Security site to bookmark: www.wtfuzz.com

The information security practitioners community in emerging countries is worth mentioning. The author of the blog that I recommend on this occasion, wtfuzz.com, is from India. His name is Rishi Narang. On twitter he defines himself as a consultant, author and researcher in cyber psychology and threat intelligence.

The first posts date from 2010. As of 2011, Rishi Narang writes about security at least six times a year. This no-frills blog is an example of the value of Internet as a marketing and personal branding vehicle. He published in 2013 two articles with detailed and useful hands-on content about the (in)security of session "cookies"  in renowned places like Outlook, Google, Twitter, Linkedin, Facebook and Yahoo. Both articles were accompanied by a video, a proof of concept "script" to "guess" those "cookies" and a summarizing table of the analyzed "cookies".

The three conclusions drawn from these two articles on "cookie-based" session maintenance are:

- "Cookies" need to expire on the server that sends them, at least when the session expires and, preferably, periodically.

- The preference of using HTTPS and HTTP as transport protocol.

- These session "cookies" need to be created in a truly random manner.

The popular security publication SC magazine reported the vulnerabilities that Rishi Narang found in those big Internet names and published a link to his blog. Surely he has received an invitation to share his analysis and contribute to improving the security of some of these companies' cookies or the proposal to join a web development security provider.

In short, wtfuzz.com card is an excellent presentation of an inquisitive security professional.

Outside the typical IT security, in this blog you can find a non-technical article titled "It's you and me". It was published in October 2012. It talks about human emotions and differences between women and men. Perhaps this is why Rishi defines himself as a cyber psychology researcher?

Vulnerable tower... and cookies?
 

Happy cooking!

You can also read this entry in Spanish.

Linux commands hodgepodge (II)

Again this post is an unusual one. The second unusual one after the first one on linux command lines. The reader will not find a series of paragraphs with a ine of thought in it but rather a collection of command lines and related telegraphic recommendations for some aspects of the Linux Universe (e.g. Ubuntu).

Happy command line experience!

- To install a debian package via command line
# dpkg -i deb package

- To list the packages we have installed
dpkg -l

- To indetify whether a package name is installed
dpkg -l | grep package name

- To get rid of configuration files from packages that are not installed anymore
dpkg --list |grep "^rc" | cut -d " " -f 3 | xargs sudo dpkg --purge

The legend of the dpkg --list output can be found here.

- To know which Ubuntu is installed
lsb_release -a

- To know which linux kernel is installed
uname -a


- To remove a debian package (leaving the configuration files)
#apt-get remove packagename

- To remove a debian package and the related configuration files
#apt-get purge packagename

- To find which files have being created in the last 24 hours
find -mtime 0


- To download a blogspot blog
wget -m http://securityandrisk.blogspot.fr

(you can also try with http://securityandrisk.blogspot.de/search?max-results=2000)

- To know the status of networking interfaces
#rfkill list

- To unlock one of them
#rfkill unblock number

- To start the firestarter firewall
#/etc/init.d/firestarter start

- To dump all traffic seen by the network interface not sent to or by your box and not part of multicast or broadcast
#tcpdump -i eth0 net 192.168.x.0/24 and not host 192.168.x.a and not multicast and not broadcast

- To identify active Internet connections (only servers)
#netstat -tulpn

- Nice and easy way to identify the networks this box has been
#grep -i NetworkManager /var/log/syslog

- To edit the scheduler in linux
crontab -e

- The basic way to use vi or vim:

To move into the text: h l j k
To replace a character under cursor with c rc
To insert before or after the cursor i a
To open a new line below or above the current line o O
To delete a character x
To undo the last command u
To select a line yy
To paste a line p P
To write and exit :wq
To toggle edit/meta mode ESC

When installing packages, you will find the config files in /etc/apt/apt/conf and the binary files in /usr/bin

- You need to define a network interface in Linux via a config file and not via NetworkManager? Then this is the location and syntax
edit /etc/network/interfaces
in the file
iface eth0 inet static
address 192.168.1.2
netmask 255.255.255.0
gateway 192.168.1.1

- You need to define a DNS servers in Linux via a config file and not via NetworkManager? Then this is the location and syntax
/etc/resolv.conf
nameserver 8.8.8.8

- You need to declare the name of your host via a config file? Then this is the location and syntax
/etc/hosts
127.0.0.1 localhost

- You need to swith on/off a network interface in Linux via the command line and not via NetworkManager?
Then you can use ifup/ifdown or
sudo ifconfig down
sudo ifconfig up

- A quick way to become root?
sudo su -

- Need to get processes associated with a name
ps aux | grep name

- A non-elegant way to kill a process?
killall processname

- You need to get rid of the disturbing sound with typing
sudo modprobe –r pcspkr

Command lines enlighten us

Security site to bookmark: www.rationalsurvivability.com

Rationalsurvivability is Chris Hoff's personal blog. Chris is a renowned IT security architect, currently working for Juniper. Browsing his Linkedin presence, you read about the technical security and network management positions he has held in companies like Cisco, Unisys or Qualys. His career confirms the value of the suggestions he writes in rationalsurvivability.

