Like anything else, keylogging can be used for good, or for evil. Here is a list of related links, including both hardware and software keyloggers. (Yow!) Regardless of the privacy issues, there are also security issues as well. Some trojans will install keylogger software as part of their kit. There are also keyloggers geared for […]
Keylogging
Automating Secure FTP Downloads With Kermit
If you need to automate FTP downloads, and want lots of flexibility, an oldie but goodie is Kermit. I know what you’re thinking: “Hey, isn’t Kermit an old DOS comms program?”. Yes, it is a very old program. The cool thing about this, though, is that if you need to automate file transfers, it has […]
Block IP Addresses With IPtables
We wrote about blocking particular IP addresses with the route command here. If you are already using iptables, or want to start, a better way is to block particular hosts: iptables -I INPUT -s 25.55.55.55 -j DROP This command will simply drop any packet coming from the address 25.55.55.55. To list the chains: iptables -L […]
Configuring the Red Hat Enterprise Firewall
First off, let’s test ssh access: host user $ ssh x.y.z.w ssh: connect to host x.y.z.w port 22: Connection timed out host user $ Let’s add ssh access. Go to Applications->System Settings->Security Level: If you are not root, you will get a prompt to enter the root password: Be default nothing is enabled as trusted. […]
Encrypting Files Conventionally With GnuPG
Conventional encryption is where there are no keys involved. This can be done with the -c option on GnuPG. When you use this option you will be asked for a passphrase. To decrypt the file the same passphrase is needed. This is ideal for password lists, where you have the ability to share the passphrase […]
Running a Quick Ping Scan using NMAP
Nmap can make quick of work of doing a ping sweep of your network: [usr-1@srv-1 ~]$ nmap -sP 10.50.100.1-255 Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2005-06-13 15:50 PDT Host 10.50.100.1 appears to be up. Host 10.50.100.2 appears to be up. Host 10.50.100.22 appears to be up. Host mondo (10.50.100.72) appears to be up. Host […]
Windows Run At Logon Keys
One key to check on Windows boxen is the Run key. The run key is located in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. When a user logs on, the programs specified in the run key also run. Many times a trojan will install itself here. A lesser evil is the hordes of small little apps that like to run some […]
Securing PHP
The first step to secure PHP is from the system perspective. Only provide what you have to. Of course, the code needs to be secure as well by using proper input validation, encryption, etc., but as systems administrators, we can head off some problems. First off, you can view a complete rundown of your current […]
Netcat and Hammurabi
When I was a kid in 1975, my dad brought home a terminal with an accoustical coupler on the top where I could put a standard phone handset in, and communicate with a Microdata minicomputer at his work. [Dick Pick developed the operating system for the Microdata. To make it fast, he programmed it using […]
Setting Up a Windows Server 2003 Host Based Firewall
There is a false sense of security when you envision your network as inside and outside, with a firewall protecting you from hostile users on the outside. One particularly nasty problem is when users bring their laptops home, surf, read email, and then plug it right back in to the corporate LAN on Monday morning. […]
Using HfNetCk To Audit Windows Patches
There is a most fabulous utility available for free download from Shavlik Technologies here that will scan your Windows boxen for needed security/bug fixes. The command line version doesn’t require registration, and is quite easy to use. The cool thing is that the status of current patches is downloaded at run time. Let’s run this […]
Spike in Port 12345 Traffic
We have noticed a surge in traffic on port 12345. This could be NetBus, or a variant. We suspect that some trojan backdoor is in the wild tacked on to a new worm. The worm is looking for other friendly hosts listening on port 12345. To see a historical chart of activity on this port, […]
Fizzer Worm is Nasty – Update Sigs, OK?
Yet another worm making the rounds via email. This one has a nasty payload. More info here. Removal tool here. Additional info for administrators and operators on IRC networks here.
Using the AFICK File Integrity Checker
One important component of securing a system is to use a file integrity checker.There are multiple tools out there that can do this, including AIDE, and Tripwire. One project that does what we need, has few installation requirements, is fairly easy to install, and is multi platform is AFICK. In this article we will install […]
Building a Security Audit Toolkit
As moon-howling, tree-hugging, packet-sniffing pagans, we like to celebrate the Summer Solstice by doing a security audit of the systems on our network. Spending the longest day of the year auditing systems will help us avoid spending the longest night of the year restoring a hacked one. In our audit, we will be disabling unused […]
Customizing the AFICK File Integrity Checker
In this article, we set up AFICK. Let’s adapt AFICK to use a particular directory tree and a different database. This way, we can fingerprint the OS on one run, and fingerprint more dynamic content with a different job. Here is our configuration file: [root@ids afick]# cat /etc/afickweb.conf database:=/var/lib/afickweb/afick history := /var/lib/afickweb/history archive := /var/lib/afickweb/archive […]
IPC$ Security Trick
It is possible to establish a security context with another domain by using the net use command. Syntax: net use \\<server name>\IPC$ /USER:<domain>\<account> Explanation: If you want to manage the Booky domain, with a PDC called Kooky, and you had an administrative account on Booky called bookadmin, you could use: net use \\kooky\IPC$ /USER:BOOKY\bookadmin you […]
Building a Chrooted sftp Environment
There was a time, not so very long ago, when we used to enjoy running an ftp server and locking our users into tiny little chrooted jails. While we still enjoy denying users their freedom, we now prefer to do so using a maximum security facility. The sftp file transfer program, which comes with OpenSSH […]
WinSCP Freeware SFTP and SCP client for Windows
WinSCP is a full featured GUI SCP client. This means that communication between the server and the client is encrypted well, unlike FTP or Explorer. WinSCP also includes synchronization options that will help minimize the amount of traffic needed to mirror filesystems. We installed all of the options: Here you can see the array of […]
TCPDump Lab
We picked up a DEC Alpha Multia cheap at auction a couple years ago. We will use this multia to dump the network traffic that NT creates on boot using TCPDump. The first problem we had was that our Multia is not Y2K compatible. Many of our files ended up with dates of 2019, and […]
