Depth or layers? – Security Blog #9

Okay, so… Have you heard of the famous cake layers? If you haven’t, please, check out my last blog. Else, we can continue!

And just for you to understand the reference. The anchors go the ocean floor… Deeply… To the depths…

176805103_eeb002dfdf_o
“Rusty Anchor” by _lem (CC https://creativecommons.org/licenses/by-nc-nd/2.0/). Taken from https://www.flickr.com/photos/_lem/176805103/

So, why did I asked you to read about the security layers? Because security in depth is based on the layers implementation. We already discussed how layers are supposed to function, if you achieve to cover all holes of each layer with the preceding layers, there will be no way an attack could be successful to your system. The thing is that achieving that level of perfection is impossible. Instead, security in depth assumes from the start that the layer method can, and will eventually fail. The layered security only achieves the exhaustion of the threat (Successful defense) or the slowing of it, giving time for other plans of action and countermeasures initialize.

Depth defense also assumes that the hack or breach isn’t necessarily of remote origin, this means that the possibility of physical theft, threats, unauthorized person access, and some other unique events (See van Eck phreaking below).

Usually, taking into account those possible events involve the set up of:

  1. Monitors, alerts and emergency responses
  2. Authorized personnel activity logs
  3. Forensic analysis
  4. Reports on criminal activity
  5. Disaster recovery

Remeber that the objective of depth defense is to gain time. Each of the set up new components main objective is to delay the threat, which might not be obtained if we used only technological solutions. The obtained extra time should be used by the administrator to identify and try to overcome the hack.

And I guess that is for now regarding security.
As a mini comment on the course: I enjoyed it big time. It was fun and learned a quite a lot of new stuff 😀

Miguel Montoya
Esperanto enthusiast
ʕ•ᴥ•ʔ

Further readings:

Listening to the CRT radiation: Van Eck Phreaking

Specific actions for small business regarding Depth Security: Defense in Depth and Layered Security Explained

Anuncios

Cake layers rule – Security Blog #8

As the 8th blog regarding security, I will talk about the computer security layers. There are some people who state that there are 5, there are some people who say there are 8. What I mostly found during the investigation is that there are security layers as layers in the cake (Including the top frosting), 7.

What you, dear reader, need to remember during the reading of this entry, is that this set of rules can be implemented either by a network system administration or a regular single computer user.

The logic behind the security layers is the following: A single defense will be ineffective or flawed if the defense mechanism leaves unprotected areas, with its protective layer (umbrella), empty. That it’s why the layer’s purpose is to cover those empty spots. Theoretically, the empty areas on each layer would be so different, that an attack can’t penetrate through all the holes, and the service would remain available.

8234883949_e9e1be1f17_k
“20121201-_IGP1571” by Tim Ebbs (CC https://creativecommons.org/licenses/by-nc-nd/2.0/). Taken from https://www.flickr.com/photos/ebbsphotography/8234883949/
  1. Application Whitelisting: The objective is to install just a set of limited programs and applications in the administered computers. The fewer applications, the fewer possibility there is of a breach.
  2. System Restore Solution: This is one of the most talked security solutions in the classroom. Basically, it consists of creating a plan of action when the hack peril arouses.  This would let the user gain access to their files, even if the system is hacked and damaged files remain.
  3. Network authentication: A system of usernames and passwords must be taken into place. This would give access only to authorized users. This means no login without a password prompt.
  4. Encryption: All of your files, disks and the rest of removable devices should be encrypted. This will provide a method for users to not risk an information breach, as the encrypted USB (Or any device), will not be able to be read on a foreign machine.
  5. Remote authentication: This is a very obvious rule. It consists of setting usernames and passwords for remote server access. These usernames and passwords should only be provided to trustworthy users. This is the obvious part.
  6. Network folder encryption: Most of the websites that deal with this topic, consider that this layer should be included in layer 4. I guess it is different enough that I would let it pass as a different layer (As not everyone uses this features). This concept consists of also managing the encryption of shared data. This will prevent users from listening unauthorized access to the network information.
  7. Secure Boundry and End-To-End Messaging: This basically consists of using emails and instant messaging as a secure method of communication, rather of dealing with the encryption from the server to the user and vice-versa.

