Linux commands hodgepodge (I)

This post is an unusual one. The reader will not find a line of thought in it but rather a collection of command lines and telegraphic recommendations for some configuration files in the Linux (more specifically, Ubuntu) Universe.

Happy command line experience!

- To open a X session via ssh
$ ssh -X -p xxxx usernameh@ipaddressorname

- Enable networking in Linux
# route add -net 192.168.x.y netmask 255.255.255.0 gw 192.168.a.b dev eth0

- How to quickly install sshd
# apt-get install openssh-server

- Sshd to start at boot time in Debian flavours
# update-rc.d ssh defaults

- Sshd not to start at boot time in Debian flavours
# update-rc.d ssh remove

- Where to configure sshd?
# gedit (or vi) (or pico) /etc/ssh/sshd_config

- And there, some configuration settings are

X11Forwarding yes
Port xxxx
PermitRootLogin no
LogLevel VERBOSE

- How to start the sshd service
# service ssh start (or the old way /etc/init.d/ssh start)

- How to stop the ssh service
# service ssh stop (or the old way /etc/init.d/ssh stop)

- Networking to start at boot time in Debian flavours
# update-rc.d networking defaults

- Networking not to start at boot time in Debian flavours
# update-rc.d networking remove

- How to tunnel via ssh
$ ssh -p xxxx -L aaaa:localhost:bbbb username@ipaddressorname
bbbb is the local port
aaaa is the remote port

- How to disable the firestarter firewall at startup time
mv /init.d/firestarter /init.d/firestarter.old (to change the name)

- How to recover gnome GUI in the latest Ubuntu versions
# apt-get install gnome-session-fallback

- How to copy from a hard disk to an external memory storage
dd if=/dev/sda2 of=/media/externalstoragename/backupfilename.dd bs=64k conv=notrunc,noerror

- How to delete a USB memory storage
sudo dd if=/dev/zero of=/dev/sdb bs=64k

- How to install grub
# grub-install devicename

- In case there is a need to open a firewall in win7
netsh firewall set portopening protocol=TCP port=xxx name=ruleportxxx mode=ENABLE profile=All

- How to copy a file via ssh
$scp -P xxxx /source/file user@remotehost:/destination/file

- Copying files over ssh using dd (directories need to exist)
$ dd if=./yourlocalfiletocopy | ssh -p xxxx username@fqdn dd of=/path/filename



- Copying files over ssh using dd (directories need to exist) -alternative way
$ dd if=./filetotransfer | ssh username@fqdn dd "of=/destinationpath/filename"

- Copying files from the ssh server to local using dd via ssh (directories need to exist)
$ ssh -p xxxx username@fqdn 'dd if=/pathtofileinsshserver/filename' | dd of=./pathtolocaldestination/filename

- How to install 7z crypto compressing solution
# apt-get install p7zip

- How to compress a file or directory
$ 7z a destinationfile.7z ./folderorfiletocompress

- How to decompress (no full path)
$ 7z e compressedfile.7z

- How to decompress (full path)
$ 7z x compressedfile.7z

- How to compress a file or directory using a password and in volumes
$ 7z a -p -v1g destinationfile.7z ./folderorfiletocompress

- How to stop a machine via ssh (if you are using lightdm, shutdown will not power the machine off)
# poweroff --verbose

- How to reboot a machine via ssh
# reboot --verbose

- ssh login without a password
Good summary here

- How to see real time the iptables logs in linux
# /sbin/iptables -L

- How to see whether the firestarter FW is running
# /etc/init.d/firestarter status

- How to see whether iptables is running
$ lsmod | grep iptable

- How to lock the Ubuntu box using the keyboard
CTRL + Alt + L

- Where are authentication related logs in linux?
$ less (or pico) /var/log/auth.log

- If there is a need to check previous zipped logs
# gzip -d syslog.2.gz

- Executing a terminal server that is not linked to a user in Ubuntu
# x11vnc  -safer -localhost -nopw -once -auth /var/run/lightdm/root/:0 -noxrecord -bg -rfbport xxxx

- Executing a terminal server that is not linked to a user in Ubuntu (a more verbose one)
# /usr/bin/x11vnc -safer-auth /var/run/lightdm/root/:0 -noxrecord -noxfixes -noxdamage -forever (or once) -bg -rfbport xxxx -o /tmp/x11vnc.log

- Executing a terminal server that is linked to a user session
$ x11vnc -safer -localhost -nopw -once -display :0

- Typical rc.local file for paranoid ones
ifconfig eth0 192.168.xxx.xxx netmask 255.255.255.0
route add default gw 192.168.y.y eth0
arp -s 192.168.y.y 00:router:mac:address
/etc/init.d/ddclient start
rfkill block bluetooth
rfkill block wifi
rfkill block wwan

- If you are encrypting the home drive and using keys in ssh to log in...
place the .authorised_keys file outside the crypto zone as you can read here
... in addition to that, add these 2 lines to the .profile file to speed up decryption at log-in time:
ecryptfs-mount-private
cd /home/username

- Who is in the system
$ who

- Who logged in last
$ last -a

Security site to bookmark: datalossdb.org

datalossdb.org is an open Internet project by the Open Security Foundation with the aim to collect and publish security incidents related to loss and compromise of personal data. It dates back to 2008, when they agreed to maintain the database that the popular site attrition.org started. Open Security Foundation is also known for its popular vulnerability database (http://osvdb.org).

