How can you secure something without locking it?

First: Companies and users are complacent!

Second: They don't want to accept their responsibility!

Depending on what we want to secure and who we want to secure it from, there are ways, for example:

Let's make some simple easy to follow analogies.

We have a bunch of chickens and we want to protect them from Foxes. 

Things to consider: 

• Do we believe in foxes?
• Will they attack our chickens?
• What is the likelihood of our chickens being attacked? 
• Is the garden open, without a fence or even with a natural fence?

If we don't believe in foxes, there is no chance we will believe or think our chickens will be attacked by foxes! So nothing will be done to protect the poor chickens.

Let's say we do believe in foxes, because we know they exist, we've heard on the news, but the way we operate or think is about probabilities. What are the chances of the chickens being attacked by foxes?

Take a chance or not?

Let's say we believe in foxes and half-hearted want to do something, to convince ourselves we did something.

Let's erect a fence, this should keep foxes out, really?!

Important: 

• Know what you need to protect
• Protect from what
• How important is what we are trying to protect? 

In the case scenario above, are foxes the only thing we have to worry about?

How about thieves?

How about diseases?

How about what predators?

Also Important is Acceptance!

1. We do not know everything
2. The scenarios change
3. The danger changes

If we think a fence is good enough, let's explore this a bit. 

We erected a fence, chickens are happily protected in the garden, foxes out, but for how long?

All it needs is:

• Gate left open 
• Some panels in the fence start to rotten and break, 
• Holes in the fence.....

Then you wake up the following day and one of your chickens gone, eaten by the beautiful fox? Maybe!

What needs to be done right away?

1. Investigation, check the fence, check signs of feathers in the garden, 
2. Fix the fence, and now armed with the knowledge a fence is not enough
3. Build a small house to keep the chickens over night. IMPORTANT!!!
4. Put a lock on the gate
5. Instruct everyone to keep the gate locked. Procedure!

I believe this shows to you the necessity of making sure you are watching what is going on with your chickens. Monitoring!

If we cannot find any evidence the chicken has been eaten by a fox, should we assume:

1. The chicken has gone voluntarily?

2. The chicken has been abducted by aliens?

This is what I expect to be done:

1. Inspect the whole fence, fix it it if need

2. Build a little house to protect the chickens over night

3. Put a lock on the gates and don't share with everyone

4. Assign someone to check the chickens frequently and count them

5. Put a system to watch the chickens day and night

6. Don't let anyone near the chickens if they have not been well trained

7.Having Systems in place is good, but a team has to be monitoring and watching, and they also need to know what to do in case of a breach happens.

Let's say someone is coming over the fence during the day, we have all these protections, but no one is actually paying attention. If you have someone watching and they see a criminal jumping over the fence, if they are not trained in what to do or how to do, again nothing will happen.

The minimum you can train them to is: If someone is trying to jump over the fence SCREAM LOUD!!!! THIEF!!! this might scare them off.

Let's say you have a diamond and you want to protect it.

There are some options and it is up to you to evaluate the pros and cons and chose the best for your environment.

1. You can put the diamond in a safe box in a bank

2. You can buy a safe and keep it at home

3. You can dig a hole and bury it

Would you leave your diamond on your desk overnight?

These are just some thought open for discussion, if you want to comment and pick it apart and or make suggestions, let's discuss it.

A Musica Me Toca

a musica me toca
ondas que reverberam
Pelo meu corpo adentro
Me tocam como instrumento
mexem nas cordas das emocoes
Harmonisa e afina
Toa e desentoa
Ondas, tanta energia
Que mexe e bole
Em tudo por dentro
Tocam pensamentos
Tocam sentimentos
Cada nota uma emocao diferente
tristezas, alegrias
lembrancas e saudade
raiva e melancolia
decepcao e felicidade
A musica me toca
como um instrumento musical
bole nas minhas cordas
me faz bem, me faz mal

Me joga pra cima
numa felicidade sem fim
a gravidade e mais forte
e a lei me faz cair
de repente me faz chorar
num suspiro m faz sorrir
num momento sonhar
vem pra mim me iludir
me faz fortalecer
me faz fraquejar
me da saudades nem sei do que
de tanta coisa, de tanto lugar

A musica me toca
As vezes bem as vezes mal
As vezes desafina
nao soa legal

Por Renato de OLiveira

Username and Password - those days have long gone (Security)

Username and Password - those days have long gone (Security)

Today I am going to write about something quite important in the battle against the bad people. Do I really care how they call themselves?! Not really!!
If they hack n, or chainsaw in, or they butcher in, for me they are still the same to me.

This is my opinion: It is much easier to break something then to build or fix something which is broken.
If I want to break something, give me a hammer and I will smash to bits a phone, PC, TV, Server etc. I want to see anyone putting all the bits together and fixing what is broken....
Anyway, here is my ranting for today!