And I guess that that is a simple and easy summary of the 7 layers. Remember to implement all the layers you are capable of activating or at least finding someone who cans helps you.

Cherio.

Miguel Angel Montoya
Esperanto enthusiast
ʕ•ᴥ•ʔ

Secure Network, How? – Security Blog #7

This entry is not addressed to regular computer users, but more specifically to engineering students or people interested in network’s security, as the concepts are not that regular. This entry’s topic is the security of the network’s enterprise.

Virtual Private Network

This first category isn’t that much complex, as Virtual Private Networks (VPNs), are more and more widely used by the general users. So I won’t be talking a lot about this. VPNs are a method used by enterprises to connect and access an internal network from the outside, using a more secure network and an encrypted one.

15252943257_12957cec4a_k
“network” by Rosmarie Voegtli (CC https://creativecommons.org/licenses/by/2.0/). Taken from https://www.flickr.com/photos/rvoegtli/15252943257

Intrusion Detection Systems

Intrusion Detection Systems (IDS) main function is to aid the administrator in the detection of the type of attack that is being carried to the system. Usually, the IDS also help the administrator find and execute a solution to the problem as well as a plan of action on future detections. These systems trace and record logs, signature and triggered events. Usually, the IDS is attached to the firewall (Which I’m speaking down below) and the network router.

The most popular IDS tools I found are Snort and Cisco Network-Based IDS. Both successfully notify the user real-time, the signatures of attacks made to the network. The main advantage of Cisco IDS is the results obtained in the aftermath of the events (Reassembly of IPs and TCP sessions) and Cisco continuous support to the client. Meanwhile, Snort is open-source, cheaper to implement (Hardware wise), and flexible (Only requires Linux) and has multiple modalities where it can be implemented.

Firewalls

Firewalls, also called Intrusion Detection Devices, are software or applications that work directly in the network layer. As most of us already know, the firewalls protect the internal network users from the rest of the world, and vice versa. The rules set in the firewall can block specific functionalities and applications if the port is marked as prohibited. They also can redirect incoming requests from one port to another. When a block or a forwarding is made, a log it generated so the administrator can oversee the data that it’s being affected by the rules. usually, the firewall is located after the incoming data is processed by the router.

As I found out, the most common firewalls are Cisco ASA and Sophos. Overall I found people prefer Sophos firewalls. Basically, because Cisco ASA only works for people who can’t get out of the traditional enterprise comfort zone. This means that if you want to implement a not that usual functionality, ASA won’t be enough.

Cherio

Miguel Montoya
Esperanto enthusiast
ʕ•ᴥ•ʔ

Further reading:

Cisco IDS vs SNORT discussion thread at CISCO support: Cisco IDS vs SNORT.

Firewalls discussion thread at Spiceworks: Sophos vs SonicWall vs Cisco ASA vs Fortinet.

OMG I did it! – Security Blog #6

Okay, so I’ve been so proud this last 2 weeks because I finally got a -more than- decent score in LastPass Security Challenge. The first time I took the quiz I had more than 40 sites (There were more of them, but I already had the duplicate/same domain configuration working), and I obtained a well deserved 12%, in the lowest 7%, but at least my Master Password was excellent (At least something wasn’t horribly wrong).

26965409864_0508284796_k
“pw_xato-net_02-06” by Mark Burnett (CC https://creativecommons.org/licenses/by/2.0/). Taken from https://www.flickr.com/photos/mark_burnett/26965409864

Now, I can truly be proud to say that after some heavy work I got, after inserting 5 new sites, a 96%. This puts my account in the top 1% of Last Pass users. YAY!

