Physical safety - Checking CPU temperatures in Linux Ubuntu

Dear all,
Short post to propose two easy ways to check physical parameters via sensors in our Ubuntu Linux box.

The first one is command line based and it is described in this Ubuntu help page.

Basically we need to install lm-sensors:
# apt-get install lm-sensors

Run the sensors-detect routine:

# sensors-detect

Type YES several times ;-) and load the module:
# service module-init-tools start

Finally run sensors and we will see the rpms of the fan and several internal temperatures including their usual functioning range.

The second one is a graphical but lightweight application called gkrellm with lots of configuration possibilities.

Sensing the sky!

Happy sensor-based monitoring!

Security site to bookmark: www.pentest-standard.org

In current times, the option to abandon a company's payroll and become an entrepreneurial Information Security freelancer appears as a plausible option to many IT Sec professionals. This choice comes either as a thoughtful decision or as a "last resort" before "being forced" to leave the industry and test their luck in other, more generic, IT areas.

Firms depend heavily on IT. They increasingly engage security professionals. A typically demanded service is the security analysis of their information systems, also known as a penetration test. Pentest-standard.org is a valuable initiative that provides both security vendors and their customers with one common "pen testing" language and scope, as you can read in their FAQ section.

Key players such as Chris Nickerson , Dave Kennedy , Chris John Riley , Carlos Perez and Wim Remes, among many others, have contributed to make pentest-standard.org a necessary go-to site for security pen testers. First thought of in 2009 and created in 2010, the site has had over 1800 content reviews and it continues evolving. Pentest-standard.org uses a handy wiki format and it welcomes contributions from the community via either the corresponding Linkedin group or a PDF-based collaboration site powered by Adobe.

I highlight two components of this site:

• The seven pen-testing execution stages: Each of them starts off with a valuable mind map that could very well be the script to follow in a formal pen-testing engagement. Non-technical, but pivotal, elements such as scoping and payment methods are also present.

• The technical guidelines: An excellent compilation of links and tools, both free and commercial software, required for each of the pen-test phases.

Finally , I would like to thank everyone involved in this "pen-testing vademecum" and invite the Infosec community to contribute. A revealing question would be: How much of what you can read in pentest-standard.org do you already know?

A version of this post in Spanish is available here.

A nice tool to fly ... and to pen test?

Unattended updates in Ubuntu Linux

A key measure to keep our IT boxes in a healthy state is to regularly update the operating system and applications. This simple measure could save us from the "low-hanging hacks". Let's take this statement and link it with the fact that automation in IT is worth-considering. The following lines provide some tips on how to automate the software upgrade process that, otherwise, would require typical manual steps such as these ones:

- For a complete update:
$ sudo apt-get update
$ sudo apt-get upgrade

- For a specific update
$ sudo apt-get install package-names

There is a nifty package in Ubuntu Linux called unattended-upgrades that would do the magic for us, as mentioned in this Ubuntu Help page. The command line I would highlight from that page is:


$ sudo dpkg-reconfigure -plow unattended-upgrades

The AskUbuntu community also provides juicy input for this. In this case, I highlight the following steps I extracted from the AskUbuntu page:

- Uncomment the Ubuntu packages to be installed silently, mainly security patches and updates. This is also the place to prevent any package from being silently upgraded by using the Package-Blacklist section:

$ sudo gedit /etc/apt/apt.conf.d/50unattended-upgrades

- The command line to check whether things are OK is this one:

$ sudo unattended-upgrades --dry-run and --debug.

- The line to check whether the upgrades are really taking place:

$ tail /var/log/unattended-upgrades/unattended-upgrades.log

Finally, for those using Google Chrome, it can also be included in this silent process with the info provided by this AskUbuntu page:

$ sudo gedit /etc/apt/apt.conf.d/50unattended-upgrades

and adding

 "Google\, Inc.:stable";

 in the Unattended-Upgrade::Allowed-Origins section of the

etc/apt/apt.conf.d/50unattended-upgrades file.


Nothing to do with Ubuntu, however, the way to silently update Java in Windows 7 using Powershell and VisualBasic is explained in this Superuser page. The security catch with this one is that the Task Scheduler would need to save the admin password in order to run the silent update.

Good to keep the house updated!

 Happy silent updating!

Security site to bookmark: www.reddit.com/r/netsec - The IT Security global bulletin board on the Internet

Wikipedia reminds us that the Agora was a meeting place, an open space, the center of commerce, culture and political life in Ancient Greece. The section in reddit.com devoted to information technology security, located at reddit.com/r/ netsec, is the agora of our security community and profession. The place to visit to stay on top of the security news, both politically correct and incorrect.
 
Since its foundation in 2005, reddit became the global Internet bulletin board, especially for US-based users, living up the role that the "Bulletin Board Systems" (BBS) played in past decades. As an example of the relevance and currency of reddit net sec articles, the same day that Cisco has announced the purchase of Sourcefire, on July 23, 2013, a user on reddit (they are called "redditors") shared the piece of news in reddit.com/r/netsec. Reading the comments shared on reddit posted by users after reading the news hints the so important "market sentiment". It is comparable to follow a related "hashtag" on twitter.  

This network security section in reddit links to related subsections. For example, the social engineering, computer forensics or reverse engineering pages are valuable. The popularity of this site makes it an optimal site to witness and to participate in fruitful conversations between Information Security professionals (itsecuriteers) on technical, organizational and business-related topics. Anyone asking questions can receive interesting and alternative answers. Noteworthy is the link to a jobs site. While most positions are based in the U.S., there is a growing number of postings for positions in Europe and to work remotely.

Finally, there is also a place for those who starting in this field: The academic discussion forum (e.g. the "2013 Q3 Academic Program Thread"). There, students post their evaluations regarding security degrees and training courses. 
A wise piece of general advice given by reddit.com to those who want to post news or comments is to avoid creating unnecessary conflict: Something that we can also apply almost in any aspect of our lives.

Sometimes there is no room to manoeuvre

You can also read this entry in Spanish here.

Happy redditing!

Book Review: Ninja Hacking by Thomas Wilhelm and Jason Andreas

Every now and then I share with the readers my views on a specific security related book. This time the title I scanned through is "Ninja Hacking: Unconventional Penetration Testing Tactics and Techniques". In a nutshell, this is a book for those who would like to get introduced into the world of security and insecurity. Especially those who also enjoy martial arts. However, this book does not target specifically at technical IT security professionals. Here you are a biased and telegraphic view:

chapter 1
It starts with the disclaimer that this is not a usual pen testing book. It includes
a reference to ancient feudal Japanese tradition: ninjas and samurais, the documented and the undocumented side of war and military strategy. It mentions how the public image of ninjas was negative. Stealthy reconaissance was a ninja technique. The authors establish a parallel between ninja codes and weapons and unusual pen testing.

chapter 2
This chapter links pen testing with Ninjitsu. They mention arts such as espionage and unconventional warfare. The authors propose that while white hats use methodologies to perform pen tests, ninjas take alternative paths. Important detail: ninjas move undetected.

The difference between white and black hacking is system owner permission. The description of grey hat hackers in this book is somehow confusing: they use illegal attack methods without hacking the spirit of the law?

All in all, 17 chapters for those readers willing to get an initial flavour of what insecurity means today. A light appetizer for a non-technical audience before embarking on more robust references.

Ninja "security" turtles?