Life is a running track

Things are moving fast
perhaps faster than I can follow
the feeling I can't grasp
or even swallow
I walk and the pressure is to run
I run and the pressure is to fly
nothing gives me any fun
only the desire to cry
Tears don't come out of eyes
Just the constant pain
I look around, I can't see anything
Just the emptiness in my veins
Just the pressure to run
Until when will I be running?
Why do I need to run at all?
Maybe life is a running track
and the finish line 
is death match

by Renato de Oliveira

 Create a Yum Local repository

# yum install createrepo yum-utils epel-release nginx

# systemctl enable nginx

# systemctl start nginx

# systemctl status nginx

# firewall-cmd --zone=public --permanent --add-service=http

# firewall-cmd --reload

# mkdir -p /var/www/html/repos/{base,centosplus,extra,updates}

# reposync -g -l -d -m --repoid=base --newest-only --downloadcomps --download-metadata --download_path=/var/www/html/repos/

# reposync -g -l -d -m --repoid=centosplus --newest-only --downloadcomps --download-metadata --download_path=/var/www/html/repos/

# reposync -g -l -d -m --repoid=extras --newest-only --downloadcomps --download-metadata --download_path=/var/www/html/repos/

# reposync -g -l -d -m --repoid=updates --newest-only --downloadcomps --download-metadata --download_path=/var/www/html/repos/

# createrepo -v /var/www/html/repos/base/ -g comps.xml 

# createrepo -v /var/www/html/repos/centosplus/ -g comps.xml

# createrepo -v /var/www/html/repos/extras/ -g comps.xml

# createrepo -v /var/www/html/repos/updates/ -g comps.xml

Options error: --dh fails with 'dh2048.pem': No such file or directory (errno=2)

Options error: --cert fails with 'server.crt': No such file or directory (errno=2)

Options error: Please correct these errors.

-g – enables removing of packages that fail GPG signature checking after downloading.

-l – enables yum plugin support.

-d – enables deleting of local packages no longer present in the repository.

-m – enables downloading of comps.xml files.

--repoid – specifies the repository ID.

--newest-only – tell reposync to only pull the latest version of each package in the repos.

--download-metadata – enables downloading all the non-default metadata.

--download_path – specifies the path to download packages.

# vi /etc/nginx/conf.d/repos.conf

server {

        listen   80;

        server_name  192.168.10.1;  

        root   /var/www/html/repos;

        location / {

                index  index.php index.html index.htm;

                autoindex on;

        }

}

# systemctl restart nginx

Daily Update repository server

# vi /etc/cron.daily/update-localrepos

#!/bin/bash

##specify all local repositories in a single variable

LOCAL_REPOS=”base centosplus extras updates”

##a loop to update repos one at a time 

for REPO in ${LOCAL_REPOS}; do

reposync -g -l -d -m --repoid=$REPO --newest-only --download-metadata --download_path=/var/www/html/repos/

createrepo -g comps.xml /var/www/html/repos/$REPO/  

done

# chmod 755 /etc/cron.daily/update-localrepos

Client config

# vi /etc/yum.repos.d/local-repos.repo

[local-repo]

name=Local CentOS Repository

baseurl=http://192.168.10.1/base

gpgcheck=0

enabled=1

# yum repolist

# yum search nano

# yum install nano

 What is Docker

Docker is an open platform for developing, shipping, and running applications. Docker enables you to separate your applications from your infrastructure so you can deliver software quickly. With Docker, you can manage your infrastructure in the same ways you manage your applications. By taking advantage of Docker’s methodologies for shipping, testing, and deploying code quickly, you can significantly reduce the delay between writing code and running it in production.

IMAGES

An image is a read-only template with instructions for creating a Docker container. Often, an image is based on another image, with some additional customization.

CONTAINERS

A container is a runnable instance of an image. You can create, start, stop, move, or delete a container using the Docker API or CLI. You can connect a container to one or more networks, attach storage to it, or even create a new image based on its current state.

