Things that the attacker won't care about. Thoughts on cloud security.

 Things that the attacker won't care about:

- whether you have a dedicated infosec team

- their certification level

- your budget for security 

- your roadmap and project plan for addressing security issues 

- you compliance status and audit reports

- vendors and products you are using

Start with very basic, use opensource if needed, build upon this layer by layer. 

Always ask yourself: how I’m protected now? , what could be improved now? What if I’m attacked now? 

Many say that security is not a state but a process. True, but just a process itself is not a security as well.

These things are not new and obvious. But in the Cloud, they become even more important:

- your infrastructure is always connected and always reachable from anywhere on the planet

- it takes only one compromised credential, few minutes and several API calls to nuke everything in your account. 

What are your incident response SLA times?

- Cloud gives you scalability, but it gives the same scalability to the attacker. Spin 10000 instances to crunch some numbers and attack you? for sure!

- infrastructure as code empowers you, but so true for the attacker - he can reuse templates and patterns for attack infrastructure

- data exfiltration speed now is not limited to your ISP bandwidth, but pretty much extremely fast, unlimited and will end up in your cloud bill.

But, at the same time, the cloud offers endless opportunities to build security on the impossible for on-prem levels, with endless cloud services, templates and unlimited capacity. Build smart, stay secure. 

S3 buckets audit: check bucket existence, public access level, etc - without having access to target AWS account

      Currently, publicly accessible buckets become a big deal and root cause of many recent data leaks.
All of these events even drive Amazon AWS to proactively send out emails to the customers who has such s3 configurations. Let's become a bit more proactive as well and audit s3 buckets

        First, let's take look why bucket might become publicly available:
- Configured for public access intentionally (S3 static web hosting or just public resource) or by mistake
- Configured for the access of the Authenticated Users  (option, misinterpreted by many as users from your account, which is wrong, it's any AWS authenticated user from any account)
     
         Auditing AWS account you have full access to is quite easy - just list the buckets and check theirs ACL, users and bucket policies via aws cli or web gui.

         What about cases when you:
- have many accounts and buckets (will take forever to audit manually)
- do not have enough permissions in the target AWS account to check bucket access
- you do not have permissions at all in this account (pentester mode)

To address everything above I've created small tool to do all dirty job for you (updated to v2):
https://github.com/IhorKravchuk/it-security/tree/master/scripts.aws


$python aws_test_bucket.py --profile prod-read --bucket test.bcuket

  -P AWS_PROFILE, --profile=AWS_PROFILE
                        Please specify AWS CLI profile
  -B BUCKET, --bucket=BUCKET
                        Please provide bucket name
  -F FILE, --file=FILE  Optional: file with buckets list to check

Note: --profile=AWS_PROFILE - any your AWS access profile (from aws cli). This profile HAS to NOT have access to the audited bucket (we need this just to become Authenticated User from AWS point of view )

You can specify one bucket to check using --bucket option or file with list of buckets(one bucket name per line) using --file option

Based on the bucket access status tool will provide you following responses:

Bucket: test.bucktet - The specified bucket does not exist

Bucket: test.bucktet -  Bucket exists, but Access Denied

Bucket: test.bucktet -  Found index.html, most probably S3 static web hosting is enabled

Bucket: test.bucktet - Bucket exists, publicly available and no S3 static web hosting, most probably misconfigured! 

Enjoy!

PS. More over, you can create list of the buckets(even using some DNS/name alterations and permutations) to test in the file and loop through it checking each.

Stay secure.

Trailing dot in DNS name, incorrect S3 website endpoint work and possible back-end information leak

I discovered that AWS S3 website endpoint incorrectly interpret trailing dot (which is actually essential part of FQDN according to RFC1034 ) in the website FQDN. 

Instead of referring to the correct bucket endpoint gives "No such bucket error" revealing information about web site back-end. 

I have not considered this initially as a security issue more as a misconfiguration or even expected undocumented behaviour , but found one case that could lead to others:

If web site use 3rd party DDOS and WAF protection service like CloudFlare this technic(adding trailing dot ) could reveal and expose web-site origin. 

Example of the possible information disclose below:

Dns name resolution pointing to the CloudFlare:

Trailing dot error pointing to S3 bucket back-end with rest of information pointing to CloudFlare:

PS. One of the possible usage of the s3 back-end information leak could be  s3 backet name squatting to block possible sub-domain usage due to the uniqueness of the s3 bucket names.

