Linuxworld Toronto Presentation OpenSource Securit

Open Source Security Tools : 

Open Source Security Tools Linux World / Network Toronto Tutorial Part I

Agenda: 

Agenda Open Source and Security Firewalls Port Scanners Network Sniffers Vulnerability Assessment Intrusion Detection Systems Logging Analysis Unix-like Windows Tools Crypto Tools Wireless Tools Open Source Security Opportunities

Presenter: 

Presenter Tony Howlett President of Network Security Services, Inc. CISSP, GSNA Author of “Open Source Security Tools” 17 years of experience building and managing networks

Pre-speech Caveats: 

Pre-speech Caveats Contains updates to material in book; a preview of 2nd edition OS Requirements; Linux or BSD, Reference OS is Mandrake 10.1 Choice of Security apps are my favorites, yes there are others, these are MY favorites Please hold questions till of seminar

Security Tool Warnings: 

Security Tool Warnings DO NOT run these tools on any machines that don’t belong to you without WRITTEN permission Be very careful when running them on production machines at work Failure to abide by this could result in getting fired, legal action or losing your ISP connection.

Windoze Warning: 

Windoze Warning While most of it is Unix/Linux centric, I do present some Windoze tools The number of open source Windows tools is still low but the number is increasing and some of them are quite good It’s a Windows world out there, and we all have to live in it Most are at the end, so hardcore Windows haters can leave then 

Open Source and Security: 

Open Source and Security Just about every category of security application is available in open source Many commercial security vendors use open source software as a base or engine Many of the programs compare very favorably to expensive commercial programs Example: Snort has been rated right up with commercial choices by critics and trade mags

Open Source and Security: 

Open Source and Security More Secure or Less Secure? The worlds most proprietary operating system is also the most exploited Linux and Windows about even with number of exploits available Best practices in fields like cryptography are to have open peer review Bottom line; code being closed or open source doesn’t make programmers write secure code

Open Source Opportunities: 

Open Source Opportunities Cost Reduction within your company (be the budget hero) Expansion/ addition to your existing tools Education – a great way to learn Development of new open source tools (www.sourceforge.net , www.freshmeat.net) Career / Resume Enhancement Run a Security consultancy with it (I do!)

Securing Operating Systems: 

Securing Operating Systems                                                                           The operating system is the base upon which you build all your other tools; if its insecure, you are building on a foundation of sand When building a security tool system, try to always start with a new OS installation Then lock down and harden the system

Bastille LinuxA OS Hardening Tool: 

Bastille Linux A OS Hardening Tool                                                                           Not an OS, but a set of scripts that automates the hardening process Asks questions and performs actions based on the response Can run from the command line or via a config file to run on multiple systems

Bastille LinuxA OS Hardening Tool: 

Bastille Linux A OS Hardening Tool                                                                           Requirements: Perl 5.5 or greater Perl TK Module 8.0 or greater Perl Curses Module 1.06 or greater Packages available for Debian, Redhat and Mandrake Also available for Mac OS-X, HP/UX and Solaris Download from www.bastille-linux.org

Open Source Firewalls: 

Open Source Firewalls The Ole Standby: IPTables Included with every Linux distribution with Kernel 2.4 and higher Can run from command line or via scripts Several public IPTables scripts available Many commercial firewalls are merely Linux boxes running IP tables in fancy cases Example: Watchguard Firebox Do you have it? Type “iptables –L” at the command line to find out

OS Firewall Alternatives: 

OS Firewall Alternatives Ipchains Turtle Firewall Smoothwall

IPChains: 

IPChains Available in Linux distributions with Kernel 2.2-2.3 Similar to IPTables with a little less functionality Before Kernel 2.3, IPFW is firewall program

Turtle Firewall: 

Turtle Firewall Web-based interface to IPTables Makes IPTables much easier to navigate Seeing mistakes in rules is easier Uses the Webmin Linux Administration Interface.

Turtle Firewall: 

Turtle Firewall

Turtle Firewall: 

Turtle Firewall Requirements: Kernel 2.4 or higher Iptables Webmin Interface (www.webmin.org) Perl with Expat Library Get Turtle Firewall at www.turtlefirewall.com Free for download, ~$100 for a supported version

SmoothWall Express: 

SmoothWall Express A turn-key firewall Supports NAT, DHCP, SSH Admin, VPNs and a lot more Requires a dedicated system to run on; wipes the harddrive and installs its own OS (Linux of course!) Express version is free, commercial version available with more features Get it at www.smoothwall.org

SmoothWall Express: 

SmoothWall Express

Port Scanners: 

Port Scanners Port scanners determine the state of the TCP/UDP network ports on a system Very useful from a network security standpoint Nmap is the most fully featured scanner out there, bar none.