Install Docker Centos

# curl https://download.docker.com/linux/centos/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo 

# yum sudo makecache

# yum install docker-ce --nobest

# systemctl enable docker

# systemctl status docker

# systemctl start docker

# docker run hello-world

# docker (list all command options)

# docker search browser (search for an image)

# docker pull centos (this will download an image to your local Docker repository)

# docker images (this will show all images stored onto your Docker repository)

REPOSITORY    TAG       IMAGE ID       CREATED         SIZE

centos        latest    300e315adb2f   5 days ago      209MB

hello-world   latest    bf756fb1ae65   11 months ago   13.3kB

#  docker run centos cat /etc/hosts (To run a command inside the centos container and exit)

# docker ps -l (This will list containers)

CONTAINER ID   IMAGE     COMMAND            CREATED              STATUS                          PORTS     NAMES

cf8ddd1911bb   centos    "cat /etc/hosts"   About a minute ago   Exited (0) About a minute ago             fervent_bose

# docker start cf8ddd1911bb (Re-run the same container using existing container ID)

# docker stop cf8ddd1911bb (this container is alread in exit state, but if you want to stop a running container use the command 'STOP')

# docker images (this command shows all images stored on your Docker repository)

REPOSITORY    TAG       IMAGE ID       CREATED         SIZE

centos        latest    300e315adb2f   5 days ago      209MB

hello-world   latest    bf756fb1ae65   11 months ago   13.3kB

Interactive SHELL within a container

# docker run -it centos bash (this command will start the container and initiate a BASH SHELL where you can interact with the container)

#exit and it will stop the container

# Keep container running and exit to host

<Ctrl>+<p> <Ctrl>+<q>

# docker ps -l

CONTAINER ID   IMAGE     COMMAND   CREATED              STATUS              PORTS     NAMES

7cf9311ecd3a   centos    "bash"    About a minute ago   Up About a minute             jovial_carver

# docker attach 7cf9311ecd3a   (To connect back to the container use the container ID)

# docker stop 7cf9311ecd3a   (to stop a container)

# docker kill 7cf9311ecd3a   (to kill a container)

BRASIL, Um pais bonito

BRASIL, Um pais bonito
Um pais feliz
UM Pais pacifico
Um pais com musicas lindas
Compositores maravilhosos
Com uma natureza belissima
Com um povo batalhador
Com um povo forte
um Povo com amor
Amor pela vida
Nao pela morte
Um povo em busca
De dias melhores
Um povo sem direcao
Com muitos pobres
Um povo que divide
o pouco que se tem
um povo que resiste
e que quer o bem
Bem que ta deminuindo
e aos poucos evaporando
Bem que todos procuram
Mas nao sabem que estao procurando
Um povo com feridas
Marcas de um passado recente
Passado que vai e volta
E se torna presente
Um Brasil de prais lindas
de um domingao de sol
Brasil de samba e fevo
Brasil da paixao por futebol
Um brasil de violencia
Que chora por PAZ
Um Brasil de favelas e morros
de Sophias e socorros
que ja nao aguentam mais
Brasil que acroda cedo
Rala duro, mas que dorme no ponto
Sonha com o futuro
Sonha com um conto
Conto que nos faca acordar
Desse pesadelo
Que esta a nos cercar
Brasil um pais bonito
Esta comecando a desbotar
as poucos descolorindo
e toda sua beleza a se dessipar
O cotidiano com violencia
as ruas cheias de lixo
rios e mares poluidos
mangues e floreas destruidos
a agua ta acabando
Como a espercanca tambem
e o povo bonito sofrendo
e todos policos a quem
Nao ligam pra ninguem
so querem tirar, usar e usufruir
onde esta o lado certo
e quem esta do lado errado?
ninguem quer o bem
do mau que se alastra
um mau que destroi aos poucos
e a esperanca devasta
o sorriso ta amarelando
Ja nem tem mais dentes
ta perdendo as forcas
pra acordar cedo e ralar no batente
Brasil onde vais parar?
O que aconteceu contigo?
porque perdeste a capacidade de amar?
porque everedaste por este caminho
Tao dificil de voltar?
Brasil, enquanto houver esperanca
Eu vou lutar
Quero te ver feliz
Quero voltar a amar
Quero andar pelas ruas
sem me preocupar
Quero cumprimentar as pessoas
sem me amedrontar
quero ver o verde voltar a brotar
quero ver os rios e mares
limpos, bonitos sem poluicao
onde eu possa botar meus pes
quero escutar um samba
Com toda sua energia e felicidade
dancar ate de madrugada
com muita gente e fazer amizade
Em recife dancar o frevo
em Olinda subir a ladeira
coqueiros balancando com tranquilidade
contemplando a lua e o sol
o nordeste tao bonito
O Pantanal tao selvagem
o Rio tao colorido
Sao Paulo com sua bagagem
MInas do Pao e do queijo
Decompositores lindos
Como Flavio, Beto e Lo
Chico cade suas letras critas?
Caetano cade suas letras inteligentes?
e hora de todos nos juntarmos
e macharmos a frente
na luta pela igualdade
na luta pela paz
na luta pra trazer de volta o Brasil bonito
que esta se destruindo cada vez, mais e mais

