Be careful with Free WiFi

Recently I and my colleagues have visited Moscow for a business.
When we get tired we found a nice cafe (Coffee house network) with free WiFi from Beeline.
It was really nice but only for first look. We easily get internet connection, type gmail.com and .. get warning that Google use self-signed ssl certificate from Beeline!
When we try point to other sites over https - we get absolutely the same message.
So,please note, that free Wifi providers start use some kind of proxies (there are a lot of them) with https monitoring features enabled (by man-in-the-middle technique).

Stay secured!

security asceticism - getting list of subdomains

Hi folks.

During first step of security audit you need to get list of all sub-domains for a company domain name. How we can do it?

1. If target corporate DNS server support zone transfer (it's a security problem itself) it's easy:

#dig nameserver domainname axfr

#host -l domainname

2. DNS brute forcers - as a any brute force attack it's take a lot of time and it's always dirty work

3. My favorite way - ,sure thing, using google:

Just do a simple request

-inurl:www.ibm.com site:ibm.com

So, if google already indexed these domains you will find it in the list!

Sure thing, it works only with domains with web-servers on it.

Big Brother watching you or mobile phone security issues

Lets talk about mobile phone security. You are well qualified security specialist and never install suspicious application on you handset, so, you think you are secure? Have you heard about OMA-DM technology?
OMA-DM stands from Open Mobile Alliance Device Management. Within the Open Mobile Alliance Device Management the standard for firmware handset updates is known as the Firmware Update Management Object (FUMO) This standard permits Firmware Over the Air (FOTA) technology. How it works - here you can find short description. But it was only first step of implementing such technology on the market.

The second step is SCOMO - Software Component Management Object standard that permits Software Component Over the Air (SCOTA) technology. This technology was created for more granular and flexible management of each software components. With SCOTA, one or more piece of software could be changed without requiring update whole handset firmware. SCOTA is a best way to create phones' application stores, so, consumers can have access to the latest applications, without needing to replace devices.

The most interesting thing that all these technologies use http/https over IP and xml data format.

Sound cool, does it? But lets turn on our paranoia:

1. These technologies allow vendors, mobile or value added service providers (but not only them) to install or delete any application or data on your mobile phone.

2. This technology uses centralized management model , so, from the one management Center it's possible to legally control a huge botnet of mobile phones.

3. This technology could allow (or it could be already used) government to spy on citizens.

4. These system components could be penetrated by some "bad guys" and used for stealing your data or spying on you.

Talking about OMA-DM overall security conception - I' ve found only OMA Device Management Security Candidate Version 1.2 document. According to it OMA-DM protocol use to level of authentication: on transport layer (recommended to use TLS 1.0, SSL 3.0 ) and on application layer (OMA-DM use MD5 !).

Some useful information for Windows based smartphones you can find on msdn web site:

OMA Device Management Security Best Practice

OMA Device Management

How many phones support these technologies? There are two types of OMA-DM support: OMA-DM ready terminals (soft client already build-in) and terminals that need OMA-DM client to be installed by user to enable OMA-DM support. Some useful but a bit old information you can find here .

Big Brother is watching you! Stay secured!

How to see unseen

If I say that you 100% have a lot of infrared cameras at home you probably will not trust me.
So, lets test it! As a infrared light source we gonna use remote control.
First tests - Sumsung Corby mobile phone:


Second test - build-in web camera in MacBook laptop.


How it's possible? Sensor in you camera (CCD or CMOS) is sensitive for Infrared. CMOS sensor is sensitive in the near infrared than CCD sensor, but both of them work good with infrared projector (that could be made from infrared light emitting diodes ) Usually vendors install IR cut filter before the sensor, so, if you remove it (for a lot of cameras models it's really easy) you will get possibility to make cool IR photos.

