Hardening a wireless DSL router

Avoid that someone else uses your wireless DSL router

Most homes in developed countries use a home wireless DSL router to connect to the Internet. Remember that, in an increasing number of countries, the owner of the router is legally responsible for the data coming in and out of that home network to the Internet. Avoid being in an unwanted legal case by preventing that your DSL router (and your Internet connection) is used by an intruder to commit any illegal action. Make your DSL router relatively secure with the following preventive (and a final one, detective) security measures:

- Change the private IP address that the router has by default. How many routers come with 192.168.1.1 or with 10.0.0.1? Please, let your router be other than 192.168.1.1.

- Change the default IP addressing schema of your home LAN (cable or wireless). There is no obligation to always use 192.168.1.x or 10.0.0.x. As long as it is a private IP address (see RFC 1918), dare trying with e.g. 172.16.x.x.

- Limit the mac addresses that can connect to your router. Find out the mac addresses of all the gadgets that connect to your wireless LAN and input them into your router's mac ACL.

- Use WPA2 with a long password, you can get it for example here.

- Make the admin interface only available to your internal LAN (avoid making it available through the Internet). Easy way to check this: Find out your public IP address (e.g. using myipaddress), try to reach that public IP address and the admin web page.

- Are you a hardliner? Then disable the DHCP server in your router. Add the IP addresses. routing gateway (your router) and DNS servers in each of your wireless clients manually. Use different DNS servers on each of the gadgets (so that no unique DNS server gets a complete idea of your browsing behaviour).

These measures follow a defense-in-depth approach. None of them constitute the silver bullet, but the entire set of measures is a valid starting point.

If you would like to check your router's threat exposure to the Internet:

- Find your public IP address here.

- Install nmap in your box and launch the following two lines:

$ sudo nmap -sT -n -v -T4 -O -p- --reason yourpublicaddress

$ sudo nmap -sV -n -v -T4 -O -open ports coming out from first command yourpublicaddress


The nmap command line usage help can be found here.
- Limit the services you offer to the Internet.

Nmap should produce an output similar to this one:

All 65535 scanned ports on are filtered because of 65350 no-responses and 185 host-unreaches. Too many fingerprints match this host to give specific OS details.

If the result shows some open ports, identified by the -sV option as UPnP, review the expert view of the admin interface in your router, it is probable that you allow some firmware update, or push service provision coming from your ISP or a specific server app. Just check that it corresponds to your needs (e.g. a VPN server, a file server... or maybe, nothing is published to the Internet).

Finally, a detective measure: Check your router's logs frequently. Most routers can send their logs regularly to an email address. Use this feature. It is priceless to identify abnormal uses.

Happy scanning and happy secure home DSL router!

p.s. The "--reason" is a suggestion coming from a network jedi ;-)

Avoid misuses of your DSL router while you are on the beach

Additional measure (inspired by a comment left by an anonymous reader left)

Broadcast (but as little as you need ;-)

Scan the wireless networks that surround your place, choose a wireless channel that is not used, or at least very little used. This will enable you to decrease the level of energy used by your wireless router when broadcasting its signal. 

Fine tune the energy level so that the wireless signal is almost constrained to your place. This will definitely make a wireless attack to your network a little bit more "physically challenging". Here you are some command line tips to scan the wireless spectrum using aircrack-ng from a Linux box.

$ sudo apt-get install aircrack-ng
Information on aircrack-ng installation can be found here

Disconnect from your wireless network (keep the wireless driver working though)

$ sudo airmon-ng start wlan0

airmon will tell you the name of a wireless interface that can be used to scan (it will normally be mon0)

$ sudo airmon-ng start mon0

$ sudo airodump-ng mon0

and you will get a real-time list of active wireless networks (incluing channel numbers)

Thanks to the anonymous reader!

Hacking: The next generation by Dhanjani, Rios and Hardin - Book review

The following is a brief [and biased] review of the pages of Hacking: The Next Generation. In one sentence, I would recommend it to an IT student thinking of getting closer to security as a first-time security flavour.  

Disclaimer: These lines do not substitute the reading of the book. They are meant to provide a global overview of what the reader can find in the book. My kudos to the authors, writing a book is always a big effort. And even a greater effort if the books talks about a changing target as IT security. 

The book: Hacking: The Next Generation.

The authors: Nitesh Dhanjani, Billy Rios, Brett Hardin. 

Publication year:  August 2009.

Publisher: O'Reilly Media.

