eglug

A Quick Look at Computer Security

Ahmed D. Mekkawy AKA linuxawyahmed@linuxawy.org

Computer Security

Network Security.

Host Security.

Physical Security.

etc

Encryption & Hashing

Single Key encryption.

Public / Private key encryption.

Hashing: a true one way function?

Md5? Md6 is in the kitchen now.

Sha1, sha256, sha512, sha1024

Tunneling.

Ssl (ssh, https, etc)

Data Hiding ?!

First Things First

Mentality: always challenge your work. Wear the offending attackers' hat, and think how to destroy what you have done.

Never Underestimate your potential opponent.

Never underestimate how your data/computer is important to others (may be more than how it's important to you).

Password is like a toothbrush, never share it.

Use Good Passwords

Password less than 8 characters is lame.

Password containing only lower case characters is lamer.

Passwords containing your birth date/phone number is more lamer.

Passwords containing a sequense of digits like 123456 is the lamest.

Single password used among everything is a DISASTER.

Good password?

4 types of characters: lower case, upper case, numbers, special characters. At least use 3 of them.

Good password is 16 digit, the more the better.

32 character password equals 256 bit key, I call this secure.

Use transliterated Arabic.

Typing hacker style.

Hackers

Who are the hackers?

The word 'hacker' originally mean the one who makes furniture only by an axe.

Hackers means sharp minded, skilled persons.

Great inventions are hacks.

Gnu/Linux: an OS made by hackers.

Hackers' Hats

White Hat hacker: A good guy.

Black Hat hacker: A bad guy.

Grey Hat hacker: sometimes good, sometimes bad.

Normally white hats tend to help others (free or for a fee) and make the world a better place. Black hats tend to make the world much worse for their own benefits only.

Both use the same knowledge, have the same skills.

Black Hats are also called Crackers.

Black Hat's levels

Level 3: script kiddies, or skiddies: if you know the basics, you don't have a problem.

Level 2: moderate: can cause sever damage, you must be skilled to deal with them.

Level 1: Elite. If one of them is after you, run (unless you do know that you can handle him).

Attack Anatomy

Phase I: Info gatheringLow tech: social engineering, physical break-in, dumpster diving.

STFW.

Whois Database.

Phase II: ScanningWar driving.

Network mapping.

Port scanners.

Vulnerability scanners.

Attack Anatomy Contd.

Phase III: Gaining Access, or disabling itApplication / OS attacks: skeddies exploit trolling, buffer overflows, password attacks (brute force, dictionary), web application attacks (e.g sql injections).

Network attacks: sniffing, IP spoofing, session hijacking.

Denial of Service: Stopping service, exhausting resources, remotely exhausting resources (SYN flood, DDoS, .. etc)

Attack Anatomy Contd.

Phase IV: Maintaining AccessTrojans, Backdoors, Rootkits.

Phase V: Covering Tracks and Hiding.

Let's go technical

Firewalling is what we will discuss today.

Software firewall in GNU/Linux is IPTABLES.

Let's do some Packet filtering using iptables.

What is iptables/netfilter?

The native firewall in GNU/Linux is iptables/netfilter.

Netfilter is a kernel patch (now it's basic in all modern kernels, unless you compiled your own without it)

Iptables is just a configuration tool for netfilter.

You can uninstall iptables, but not netfilter.

Netfilter cannot be stopped. Anyway you can remove all rules so it doesn't do anything.

Iptables rules are volatile, you have to put them in a startup script to start with booting.

What are the tables/chains?

Tables => Chains => Rules

We have 3 tables: Filter table

Nat table

Mangle table

We will focus on the filter table today, in filter table we have 3 main chains, which are: INPUT chain

FORWARD chain

OUTPUT chain

iptables syntax

How to add a rule: iptables -t table -A/I chain condition -j target

iptables -A INPUT -p tcp -dport 80 -j ACCEPT

How to list rules: iptables -t (table) -L (-n) (--line-number)

How to delete a rule: iptables -t (table) -D (chain) (condition) (action)

iptables -t (table) -D (chain) (rule number)

iptables initialization

First, we flush all chains, delete custom chains, zero all counters:iptables -F

iptables -X

iptables -Z

Turn off IP forwarding:echo 0 > /proc/sys/net/ipv4/ip_forward

Enable dynamic IP support. 1: enable, 2: verbose, 0: disableecho "1" > /proc/sys/net/ipv4/ip_dynaddr

To use RELATED in ftp rules, add ip_conntrack_ftp:modprobe ip_conntrack_ftp

Enable pings

Enable incoming/outgoing pings:

Incoming:iptables -A INPUT -p icmp -icmp-type echo-request -j ACCEPT

iptables -A OUTPUT -p icmp -icmp-type echo-reply -j ACCEPT

Outgoing:iptables -A OUTPUT -p icmp -icmp-type echo-request -j ACCEPT

iptables -A INPUT -p icmp -icmp-type echo-reply -j ACCEPT

Add your rules

sport dport ============> CLIENT SERVER