por Renato de Oliveira

I've seen the dark

I've seen the dark
I experienced a fall
Everything was black
Surrounded by walls

I've been Down
I've seen below
No smile, only frown
No where to go

It is Time to rise
Be strong again
Surface and go above
And set free from the pain

See the sunshine
Feel the sun on my skin
See the blue skies
and the beauty around me

I've seen the dark
Dark I've never seen before
I don't want to be in the dark
Not anymore


By Renato de Oliveira.

Recovering the Root Password for SRX Series Devices

Last week I also had to break a password and did not remember how. So I had to research into it.

1. Reboot or power off and back on the juniper SRX

2. When the boot operation finishes, just press <SPACE> bar few times to have access to the boostrap loader prompt.

loader>boot -s

3. loader> System watchdog timer disabled

4. Set the new root password

                user@host>edit

     user@host# set system root-authentication plain-text-password

     user@host# commit

How to Factory Resta Juniper Firewall SRX

There are a couple of ways of factoring reset a Juniper firewall.


a) Having physical access to the firewall itself and you will find a button at front of the firewall.

All you need to do is find a paper clip and press the paper clip through the small hole and hold it for about 30 seconds.

b) If you have access to the the command line and can go to edit mode, do as follows:

•                  root@firewall> edit
•          root@firewall# load factory-default

Set root password:

root@firewall# set system root-authentication plain-text-password

root@firewall# commit

I am writing about this, because I had a firewall I started setting up few months ago and I had to reset it factory.

Security: Some ideas on how to protect your network and systems

The goal post is always moving, the threats are always changing, but there are loads of things we can do to make it harder.

I am going direct to the point and make it short.

Some ideas on what to monitor

• Active directory object creation
• User creation, and change
• Group creation and change
• PC account creation and change

If you have not added, created, changed accounts chances are someone did it. If it was not created by IT, changes are, it was an attacker. If you are monitoring closely your AD, then you have a good chance of catching it before the accounts can be used to do any real damage.

• Data deletion and data growth

I think this one is pretty obvious, if a large chunk of data has just vanished, something is seriously wrong, right? If I see a volume let's say which had 1TB and all of a sudden, it gone down to 500GB, I would jump on it right away and start asking questions to all users, have you deleted this data, if no one raises their hand up, something somewhere needs to be investigated. There is a good chance you've been attacked. So monitor data deletion.

• Monitor Interface Band Width

Ones needs to have a base line, knowing what is normal in terms of traffic can help you in identifying if you are under attack or not. If you don't know how much traffic your routers, firewalls, and servers pass through daily, weekly, monthly how you would know if it is a normal condition or not? 

• Monitor email Queue 

The same principal applies. Knowing how many emails, hourly, daily, weekly and monthly will help you in the fight. Know what is normal condition for your system.

• Monitor web server hits

• Monitor user creation, deletion and modification for Linux servers

• Monitor file changes, especially config files servers and devices

• Scan and monitor for new hosts and devices

If you see a host you don't know or recognize, investigate it. Check its MAC address, its IP address, check who has such device. Never leave an unknown device without tracking it down!

• Monitor your Internet access
• Monitor Successful and unsuccessful login attempts 

It is important to have a monitoring in place, but it is also very important to watch closely this system. And follow up in any alerts generated by the systems.

These are just some of the things you can monitor to help you in the fight against attackers, there are many more and it is one of your tasks to study your system really well and analyse the entry points, and put monitoring in place.

Hope this is useful to you and if you have some other ideas, please share with us and we would very much appreciate it.

Renato

Onde estao aquelas emocoes?