In the past we used an user name and a password, passwords with 8 characters were considered hard to break. I have seen 12 charactered passwords be broken in 25 seconds.
Even by using complexity, man still no better or safer for brute force attacks, dictionary based attacks etc.

There is something quite nice, it is known by quite few different names:

• Second-factor authentication
• RSA Key
• Two-factor authentication
• Mobile authentication
• PIN number authentication

They all do a very similar job; they add an extra layer of security to your account. MOst of them work by requiring a RANDOM generated number, which can be sent to you via text to your mobile. It can be generated by an APP installed onto your mobile like "Google Authenticator".

A lot of Internet services started to offering similar method of authentication.

Just to name some:

• gmail.com
• hotmail.com
• facebook.com
• Paypal
• some Banks
• Dropbox
• LinkedIN
• etc

I advise you to set the two-factor authentication for all your services, to all your systems which require login. 

Some two factor providers, allow you to set it for RDP connections, VPN connections, SSH access, webmail access.

I have come across a very nice one from a company called: www.duosecurity.com. It is the nicest and most neat I came across. It is relatively cheap and so easy and quick to set up. Amazing!

If we don't take the initiative to protect ourselves, no one will and guess what, once your system, data, PC, server or device is compromised it is difficult to clean it up. Might as well start all over and might be game over.

Some links on how to set up the Second factor Authentication for various services:

PayPal

https://www.paypal.com/us/cgi-bin?cmd=xpt/Marketing_CommandDriven/securitycenter/PayPalSecurityKey-outside&bn_r=o

Google 

https://www.google.com/landing/2step/

Hotmail

http://windows.microsoft.com/en-gb/windows/two-step-verification-faq

DropBox

https://blog.dropbox.com/2014/10/have-you-enabled-two-step-verification/

FaceBook

https://www.authy.com/add-2-factor-authentication-facebook

LinkedIN
http://blog.linkedin.com/2013/05/31/protecting-your-linkedin-account-with-two-step-verification/

Twitter
https://blog.twitter.com/2013/getting-started-with-login-verification

We need to start campaigning across the  Internet for each service provider offer similar services. Security needs to come from manufacturers and Service providers.

If you want a second factor mechanism for your webmail, RDP, SSH, VPN, Firewall take a look at the duosecurity website. It is pretty nice.

I hope you make use of this info in a good way and protect yourself.

by Renato de Oliveira

Rename those default Windows accounts (Security)

Rename Default  Windows Account Names

By default, Windows has two built in very well known account names, they are:

• Administrator
• Guest

I cannot stress enough, how well known these two accounts are across the Internet . 

So it is very important to take the following steps.

a) Rename both accounts.

b) Choose a very unusual name

c) Guest account is disabled by default. DO NOT ENABLE IT!

d) Set a very strong password for both accounts

e) Disable DIAL-IN for Guest account

f) For admin accounts, choose a 12 character password or longer

g) In the password use Capitals, Numbers, Symbols and lower case

Note we will not prevent a break in by renaming these accounts, but we will make it at least a bit harder. By making it harder, you give yourself time.

Don't just rename the Administrator account to 'admin' this is even easier to guess. Use your imagination, create a theme for your admin account names. Use long numbers.

Rename these accounts before you put your server or client in production, make it part of your security base line policy.

Remember never leave default user names.

by Renato de Oliveira

Security (Default config left behind) a guilty industry

Security (Default config left behind) a guilty industry

Recently about a month ago, a website has gone up which explores video cameras and display images captured from these video links on this Russian website.
Some of these cameras are at homes, companies, public gyms etc see the article at BBC News: http://www.bbc.co.uk/news/technology-30121159

While I understand this is a security risk and can be used with the wrong intentions and be exploited, I also see that this is a wider problem and needs to be addressed at the top.

Once again defaults being left behind! Is that a joke or what?!
As I said in one of my previous articles, it is partially our fault, but majority of the guilty and blame should be passed to manufacturers. They should know better!

In this new world we are living in, anything can be exploited and it will not take long, if you set up a website at home in your PC, it can be accessed in Brazil almost instantly. It is quick and this sort of information spreads even more quickly.

Some of these devices being sold as consumable, they can open up a lot of security issues in your network, home, anywhere.

While we wait for some regulations to be put in place (I think it will take a long time) security is a top down issue. Any product should leave the factory with a basic level of security!