Chapter 1 Intelligence gathering: peering through the windows to your organization

The first chapter gives some actual tips on social engineering and intelligence gathering. They mention the Google Hacking Database and the Search Engine Assessment Tool and the usefulness of metadata and social networks to collect information that for a future attack. Tools like theHarverster.py and metagoofil.py are also mentioned. Syntax in google such as resume filetype:doc "current projects" and even the simple use of public google calendars can also render nice results.

Chapter 2 inside-out attacks: the attacker is the insider

This chapter proposes an easy path to understand how currently an external threat becomes an internal one thanks to threat vectors such as xss and xsrf. After reading this chapter, you will not use the remember password functionality in a browser.

Flash and Java are also mentioned. Another learning point in this chapter is that we should only share documents we trust with people we trust. Difficult task!

Chapter 3 The way it works: There is no patch

A varied chapter. It starts with the traditional description of the insecurities of telnet and ftp, both clear-text protocols. They also mention tools such as wireshark and a little python script named goog-mail.py to carve out email addresses. The authors also suggest the use of a password brute-force attacker tool such as hydra and John the ripper. 

This chapter also deals with session hijacking using tools such as hunt (to hijack clear-text TCP-based sessions). The fact that they are using private IP addresses makes sometimes some examples a little less realistic. On this topic, I miss a reference to the need to have a network card in promiscuous mode, also when we are trying to hijack session in a wireless network.

A basic description of SMTP snooping (with mail snarf) and spoofing is also part of this chapter. They finalise the chapter describing ARP poisoning with tools such as Cain&Abel and DNS Cache snooping with cache_snoop.pl.

Chapter 4 Blended threats: When applications exploit each other

The helicopter-view summary of this chapter is brief. Exploits currently constitute what authors name blended threats i.e. creating a big threat vector out of the combination, or beter said, chaining, of several harmless-looking vulnerabilities. 

The key concept to understand is the application protocol handler: a way for two applications to interact using the operating system. They provide examples both in Windows and Mac OS. 

Finally, the most flashy example of blended threats, conficker, with 9 million infected machines as of January 2009.

Chapter 5 Cloud insecurity: sharing the cloud with your enemy

This chapter presents the differences between cloud services offered by Amazon (based on what they call AMI - Amazon Machine Images) and Google (based on the Google App Engine). It is an eye-opener in the sense that insecurity now has a new meaning if we think of cloud services.

The apply common sense and present the two most visible vulnerability vectors i.e. misconfigured virtual machines and insecure management consoles.

Finally, they also present real vulnerabilities, already solved, (based on CSRF) that the authors discovered in Amazon Web Services.

Chapter 6 Abusing mobile devices: targeting our mobile workforce

These pages deal with ways to compromise corporate networks and information without even connecting ever to the corporate network. The rey resides in the threats targeted at mobile workforces.

First basic step to attack a corporate mobile force, spoof the MAC address of the attacking laptop. Second step, use a mix of common sense and social engineering. Certainly, also useful tools such as Burp Intruder and Cain & Abel. The first one useful to defeat easy entry portals and the second one excellent to get credentials used in services that do not use SSL permanently.

The authors also present man-in-the-middle attacks (e.g. although they don't mention it, they refer to a la ettercap-style attacks) and how easily users double click on any certificate warning appearing in their browsers.

The chapter ends with some words on metasploit, voicemail tapping and exploiting physical access to mobile devices.

Chapter 7 Infiltrating the phishing underground: learning from online criminals?

These pages deal with a real threat to our society and economy i.e. cybercrime and, more specifically, phishing (on page 177 I think there is a typo, when they refer to foreign companies, they really mean foreign countries. Some interesting facts they mention:

- phishing sites have a time to tlive (TTL) of just a few hours.

- www.phishtankcom publishes the URLs of phishing sites that are online. Very interesting for demo purposes!

- often an insecurely configured server becomes a phishing site for different phishers.

- all this points show the importance to securely configure any web server running on the Internet

The authors also mention a very useful tool for web testing, burp proxy and a skill that good phishers have: they know how to use different elements present on the Internet for their evil purposes (and they try to phish other phishers by inserting backdoors!).

They also talk about a phishing toolkit called the loot, offering phishing kits for many institutions, and about some phishing lingo such as "ReZultT" and "fullz" (all information required to steal someone's identity).

Chapter 8 Influencing your victims: do what we tell you, please

This chapter refers to human hacking. Rather than targeting a web application, sometimes accessing someone's calendar or eavesdropping a conference call (by knowing the conference ID) provide juicy information more easily.