MediaWiki as a static website and content sharing

Using wiki for knowledge management in a teams or individually is easy and often is an obvious choice.

       Challenges appear when you need to share information stored in the wiki. 

Challenges are: hardening MediaWiki installation for public access and partially sharing wiki content.

If your main goal is to just to publish content, you can extract wiki pages as a static html pages using relatively simple wget one-liner. After extracting, you can publish your wiki using AWS  S3 static web hosting.

To share only part of the information available in the wiki you can leverage Categoies and restrict user access to specified categories using special extension. Afterwards, you can use this user restricted access to grab wiki content.
Another simple way is to use Category special wiki page as a starting point for crawler to grab pages related to the specific category, let's say Public category.
The code is way shorter than all description above:

# get the wiki content
wget --recursive --level=1 --page-requisites --html-extension --no-directories --convert-links --no-parent -R "*Special*" -R "*action=*" -R "*printable=*"  -R "*oldid=*" -R "*title=Talk:*" -R "*limit=*" "http://mywikiprivate:80/wiki/index.php/Category:Public"
# replace sensitive by the link to the stub page
sed -i -E 's/http:\/\/mywikiprivate[^"]*/http:\/\/wiki.your_website.ca\/404.html/g' *.html 
# remove sensitive file
rm Category\:Public.1.html
# rename Public category pages to be an a list of published pages
mv Category:Public.html Public.html 
# sync content to AWS
aws s3 sync ./ s3://you_bucket/

Result of such script running along with some public notes from my wiki could be found here:
http://wiki.it-security.ca

Disclaimer: current wiki publication contains only small part of the information available and will be updated on almost daily basis to add more content cleared for publishing. Main purpose of this wiki is to keep technical notes and references in the structured way. Some of them are obvious, outdated or incomplete.

Goal of the establishing public publishing process is to keep wiki information up-do-date  and have ability to publish small useful notes which does not fit blog format and style.

Amazon AWS Account level security checklist and how-to

Disclaimer :-):
There are bunch of Amazon AWS security checklists and recommendations online. Definitely the best one is https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf 
I'm not trying to reinvent the wheel, but integrate and summarize lessons I learned and advices given to me by other AWS experts.

This checklist starts from the moment when you begin AWS account creation.

1.  Create dedicated email address for AWS account registration. This email will become you root account login name, so, please, do not use your daily used or published online email
2. Enable MFA  (Multi Factor Authentication) on the root account. Details: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html
3. Remove or DO NOT create any API key associated with root account. API keys has no MFA - anyone who has root API keys gets full  access to you account. Unintentional leaking of the API key quite common security incident.
4. Copy/bookmark/save IAM sign-in url. You will need to access you AWS Web GUI.
5. Create IAM user with  AdministratorAccess policy attached. It will be your new  "root" like account.
6. Create other IAM users required. Minimize their permission using built-in AWS managed policies like: PowerUserAccess; ReadOnlyAccess; AmazonEC2FullAccess , etc
7. Enable MFA on all users created.  Details: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html
8. Enforce strict password policy. Details: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html
9. Generate API keys for users who needs it. For "high-power" user make this keys inactive. They will activate keys through MFA protected AWS Web GUI only when it needed.
10. Do not use API keys in applications running inside AWS. Use IAM roles instead. Details: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
11. Enable and configure CloudTrail  for all regions  + s3 bucket for the CloudTrailLogs.  Details: http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.html
12. Send CloudTrails Events to the CloudWatch Logs. Details: http://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html
13. Configure monitoring of the CloudTrail Log Files using Amazon CloudWatch Logs metric filters and alarms. Details: http://docs.aws.amazon.com/awscloudtrail/latest/userguide/monitor-cloudtrail-log-files-with-cloudwatch-logs.html
14. Configure near-real time Log data processing using Subscriptions or/and using lambda function.  Details: http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/Subscriptions.html
15. Using #13 and 14 configure notification for suspicions events
16. Enable AWS Config Service to get AWS configuration snapshots and change notifications. Details: http://docs.aws.amazon.com/config/latest/developerguide/gs-console.html
17. Enable and configure AWS VPC flow logs to get visibility on network level. Details: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/flow-logs.html
18. Enforce server side encryption on your S3 buckets: Details: http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html
19. Enable encryption on you EBS volumes: Details: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html

Almost all steps covered above could and must be automated. I already published and will publish more automation examples in this blog.