Uses for Port Scanners: 

Uses for Port Scanners                                                                           Determine number of answering machines on the network (Ping Sweep) OS Identification (TCP Fingerprinting) Identify unnecessary or rogue services running on machines

Nmap: 

Nmap                                                                           Powerful light weight port scanner Runs on Unix or Windows Command Line or GUI Easy to run but also deep in functionality

Nmap Requirements: 

Nmap Requirements                                                                           Nmap Requirements: LibPcap libraries (www.tcpdump.org) Download Nmap from www.insecure.org (a great security information site too!)

Nmap Demo: 

Nmap Demo  

Vulnerability Scanners: 

Vulnerability Scanners                                                                           These programs take port scanning a bit farther and try to run exploits against open ports These scripts replicate the actions of hackers or other malware such as viruses or worms Can be very useful to show how good your defenses are Can be run in “safe mode” which means holes aren't exploited if found. This results in a higher false positive rate, however

Nessus-NOT!: 

Nessus-NOT!                                                                           Was one of the better open source security programs available Uses Nmap and other popular programs as modules Utilizes a “plug-in” architecture for each security test so latest exploits can easily be added Now closed source by authors commercial company

Alternatives to Nessus: 

Alternatives to Nessus                                                                           Several of the major contributors “forked” the open source version of nessus to form new Open Source VAS projects OpenVAS http://www.openvas.org ATF http://www.computec.ch/projekte/atk/ Porz-Wahn http://developer.berlios.de/projects/porz-wahn/

Benefits of OpenVAS and other Nessus Forks: 

Benefits of OpenVAS and other Nessus Forks                                                                           Client-Server architecture. Supports multiple platforms for clients (Linux, Windows, Web-based, Java) Has a built in scripting language (NASL) for writing custom security tests Well documented and supported from legacy Best of all, absolutely FREE!

OpenVAS Requirements: 

OpenVAS Requirements                                                                           LibPcap Libraries (www.tcpdump.org) Gimp Took Kit (GTK) ftp.gimp.org/pub/gtk/v1.2 Nmap (if you want to use it as your port scanner) OpenSSL (if you want to connect securely www.openssl.org)

OpenVAS Demo: 

OpenVAS Demo

Netscan Command Console (NCC): 

Netscan Command Console (NCC) A web based interface and database backend for managing multiple .nsr-based vulnerability scans Allows for scheduling of future scans, recurrence and storing of results in a database Web based analysis tool for results Multi-user, multi group (good for consultants) Version 2.0 coming out in June (sneak preview today!) Co-written by yours truly 

Netscan Command Console (NCC): 

Netscan Command Console (NCC) Written using Perl and PHP Based on the LAMP platform (Linux, Apache, MySQL and PHP (Perl too!) Backwards compatible with OS Nessus Requirements: MySQL: Version 3.2352 or higher PHP: Version 4.32 or higher Perl: Version 5.8 or higher OpenVAS/Nessus: Version 2.07 or higher Apache: Version 2.0.47 or higher Get it at www.netsecuritysvcs.com/ncc

NCC Demo: 

NCC Demo

Network Sniffers: 

Network Sniffers These programs grab data packets off the network for examination/analysis Highly useful for any number of tasks including but not limited to security Commercial sniffers can run into the tens of thousands of dollars

Ethereal: 

Ethereal A free open source Ethernet sniffer with many features Graphic Interface Also, works with other programs (both as a slave program and to produce files for use/analysis in 3rd party programs)

Ethereal: 

Ethereal Requirement LibPcap Libraries Network card capable of working in promiscuous mode Download at www.ethereal.org

Ethereal Demo: 

Ethereal Demo

Intrusion Detection Systems: 

Intrusion Detection Systems Programs that look for anomalous behavior on a system and alert operators Some systems provide for additional analysis / reporting capability This is CRUTIAL to the usability of the system A vital backup to your firewall and perimeter defenses. A strong defense against internal attacks which firewalls can’t detect or stop

IDS Vs. IPS: 

IDS Vs. IPS What is the the difference between IPS (Intrusion Prevention System) and IDS? Answer: Marketing mostly! Some combine a firewall with IDS to take action on alerts such as blocking ports, etc. WARNING: these features can cause a your network to be DOS’d inadvertently

Host IDS Vs. Network based: 

Host IDS Vs. Network based A host based IDS (Tripwire) looks for changes/anomalous activity on a single host such as file modifications, etc. A network based IDS (NIDS) looks for suspicious behavior on a network wire. Network-based will pick up activities on all boxes that enter from the network but may miss activity that doesn’t match signatures or comes from a different source. For Example, brute force attempts on a login or floppy-based trojans Host-based can pick up things NIDS can’t (changes to files by a legal user, etc) but must be loaded on every box. Some systems may warrant both.