It is an easy to follow web site: it consists of two horizontal menu bars, a top text-based bar with links to 11 sections, and below this, a graph bar with a timelime. Its front page is broken down into two columns. We need to register to use all the services they offer. Registration requires only an email address and a username. The relevant sections of this site are:

- First, they introduce the site: Who they are and how they work. They seek and receive news about security incidents with compromised personal information. They add those pieces of news to their public database. They also announce it on their twitter "datalossdb" account and send them via a distribution list.

- Second, they offer the ability to search for incidents in their database according to different search criteria such as type, size or source. Although most available data come from the USA, this site is nevertheless valuable to justify security measures with actual data on real incidents.

- Third, they provide a form for the visitor to report incidents. It is not necessary to be registered to report an incident.

- Fourth, they provide access to collections of incidents from 16 primary information sources. These sources are authorities linked to personal data protection in different U.S. States (such as "Consumer Protection Boards" or the "Attorney General"). Companies and institutions that suffer data loss must reported it to these institutions. The New York, Maryland and Massachusetts bodies are worth mentioning given the high number of cases that they spublish.

- Fifth, they list the personal data protection laws in each of the States. 12 of them have to keep track of  related incidents, 35 require notification to those affected but do not have a centralized register and 4 States have no such legislation.

- Sixth, they show statistics and incidents analysis including the types of lost data, the sector concerned and their figures for different time windows. So far, the largest incident contained in this site occurred in March 2012 and affected 150 million customers.

- Seventh, you can subscribe to three mailing lists, the first is the most relevant one, the second is to discuss incidents and the third is a weekly summary of activity.

The last three sections present:

- Those incidents that do not have the minimum information to be entered into the database in the form a newspaper called "the blotter"
- A section with strange incidents or small entity ones that have a limited number of affected users or do not refer to elements of identity such as social security numbers, credit cards, bank accounts, medical or financial records.
- A final section with the names that keep this site, its contact details and sponsors.

In short, the site datalossdb.org is a valuable database of real personal data incidents. A useful tool to demonstrate that personal data are really threatened. I miss a similar database with incidents happening in Europe. The final question would be: does privacy still exist in our society?

A version in Spanish of this post will be located here in this publication. Stay tuned!

Happy browsing!

http://datalossdb.org/

Human intuition: What if we apply it to improve security?

Within the @Google Presents talk series, the Nobel Price and psychologist Daniel Kahneman gave a lecture on intuition that I summarise in this post, always looking at it through the information security lens to distill innovate knowledge.

He started with an enticing question:

Intuition, why do we magically know things without knowing we know?

Different authors have studied human intuition. Gary Klein in his book on "Sources of Power: How People Make Decisions" think that judgement biases are not so negative. Malcolm Gladwell, in his book "Blink: The Power of Thinking Without Thinking" has also dealt with the power of intuition.

Mr. Kahneman is sceptict about expert human intuition. For example, in fields like Medicine, when can you trust intuition? He identifies two modes of thinking that lead to the creation of judgements:

- Mode A, as something that happens to us, e.g. when we perceive through our senses, have impressions and intuitive thinking. This is the intuitive and automatic one.
- Mode B, as something that requires effort. This is the deliberate and 'effortful' one.

He shares some scientific results that can have an impact in social engineering: self control related to mode B is impaired if we are doing another activity at the same time. This means that it takes some effort to control our impulses. For example, we would pick chocolate more easily if we keep at the same time a 7 digit number in our head (minute 12 of the talk).

Would that mean that if we ask someone for their password while they are doing an 'effortful' activity we could be more successful than if we ask them when they are idle? Probably.

However, if we focus at mode B, for example, driving is a skill. In a mode A skill things begin to happen automatically: we can drive and talk, we would brake in a completely automatic manner. The same cannot be said, for example, if we drive on skids. This is a completely non-intuitive skill.

But then, when can you trust intuition? Mr Kahneman states that, if there are clear rules in the environment, especially if those rules can give us immediate feedback, we will acquire those rules and let mode A run. This is the reason why we are very good at immediate reinforced practice. This is what he calls intuitive expertise: the reason why, in Medicine, anesthesiologists, thanks to the quick and good feedback they receive from their actions, develop intuitive expertise and the reason why radiologists get the opposite case: they receive slow and not so good feedback from their actions so they have a difficult time to develop intuitive expertise.

Let's have this point in mind when we approach a user community to improve their security practices.

This expertise is not possible in chaotic scenarios. This is why the world is not predictable. For those cases when predictability is poor, it is better to follow pre-made scripts.