Check your resulted account security status:

• Check Amazon AWS Trusted advisor 
• Run AWS Credentials Report 
• Run awesome AWS audit Scout2 tool : https://isecpartners.github.io/Scout2/

And do this periodically. 

Checklists and Best Practices:

AWS CIS Foundations Benchmark (must read document)
https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf

AWS Auditing Security Checklist
https://d0.awsstatic.com/whitepapers/compliance/AWS_Auditing_Security_Checklist.pdf

PS. I would like to thank Liem aka Pimpon  for advices in preparing this checklist.

AWS "one-liners": Configure AWS password policy in one shot

"As soon as you have passwords you need a password policy" - © captain obvious

Limitations:
AWS allows you to have only one password policy for whole AWS account.

You can configure it using web GUI or, if you prefer to have all your infrastructure and security as code, using boto and python:

#!/usr/bin/python

import boto3
import pprint

boto3.setup_default_session(profile_name='staging')
iam=boto3.resource('iam')
account_password_policy = iam.AccountPasswordPolicy()
response = account_password_policy.update(
    MinimumPasswordLength=12,
    RequireSymbols=True,
    RequireNumbers=True,
    RequireUppercaseCharacters=True,
    RequireLowercaseCharacters=True,
    AllowUsersToChangePassword=True,
    MaxPasswordAge=90,
    PasswordReusePrevention=12,
    HardExpiry=False
)

pprint.pprint(response)

You can find more details about particular password policy parameters here:

http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html

Scary false positive or story about Best practice to secure your root AWS account

What the best practice of securing AWS root account? - Not using it at all!

Let's clean it up first:

1. remove any API key associated with root account
2.  reset root password and change email assoicated
3. enable MFA (or deactivate previous and create new) on the root account.

Start using IAM:

1. Copy/bookmark/save IAM sign-in url 
2. create required users including one with AdministratorAccess policy attached. 
3. Enable MFA on all users created

Secure root account:

1. Print you root account credentials.
2. Log in using printed credentials to ensure that it works.
3. Put in tamper evident envelope
4. Add some signatures, stamps or voodoo on envelope. 
5. Hide it in SafeBox
6. Use it only in case of emergency :-)  

Now let's add some monitoring just in case:

1. Enable and configure CloudTrail + bucket for Logs
2. Configure CloudWatchLogs (CloudWatch) to process CloudTrail logs
3. Add metric filters to detect root-user related events
4. Set-up alarm and notifications (SNS) for the metrics

For root users  CloudWatchLog metric filter looks like:

Filter Name:

Security-CloudWarchAlarms-RootAccessMetricFilte

Filter Pattern:

{$.userIdentity.type = "Root"}

I did everything mentioned above and was ,let's say, "surprised" to get months after notification saying "Root log-in  detected" . Checked CloudTrail looking for  the root user - nothing....Hmm.. Start looking into CloudTrailLogs content  for the detailed row events and found this:

"eventVersion": "1.02", "userIdentity": { "type": "Root", "principalId": "577343344455", "arn": "arn:aws:iam::577343344455:root", "accountId": "5577343344455", "userName": "my_company", "invokedBy": "support.amazonaws.com" }, "eventTime": "2016-03-22T19:22:23Z", "eventSource": "iam.amazonaws.com", "eventName": "GetAccountSummary", "awsRegion": "us-east-1", "sourceIPAddress": "support.amazonaws.com", "userAgent": "support.amazonaws.com", "requestParameters": null, "responseElements": null, "requestID": "675d-fxx3-1x5-9xxd-4768xxx17", "eventID": "b9xxxxfcaf-3xx7-4xxd-a220-exxxx8", "eventType": "AwsApiCall",  "recipientAccountId": "577343344455"

Dear AWS support - you got me :-))

AWS s3 bucket encryption audit

Storing sensitive information at AWS S3?- it's a must to encrypt your data at rest.
How?

• do it yourself (client side encryption) and transfer to S3 already encrypted
• ask AWS to do it for you (server side encryption). In this case you have 2 options: S3 managed encryption keys or KMS-managed encryption keys.

