Backtrack, netbooks and virtualisation


The need to install and work with new Linux distributions, some of them security related such us Backtrack 3, is always permanent. By the way, here you can find the link to the Linux distributions list.

Most of the current security tools run on those platforms. If we add as hardware element to this scenario one of the lightweight and attractive netbooks, then the combination can result into a frustrating experience trying to get network, especially wireless, video and sound to work.

This entry proposes a way forward for the scenario mentioned. The target will be to install a security testing platform (e.g. Backtrack 3) in a netbook without having to install new drivers on the machine (see screenshot above). The key steps are:

- Install in your netbook the operating system you prefer. If possible, let it coincide with the easiest OS. For example, the installation of Ubuntu intrepid (8.10) in most of the netbooks is relatively easy following the tips presented in the Ubuntu wiki. Do not trust all sites proposing ways forward to solve the problems you face with the installation (some of the pages that the typical search engines can provide with keywords such as "install wireless Ubuntu netbook name" will confuse you rather than help you).

- Once you get your video drivers and network to work, you have already a working platform - let's get the most of that. Probably you will need to install additional drivers in Ubuntu. A note on this, keep the driver files (and the instructions how to do it) at hand. You will need to install them again after a kernel update if they are not part of the regular distribution.

- Install virtualbox, a virtualisation platform available from Sun, ready to use and able to produce snapshots.

- Within virtualbox, create a virtual machine out of the Backtrack 3 iso file. You can even create a bootable virtual harddisk based on BT3 following this website (the last fragment related to VMware, where there is also a link to the automated script present in BT3 beta, and absent in BT3 final, that will help you) and this one (also at the end of the page).

- There is no need to go through the hassle of installing new drivers. If you got your wireless network running in your host system, then the guest system will use it directly ;-)

This way, you will get something like the screenshot below i.e. Backtrack 3 with a working wireless connection running on a virtual machine on top of Ubuntu Intrepid.

Last handy tip: Follow the menues shown in this screenshot and place the KDE panel on top of the screen and not below (as it appears by default)- otherwise you will not see it in the small screen of the netbook - unless you install virtuabox guest additions!)

Happy virtual work!

Identifying the ownership of a website

This is a quick step-by-step guide with the steps to follow to identify Internet web site coordinates (IP address, registration data, connectivity and name service provider).

Step 0 Download a copy of the website (if required for investigation purposes)

You can do that using wget, compressing using tar and gzip and finally keeping an md5 hash.
wget -m -k -K -E webname
tar -cf webname.tar *
gzip webname.tar (or get both steps together with tar -czvf webname.tar.gz)
md5sum webname.tar.gz > webname.tar.gz.md5

Step 1 Obtaining the IP address of the site (e.g. with www.google.com)
Launch a nslookup query (in Linux or Windows) to get the IP address of the site

$ nslookup www.google.com

An alternative to this command is

$ dig +qr www.google.com

There are many online sites providing online nslookup services e.g.
http://centralops.net/asp/co/NsLookup.vbs.asp
http://www.kloth.net/services/dig.php

If you need a name server IP address to bind to, some examples are

142.77.1.1
193.196.32.1
208.07.222.222
129.206.100.126
70.84.161.11

Step 2 Determine the owner of the IP address
Go to arin whois service and introduce the IP address from step 1 and you will read something like NetType: Allocated to RIPE NCC. The RIPE NCC is one of five Regional Internet Registries (RIRs) providing Internet resource allocations, registration services and co-ordination activities that support the operation of the Internet globally. Others are AfriNIC, APNIC, LACNIC, RIPE and InterNIC.

Step 3 Obtain the hosting company name
Go to the Internet register that the previous step signalled as owner of the IP range requested e.g. http://www.db.ripe.net/whois/ and insert the same IP address. You will get the hosting company.

Step 4 Name service provider
$ dig +qr www.website NS (ns in lower letters will also work - provides information on the authoritative name servers for that website)
Search on the Internet infomation on the name service (company name and contact point)
More on this command
$ dig +qr www.website MX (tells about the mail server associated to the site)
$ dig +qr www.website A (tells the IP address of the site)
$ dig +qr www.website ANY (provides a subset of the three commands above)

This step will tell us which authoritative name servers provides the name to the website (there are occasions when the name server provider differs from the hosting company).

N.B. Thanks to Melkiades for his help on this entry.

Security and risk blog

Welcome to this site about information security and risk management by Alberto Partida, an IT security professional.
Hacking is about outsmarting those who have designed the information system.
Information security is about outsmarting hacking.

These are the some of the topics discussed in Security and risk:
Current technical (or not) infosec topics
Enterprise risk management study
The 8 critical success actions for Infosec
Publications
Links to IS Security sites
Security papers

Enterprise risk management

How do companies face and manage risks currently? Do their diverse risk management functions still work in silos? Where does information security fit in this risk management puzzle? Among others, these questions are the triggers for an academic information security study that is presented in this site.

The study investigates how the link of information security with operational risk management brings benefits to any organisation. It has the following sections:

Executive summary
Introduction
Hypothesis
The risk house model
Outcome of the survey: Demographics
Outcome of the survey: Interpretation
Literature review: Thinking path
Literature references
Literature review: Summary
In a nutshell
Present and future
Annex: Link to the survey
Annex: Survey questions
Annex: Survey questions (Spanish)
Acknowledgements
Copyright
Awards


Information Systems Security sites

- Secure home pc: This site posts regularly articles on day-to-day topics related to endpoint computer security. It targets computer users that are not IT experts but, at the same time, would like to have a secure computer for their daily activities (email, banking, blogging, sharing, etc.).