Daily Security Tips from Ed Skoudis - Week of January 27, 2003
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Security Tip for Friday, January 31st, 2003
Talk About Monitoring in Your Warning Banners
Everyone knows you should have warning banners on your machines, alerting users who are logging in that they shouldn't do bad things. However, most warning banners leave out a crucial component of the warning. Your warning banner must state: "The use of the system may be monitored and recorded." This line informs users that they have limitations to their expectation of privacy on the system. It arms your incident handling team with the ability to monitor users' sessions when foul play is suspected. If you ever want to monitor an individual user's activities, however, make sure you get written approval from your HR organization to ensure you aren't violating the law.
Security Tip for Thursday, January 30th, 2003
Check for Hidden Data in Windows Alternate Data Streams
Attackers frequently hide data on Windows systems using Alternate Data Streams (ADSs). Any file or folder on a Windows partition formatted for NTFS can have arbitrarily large numbers of hidden files attached to them. These alternate data streams hide behind the original file or folder, and do not show up in Windows Explorer or a command-line dir listing. To find malicious files hidden in alternate data streams, use the free LADS tool by Frank Heyne available at http://www.heysoft.de/nt/ep-lads.htm. Note that some applications, such as word processors, store legitimate data in ADSs. Therefore, if you discover an ADS on your machine, look at the data to determine if it's malicious.
Security Tip for Wednesday, January 29th, 2003
When Grabbing a System Snapshot for Forensics, Grab Everything
When handling computer attack incidents, you need to create a copy of the impacted system early on in the incident handling process. Don't execute a bunch of commands before getting a backup of the system, because any commands you run could alter the crucial evidence you need to nab and prosecute the attacker. When making your backup for detailed forensics analysis, make sure you get a complete, bit-by-bit backup of the impacted system. If you just get a copy of allocated space, you'll likely miss a bunch of useful evidence. To get all of the evidence from your drive, make sure you get a copy of:
Allocated space (regular space where files are written)
Unallocated space (unused space where deleted files may still linger)
Slack space (extra space where a file doesn't fill an entire block, but may contain the attacker's data)
Bad blocks (which could be damaged space on the hard drive, or possibly a place where attackers hide data)
The dd program can be used on UNIX or Windows to get a copy of all of these items.
Security Tip for Tuesday, January 28th, 2003
Use a Separate Log Server to Minimize Log Alteration Attacks
Most attackers with any degree of skill alter the logs of a victim machine to hide their nefarious deeds. After taking over a system, attackers often delete incriminating log entries that show how they got in, or even put false entries in the logs to throw off your investigation. To minimize the possibility of log alteration by attackers, configure your machines to log to a separate logging server, especially your DMZ systems. If bad guys hack into your web server or DNS server, they won't be able to alter the logs, which are stored on a separate machine. The bad guy will have to attack your logging server, which should be very carefully hardened. On UNIX, the built-in syslog tool can send logs across the network to a logging server. On Windows, a variety of third-party logging tools support remote logging, such as TNT Software's ELM tools (http://www.tntsoftware.com/).
Security Tip for Monday, January 27th, 2003
Keep Your Domain Name Registration Current
When you registered your domain name (such as counterhack.net), you provided the technical, billing, and administrative contact names, addresses, and phone numbers for your organization. This data is publicly available on your registrar's web site, through a whois lookup. Make sure you keep your registration information up to date by checking it every quarter using the whois look up capabilities of your registrar (such as http://www.netsol.com/cgi-bin/whois/whois).
To help prevent social engineers from using the name and address information, consider using organization names instead of individual names for your registration contacts. For example, instead of listing "Fred Smith" as your technical contact, consider using "Internet Gateway Management Team". Regardless of whether you use a human or organization name, make sure you have a responsive person assigned to field calls and e-mails sent to your contact! You may get some very important indications about security attacks via this channel. Finally, make sure you know when your registration is scheduled to expire, and renew early to prevent someone from scooping up your domain name and stealing your traffic. Write this expiration date on your calendar so you don't forget to renew!