If you create a new bucket for sensitive data NEVER create it without AWS bucket  policy enforcing encryption: encryption is object level attribute at S3 and user specify (technically request) encryption during upload process. Policy will block all uploads if encryption not requested. Simple and Easy.. Except:

      You have existing S3 bucket with data uploaded before you enable this policy, you have mixed (encrypted and non encrypted objects) or just doing security audit. In this case you need to scan the bucket to find unencrypted objects. How? quite easy using  few python lines bellow:


import boto3
import pprint
import sys
boto3.setup_default_session(profile_name='prod')
s3 = boto3.resource('s3')
if len(sys.argv) < 2:
   print "Missing bucket name"
   sys.exit
bucket = s3.Bucket(sys.argv[1])
for obj in bucket.objects.all():
   key = s3.Object(bucket.name, obj.key)
   if key.server_side_encryption is None:
       print "Not encrypted object found:", key

Nice, Yep, But it will take almost forever to scan bucket that contains thousand or tens of thousand of objects. In this it would be nice to have some counters, progress bar, ETA , summary, etc.. So, vuala:

https://github.com/IhorKravchuk/it-security/blob/master/s3_enc_check.py


Small program providing all these features mentioned. Feel free to use it or request reasonable changes/modifications. 

AWS CloudFormation template security group viewer

        Almost any AWS CloudFormation template are more then long enough. It's OK when you are dealing with different relatively "static" resources but become a big  problem for something way more dynamic like security group.
    This kind of resource you need to modify and review a lot, especially if you cloud security professional.  Reading AWS CloudFromation template JSON manually  makes your life miserable and you can easily miss bunch of security problems and holes.
     My small aws_secgroup_viewer Python program helps you to quickly review and analyse all security groups in your template.

     https://github.com/IhorKravchuk/it-security/blob/master/aws_secgroup_viewer.py

     Supports both security group notations used by CloudFormation: firewall rules inside security group or as separate resources linked to group.

Remote access to the car or practical aspects of the ELM 327 security

      What would you say if I tell you that many car owners grant open remote wireless access to their cars? More over many of them available on the 4/7 basis.. You probably would tell me that it's impossible or might think I discovered new security bug in the new cars with built-in WiFi or Bluetooth... Nope! I'm taking about yours 5-7-10 years old cars! How come?
      Many of you probably know about OBD-II connector installed in your car.

 It is used for  diagnostic, but at the same time for cleaning  car error codes or even for car firmware upgrade.  Nice and quite useful interface that give you access to the CAN bus and widely used by a car owners to check their cars.
     Currently cheapest 10$  (thanks to our Chinese friends) and widely used adapters are based on  ELM 327 chip plus, guess what, Bluetooth or even WiFi interface.

 Sure things they definitely need wireless interface so you can do car diagnostic using you smartphone or tablet :-)
To collect more data and to simplify life (finding the port and connecting device while sitting in a car on driver's seat is definitely a gymnastic trick :-)  ) many car owners just leave the device always connected!
Not only connected but in the most cases (based on the adapter version ) always powered ON.

So, we have wireless adapter always connected to you car and using as security measure .....  default unchangeable PIN (1234 for Bluetooth and 12345678 for WiFi). What a gift!

What you can do knowing all above? Scan for Bluetooth of WiFi devices broadcasting OBD II name and...

•  diagnose  a car :-))
•  get access to the CAN bus  or hack the CAN bus
• control the car  or even autopilot it.

Have a Good Hack  Luck and stay secure!

PS.

Useful links related to CAN bus security:

• Comprehensive Experimental Analyses of Automotive Attack Surfaces
• Hopping On the CAN Bus. Automotive Security and the CANard Toolkit. Eric EvenchickBlack Hat Asia 2015 
• canbushack: Hack Your Car
• Adventures in Automotive Networks and Control Units
• DEFCON-21-Illera-Vidal-Dude-WTF-in-My-Car-Updated
• Car Hacking Really Is For Dummies With This Sexy (And Free) Software
• How to Hack Your Mini Cooper:Reverse Engineering CAN Message on Passenger Automobiles

     

Password management in CLI. Using the standard unix password manager: pass with AWS CodeCommit and multi-environment setup