The authors also mention the importance of social network in current hacking trends. For example, they created a fake identity in linkedin, or rather, they stole someone's identity and in several minutes this identity had received 82 incoming requests to be part of their network.

They also mention the evilness of the "forgot your password?" questions that some sites use to authenticate users, especially when complemented by facebook or linkedin information.

They complete this chapter with sentiment analysis based on tools such as Yahoo!Pipes,  sites like wefeelfine.org and concepts such a a word cloud.

Chapter 9: Hacking executives: can your CEO spot a targeted attack?

This is the flashiest chapter. Easy to read and really implementable. The authors talk about how to construct personalised attacks, with little effort, against executives based on network analysis (note that network here is a set of acquaintances and not cables and switches). Why attacking executives? They are normally the most informed members of the organisation.

They mention two main motives: financial gains and vengeance. Regarding how to monetise an attack, the authors mention that it is more profitable to try to sell the information to the company that actually owned it rather than trying to go to the competitor.

Information gathering using public sites and social networks is the first step in the attack. The input gathered helps identifying the executive's trusted circle and, specially, those with the most influence over the executive. A little but interesting detail, probably family members will not be in that trusted circle. Another one, sending the attack to the executive's assistant provide promising results given the trust existing between both players.

The authors also mention useful sites such as www.tweetstats.com, namechk.com, the phyton script titled theharvester and the enticing USB data stealer named USB switchblade.

Chapter 10 Case studies: different perspectives

In this last chapter they present two case studies. The first one clearly shows the need to disable old accounts and to control who joins a teleconference.The second one claims the importance of hardening ssh servers, the need not to publish IT information related to a company in Internet and the beauty of XSS based exploits.

Happy next generation hacking reading!

Guest post: 7 Reasons to Monitor Internet Usage

7 Reasons to Monitor Internet Usage

Monitoring internet usage is a popular issue for companies that use the internet irrespective of their size. There are various and valid reasons why a business should monitor internet usage. In this article we’ll discuss some of them and the benefits of doing so:

1. Security – Perhaps the most important reason for internet usage monitoring is to ensure data transferred to and from the internet does not contain malicious code or malware. This type of monitoring can protect your organization from potentially destructive malware infections and Trojan infections that could compromise the company’s intellectual property.

2. Productivity – While there are advantages in allowing people access to the internet, even if this means occasional periods of browsing for personal reasons, monitoring is essential to prevent excessive use by employees. Proper internet usage monitoring and control can work in an organization’s favor if usage is maintained at a level that promotes productivity, rather than a situation that results in multiple incidents of cyberslacking and unacceptable levels of internet usage.

3. Costs – Internet connectivity is not free; bandwidth costs money and there are additional costs if something goes wrong. If an organization monitors Internet usage these costs can be mitigated; proactively reducing unnecessary bandwidth usage and improve the security of internal networks.

4. Confidentiality – Giving employees access to use the internet also opens a door through which confidential information can be leaked, lost or stolen. Adequate monitoring of internet usage can prevent information theft – both intentional and accidental.

5. Legal Liability – There are many ways how an individual can use the internet to commit crime – from infringing on someone else’s intellectual property to actual hacking attempts. Monitor internet usage to prevent and identify such events as they occur and you’ll be able to stop them before they trigger a legal response.

6. Forensics – Monitoring also allows an organization to effectively investigate incidents. If an employee breaches company policy by engaging in prohibited internet activities, you will need the evidence to back up your position. If a workstation is compromised due to inappropriate internet usage, you will want to know what websites were accessed and led to that workstation being compromised. This information can be used to identify areas that needed increased security measures.

7. Reputation – Proper internet monitoring will help an organization to keep its reputation intact and prevent an employee’s actions from causing harm to the company through malware infections or illegal activity.

Each of the above points are strongly interlinked and together provide a robust and valid argument in favor of monitoring internet usage – each point merits equal attention and consideration. Monitor internet usage properly and efficiently to ensure your organization never suffers a fallout due to web threats. Prevention is always better then the cure.

This guest post was provided by Emmanuel Carabott on behalf of GFI Software Ltd. GFI is a leading software developer that provides a single source for network administrators to address their network security, content security and messaging needs. Read more on how to monitor internet usage.

All product and company names herein may be trademarks of their respective owners.

Monitoring filters complexity

Avoid arp poisoning in your LAN

In Linux, rudimentary but effective:

Here you are some quick measures to make arp spoofing in a shared LAN a little bit more difficult. Note, however, that these measures will not protect you from firesheep (cookie-based mechanism to steal non-https sites' credentials).

