Public DNS servers: Less privacy in exchange of a security layer

There are several free public DNS servers on the Internet. Google, Scrubit and DNSadvantage are some of them. OpenDNS is the one I have selected to test in Ubuntu for a while. They offer web content filtering and basic protection against known phishing, botnets and some known worms.

Inserting in the /etc/resolv.conf the OpenDNS name servers is an easy task: Their name servers are 208.67.222.222 and 208.67.220.220. If you are using DHCP, add those name servers, separated by a comma, in the file /etc/dhcp3/dhclient.conf, using the following line:

prepend domain-name-servers 208.67.222.222,208.67.220.220;

There are however some additional steps to take if our ISP uses a dynamic public IP address. OpenDNS provides a simple utility for those using MS Windows or MacOS. In Linux, we have to follow the next steps. After visiting several sites that provide input on this scenario (e.g. in Ubuntu docs or in the ddclient site), I summarise only those effective valid steps:

0. Sign in to the OpenDNS site, create your network and configure your security and content filtering settings.

1. Install ddclient e.g. in Ubuntu

$ sudo apt-get install ddclient

2. Configure the file /etc/ddclient.conf in this manner
ssl=yes
daemon=300
protocol=dyndns2
use=web
server=updates.opendns.com
login=yourlogin
password=yourpassword
yournetworknameintheopendnssite

3. If there is a /var/cache/ddclient/ddclient.cache file, erase the "ip=" segment [although you can skip this step]

4. Now it is advisable to
4.1 Test ddclient using the command line
$ sudo ddclient -daemon=0 -noquiet -debug
4.2 Start the daemon at boot up by writing in the file /etc/rc.local the line
/usr/sbin/ddclient -daemon 300 -syslog
before exit 0.

5. The ddclient daemon can be stopped with
sudo killall ddclient
or started with
sudo /etc/rc.local

And ready to surf! Now they will gather all the sites you visit (privacy loss). However, that was already the case wih your ISP's name service.

These "secure" name servers can constitute an additional security layer for home browsers, provided that they require a naming service. However, if they type an IP address directly (or a trojan within their box), then there is no additional security layer. Sites like this one can provide the IP address of a site directly.

A little final note: These OpenDNS services, web filtering and basic phishing protection, take around 5 minutes to get updated with a new IPaddress. Take that into account, the first 5 minutes of use of your browser will provide "unprotected" web surfing.

Happy name resolution! (and happy to read your comments)

Little addendum triggered by a cunning comment from a committed reader: An alternative to the use of these public DNS servers is running your own DNS server, configured to obtain names from the Internet root domain name servers. Certainly, a better alternative from a security standpoint. However, this option is only viable for those IT savvy individuals with sufficient skills, and resources, to run their own name service.

Network Flow analysis by Michael W. Lucas - Book review

Management schools teach you that someone or something is effective if they do the right things and they are efficient if they do the things right. The book "network flow analysis" by Michael W. Lucas (edited by no starch press and available in Amazon) is effective, it shows the thing you need to know about netflows, and efficient, it has the right lightweight format, although sometimes I have missed some explanatory drawings for those who learn visually.

The book is divided into an introduction and 9 chapters. Michael first explains the reason of the book in the intro and the difference between what network management tools give to the network expert and what working with network flows can provide.

I started then the book with chapter 1, where I really appreciated that the flow system architecture is right after the definition of a network flow. This avoids confusion and saves time to the reader. Actually, this topic of saving time to the reader and leading them to the point is a constant throughout the entire book. As a little suggestion, I would have added in this chapter a little disclaimer for the reader stating that some TCP/IP networking concepts should already be known by the reader (well, actually, surely readers will be network specialists).

Chapter 2 is the howto 101 to install and start operating with network sensors and collectors using the free flow-tools available in Google code. As a side note, I really liked to see in the book real command lines. This is the reason why I will keep the book close to my machine; it can really be used as a basic manual to install softflowd as a software-based network flow sensor and flow-capture as a flow collector. In addition to this, it was good to be reminded that the -arp switch in ifconfig enables a network interface without participating in arp.

Chapter 3 introduces the use of flow-cat and flow-print to view flows. In this chapter the junior network admin starts realising the potential value of net flows. My only "but" for this entire chapter is the reference to hexadecimal output. For future editions, I would propose to highlight and insert a little explanation when talking about flow-print -f 0 adding interface numbers by printing port and protocol info in hex.

Once the foundations have been laid out, chapter 4 refers to real life aspects of net flows such as filtering. For that, Michael proposes the use of flow-nfilter, building filters out of primitives, knowing that each primitive can only include one type of match. The bonus point for this chapter would be a nice little diagram showing how primitives relate to filters.