Onde estao aquelas emocoes
queria deixa-las a vista
onde eu pudesse ve-las
Elas que sempre se vao
quando eu mais preciso delas
quando me sinto vulneravel
quando estou mais exposto
Cade aquela alegria?
Onde esta aquela calma?
Por onde anda a tranquilidade
Que tanto precisa minha alma?
Pra onde foi a paz
que acalenta meu espirito
que me faz ter esperanca
que me faz ver tudo mais bonito
o ar ta cheio de conflitos
minha visao nublada
minha cabeca pesada
entregue a preocupacao
caminhando sozinho
emocoes turvas
sao estas mais fortes?
As que me pegam de supetao
Ou sou eu mais sensivel
a tal tipo (negativo) de emocao?
Parecem durar muito
e nunca quere ir embora
parecem querer habitar o meu mundo
sempre voltando de ultima hora
Onde estao as emocoes
Boas, que fazem sonhar
Que fazem acordar de manha
e com vontade respirar
As emocoes de quando se ve o sol
e sente aquecer a pele
quando se ve o ceu azul
um suspiro, e tudo fica leve
Onde estao essas emocoes
Que relaxam o corpo
que desnevoa a mente
Que deixa o corpo relaxado
e que apruma o passo
pra se caminhar em frente
SAo essas, emocoes?
Sera que elas existem?
Sera qua neo sao so ilusoes?
Onde estao essas emoces?

Por Renato de Oliveira

How can you secure something without locking it?

First: Companies and users are complacent!

Second: They don't want to accept their responsibility!

Depending on what we want to secure and who we want to secure it from, there are ways, for example:

Let's make some simple easy to follow analogies.

We have a bunch of chickens and we want to protect them from Foxes. 

Things to consider: 

• Do we believe in foxes?
• Will they attack our chickens?
• What is the likelihood of our chickens being attacked? 
• Is the garden open, without a fence or even with a natural fence?

If we don't believe in foxes, there is no chance we will believe or think our chickens will be attacked by foxes! So nothing will be done to protect the poor chickens.

Let's say we do believe in foxes, because we know they exist, we've heard on the news, but the way we operate or think is about probabilities. What are the chances of the chickens being attacked by foxes?

Take a chance or not?

Let's say we believe in foxes and half-hearted want to do something, to convince ourselves we did something.

Let's erect a fence, this should keep foxes out, really?!

Important: 

• Know what you need to protect
• Protect from what
• How important is what we are trying to protect? 

In the case scenario above, are foxes the only thing we have to worry about?

How about thieves?

How about diseases?

How about what predators?

Also Important is Acceptance!

1. We do not know everything
2. The scenarios change
3. The danger changes

If we think a fence is good enough, let's explore this a bit. 

We erected a fence, chickens are happily protected in the garden, foxes out, but for how long?

All it needs is:

• Gate left open 
• Some panels in the fence start to rotten and break, 
• Holes in the fence.....

Then you wake up the following day and one of your chickens gone, eaten by the beautiful fox? Maybe!

What needs to be done right away?

1. Investigation, check the fence, check signs of feathers in the garden, 
2. Fix the fence, and now armed with the knowledge a fence is not enough
3. Build a small house to keep the chickens over night. IMPORTANT!!!
4. Put a lock on the gate
5. Instruct everyone to keep the gate locked. Procedure!

I believe this shows to you the necessity of making sure you are watching what is going on with your chickens. Monitoring!

If we cannot find any evidence the chicken has been eaten by a fox, should we assume:

1. The chicken has gone voluntarily?

2. The chicken has been abducted by aliens?

This is what I expect to be done:

1. Inspect the whole fence, fix it it if need

2. Build a little house to protect the chickens over night

3. Put a lock on the gates and don't share with everyone

4. Assign someone to check the chickens frequently and count them

5. Put a system to watch the chickens day and night

6. Don't let anyone near the chickens if they have not been well trained

7.Having Systems in place is good, but a team has to be monitoring and watching, and they also need to know what to do in case of a breach happens.

Let's say someone is coming over the fence during the day, we have all these protections, but no one is actually paying attention. If you have someone watching and they see a criminal jumping over the fence, if they are not trained in what to do or how to do, again nothing will happen.

The minimum you can train them to is: If someone is trying to jump over the fence SCREAM LOUD!!!! THIEF!!! this might scare them off.

Let's say you have a diamond and you want to protect it.

There are some options and it is up to you to evaluate the pros and cons and chose the best for your environment.

1. You can put the diamond in a safe box in a bank

2. You can buy a safe and keep it at home

3. You can dig a hole and bury it

Would you leave your diamond on your desk overnight?

These are just some thought open for discussion, if you want to comment and pick it apart and or make suggestions, let's discuss it.