1. Avoid that the arp protocol constantly asks for the mac address of your router. Add the following line to the /etc/rc.local file:
# arp -s ipaddressofyourrouter  macaddressofyourrouter
This way, this entry will be permanently stored into the ARP cache.

2. Create an alert with arpwatch using e.g. the following line:
# arpwatch -d -i yourinterface
The arp database will reside in /var/lib/arpwatch/arp/dat

3. A way to check that there are less arp probes in the net then will be
# tcpdump -i yourinterface -n -v arp

If you change your router, remember to change your rc.local file accordingly.

In Windows, a nice tool is the one from irongeek called decaffeinatid.

This is not bulletproof but it saves you from the typical arp poisoning attack. If any reader would like to add any additional idea to this topic, please comment.

Happy browsing in a shared network ;-)!

Avoid ARP poisoning

Note to a comment: Arpon is a useful tool for this purpose. Besides, Arpon 2.7 was just release last July. Be aware that, according to Arpon site "it requires a deamon in every host of the connection".

The Value of Vulnerability Assessments

With this out of sequence post we start a series of guest contributions. In these days of complexity in our everybay business of IT security, it is advisable to remember the foundations to protect your boxes from known threats. Here you are 7 down-to-Earth tips to secure your servers:

Do you know how your server measures up to potential threats? If you haven't performed a vulnerability
assessment on your servers yet, you may not be aware of issues that may leave you exposed to hackers and web-based attacks. A vulnerability assessment is the process of inventorying systems to check for possible security problems, and is an important part of system management and administration.

Vulnerabilities are weaknesses within a server or network that can be exploited in order to gain unauthorized access to a system, usually with the intention of performing malicious activities. The most common way to address many software-related vulnerabilities is through patches, which will usually be provided by the software manufacturer to correct security weaknesses or other bugs within a program.

However, there may be times when a patch is not available to address a possible security hole, and not all vulnerabilities are software-related to where a patch would be offered. This is where the concept of vulnerability assessments comes into play. Minimizing the attack surface and the effect that a potential hacking attempt could have on your system is a proactive way of effectively managing a server network.

Protecting your data vault

While there is no 100% way to protect your servers against vulnerabilities, in performing a vulnerability
assessment there are some steps you can take to minimize your risk:

Close unused ports
Ideally, your server network setup should include at least a network firewall and a server-level firewall to block undesired traffic. Undesired traffic would include traffic to ports that are unused or that correspond with services that shouldn't be publicly-available. These ports should be blocked in your firewall(s).

Don't over-share
If servers on your network are set up to share files with others, or to access network shares (such as file servers and other resources), make sure that those shares are configured to only allow access as appropriate. Hosts that don't participate in sharing resources should have that capability turned off completely.

Stop unnecessary services
The more services you have on your server, especially those that listen on network ports, the more avenues a hacker has to get into your system. This is especially true if you have services running that aren't being monitored or used, and therefore are unmaintained. Stop services that are not in use or necessary, and restrict access to others that are not intended for public access.

Remove unnecessary applications
Many operating systems come with a wide set of programs that may not be necessary for normal server
operations. Find out what software is installed on your system, and then determine which of those
applications are not necessary and remove them.

Change your passwords
Using default vendor passwords is more common than you may think – but since those passwords are usually publicly-known, they are often the first ones used during hacking attempts. Secure passwords should always be used in favor of the vendor defaults, and industry experts recommend changing them every 30-60 days.

Do some research
When software or new applications are installed, users often neglect the time needed to review their settings to ensure that everything is up to par with modern security standards. Take some time to research what you are installing and any security implications that it may have, including what features may be enabled that could introduce security problems, and what settings need to be adjusted.

Encrypt when possible
Many services and network hardware have the capability of encrypting traffic, which decreases the likelihood of information being “sniffed” out of your network. When transmitting sensitive data, such as passwords, always use an encrypted connection.

Regular vulnerability assessment is a vital part of maintaining system security. Not only will it help diminish the success or possible effects of malicious activity against your servers, but it's also a requirement for many modern compliance standards such as PCI DSS, HIPAA, SOX, GLB/GLBA, and other regulatory standards.

This guest post was provided by Vanessa Vasile on behalf of GFI Software Ltd. GFI is a leading software developer that provides a single source for network administrators to address their network security, content security and messaging needs. More information: GFI vulnerability assessment.


All product and company names herein may be trademarks of their respective owners.