Chapter 5 follows the logical thread started by chapter 4: After filtering comes reporting. Actually, this is also a constant feature in this book. The reader never gets lost. It is easy to understand and follow the proposed script along the pages of the book. We learn how to use flow-cat in combination with flow-report and, later on, with flow-nfilter. This is one of the strong points of Michael's book. It is sure that smart network admins will come back to chapter 5 (and 6) regularly during their work time.

Chapter 6, at first glance, can be seen as hard core: Perl comes into the picture! However, Michael gives effectively readers through the jungle of installing Cflow.pm, so that FlowScan can work, while mentioning useful tools such as flowdumper, a tool that shows everything in the flow record. This chapter also mentions the difference between FlowScan and CUFLow.

Chapter 7 presents a collection of three tools: FlowViewer, FlowGrapher and FlowTracker. The first one is a web interface for flow-print and flow-nfilter, optimal mainly for network admins. The second one uses arbitrary flow data and the third one generates RDD-graphs based on flow data. This chapter introduces these tools and provides a basic manual, enough to start playing with them. Probably chapters 7 and 8 could trigger an entire new book on visualising net flows.

Chapter 8 is the step by step basic manual to use gnuplot, the generic graphical representation tool in Linux, in this occasion, certainly, for network flow data, but in itself, this chapter is a useful guide for anyone willing to start off "the gnuplot experience".

Chapter 9 belongs to the "swiss army knife" subset of this book (together with chapters 5 and 6). Once everything is installed, implemented and running. What do we do with it? Well, this chapter answers this question in a very practical way.

I have released a series of tweets (http://twitter.com/itsecuriteer) with a small number of valuable pearls coming out from reading this effective book. All in all, I agree with Mr. Bretjlich's comments about the book (see http://taosecurity.blogspot.com/2010/08/consider-reading-network-flow-analysis.html): A five-star book on network flows.

Finally, a little piece of advice, please read the afterword on page 189, where the author refer to key non-technical skills that all admins should have (and practise ;-)

Happy October reading!

Truecrypt and USB drives

Human beings lose things. Laptops, smartphones and USB memory drives are things. We also lose them (see e.g. this piece of news). The data that any IT related hardware item can carry is often more valuable than the hardware itself. Truecrypt is a valid option to encrypt "losable" devices. This way, a third party would have a more difficult time to reach data stored e.g. in a USB memory drive. 

Truecrypt exists for Linux, Mac OS and MS Windows (where there is also a portable version - however requiring local admin rights). Once it is installed, its GUI looks like this:

It can use both a file or an entire partition as encrypted container. Both options can be mounted in the system and all data stored there will be encrypted at rest. The symmetric encryption algorithms that Truecrypt can use are the following. According to speed and crypto strength needs, the use of AES is the recommendable option:

However, remember that the security of your container relies, not only on the strength of the encryption algorithm used, but also on the strength of the password used as authenticating credential. The tool also allows for the use, together with a strong password, of a keyfile, so that both elements are required to decrypt and use the container (it there is the need to base authenticating credentials, not only on something you know, but also on something you have).

Little note: If you need to encrypt a set of already existing files, then you first need to create an empty container, and afterwards, move the files there.

Final catch: The drawback of using Truecrypt to encrypt your USB memory drive is that you need Truecrypt executed whenever you use your files. The advantage, if your USB memory drive is lost, your data will be safer. Up to your risk management decision ;-).

Happy secure data transport!

Free of charge web-based photo geo-location - Exif data cleaning

Digital photo files contain exif data. Typical items within exif data are camera model, date and time of the picture, and, if taken with a GPS-enabled device, also the GPS coordinates where the photo was taken. If that is the case, how can we geo-locate a picture?

The Exif Firefox Add-on is an easy way to read exif data. Once you have access to the GPS coordenates, the process is easy. Here we present the steps to geo-locate free of charge (and web-based) a photo:

From GPS coordinates to a real physical location:
- Go to tomtom routes and add the GPS coordinates as shown below,

For the reverse process, from a real physical location to GPS coordinates:
- Go to gpscoordinates.eu and enter the physical location as shown below,

A quick way to delete exif data in your pictures is opening them with GIMP, the GNU Image Manipulation Program, and saving them again unticking the advanced option of "save exif data".

Happy geo-location!

Sound in Ubuntu 10.04 - Security videos and podcasts

Willing to enjoy security videos or podcasts such as the following ones?

Videos
- irongeek
- owasp
- schmoocon

Podcasts
- pauldotcom
- risky business
- eurotrash
- social engineer

... and, for whatever reason, your new installation of Ubuntu 10.04 does not provide you with sound in your laptop or desktop? Try this one:

user@machine:~$ sudo apt-get install gnome-alsamixer
user@machine:~$ gnome-alsamixer

This alsa-related sound app offers you a way to, usually successfully, control your speakers and micro in an easy manner. Pay special attention to the PCM control feature.

Happy listening!

By the way, does your machine enter into power saving mode while watching security videos? That is annoying. Try caffeine, a little python app.