A Musica Me Toca

a musica me toca
ondas que reverberam
Pelo meu corpo adentro
Me tocam como instrumento
mexem nas cordas das emocoes
Harmonisa e afina
Toa e desentoa
Ondas, tanta energia
Que mexe e bole
Em tudo por dentro
Tocam pensamentos
Tocam sentimentos
Cada nota uma emocao diferente
tristezas, alegrias
lembrancas e saudade
raiva e melancolia
decepcao e felicidade
A musica me toca
como um instrumento musical
bole nas minhas cordas
me faz bem, me faz mal

Me joga pra cima
numa felicidade sem fim
a gravidade e mais forte
e a lei me faz cair
de repente me faz chorar
num suspiro m faz sorrir
num momento sonhar
vem pra mim me iludir
me faz fortalecer
me faz fraquejar
me da saudades nem sei do que
de tanta coisa, de tanto lugar

A musica me toca
As vezes bem as vezes mal
As vezes desafina
nao soa legal

Por Renato de OLiveira

Username and Password - those days have long gone (Security)

Username and Password - those days have long gone (Security)

Today I am going to write about something quite important in the battle against the bad people. Do I really care how they call themselves?! Not really!!
If they hack n, or chainsaw in, or they butcher in, for me they are still the same to me.

This is my opinion: It is much easier to break something then to build or fix something which is broken.
If I want to break something, give me a hammer and I will smash to bits a phone, PC, TV, Server etc. I want to see anyone putting all the bits together and fixing what is broken....
Anyway, here is my ranting for today!

In the past we used an user name and a password, passwords with 8 characters were considered hard to break. I have seen 12 charactered passwords be broken in 25 seconds.
Even by using complexity, man still no better or safer for brute force attacks, dictionary based attacks etc.

There is something quite nice, it is known by quite few different names:

• Second-factor authentication
• RSA Key
• Two-factor authentication
• Mobile authentication
• PIN number authentication

They all do a very similar job; they add an extra layer of security to your account. MOst of them work by requiring a RANDOM generated number, which can be sent to you via text to your mobile. It can be generated by an APP installed onto your mobile like "Google Authenticator".

A lot of Internet services started to offering similar method of authentication.

Just to name some:

• gmail.com
• hotmail.com
• facebook.com
• Paypal
• some Banks
• Dropbox
• LinkedIN
• etc

I advise you to set the two-factor authentication for all your services, to all your systems which require login. 

Some two factor providers, allow you to set it for RDP connections, VPN connections, SSH access, webmail access.

I have come across a very nice one from a company called: www.duosecurity.com. It is the nicest and most neat I came across. It is relatively cheap and so easy and quick to set up. Amazing!

If we don't take the initiative to protect ourselves, no one will and guess what, once your system, data, PC, server or device is compromised it is difficult to clean it up. Might as well start all over and might be game over.

Some links on how to set up the Second factor Authentication for various services:

PayPal

https://www.paypal.com/us/cgi-bin?cmd=xpt/Marketing_CommandDriven/securitycenter/PayPalSecurityKey-outside&bn_r=o

Google 

https://www.google.com/landing/2step/

Hotmail

http://windows.microsoft.com/en-gb/windows/two-step-verification-faq

DropBox

https://blog.dropbox.com/2014/10/have-you-enabled-two-step-verification/

FaceBook

https://www.authy.com/add-2-factor-authentication-facebook

LinkedIN
http://blog.linkedin.com/2013/05/31/protecting-your-linkedin-account-with-two-step-verification/

Twitter
https://blog.twitter.com/2013/getting-started-with-login-verification

We need to start campaigning across the  Internet for each service provider offer similar services. Security needs to come from manufacturers and Service providers.

If you want a second factor mechanism for your webmail, RDP, SSH, VPN, Firewall take a look at the duosecurity website. It is pretty nice.

I hope you make use of this info in a good way and protect yourself.

by Renato de Oliveira

Rename those default Windows accounts (Security)

Rename Default  Windows Account Names

By default, Windows has two built in very well known account names, they are:

• Administrator
• Guest

I cannot stress enough, how well known these two accounts are across the Internet . 