This thought is valuable when designing incident response actions. Build your formula and don't let intuition be the main driver. 


Peculiarities of our mind

Mr Kahneman mentioned that human memory is superb at remembering routes through space but rather poor at remembering a list. An practical example of this can be found in the book "Moonwalking with Einstein" by Joshua Foer.

So what about if we associate places in our work facilities with secure behaviours?

Our mind likes to think about agents that have traits and behaviours. We are not good at remembering sentences with abstract subjects. Our behaviour is influenced by the signs and posters that we see around us. Especially by those that relate to something concrete. For example, when people are exposed to a threatening word, they move back. Symbolic threats have a real effect.

And what about if we place a poster with a pair of eyes watching us close to an Internet kiosk in a public place in a firm? Would users behave more securely?

Our mood is also influenced by our actions. If we make a smiling face, we are more likely to think that things are funny. If we place a pencil in our mouth, we will think that the cartoons we watch are funnier.

By partially activating ideas through these mechanisms e.g. by whispering words, then the threshold to feel emotions related to those ideas is lower and all this happen without us knowing it consciously.

This has a lot of potential at the time of designing a cultural change related to information security at workplaces.

Our associative memory is a repository of knowledge. We take very little time to create norms in our minds. Our reasoning flows along causal lines, this happens intuitively. The coherence that we experience can be turned into a judgement of probability. This is the reason why Mr Kahneman is not really a fan of human intuition: People have confidence in intuitions that are not essentially true.

This point is key for those applying risk management methodologies to their information security practice.

He mentions that, so far, all intelligence tests we have are for mode of thinking B. However, we are all influenced by our intuition. It's hard work for mode B to overturn what mode A tells us.

I finalise this summary with the 'security related' morale of the talk. When can we trust our intuition? Only when the environment is predictable and we have had the opportunity to learn its regularities.

Happy intuitive reading!

Were these the posters in the Middle Ages?

Surviving success in entrepreneurship and... in IT security?

Stanford University shares with everyone on the Internet a series of podcasts and videos related to entrepreneurship through their Entrepreneurship Corner. These pills of knowledge are not intentionally related to information security. However, I find that the learning points mentioned there are worth at least some reflection time by itsecuriteers. For instance, Mark Forchette presented his talk on how to survive success. I drew some lessons from his talk:

lesson 1 - know what you want, set your objectives, promise you will achieve it

lesson 2 - you must have passion

lesson 3 - no matter what you do, you must know how to sell, everybody sells

(proposal of a book to read : how to master the art of selling)

lesson 4 - there is no failure that you can't recover from (so enjoy failures)

lesson 5 - strategy and tactical implementation = success (if you cannot execute the plan, it's not worth the paper it is written in)

lesson 6 - the most dangerous thing in the world is a past success you are still in love with  - surviving success is one of the most difficult things - the best day has to be ahead of you

lesson 7 - do things other than just for money

lesson 8 - people do business with people they like - business is a contact sport - be likeable

lesson 9 - prepare, prepare, prepare

lesson 10 - make sure the right people are on the right seat

Look at these 10 lessons from the IT security practitioner viewpoint. They can provide you with value.

Happy entrepreneurial reading!

Learning to fly

WPA password strength (or the role of special characters in WPA passphrases)

It is a good security practice to use a long passphrase in WPA Personal protected wifi networks. WPA Personal is also known as WPA-PSK (pre-shared key). The strength offered by WPA-PSK is related to the strength of the passphrase, so that it cannot be easily guessed, either because it is a very short one or because it is a very predictible one. This is the reason why many of us opted to use up to 63 random printable ASCII characters, recurring to sites providing that such as www.grc.com.

Life was fun when we had one, maybe two, wireless computers at home. We inserted the damned long passphrase (certainly after several attempts!) and off we go.

Soon our homes started to have new wireless-enabled inhabitants (smartphones, tablets, e-book readers and and and). In most of these new devices, it is not so straight forward to insert a 63 character long random printable ASCII chain. In some cases, some of those special ASCII characters are not even present in the suite of keyboards (via a physical board or displayed on screen) that these wireless devices offer.

Should we then decrease the complexity of our WPA passphrase or not? This is obviously a possible strategy, however sometimes you need to go and change your WPA settings manually in many devices. This takes time. Another alternative is to get the "strange character" via copy and paste or a similar short cut.

A third possible way is the following: If you are lucky, some of those new devices that do not allow typing "strange ASCII characters" on them allow the insertion of the 64-digit hexadecimal key that corresponds to your passphrase and your SSID. This is the case for Amazon kindle devices. You can code yourself the algorithm to obtain the 64 digit long hexadecimal key or you can use this site, or even only the Javascript code that it contains, by a software developer from the Netherlands.

Reaching this point of this post, you would wonder, and what has happened to the strength and complexity of my 63 character long random printable ASCII chain if it can be replaced by a 64 digit long hexadecimal key? it turns out that the WPA-PSK passphrase strength resides only on the entropy it displays. That's about it!

Keep randomness in your life ;-)!