2014-10-15 Michael BoelenCrypto, Software, System Administration, Vulnerabilities Leave a comment

Protect Linux systems against SSLv3 Poodle vulnerability

What is the Poodle vulnerability ? The “Poodle” vulnerability is basicly an attack on the SSL 3.0 protocol. It is discovered in October 2014. The flaw is in the protocol itself (not implementation), which makes the issue applicable for all products using SSL 3.0. TLS 1.0 and later are considered safe against the attack. How does the attack work? While we won’t go into too much depth of encryption and ciphers, we will share some basics. When SSL 3.0 is […]

2014-10-13 Michael BoelenLynis, System Administration Leave a comment

Installation of Lynis on Arch Linux systems

Install Lynis on Arch Linux Tutorial for Lynis installation on Arch Linux Pacman Arch Linux is getting more popular, due to its great community support and the way it is organized. Being a “rolling release” system, it is continuously up-to-date. Of course you want to make sure your security defenses are equally up-to-date, so that’s where Lynis comes in. Normally pacman is used for installing new packages. Unfortunately, the lynis package does not show up. [root@archlinux ~]# pacman -Ss lynis […]

2014-10-09 Michael BoelenAuditing, Hardening, Software, System Administration, Vulnerabilities Leave a comment

How to solve Shellshock on Debian and Ubuntu

Protect against Shellshock For Debian and Ubuntu Shellshock is a serious software weakness, or vulnerability, in Bash. This shell is used on almost all Unix based systems, including Debian and Ubuntu. As it can be used without much efforts and remotely exploit systems, it has a maximum vulnerability score according to CVSS. Upgrade Bash First update the software repository with apt-get, using the update parameter. apt-get update && apt-get install –only-upgrade bash Your system should now have a newer version […]

2014-10-07 Michael BoelenInformation Gathering, Software 2 comments

Linux host discovery with Nmap

Linux host discovery Using Nmap Not everyone has the budget to buy an expensive software suite to do host discovery on the network. Fortunately there are some great open source alternatives. By combining the right tools we can discover hosts and filter the ones we are looking for. In this article we have the goal to determine what systems on our network are running Linux. Of course it is easy to swap out some pieces in the examples to do […]

2014-10-01 Michael BoelenAccounting, Auditing, Logging Leave a comment

Creating audit trails – Logging commands on Linux with Snoopy

Creating audit trails Logging commands on Linux with Snoopy Our customers often want to set-up an audit trail for accounting purposes. When something happens, they want to be able to see what happened, when it did and by whom. Defining an audit trail is also becoming mandatory for compliance, like PCI. One possible solution we cover is using Snoopy, a small library to log executed commands. How it works Snoopy is a wrapper around the execve() function. This is a […]

2014-09-26 Michael BoelenVulnerabilities Leave a comment

How to protect yourself against Shellshock Bash vulnerability

Shellshock vulnerability – Bash Bash is one of the most used shells on Unix based systems. The newly discovered “shellshock” vulnerability affects millions of systems. The weakness abuses an internal check when Bash gets a variable declaration. By defining this variable and putting more “stuff” (commands) in it, Bash will actually execute those commands as well. Unfortunately this results in several possible ways to exploit it by attackers. Websites One way this vulnerability scan be exploited, is by embedding it […]

2014-09-12 Michael BoelenVirtualization 2 comments

Docker Security: How Containers (Not) Help You

Docker and Security Things about containers Security is hot and so is Docker. During the last years Docker has become one of quickest growing container techniques for Linux. While system virtualization continues to grow, the technology allowing flexible containers is growing even faster and starting to compete. In this article we have a look how containers may help you with you security needs and Docker security in particular. How containers work Containers are like “chroot” on steroids. Where chroot is […]

2014-08-30 Michael BoelenAuditing Leave a comment

Linux Security Scanning for Dummies

Linux Security Scanning for Dummies Every system needs some level of protection. Still, many people simply forget to do it, or can not find the time to properly do it. To be as efficient and effective as possible, let’s take at a structured way for security scanning your Linux machines. The 5 dummy steps are: 1. Focus on risk Like not every company is a bank, our systems are not all part of a top secret mission. We have to […]

«1…19 202122 23…28 »