How we can use it? For fun, as a very simple night vision system, or even as kind of x-ray system for some kind of materials transparent in IR lights (some types of paper, synthetics, etc)

Security configuration guides

When auditors visit your company for checking overall information security level they usually shower you with questions about vulnerability and patch management process. And if you haven't one of these processes well established - I'm dead sure you will get serious deficiency in the audit results.

But what about system hardening process ( it could part of configuration management ) - do you have such process established? Do yo have security configuration standards for all yours OS, DB and application well developed and updated? If you will start doing this from a scratch you gonna waste hell of a lot time. To save your time I propose you list of links to the well known library of security configuration guides:

1. USA National Security Agency (NSA) - Security Configuration Guides
2. USA National Institute of Standards and Technology (NIST) - National Checklist Program Repository
3. USA Defense Information System Agency (DISA) - Security Technical Implementation Guides (STIGS)
4. Community: the Center of Internet Security (CIS) - CIS Benchmarks

Sure thing you can find a lot of such guides on vendors websites:

1. Apple Mac OS X Security Configuration Guide
2. Microsoft Security Configuration Guides and Wizards
3. Apache community Security Tips
4. Cisco IOS Security Configuration Guide
5. Debian Linux Securing Debian Manual

Automated Hardening Tools:

• Famous tool for Solaris JASS (and old one for Solaris 8 YASSP)
• For Linux - Bastille Linux

So, use it and stay secured!

PS. If you got more links and guides , pls add it in comments.

I do it myself:

Old one general Unix security checklist

Using Google Alert for information security

So, we have spent hell of a lot of time and money installing different systems but how we can be sure that everything done good? Once in the morning you can find out that top today news is: your company has been hacked! I think, you must get worst news first. For this purpose you can write own web robot but from my point of view the simplest way is google alert service. How we can use it?

Create a search pattern like " my_company_name hacked OR compromised OR defaced " change option How often to as-it-happens, provide email and vuala - once google find something it gonna inform you.

More over you can use google alert service for checking your company web-resources for occasional leakage of confidential information. For this purpose create pattern like "site:my_company_web_site.com confidential OR secret OR internal use" or special pattern for documents that should not be published "site:my_company_web_site.com confidential filetype:doc OR filetype:cad". So, google will monitor your web sites instead of you and notify you.

Sure thing you can combine both methods for control of private data leakage over the internet, finding negative information about your company, advertisement about selling your protected data, etc.

Keep informed! :-)

Vulnerabilities scanners architecture in big enterprise

Let's talk about vulnerabilities scanners within corporate security infrastructure. Everybody knows that vulnerability identification is one of the major component of security risk management process. So we must be sure that information about vulnerabilities is correct and up to date .
It's easy when you scan the network from your own laptop and use direct connection to the target system. But what about huge corporate network with a lot of routers, firewalls and packet filters between you and target system?
First of all you must install multiply instances of vulnerabilities scanners across the network. why you should avoid to use one scanner for all network ?
- compromising this scanner will give possibilities to attacker easily get access to all hosts. (For same scanner it's snap - IBM ISS internet scanner only works on Windows XP SP1 , so the scanner is vulnerable himself. )
- scanning through the firewalls will impact to the scan performance and could produce firewall cpu overload.
-low accuracy of the scans results (firewalls, routers and packets filters between scanner and the target can distort the scan )
So, does installing multiply scanner fix all problems? Sure thing, not. What about scan accuracy? It's depends of scanners and network configuration. So, if you would like to get trusted result you must be sure in scanner and network configuration before run each scan. It is not easy and can consume a lot of time without any warranty. How to solve this problem? Just do the same as engineers do for the precision instruments - calibrate them using master or template.
I recommend to use a bunch of calibration systems and allocate them across the network. It could be virtual systems based on well known vulnerable distributive such as Damn Vulnerable Linux or simple unpatched Windows with a test services running.
So, before scan the target system you must choose nearest calibration system, scan it and check result for accuracy. From my experience it's very important to do this because often even very famous vulnerabilities scanners fail during simple scan.