Network Intrusion Detection Systems: 

Network Intrusion Detection Systems NIDS systems are complicated sniffers that check all data packets on the network against a database of signatures Some IDS systems also do anomalous activity detection and Intrusion Prevention (taking action on the results)

Slide43: 

A powerful, lightweight open source NIDS Large default rule set (several thousand) Highly customizable and configurable Offers a scripting language to write custom rules to match your network Works on Linux/BSD/Windows

Slide44: 

Software requirements LibPcap Libraries Linux Kernel 2.4 or greater Hardware requirements Network card capable of working in promiscuous mode Intel 500 Ghx processor or greater (Its works on less) 128MB of ram Command line interface only Download at www.snort.org

Get the Pig: 

Get the Pig Download tar file from www.snort.org Most current version 2.4.4 Decide if you want to register as a user Sourcefire (owner of Snort) subscribers get real-time feeds (cost: approx $1700/year) Registered users (no cost) get 5 day delayed Verified rules feed Non-registered users get static rule set with installation GPL feed available for those that don’t want to use the Verified rule set.

Useful Snort Add-on Tools: 

Useful Snort Add-on Tools Webmin Snort Module BASE/ACID

Webmin Snort Module: 

Webmin Snort Module Module for popular Webmin administration program Benefits: easy rule set and conf file management Downside: have to run Webmin and web server on Snort box Download at www.webmin.com

Webmin Snort Demo: 

Webmin Snort Demo

Basic Analysis and Security Engine (BASE): 

Basic Analysis and Security Engine (BASE) Formerly Analysis Console for Intrusion Detection (ACID) Web front end and database interface for Snort This program allows you to really tap into the power of Snort Imports alerts into a database and allows viewing through a web-based interface This allows analysis of your Snort data and helps with tuning your Snort sensors

BASE Requirements: 

BASE Requirements MySQL, PostGreSQL or Oracle database PHP-enabled web server One or more snort sensors to gather data from Important: You must build your Snort boxes with the “--with-mysql” or appropriate parameter and edit the snort.conf files correctly. Download BASE from: http://secureideas.sourceforge.net/

BASE Demo: 

BASE Demo

Crypto Security: 

Crypto Security GPG (GNU PGP) Unix Cain and Abel (Windows) OS version of Windows PGP no longer available (volunteers anyone?)

GnuPG: 

GnuPG The GNU Privacy Guard (get it?) The GNU implementation of the OpenPGP standard Versions available for Unix/Windows/Mac OS Command line interface only Get it www.gnupg.org

Cain and Abel: 

Cain and Abel Password and Credential recovery tool for Windows (read between the lines) Not revolutionary but evolutionary; contains many tools in one simple, easy to use package. One very scary tool…

Cain and Abel: 

Cain and Abel Integrates the following features in an easy to use GUI Network sniffer (wireless too!) Password cracking for just about every OS and platform ARP cache poisoning tool (to circumvent switches) Remote control agent And More! Support for Rainbow Tables, the latest innovation in password cracking Download it at http://www.oxid.it/cain.html

Cain and AbelPlatforms Cracked: 

Cain and Abel Platforms Cracked Windows NT Hashes Windows Protected Storage Windows Credential Manager Windows LSA Secrets Windows Remote Desktop MS Access MS SQL Server Base 64 Cisco Type 7 Cisco VPN VNC RSA SecurID Oracle

Cain and Abel Demo: 

Cain and Abel Demo Sorry no Cain and Abel demo… I don’t want to embarrass anyone or go to jail At a recent hacker convention, I saw this tool used to reveal the password of attendees including some federal agents and a professor of a major university Moral of this story.. Don’t use wireless networks at conventions.. Especially hacker conventions!

Wireless Security: 

Wireless Security Kismet Wireless (Unix/Linux/BSD) Palm version available Netstumbler (Windows) Stumbverter (Windows) One of the few areas where Windows Tools meet or surpass Unix tools in quality

Kismet Wireless: 

Kismet Wireless Curses based wireless exploration program Can interface with wireless cracking programs like WEPcrack Requirements: Wireless network card that supports rfmon GPSD (GPD monitoring daemon) Expat libraries Download it at: http://www.kismetwireless.net/

NetStumber: 

NetStumber Not purely Open Source, but Freeware License Available at www.netstumbler.com along with lots of other good wireless resources Gives lots of useful information (signal strengths, type of equipment, AP settings, GPS data) Requirements: Windows W2K or later Prism2, Hermes or Atmel chip-based Wifi card Optional external antenna for better results Optional GPS receiver for map data