So,  it was really a heavy task to change the passwords of almost 50 sites. It was really horrible and exhausting (Maybe because I tried to all of the necessary changes in one sitting). But I can share some stuff I’ve learned to the rest of the world:

  • Last Pass offers a method that automatically changes your password in the supported sites (Usually it only works with the big ones). I found that method extremely ineffective. It takes what feels like years, to let the program found the adequate buttons, text fields and then generate the password. I don’t know why did this happen. Maybe because I have some pages in Spanish and Esperanto, and the program failed to find the buttons (if the method is made using the value of the button and not the ID, or something like that).
    I mean. My problem was with the time it took to accomplish those tasks. Not that it didn’t work. I don’t have any problem leaving Last Pass to change your password in the background while you do something else. Then there isn’t any con for you. (Remember that you will need to manually select each site that you wish to auto-change).
  • Manually changing your passwords was a pain in the butt… sometimes. Why? Because of three reasons.
    1. Sometimes, Last Pass doesn’t detect the new password fields. So how can I take advantage of the password generator, if it doesn’t appear where I need it to be. I then need to use the generate password feature in the extension button of the explorer.  Which is, in fact, the second reason.
    2. If you have the necessity of using the “generate password” inside the extension button, and if you want to write edit the password (Which is a feature you supposedly have), you will suffer. Why? Because the dumb system stores the texts that you have managed to type in. I was going to post a GIF where I showed this ugly implementation, but then I realized that the stored list has passwords that you actually use on some sites! I mean, if supposedly Last Pass is trying to make me use different passwords for each account, then don’t show me my used passwords. But specifically, don’t store them in a list that impedes the insertion of a new password to test or the generation and tweaking of a different one. So I encourage you to try this by yourself so you can actually understand.
      The problem is that instead of letting the user write a new password to test, it will change the value of the field to the stored text in the list (I sincerely don’t know how I managed to get those in) that starts with the key you just typed, like a form.
      And if you manage to actually make Last Pass stop changing your text, you can only add more characters to the end of the string. You can’t move the text cursor somewhere else because, bad luck, it will change the entire string that it’s being displayed.
      And after that, if you think that that password you have would fit your needs, then, good luck copying that into the reset password field (Remeber that you only got here because, from the start, Last Pass didn’t detect that you were actually trying to change the password). Because when you release the ctrl+c keys, Last Pass will change the text to the string that starts with c in the list. And your clipboard will still remain empty, and your perfect password lost.
    3. Okay, so let’s say that Last Pass actually detected you are changing your password. And let’s say that you manage to generate a new one, either automatically (Without even touching a thing), or semi-automatically (Giving the generator some parameters). Sometimes, after you click the update password button in the site, Last Pass will prompt you to update also the entry in your vault. But, this is only sometimes! And how am I to know that if you can detect that new password field for a particular site, doesn’t mean that you will be able to tell if I actually updated the password?!
      If this feature didn’t exist, then I wouldn’t care. But the problem is that sometimes it does work. And it’s beautiful. But when it doesn’t, how am I to update myself the Last Pass vault entry, if I don’t have any clue of the new password! It only leaves me with the option to click on the “I forgot my password” on the site. Generate another password and remember to copy it. Then, and this is just ridiculous, if Last Pass doesn’t automatically detect the new password this time, I manually updated it in the vault.

And those are my complaints of Last Pass. I still have one HUGE complain. During this process of changing the passwords, I found out that there are sites that handle this request easely, and others that makes it impossible to the user to reach its goal. Some of them let you change the password only if you click on the “I forgot my password”. But there is one site that is thw worst of all.
dish.com.mx – I mean… they don’t event let you change your password. So I clicked on the forgotten password button, to then realize that they just sent me my password via email. OMG. That is so badly implemented. In fact I made a public complaint in Twitter. But they account is mostly offline.

And I guess that its everything I have to share about my experience. If you feel like asking something, please do.

Cheerio.

Miguel Montoya
Esperanto enthusiast
ʕ•ᴥ•ʔ

Let’s talk about 2 factor aunthentication – Security Blog #5

After the last security class, when we all did the Last Pass Challenge (Where I did so… so bad), I started to change an generate a lot of passwords (Like 40 as of now) and activated 2-factor authentication on most of the sites where I could. I don’t know why I did this until now, and not when we talked about this topic in class.