Install and configure pass utility: http://www.passwordstore.org/

yum install pass

Multi-environment setup: Work and Personal passwords in 2 different locations, gpg keys and version controls.

less ~/.bashrc 

# Switch to personal pass credentials
personal() {
    if [ -e ~/.gnupg ]; then rm ~/.gnupg ;fi 
    export PASSWORD_STORE_DIR=/run/media/my_user/DATA/Personal/credentials/.pass 
    ln -s /run/media/my_user/DATA/Personal/credentials/.gnupg ~/
}

work() {
    if [ -e ~/.gnupg ]; then rm ~/.gnupg ;fi
    export PASSWORD_STORE_DIR=/home/my_user/Big_corp/credentials/.pass
    ln -s /home/my_user/Big_corp/credentials/.gnupg ~/
}

Enable config above:

$. ~/.bashrc

Switch to personal environment:

$personal

Generate gpg keys:

gpg --gen-key

Check

gpg --list-keys

Note Key-ID anb initiate pass:

pass init 75d6793

For versions enable git feature

pass git init

Start using:

pass insert Test/test
pass ls
pass show Test/test
pass rm Test/test

Version Control

Configure remote if you need ( central git repo, github or AWS CodeCommit )

 AWS Code commit example:

Configure CodeCommit: Create repo + allow access to it for you user and add you public ssh key to the user in IAM.

Then on you machine:

1. go to $PASSWORD_STORE_DIR
2. git remote add origin ssh://APrrfrA@git-codecommit.us-east-1.amazonaws.com/v1/repos/credentials
3. git remote -v
4. git push origin master

And now you push your changes

pass git push

---

PS. pass use gpg2 if it available instead of gpg. Recently gpg2 has been updated to version 2.1 that might cause some issues with availability of you gpg keys. So, if you see your kees using gpg --list-keys but can't see them using gpg2 --list-keys, most probably automatic migration to version 2.1 fail and you need to do it manually.  

Force migration from GnuPG 1 to 2.1 

remove files:

rm pubring.kbx 
rm -rf private-keys-v1.d

force migration:

gpg2 --import ~/.gnupg/secring.gpg

canary in a coal mine

Simple couple of string on high critical servers that could save your ass .

add to root or your user  .bash_profile following string:

echo $SSH_CONNECTION | sed 's/\(.*\) \(.*\) \(.*\) \(.*\)/ Remote root ssh login detected from  \1:\2 to '"`hostname`"' IP \3 Port \4/' | mail -s "Remote root ssh login warning" your@email.com

Instead of email you can put your phone_number@your_operator.sms.gateway - and get sms like this:

Remote root ssh login detected from  10.1.1.148:65308 to my.server.com IP 141.1.1.107 Port 22

almost  immediately after root user login.

Stay informed!

ssh - Knockin' on Heaven's Door

Using both: port knocking technology and trusted networks for secure ssh access:

The key feature of this method is using ssh daemon listening on 2 diff ports:
--sshd_config--

# What ports, IPs and protocols we listen for
Port 22
Port 3054

and iptables.

1. "Normal" ssh port (22) will be available only from trusted subnets
2.  "New"ssh port (3054) will be available on demand (well known port knocking technology )

How-to:

1. Create new chain:

iptables -N SSH

2.  add it as action to our 2 ssh ports and 1 knocking port

iptables -A INPUT -p tcp -m tcp --dport 22 --syn  -j SSH
iptables -A INPUT -p tcp -m tcp --dport 3054 --syn  -j SSH
iptables -A INPUT -p tcp -m tcp --dport 3055 --syn  -j SSH

3. add rules to our SSH chain

--- add rule for trusted subnet:

iptables -A SSH  -s 184.144.0.0/13 -p tcp -m tcp --dport 22 -j ACCEPT -m comment --comment "Trusted subnet"

---add rule for knock port using recent iptables module:  add packet source to "recent" :

iptables -A SSH -p tcp -m tcp --dport 3055 --syn -m recent --set     --name ssh --rsource -j REJECT --reject-with tcp-reset

--- allow to connect to "new" ssh port within 30 second interval from the IP used to knock

iptables -A SSH -p tcp -m tcp --dport 3054 --syn -m recent --rcheck --seconds 30 --name ssh --rsource -j ACCEPT

That's it. To knock knock simple use: telnet "IP" 3055 and after that you have 30 second to connect.

