted attempts and block them with iptables, like this:

sudo iptables -I INPUT -s AAA.BBB.CCC.DDD -p tcp --dport ZZZ -j REJECT

Where the IP to block is "AAA.BBB.CCC.DDD" and the port is "ZZZ" as a number, so to block 192.168.0.1 on port 7000 you would do:

sudo iptables -I INPUT -s 192.168.0.1 -p tcp --dport 7000 -j REJECT

Instead of REJECT you can use DROP, and in place of tcp you can use udp and icmp protocols.

To block a whole subnet range I just do this:

sudo iptables -A INPUT -s AAA.BBB.CCC.000/AAA.BBB.CCC.255 -p tcp --dport ZZZ -j DROP

This makes all addresses in the range not respond, the range could have been 192.168.0.0/192.168.0.255, or you could block higher up the range like this 192.168.0.0/192.160.255.255, the first address range blocks just the last section subnet mask, the second blocks the last two sections of the subnet mask!

You can view the iptables in use with:

sudo iptables -L

Why Does This Exist?

Its not often I have to actually turn a server towards the outside world, my personal servers usually sit on my LAN and never route to the internet, like-wise the items I provision in the office are for internal use...

Yesterday however, I had the pleasure of being told to make a service available to the outside world...

No big deal, it's Apache2 on a Ubuntu host, set up done... And I only opened port 80 then left it... All was fine...

It has run for six hours... six... On a brand new acquired IP address, no-one but the recipient at the far end knows about the server being there, it has no DNS entry, it has no other services, just port 80 and ssh open...

Yes, I have had hacker, poking, security breach attempts from China, Vietnam, the British Virgin Islands, Canada, the Netherlands and Russia...

The mind boggles at quite how much hacking and infiltration is going on out there...

I've been checking the mainly ssh breach attempts with the command:

cat /var/log/auth.log | grep "Failed"

I run this to a file and then have a python script to log the IP addresses into a table for me, and I can then just block them individually or as a subnet range, though iptables.

I also check for successful logins just in case with:

cat /var/log/auth.log | grep "session opened" | grep "LOGIN"

I wonder however whether a python script to manage all this for me might be in order... Hmmm, project time!

Windoze Security Loop Hole

This is an example of why I hate Windows...

In a curious case of a security loop hole, in the office, we have a supposedly locked down security situation, none of us are local administrators on our machines, and neither do we have access to any of the very useful parts of our machines.

This is a real pain, and one whereby we often have to call up on the IT Administrators to come and physically, or remotely in a remote desktop session, enter their password for us.

I personally disagree that educated users such as myself have to put up with this situation, I agree totally with data privacy and integrity, however, I wholly disagree with locking people out of things on their machines, such as defragging, or emptying the temporary folders... Or in the case of a programmer, not being able to empty Prefetch or write an ISO to an SD Card.

Anyway, today, I had to write an ISO to an sdcard, the result... I called IT and asked them to run the program for me....

So, just to be clear, I'm logged in as myself:

I am unable to access parts of the system, like the Administrators desktop folders...

I get IT to log the ISO image writer as their elevated user, and the loop-hole begins, you see the program has a standard windows open dialog.  And this will work with any standard windows open or save-as dialog, in any program... The program is running as Administrator at this point.

When I select to browse to the file to open, the default folder is the administrators folder by name...

However, because these dialogs all use explorer under the hood, and it's all integrated, they do far more than select a file for you, they let you create folders, browse things and even launch programs...

Yes you can launch a program from a save-sa, or open-sa, browsing dialog!

Lets try to run a command prompt...

Oh, look, it's running as Administrator...

And now I can see the Administrator account directories, which were hidden from be in my own logged on Explorer window..

And I can clear the prefetch folder in windows...

This is clearly wrong, but it's all caused by windows, so what's going on?...

Well, instead of asking the current session (logged in as regular old me) to start the new application instance of Command Prompt, it's asking the application owning the browsing dialog, so command prompt is started under and inherits the user credential level of that program, not my whole session.

What should have happened, well, I believe windows, starting a new program from an elevated user like this should have re-prompted for the user's password again.  And indeed, trying to start certain files from the launched command prompt it does go back to the session level to ask for the credentials to start the application with.  But not asking and just starting the new application is a problem.

Solutions I can think of include, setting the administrator level account to timeout its password every minute, so one reduces the amount of time a regular user has an unaccredited ability to launch programs.  And within a minute the administrator could have started anything the user wanted and left.

A better solution however, might have been to have a user elevation level which could give access only to what the regular user wanted, permissions to use peripherals perhaps, rather than start applications.  And the Administrator should not have just started the application as themselves, but should have started the application under themselves as the Hardware only user.

There are other solutions, and I'm sure many I'm not even going to think about, because I don't use Windows systems.  If I want security, I simply use Linux and set things up correctly.

John McAfee Winner...

I'm not sure how I missed this, but here it is, genius...