16021496959_1d2ffb589a_h
“Fingerprint authentication 06” by Hideya Hamano (CC BY-NC-ND). From https://www.flickr.com/photos/mawari/16021496959

I knew what the 2-factor authentication did, but I didn’t know how. So after some reading (Links below) I finally got around all the concepts.

  1. 2 Factor Authentication (2FA) is just a layer of Multi-Factor Authentication (MFA)
  2. 2FA works even if the device isn’t connected to the internet. Not for SMS 2FA.
  3. It’s very secure, but as everything, it has some weak components.
  4. This makes 2FA a failed attempt to create a silver bullet for security.

Let’s start with the concept of 2FA just being a layer. What layer? Of how many? Why do we have that layer only? I want more of those!

Okay, so the point of the verification is to tell the service that you are who you say you are. That is why we have passwords. And passwords are things we know, and the knowledge factors are the first and basic layer of credentials in an MFA.

The second layer of credentials are the possession factors, which are the things that the user has, like a phone, an ID or tokens. This is the layer where 2FA is based upon.

The last big layer is the third one. It’s called inherence factors. These factors are the things that the user is. Usually, we are talking about biometrics here, but there are ways to measure behaviors and patterns of a user (Behavioral biometrics) such the way they walk, the way the type or talk. This layer is less used because it depends on hardware and it might increment complexity and costs.

There are two more, far simpler layers, that are only used in heavy security demanding systems. Location and time are these layers. This means the location of which the user is trying to access the service and the time might be taken into account to verify you.


And now: Whow do they manage to make 2FA app’s, such as Google Authenticator, work even if the app is completely disconnected from the WEB?

First. I’m going to explain to you two types of One Time Passcode (OTP): HMAC-based OTP (HOTP) and Time-based OTP (TOTP). Both of these are used to generate the numbers that you see in Google Authenticator App, and both use HMACs in the process.

The first method, HOTP, (The inefficient one), takes the secret key the sever gave to you when the account was created or the 2FA service was activated, and a counter as the message for the HMAC function. The counter represents the number of times an OTP was generated. So when I try to login to a site for the nth time (The server must know how many times have I used an OTP. It also knows the secret and has the same HMAC), I also generate the nth code in my app. And this works as long the server and the app have fully synched counters. The server even usually checks from n to n+x values of the counter to see if, by any case, the mobile app has gotten out of sync. In case the app’s counter is ahead, the server can know at which value the app is currently in, but only if it’s in the x-range, and the problem is that the user can get so ahead from the server that it can’t get in sync.

The second method, TOPT (The popular one), also uses an HMAC function and the secret key. But instead of a counter, it uses 30 seconds intervals of UNIX time; It uses floor(Unix-time() / 30) to get to the nearest second. The server and the user are usually just some seconds out of sync, so the server can just check for the previous and following values of the HMAC function to see if that is the code that the user is typing.

Both methods generated a hashed message. Then, both the server and the client slice and apply some modulos to finally generate the code. The user sends the generated message, and the server compares it to the set of messages it generated (In case the user is out of sync), and if the service is using HOTP, it also increments the counter on success.

And because both devices have everything they need to generate the adequate code for that specific moment, they don’t need to be connected.


But is this secure enough?

Well… It depends… This method is as secure as it’s weakest component.

In case that the 2FA isn’t done using an app, but instead uses 2FA-SMS (The server generates a code, it sends it to the user, the user types it in), the integrity of 2FA can be easily compromised by intercepting or redirecting messages.

There are some sites where the account-recovery is badly implemented and can let the hijacker get around the necessity of introducing the 2FA code.

The database where the user keys are stored can also get hacked. With this knowledge, along with the hash and a clock you could, in theory, generate the security code.


Maybe I will post something more regarding this and my current Last Pass experience (I think that there are only some few sites missing!).

But as for now, I think I have said enough.

Cheers.

Miguel Montoya
Esperanto enthusiast
ʕ•ᴥ•ʔ


Some further reading:

Some references:

I want to become a pro – Security blog #4

So you are a pro, you say…

You think you are good, you say…

But do you have a computer security certification?