It will allow you to use ssh and ssh-based tools as usual from trusted location, always be able to connect to server from any location around the world and reduce amount of alerts getting form your HIDS.

PS. Not forget about turning on SSH public key based authentication  and switching PasswordAuthentication to "no".


inspired by  http://execbit.ru/2011/05/18/portknoking/

careless developers

One more simple and lazy Google (tm) hacking:
try to google:

inurl:"info.php" filetype:php allow_url_fopen https
or
inurl:"info.php" filetype:php intitle:"phpinfo()"
Found:
about 282,000 results (0.22 seconds)

So, today we have quarter of a million careless developers :-)

Have a nice day, folks :-)

Multiboot USB Flash drive

Summer's over, so I'm back (Again)

Let's start from a small trick. If you are security guy (i hope you are) you definitely need to have hell of a lot different liveOS . Sure thing you can have a lot of boot CD, DVD or flash drives with you. But what about one flash disk with multiply different liveOS on it? More over they start from .iso files on flash drive! Very useful!
So, here the steps to create this flash drive.
1. Partition your flash disk. Normally you flash drive is in superfloppy mode with no partition on it.
You can't partition your flash disk by standart Windows format tool. For this purpose use HP USB Format Tool on Windows or Disk Utility on MacOS.
2. Now you have two options:
- use Multiboot USB program on windows and install everything using GUI. In this case just choose which linux you wish to install from the list of preconfigured options.
- use GRUB4DOS (Multiboot USB based on it too) project and do the same manualy.

In my case I've got BackTrack4,Ubuntu NR, Ophcrack XP,Ultimate Boot CD and Offline NT Password Remover on the 4Gb flash disk.

File encryption with smart card for rookies

Let's talk about smart card and file encryption. Your company or just you got a smart card. You would like to use it in stand alone computer scheme (domain infrastructure gives you a lot more features). For this purpose from my point of view you have two best solutions:

1-st - Use a wonderful and powerful tool called TrueCrypt, which has been recommended by Bruce Schneier

As first step you must point TrueCrypt to PKCS 11 library (usually you got it from vendor)

Note: in 64 platform you must point to x86 dlls.

Second step is to go to a Settings/key files and chose Add Token Files option.

You gonna be asked for a PIN to your smart card (it must be already inserted)

If you don't have this key file yet (which is normal for first use of smart card) you should generate it as a next step of pressing " import new key file"

After that - modify some preferences for better security:

-start TrueCrypt at the background

-enable all auto dismount options and set idle time-out to 20 min.

-enable wipe cache option for extra security

Note: do not enable auto mount option - it requires password even in case of key file usage.

For user convenience add encrypted disk to favorites and assign hot keys for mount and unmount this disk.

Everything seems to be nice except some security issues:

1. True Crypt creates key file and stores it on smart card file system as a files protected by PIN. It means that spyware can withdraw this key file from smart in background card if user provide PIN for it. (I haven't seen such program yet but it's possible to do such key and pin "fishing" attack )

2.User must mount disk before use and unmount after.

3. If user lose smart card it's impossible to restore data. But, there is a solution for this: security officer could use a second smart card for storing copy of user encryption key file and keep this backup card (like miniHSM) in safe place.

2-nd Solution have been provided to you by Microsoft for free (there's no such thing as a free lunch :-)) ) in Windows Vista and Windows 7.

Both of these operation systems support using smart card for EFS file encryption out of box.

(There is a possibility to use such feature in Windows XP but only in domain configuration with smart card logon)

Before enable it you must some-how generate and import certificate to your smart card.

I use for this purpose a nice CA based on open-ssl. (This CA with a lot of features has been developed by friend of mine Gorthaur and I hope he will write a nice article about it soon)

First step is choosing your certificate for future file encryption

Then you should create a folder and enable encryption on it.

For first look that's enough and everything works perfect, but in absolutely insecure manner.

You will see it when you take out the card from reader. You could decrypt and encrypt your files even without smart card and even after lock/unlock PC. I'm dead sure that it's absolutely insecure!

So, let's add more security! Type gpedit.msc and go to Encryption file system properties.

Here we have two main option:

-use cashing capable symmetric key (A symmetric key is derived from the user’s private key and cached in protected memory) It gives you more performance and you don't need to keep smart card in reader all the time.