So it is very important to take the following steps.

a) Rename both accounts.

b) Choose a very unusual name

c) Guest account is disabled by default. DO NOT ENABLE IT!

d) Set a very strong password for both accounts

e) Disable DIAL-IN for Guest account

f) For admin accounts, choose a 12 character password or longer

g) In the password use Capitals, Numbers, Symbols and lower case

Note we will not prevent a break in by renaming these accounts, but we will make it at least a bit harder. By making it harder, you give yourself time.

Don't just rename the Administrator account to 'admin' this is even easier to guess. Use your imagination, create a theme for your admin account names. Use long numbers.

Rename these accounts before you put your server or client in production, make it part of your security base line policy.

Remember never leave default user names.

by Renato de Oliveira

Security (Default config left behind) a guilty industry

Security (Default config left behind) a guilty industry

Recently about a month ago, a website has gone up which explores video cameras and display images captured from these video links on this Russian website.
Some of these cameras are at homes, companies, public gyms etc see the article at BBC News: http://www.bbc.co.uk/news/technology-30121159

While I understand this is a security risk and can be used with the wrong intentions and be exploited, I also see that this is a wider problem and needs to be addressed at the top.

Once again defaults being left behind! Is that a joke or what?!
As I said in one of my previous articles, it is partially our fault, but majority of the guilty and blame should be passed to manufacturers. They should know better!

In this new world we are living in, anything can be exploited and it will not take long, if you set up a website at home in your PC, it can be accessed in Brazil almost instantly. It is quick and this sort of information spreads even more quickly.

Some of these devices being sold as consumable, they can open up a lot of security issues in your network, home, anywhere.

While we wait for some regulations to be put in place (I think it will take a long time) security is a top down issue. Any product should leave the factory with a basic level of security!

Some easily, guessable user names being used on some of these devices are:

• Admin
• Administrator
• root
• guest

Information like this can be found anywhere on the Internet. So when you buy any device which requires

1. Connection to the Internet
2. Connection to a Network 

Look out for the basic security:

• Change the default password
• Change if you can the default username (too easy to guess)
• Set account lockout 
• Set idle timeout
• Set HTTPS
• Disable HTTP
• Disable TELNET
• DISABLE FTP
• If you can link the account or service to Google Authenticator do it!
• Enable the built in firewall if available
• Set IP restrictions to certain IP addreeses

These are just some of the basic security, if followed a lot of problems will be avoided and will keep a lot of bad people out.

by Renato de OLiveira

 

How to Disable SSL V3.0 on Apache Red Hat (POODLE attack part 5)

Disable SSL V3.0 on Apache Red Hat (POODLE attack part 5)

If you are running Apache on Redhat this is how you disable SSL V3.0.

1. Log in to your Linux Redhat
2. Become root or use sudo.
3. Edit /etc/httpd/conf/ssl.conf

Replace the line:

SSLProtocol all -SSLv2 with the line below

SSLProtocol all -SSLv2 -SSLv3

Save the file and restart Apache

/etc/init.d/httpd restart

or

service httpd restart

That is it

By Renato de Oliveira

Security part 5 (Securing your phone)

Security part 5 (Securing your phone)

There were a lot of talk recently on the media about phone hacking. Loads of bad press and a lot of exploitation of unaware users. Some of us do know and understand the risks, but we never really think it can happen to us and to a degree we are complacent. We are used to use defaults, to want the easiest possible.

I Think a certain level of security should be enforced by manufacturers, and not expect users to know how to lock down things. Some of services the default password is: admin or blank or 0000.

Come on, this is like a joke! 

Manufacturers need to take more responsibility and face for the fact that they should know much more than users.

We have to understand a smart phone is pretty much a very powerful, portable PC. Some of these phones are much more powerful than PCs manufactured few years ago, they have better CPU/Processor, they have more memory, even more storage, they are connected to the Internet and guess what where is the firewall?!!!

In this article I am going to try and cover some of the basic security issues we face, and how to try and prevent it from happening, give some tips on what to do in case the worse does happen.

Let's cover the basics

1. How to prevent unauthorised people from using your phone?

Most phones have a built in mechanism to be enabled and ask for a pass code, PIN number or both.

• 1. Set your phone to autolock
• 2. Set a PIN number or pass core
• 3. Set it for a strong PIN number

These steps will certainly keep most unauthorised users out of your phone.

    2. How to prevent people accessing messages left to you on your voice mail?

Again most phones and network operators allow you to set a password for:

• Listening to messages
• Saving messages
• Deleting messages

Set a password, PIN number for your voice mail. Do not forget to set it..