Stumbverter: 

Stumbverter Open Source add-on to Netstumbler; also works with Kismet files Converts your Netstumbler files captured with GPS data into MS Map Point Makes a nice graphical representation of the APs in your area Good for finding areas of signal interference, channel choices Surveying for rogue access points Requirements: Netstumbler GPS sensor with PC interface Licensed version of MS Map Point 2004 or later Get it at http://www.sonar-security.com/sv.html

Netstumbler/StumbverterDemo: 

Netstumbler/Stumbverter Demo

Email Security: 

Email Security Anti spam (SpamAssassin) Anti virus (ClamAV) Blackhole Lists (RBL, )

AntiSpam Tools: 

AntiSpam Tools SpamAssassin Perl based Spam filter Works with Sendmail/Postfix Filters spam based on signature matching, location, attributes (futures date, internal addresses) or Bayesian logic. Part of many commercial anti-spam Solutions Get it at http://spamassassin.apache.org/

ClamAV: 

ClamAV Open Source Anti-virus Toolkit project Works at the mail server rather than on desktops Upsides: Takes processing job off of the desktops Free! Downsides Mainly for Email Attachment scanning; Doesn’t catch Viruses on CDs or downloaded via other means (web) Best used as a additional protection not sole Download at: http://www.clamav.net/

Blackhole Lists: 

Blackhole Lists Not software per say, but collaborative lists of known spamming addresses Most mail servers will work automatically with these lists Some charge for subscriptions, some are free SpamHaus sbl.spamhaus.org MAPS Spam Relay List relays.mail-abuse.org Arbitrary Black Hole List spammers.v6net.org

Forensic Security: 

Forensic Security UNIX DD Command The Sleuth Kit Autopsy Forensic Browser The Forensic Toolkit (Windows)

Unix DD Command: 

Unix DD Command Useful for making exact copies of evidence after an attack Available on almost all Unix Systems Be careful with this command, you can also destroy data Make sure you follow proper forensic data collection techniques or you may make evidence unusable in court

SleuthKit/Autopsy Forensic Browser: 

SleuthKit/Autopsy Forensic Browser A Unix/Linux/BSD data collection and analysis program Allows for multiple case file Allows for viewing of different file types Browser interface (AFS) Get it at: http://www.sleuthkit.org/

SleuthKit/AFB Demo: 

SleuthKit/AFB Demo

The Forensic ToolKit: 

The Forensic ToolKit A collection of free tools made available by AtStake Not open source but freeware (be careful of license restrictions on commercial use) Useful for Windows systems analysis without modifying file access traits (time, etc) plus info not available through built in OS tools Afind shows files by access time Hfind shows windows hidden files Sfind shows hidden data streams on Filestat Shows all attributes of files Hunt Uses null session to generate info on a Windows host Download at: http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/forensics.htm

Forensic ToolKit Demo: 

Forensic ToolKit Demo

Windows Tools for UNIX/Linux like features: 

Windows Tools for UNIX/Linux like features Windows is notorious lacking in built-in command line / network diagnostic tools Example: whois, SSH, etc There are open source tools to add these and more to your Windows system: PuTTY (SSH Client for Windows) Sam Spade (whois,graphical traceroute, finger, IPBlock, Spam Blackhole list, etc) Everest

PuTTY: 

PuTTY Window SSH/Telnet/Secure Telnet client Great for saving terminal session logs too Get it at http://www.chiark.greenend.org.uk/~sgtatham/putty/

PuTTY Demo: 

PuTTY Demo

Sam Spade: 

Sam Spade Just like the fictional detective, great at finding things out and tracking down bad guys Offers Windows based whois, graphical trace route, finger Can find owner of Ips (IPBlock) Can find the abuse contact and file a complaint Find out if your mail server is on a blackhole list Get it at www.samspade.org/ssw

Sam Spade Demo: 

Sam Spade Demo

Open Source Software Needs: 

Open Source Software Needs Opportunities to contribute and gain experience and reputation Better Windows Tools! Encryption Windows VAS Windows Snort tools OpenVAS project or side projects (like NCC!) Better Unix wireless tools

REPEATSecurity Tool Warnings: 

REPEAT Security Tool Warnings DO NOT run these tools on any machines that don’t belong to you without WRITTEN permission Be very careful when running them on production machines at work Failure to abide by this could result in getting fired, legal action or losing your ISP connection.

Questions / Comments?: 

Questions / Comments? Email me at thowlett@netsecuritysvcs.com Most of the tools mentioned and more can be found in my book “Open Source Security Tools”, available from your bookseller or online