-use a non-cached mode. It require to keep smart card in reader all the time.

I prefer cached mode with short time caching (5 min) (windows default is 480 min!!!!) and clearing a cache when user lock the station. I think it good compromise between performance and security.

Not forget to run gpupdate /force and enjoy it.

If you try to write to encrypted area without smart card inserted (and when key cache period expired) you will got messages below

This message you will got if you will try to read files in encrypted area without smart card and after cached key expired:
Do not forget to type PIN when you insert smart card back! PIN request window is located at the system notification area and it's really small. Do not miss it !

That's all rookies. Stay secured!

security asceticism - getting list of subdomains

Hi folks.

During first step of security audit you need to get list of all sub-domains for a company domain name. How we can do it?

1. If target corporate DNS server support zone transfer (it's a security problem itself) it's easy:

#dig nameserver domainname axfr

#host -l domainname

2. DNS brute forcers - as a any brute force attack it's take a lot of time and it's always dirty work

3. My favorite way - ,sure thing, using google:

Just do a simple request

-inurl:www.ibm.com site:ibm.com

So, if google already indexed these domains you will find it in the list!

Sure thing, it works only with domains with web-servers on it.

How to see unseen

If I say that you 100% have a lot of infrared cameras at home you probably will not trust me.
So, lets test it! As a infrared light source we gonna use remote control.
First tests - Sumsung Corby mobile phone:


Second test - build-in web camera in MacBook laptop.


How it's possible? Sensor in you camera (CCD or CMOS) is sensitive for Infrared. CMOS sensor is sensitive in the near infrared than CCD sensor, but both of them work good with infrared projector (that could be made from infrared light emitting diodes ) Usually vendors install IR cut filter before the sensor, so, if you remove it (for a lot of cameras models it's really easy) you will get possibility to make cool IR photos.

How we can use it? For fun, as a very simple night vision system, or even as kind of x-ray system for some kind of materials transparent in IR lights (some types of paper, synthetics, etc)

Security configuration guides

When auditors visit your company for checking overall information security level they usually shower you with questions about vulnerability and patch management process. And if you haven't one of these processes well established - I'm dead sure you will get serious deficiency in the audit results.

But what about system hardening process ( it could part of configuration management ) - do you have such process established? Do yo have security configuration standards for all yours OS, DB and application well developed and updated? If you will start doing this from a scratch you gonna waste hell of a lot time. To save your time I propose you list of links to the well known library of security configuration guides:

1. USA National Security Agency (NSA) - Security Configuration Guides
2. USA National Institute of Standards and Technology (NIST) - National Checklist Program Repository
3. USA Defense Information System Agency (DISA) - Security Technical Implementation Guides (STIGS)
4. Community: the Center of Internet Security (CIS) - CIS Benchmarks

Sure thing you can find a lot of such guides on vendors websites:

1. Apple Mac OS X Security Configuration Guide
2. Microsoft Security Configuration Guides and Wizards
3. Apache community Security Tips
4. Cisco IOS Security Configuration Guide
5. Debian Linux Securing Debian Manual

Automated Hardening Tools:

• Famous tool for Solaris JASS (and old one for Solaris 8 YASSP)
• For Linux - Bastille Linux

So, use it and stay secured!

PS. If you got more links and guides , pls add it in comments.

I do it myself:

Old one general Unix security checklist

Using Google Alert for information security

So, we have spent hell of a lot of time and money installing different systems but how we can be sure that everything done good? Once in the morning you can find out that top today news is: your company has been hacked! I think, you must get worst news first. For this purpose you can write own web robot but from my point of view the simplest way is google alert service. How we can use it?

Create a search pattern like " my_company_name hacked OR compromised OR defaced " change option How often to as-it-happens, provide email and vuala - once google find something it gonna inform you.

More over you can use google alert service for checking your company web-resources for occasional leakage of confidential information. For this purpose create pattern like "site:my_company_web_site.com confidential OR secret OR internal use" or special pattern for documents that should not be published "site:my_company_web_site.com confidential filetype:doc OR filetype:cad". So, google will monitor your web sites instead of you and notify you.

Sure thing you can combine both methods for control of private data leakage over the internet, finding negative information about your company, advertisement about selling your protected data, etc.

Keep informed! :-)