No?, you say…

11960608165_55df368e44_o
“Professional” by Dan Taylor (CC BY-NC-ND). From https://www.flickr.com/photos/dantaylorphotography/11960608165

As many more data breaches are happening each year, with more size and quality of attack, cybersecurity skills are on very high demand. But not because there a lot of jobs available, means that the position is going to be given to anyone who tryes and aplyes (Mainly to make sure that the person know about the stuff, but also because there are so many areas of specialization in security). The company will ask you to have one or more certifications.

Let’s talk about some of them. In fact, just 8 of the more of 70 certifications that Wikipedia has mentioned (Only 10 of those have an individual entry).

ISSEP/CISSP

The Information Systems Security Engineering Professional certification was developed by the N.S.A. It cover security methodologies and practices into all information systems aswell as the proper and secure handling of data. This is the must-have certification if you want a career in IT security.
It’s issued by the (ISC)²

LPT

The EC-Council Licensed Penetration Tester certification demonstartes the person’s ability to audit network security and perform penetrations and develop proper corrective actions to the problems and weakness found in the test.
It’s issued by the EC-Council

GPEN

The GIAC Certified Penetration Tester certification it’s similar to the LPT (Above) but it demonstrate too the persons knowledge of legal issues regardiong penetration testing aswell as specific penetrations tests and practices.
It’s issued by the GIAC.

CSFA

The Cybersecurity Forensic Analyst certification provides the necessary knowledge to perform a deep analysis of computer systems and proper interpretation of investigation results in a short time frame.
It’s issued by the GIAC.

ECSP

The EC-Council Certified Secure Programmer issue assures that the programmer knows most f the security vulneravilities due to programming. The certification holder has developed the best practices and techniques against those vulnerabilities. This certifications it’s available for .NET and Java.
It’s issued by the EC-Council.

CSSLP

The Certified Secure Software Lifecycle Professional certification validates the holder’s ability to develop application and software security protocalsin the organization. It ensures that potential  breaches and vulnerabilities are reduced troughout the software development.
It’s issued by the (ISC)²

CEH

Certified Ethical Hacker. You can read more about this certification and ethical hacking in my previous post.
It’s issued by the EC-Council.

There are somo other certifications that I didn’t mention here.

 

Miguel Montoya
Esperanto enthusiast
ʕ•ᴥ•ʔ

Let’s be ethical – Security Blog #3

This is the first time I hear about ethical hacking. Really, it is.

I mean, I knew that there are people who do that. But I never thought that they were called like that.

So let’s start learning ethically! 😀

Ethical Hacking describes the action of hacking by an entity to help identify potential threats. The hacker tries to go around the security and search for weak points where a malicious hacker could exploit and cause an information breach. This information is later provided to the companies or individuals to fix and minimize future hazards.

Ethical hackers and penetrations testers have some perks. They might not reach the levels of adrenaline and badassery as a regular -nonethical- hacker, but they really do earn a nice economic remuneration and the nice assurance that you won’t end up in prison.

And how can you become an ethical hacker?

First, you might consider career/major in IT. You might even study alongside the military (If your country has a program) and they could even pay you to study your career and offer you a job regarding security.

You need to get some basic certifications (CCNA) and some more specialized (Security+, CISSP or TICSA). When doing your certifications, you should also work in tech support and move up to administrative roles, until you achieve an information security position. At this point, you can apply for the Certified Ethical Hacker (CEH) title by the International Council of Electronic Commerce Consultant.

To hack, network engineering skill are -of course- necessary, but UNIX/Linux, C, LISP, Perl, JAVA, and SQL are necessary concepts that you need to master. Oh, and let’s not forget about the soft skill (As any other IT job) and street smarts (People skills and talent for manipulations).

And can you just start hacking after that?

Nope.

Usually, you need expressed, written, permission to probe the network, respect individual’s and company’s privacy, close everything after testing (Let’s not leave open doors for anybody else), and record and report any finding you might have encountered.

That’s all folks…

Miguel Montoya
Esperanto enthusiast
ʕ•ᴥ•ʔ