    3. Set "Restrictions" or "Parental control" for using Apps and placing calls. It is like a second layer of protection in case your PIN number has been compromised.

   4. If you want privacy, disable "Location Services". 

If you have Location services or similar on, any application installed on your smart phone will advertise your location across the Internet to anyone. It will be very easy to track your location as you move from one place to another.

5. Do not even consider Jail breaking your smart phone, you do not know what hidden traps might be left. It is not a good idea for various reasons a) you are violating warranty b)there may be back doors left to allow data leaking.

6. Install an anti virus: Norton, Mcafee, Trendmicro etc.

As I mentioned above, don't treat your smart phone any different from a PC, it is a powerful PC in your pocket.

7. Install a Firewall, there are many different types of Firewalls available for Android and for iPhones IOs.

A Firewall is an application which protects your PC/Phone from unauthorised connections etc.

8. Only install Apps from AppStore and Google store

9. Do no use FREE WIFIs, they are very insecure and sometimes they are set up to collect data, for example: If you read your email using a FREE WIFI, whoever is the owner of the WIFI might be there also reading your messages, they might get hold of your password. SO do not use public FREE WIFI.

10. How to prevent loosing your Phone?

You can buy a dice which will sound a beep if you are distant from it. Something like this:

http://www.kensington.com/us/us/4570/proximo-find-your-phone-items-easily

11. Download and install "Find My iPhone" app for Apple devices or Android. This is an app which if set up correctly and prior to haven lost your smart phone, it can be a very good tool

• Locate the device
• Send messages to the lost device
• Deleting the data off your lost device

12. If you have lost your device

• Please do notify your Network provider ASAP
• Do not leave it for the next day, contact Network provider ASAP
• If the everything above has been followed, then you are in a good proposition
• Communicate the police

NOTE: Remember if you lost your phone and did not communicate in time to your Network provider, any calls made using your phone you will be the one asked to pay. 

13. Set your phone to auto wipe the data if 10 consecutive attempts to login have failed.

This is not a comprehensive list of security measures you can take, it is only a simple guide to give you some basic protection against many different scenarios.

You can implement other features and security measures, just spend some time researching.

You can use the same advice for many different devices i.e. iPads, Tablets, etc.

I hope this will be helpful to you and will open your eyes to this new world we are living, if we don't protect ourselves, people out there will exploit and take advantage.

By Renato de Oliveira

How to Disable SSL V3.0 for Google Chrome (POODLE Attack part 4)

How to Disable SSL V3.0 for Google Chrome 

If you use Google Chrome, here it is how to disable SSL V 3.0. 

1. Right click at your Chrome's desktop icon
2. Properties
3. At the end of the target field enter:
   " --ssl-version-min=tls1"
4. Apply
5. Quit Chrome
6. Double Click on it again to open it

To prevent connections falling back to SSLv3 from being created, Google security engineer Adam Langley said that in Chrome 39, the ability to fallback to SSLv3 will be disabled by default.

"SSLv3-fallback is only needed to support buggy HTTPS servers," Langley said in a post to the Chromium security mailing list. "Servers that correctly support only SSLv3 will continue to work (for now), but some buggy servers may stop working.

How to Disable SSL V3.0 For Client (Win7) (POODLE attack part 3)

How to Disable SSL V3.0 For Client (Win7)

Don't forget to disable also for all your Windows clients. Through out the network.

Home users please do follow these steps to disable SSL v 3.0 and if you use IE disable it there as well.

You can disable support for the SSL 3.0 protocol on Windows by following these steps:

1. Click Start, click Run, type regedt32 or type regedit, and then click OK.
2. In Registry Editor, locate the following registry key:
   HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client
   Note If the complete registry key path does not exist, you can create it by expanding the available keys and using the New -> Key option from the Edit menu.
3. On the Edit menu, click Add Value.
4. In the Data Type list, click DWORD.
5. In the Value Name box, type Enabled, and then click OK. 
   Note If this value is present, double-click the value to edit its current value.
6. In the Edit DWORD (32-bit) Value dialog box, type 0 .
7. Click OK. Restart the computer.

Note This workaround will disable SSL 3.0 for all client software installed on a system.