Some easily, guessable user names being used on some of these devices are:

• Admin
• Administrator
• root
• guest

Information like this can be found anywhere on the Internet. So when you buy any device which requires

1. Connection to the Internet
2. Connection to a Network 

Look out for the basic security:

• Change the default password
• Change if you can the default username (too easy to guess)
• Set account lockout 
• Set idle timeout
• Set HTTPS
• Disable HTTP
• Disable TELNET
• DISABLE FTP
• If you can link the account or service to Google Authenticator do it!
• Enable the built in firewall if available
• Set IP restrictions to certain IP addreeses

These are just some of the basic security, if followed a lot of problems will be avoided and will keep a lot of bad people out.

by Renato de OLiveira

 

How to Disable SSL V3.0 on Apache Red Hat (POODLE attack part 5)

Disable SSL V3.0 on Apache Red Hat (POODLE attack part 5)

If you are running Apache on Redhat this is how you disable SSL V3.0.

1. Log in to your Linux Redhat
2. Become root or use sudo.
3. Edit /etc/httpd/conf/ssl.conf

Replace the line:

SSLProtocol all -SSLv2 with the line below

SSLProtocol all -SSLv2 -SSLv3

Save the file and restart Apache

/etc/init.d/httpd restart

or

service httpd restart

That is it

By Renato de Oliveira

Security part 5 (Securing your phone)

Security part 5 (Securing your phone)

There were a lot of talk recently on the media about phone hacking. Loads of bad press and a lot of exploitation of unaware users. Some of us do know and understand the risks, but we never really think it can happen to us and to a degree we are complacent. We are used to use defaults, to want the easiest possible.

I Think a certain level of security should be enforced by manufacturers, and not expect users to know how to lock down things. Some of services the default password is: admin or blank or 0000.

Come on, this is like a joke! 

Manufacturers need to take more responsibility and face for the fact that they should know much more than users.

We have to understand a smart phone is pretty much a very powerful, portable PC. Some of these phones are much more powerful than PCs manufactured few years ago, they have better CPU/Processor, they have more memory, even more storage, they are connected to the Internet and guess what where is the firewall?!!!

In this article I am going to try and cover some of the basic security issues we face, and how to try and prevent it from happening, give some tips on what to do in case the worse does happen.

Let's cover the basics

1. How to prevent unauthorised people from using your phone?

Most phones have a built in mechanism to be enabled and ask for a pass code, PIN number or both.

• 1. Set your phone to autolock
• 2. Set a PIN number or pass core
• 3. Set it for a strong PIN number

These steps will certainly keep most unauthorised users out of your phone.

    2. How to prevent people accessing messages left to you on your voice mail?

Again most phones and network operators allow you to set a password for:

• Listening to messages
• Saving messages
• Deleting messages

Set a password, PIN number for your voice mail. Do not forget to set it..

    3. Set "Restrictions" or "Parental control" for using Apps and placing calls. It is like a second layer of protection in case your PIN number has been compromised.

   4. If you want privacy, disable "Location Services". 

If you have Location services or similar on, any application installed on your smart phone will advertise your location across the Internet to anyone. It will be very easy to track your location as you move from one place to another.

5. Do not even consider Jail breaking your smart phone, you do not know what hidden traps might be left. It is not a good idea for various reasons a) you are violating warranty b)there may be back doors left to allow data leaking.

6. Install an anti virus: Norton, Mcafee, Trendmicro etc.

As I mentioned above, don't treat your smart phone any different from a PC, it is a powerful PC in your pocket.

7. Install a Firewall, there are many different types of Firewalls available for Android and for iPhones IOs.

A Firewall is an application which protects your PC/Phone from unauthorised connections etc.

8. Only install Apps from AppStore and Google store

9. Do no use FREE WIFIs, they are very insecure and sometimes they are set up to collect data, for example: If you read your email using a FREE WIFI, whoever is the owner of the WIFI might be there also reading your messages, they might get hold of your password. SO do not use public FREE WIFI.

10. How to prevent loosing your Phone?

You can buy a dice which will sound a beep if you are distant from it. Something like this:

http://www.kensington.com/us/us/4570/proximo-find-your-phone-items-easily

11. Download and install "Find My iPhone" app for Apple devices or Android. This is an app which if set up correctly and prior to haven lost your smart phone, it can be a very good tool

• Locate the device
• Send messages to the lost device
• Deleting the data off your lost device

12. If you have lost your device

• Please do notify your Network provider ASAP
• Do not leave it for the next day, contact Network provider ASAP
• If the everything above has been followed, then you are in a good proposition
• Communicate the police

NOTE: Remember if you lost your phone and did not communicate in time to your Network provider, any calls made using your phone you will be the one asked to pay. 

13. Set your phone to auto wipe the data if 10 consecutive attempts to login have failed.

This is not a comprehensive list of security measures you can take, it is only a simple guide to give you some basic protection against many different scenarios.

You can implement other features and security measures, just spend some time researching.

You can use the same advice for many different devices i.e. iPads, Tablets, etc.

I hope this will be helpful to you and will open your eyes to this new world we are living, if we don't protect ourselves, people out there will exploit and take advantage.

By Renato de Oliveira