Just the name of the blog, rationalsurvivability, hints the strategic change in information security that the author suggests. In security, rather than trying to get close to the illusion of total, or "almost total" security, the survival of our organizations should be our mission. Innovate to survive. Using a term coined in psychology, the aim should be to improve the "resilience" of the business and therefore, of their processes.

Chris's articles are not for beginners. Technology lovers who are passionate about security and are willing to challenge their views with alternative or controversial content will enjoy rationalsurvivability: An invitation to enhance the role of information security and its practitioners in organisations.

Since 2006, at least once a month, using a typical template Wordpress, Chris publishes ideas on strategic issues such as the lack of real innovation in current security solutions, creating added value through software security as a service , virtualization and complex network management software or the opportunity to improve security in organizations using cloud services.

An attractive point of his site is the variety of topics covered and the frequent link to his conversations on twitter: from a text about the differences between real and virtual firewall to a futuristic proposal on the use of social networks to interact with machines.

In an example of controversial article, Chris reiterates the intrinsic value of the security professionals community comparing security integrators with the service industry for pets: both devote too much energy to criticize, and not constructively, the industry that supports them.

Further evidence of the interest in this blog and the value of the ideas proposed are the comments left by names like Dan Kaminski, Matt Joyce or Preston Wood.

Happy survival!

Let's help business to survive

You can also read this entry in Spanish.

Whatsapp via python. Open security questions

Whatsapp is an instant messaging application for smartphones. Its popularity increases daily. From the security viewpoint, a simple piece of advice would be to use it only to communicate content you would not mind to be known by anyone else. Details about some of the security concerns can be read in the .org version of wikipedia.

I focus on this app not to pick on the lack of security (mainly integrity and confidentiality) but rather to show the instrumental role that reverse engineering and black box testing plays in assessing the security of web-based and now smartphone-based applications such as Whatsapp.

Reverse engineering the Whatsapp app and studying the packets that the app exchanges with the server (black box testing) are two ways to be able to understand how the app works and its security features.

In a python-enabled Ubuntu box, we download the Yowsup library including the command line interface named Yowsup-cli. As mentioned in reference [1], you need to construct a configuration file preferably with phone number and an IMEI code belonging to a mobile phone that, first, you own, and, second, that you didn't use before for Whatsapp.

The command lines that reference [1] proposes are:
- Requesting a code
    ./yowsup-cli -c [yourconfigfile] --requestcode sms

- Registering with the received code

    ./yowsup-cli -c [yourconfigfile] --register thecodeyourreceivedinyourphone

- Modifying the config file with the received password as shown in
reference [1]

- And you are ready to send Whatsapp messages
    ./yowsup-cli -c [yourconfigfile] -s [destination phone number] “message”

Now some security related questions:

- The config file uses an IMEI code and a phone number. As long as someone has access to those two pieces of information, what prevents them from following these steps and sending messages?

- Why instant messaging attract a myriad of users and secured or hardened systems are not so attractive?

- Would it be worthy to research the crossroad between user friendliness and information security? Certainly!
 
The sites I used as reference to build this post are:
[1]- Whatsapp in Linux with Python by Alejandro Pernin.
[2]- The python code by Tarek Galal hosted in github.
[3]- The command line interface page by Tarek Galal hosted in github.

Happy (in)secure messaging!

Photos also communicate

Book review: The Phoenix Project by Gene Kim, Kevin Behr and George Spafford

Every now and then I share with the readers my views on a specific IT or IT security related book. This time I start with a final statement: This is a must-read novel. Every IT and IT security professional will sleep much better after the reading of this The Phoenix Project. Why? Here you are some telegraphic arguments or tips extracted from its pages:

- Consider IT development and IT operations as elements in a production plant.
- Go and re-visit how you can use Kanban boards to protect your bottlenecks i.e. your highly overdemanded resources.
- There are 4 types of work: Business project work, IT project work, changes and unplanned work. The last two ones, if not properly managed, will destroy you.

This book is a tool to reflect on how you need to interact with core business areas and executives. Above all, this is a novel, a human story that you will find very close to your everyday live.

The special bonus in this book for those related to security? Read how the IT security officer goes from being hated to being a part of the solution to the problems the company is having. That is a great worth reading passage in this book.

An additional ingredient in the book is the role of a somehow distanced but experienced mento. One of the lessons of the book: do not despair and think simple!

And remember:
- IT is pervasive, like electricity, it is not just a support area.
- If IT wins, the business wins.
- IT and business in unsuccessful companies is a dysfunctional marriage.
- Interesting idea: A hedge fund betting on organisations with a great IT department. 
- A new? concept: devops (from development and operations).
- And even a newer proposal: organisations with no IT department, but rather IT inside the business areas. How does this sound?

Kudos to the authors Gene Kim, Kevin Behr and George Spafford!

Infosec people, build the tower but enjoy the tree!