Note After applying this workaround, client applications on this machine will not be able to communicate with other servers that only support SSL 3.0.

by Renato de Oliveira

How to Disable SSL V 3.0 for Windows Servers (Protect against POODLE attack) part 2

Disable SSL 3.0 in Windows For Server Software

We have to remember to turn SSL V 3.0 on all servers, especially the ones facing the Internet or hosting IIS and handling HTTPs.

You can disable support for the SSL 3.0 protocol on Windows by following these steps:

1. Click Start, click Run, type regedt32 or type regedit, and then click OK.
2. In Registry Editor, locate the following registry key:
   HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
   Note If the complete registry key path does not exist, you can create it by expanding the available keys and using the New -> Key option from the Edit menu.
3. On the Edit menu, click Add Value.
4. In the Data Type list, click DWORD.
5. In the Value Name box, type Enabled, and then click OK. 
   Note If this value is present, double-click the value to edit its current value.
6. In the Edit DWORD (32-bit) Value dialog box, type 0 .
7. Click OK. Restart the computer.

Note This workaround will disable SSL 3.0 for all server software installed on a system, including IIS.

 You can disable support for the SSL 2.0 protocol on Windows by following these steps:

1. Click Start, click Run, type regedt32 or type regedit, and then click OK.
2. In Registry Editor, locate the following registry key:
   HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
   Note If the complete registry key path does not exist, you can create it by expanding the available keys and using the New -> Key option from the Edit menu.
3. On the Edit menu, click Add Value.
4. In the Data Type list, click DWORD.
5. In the Value Name box, type Enabled, and then click OK. 
   Note If this value is present, double-click the value to edit its current value.
6. In the Edit DWORD (32-bit) Value dialog box, type 0 .
7. Click OK. Restart the computer.

 Note This workaround will disable SSL 2.0 for all server software installed on a system, including IIS.

Note After applying this workaround, clients that rely only on SSL 3.0 will not be able to communicate with the server.

POODLE Attack (which stands for "Padding Oracle On Downgraded Legacy Encryption)

The POODLE attack (which stands for "Padding Oracle On Downgraded Legacy Encryption)

Recently a lot of security issues have been uncovered. Poodle was discovered back in  September 2014 by the Google security team, this can lead to a Man in the Middle exploit which takes advantage of Internet and security software clients' fallback to SSL 3.0.

POODLE is an example of a vulnerability that succeeds thanks to a mechanism designed for reducing security for the sake of interoperability.

I am not go into too much details about this vulnerability. if you really want to understand it fully and the ins and outs I suggest you read this article: https://www.us-cert.gov/ncas/alerts/TA14-290A

We must disable the support for SSL V 3.0 and this is what I will show you. How to disable it for various different OSs and different servers, devices and applications. 
I would like to stress this is a serious vulnerability and it is strongly recommend you do disable SSL V 3.0.

Let's deal with the easy part. 
How to disable SSL V 3.0 support for Internet Explorer.

1. Click on "Tools" menu option
2. Click on "Internet Options"
3. Click on [Advanced] tab
4. Scroll the bar on the right, right to the bottom
5. Dis-Select "Use SSL 3.0"
6. Dis-Select "Use SSL 2.0"
7. Select "Use TLS 1.0"
8. Select "Use TLS 1.1"
9. Select "Use TLS 1.2"
10. Click on [OK]

Note  After applying this workaround, Internet Explorer will fail to connect to Web servers that only support SSL up to 3.0 and don’t support TLS 1.0, TLS 1.1, and TLS 1.2. 

Disable SSL 3.0 and enable TLS 1.0, TLS 1.1, and TLS 1.2 for Internet Explorer in Group Policy

You can disable support for the SSL 3.0 protocol in Internet Explorer via Group Policy by modifying the Turn Off Encryption Support Group Policy Object.

1. Open Group Policy Management.
2. Select the group policy object to modify, right click and select Edit.
3. In the Group Policy Management Editor, browse to the following setting:
   Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> Turn off encryption support
4. Double-click the Turn off Encryption Support setting to edit the setting.
5. Click Enabled.
6. In the Options window, change the Secure Protocol combinations setting to "Use TLS 1.0, TLS 1.1, and TLS 1.2".
7. Note It is important to check consecutive versions. Not selecting consecutive versions (e.g. checking TLS 1.0 and 1.2, but not checking 1.1) could result in connection errors.
8. Click OK.

Let's make a bit more difficult for these people who want to take advantage!

Nets post I'll show how to disable for Windows client and server by editing the registry.

by Renato de Oliveira