Security+ Topic - Removable Media Encryption

Do you remember the days of sneakernet?  That was a long time ago when people would move files between machines with a floppy disk as there was no network infrastructure.  These days its quite simple to transfer a file over the network but for some reason, the use of USB flash drives seems to have brought new light to the term sneakernet.  With how small they are and sometimes can fit nicely onto your keychain, USB flash drives have found their way back to being mainstream for moving files around.  Part of this is due to the mobility of laptops.  When in a desktop environment, files are usually moved on the network no problem but as people get together with laptops, it is much quicker to transfer files with a USB drive.

There are a couple big concerns with this process that needs to be addressed.  To start, you never know what is on that drive.  Most operating systems will have an automount and then an autoplay function to make it easy for you to open it up.  While this is a nice feature, it also lets in potential dangers.  An attacker may decide to have software setup on the flash drive that loads when inserted and then installs some sort of backdoor or phone home software.  There is even campfire stories of hackers installing malicious software onto cheap USB drives and then purposely leaving them around the city for people to plug into their computers.  So what is to prevent this, disabling autorun would be a good start.  Making sure your anti-virus software is up-to-date would also be good with on-load scanning.

The above paragraph is really the background that I want to give for this part though.  What about those files that YOU put on the drive.  Say you work from home sometimes and your internet service provider connection is really slow, so you decide that you will put your work onto a USB drive and offload it onto your desktop in the office the next day.  Sounds like a simple plan but what about that USB drive in transit?  Wouldn’t it be quite easy for it to slip out of your bag or fall out of the door of your car?  I could describe quite a few scenarios here but I hope you get the point.  Someone is most likely going to pick up that USB drive and plug it into their computer.  If that USB drive is not encrypted in some way, then you have opened up all your secret files to the public.

There are also a lot of cool ways to protect those files.  The easiest way would be to simply add a password to the file if the software allows you to.  This would still allow someone to see the files and possibly brute force their way into it.  Another option is encryption software such as bitlocker or truecrypt.  These can encrypt the entire USB drive so when someone plugs it in, the operating system just thinks it needs formatted as it cannot read the drive properly.  One of my favorite ‘cool’ ways of USB drive protection is my fingerprint reading USB flash drive.  When you first plug it in, the user is presented with a small accessible filesystem.  It also mounts a fake cd drive with fingerprint reading portable software.  After my fingerprint is authenticated, it unmounts the public filesystem and then mounts my private filesystem.  Neat eh?

Security+ Topic - Drive Encryption

Data encryption is a major part of computer security and this comes in at every form that you can think of.  From where the data originates, how it is transferred, and stored long term must all be taken into consideration.  Take for instance your mother's secret recipe.  It was on her fridge for years so you decide to make a copy of it on your computer.  Years later you donate the computer to the thrift store.  Then someone checks out the hard drive and the secret recipe is used to make millions at a chain restaurant.  Is this a silly example?  No.  It happens all the time where data is not secured and thus is exploited down the road.

Securing your data starts with where it originates most of the time.  Your computer.  When it comes to making sure that your computer is encrypted is usually thought of when it comes to laptops but it really does impact every computer you ever touch.  In the laptop realm it boils down to the fear of the computer being stolen.  Something happens at a coffee shop and the next thing you know it was stolen with no recourse.  Things like this happening is why employers require laptops to be encrypted.  They never know what may be permanently or temporarily stored on your laptop while you are away from the office.  Its a level of insurance and safety for company secrets.

I’m going to break off here in the realm of full disk encryption in regards to full disk encryption on virtual machines.  This is something that you don’t see much (these days) and most people don’t think about it.  Our virtual machines are the first thing that people think about when it comes to spinning up an environment for their needs.  They will then go through the process of firewall, hardening, password management, and more to make sure they are secure.  As the environment grows, what about the VHD or VMDK?  Backups will be taken and snapshots made.  The important take away point here is the risk of whole virtual machine theft and the ease of access after they have the virtual machine file itself.  Without encrypting the drive, the inside of the virtual machine file, they can mount the drive and take what they want.

There are two lines of thought here for encrypting the drive.  One is to simply encrypt the HDD where the virtual machine drive files exist.  This is fine except it is not protecting you.  Sure if someone walks away with the physical hard drive then its useless to them but if they can copy the virtual machine hard drive while the system is turned on then you just handed them unencrypted data.  The other line of thought is installing the encryption software inside of each virtual machine.  In large deployments this can be a nightmare to manage.  Especially if you are rebooting the server remotely and have no way to see the console for entering the encryption password.  There are trade-offs for the scenarios that must be taken into account.

Finally there is concern about the speed of the HDD responses with encryption software in place.  With todays encryption opens such as truecrypt (no longer supported, sad) and bitlocker, they are basically as fast as writing directly to the hard drive.  In situations where encrypting the drive is not an option due to certain company requirements, you may be left with the only option of a literal lock and key.  Lock down the network so they have no way to copy off the virtual hard drive and place the virtual host behind lock and key with no options for removable media.

Security+ Topic - Basic Network Security Tools

A common topic that comes up from people just getting into the computer security realm is what tools they can use to break into a computer.  Well that is a seriously loaded question with a lot of different directions you could go.  I want to take a moment and step back from the question and really dig into what most people are really asking.  To me it seems they want to know right from the start how to hack their neighbor in under 10 seconds like in the movies.  While you may be able to accomplish something similar to this deep into your career, it most likely isn’t going to happen from the start.

What really needs to happen at this point is the basic understanding of ports and what services may be associated with them.  I’m going to assume at this point that you have some sort of networking knowledge and will be able to follow the conversation without breaking down every point moving forward.  Every service listens on a port to do its normal functions.  Using this information some smart people have developed tools that can scan through a set of common ports to see what is currently accepting connections.  These port scanners can be very simple such as opening a TCP connection and then that is it or they can see what service is listening on that port by sending a query.  Generally speaking though, the tools such as nmap will simply open a TCP connection and then close it when done.  The list of ports it finds is then reported back with the common services associated with it.

We can then move on with the information of what ports are listening to something a little deeper.  A vulnerability scanner will take the list of ports it found to be open and start analyzing the information on those ports.  An example here would be a SMB server that the vulnerability scanner would send specific packets to in order to get more information.  A locked down system would simply report back that the port is open.  A less secure system would give out all sorts of information such as software version number and then try to make a connection based off that.  This is where the part about being a vulnerability scanner comes into play.  A simple port scanner is just for ports but a vulnerability scanner uses the version information reported back and does a search through its databases for known issues.  If it finds that you are running version 1.2.3 and there is a known issue with that version, it could formulate a specially crafted packet to take advantage of the exploit.  Now not all software does this.  Some white-hat software simply lets you know that there is a known exploit and then provides you with the CVE numbers for you to take action.

The next step in this whole thing is the protocol analyzers.  Generally speaking these are not used by the average joe.  Sure they are great tools for seeing what is going on with your network but until there is something interesting (such as an exploit) that you are able to take action on, there is not a ton to see.  Oh you made it this far?  Good.  I then want to talk for a moment about protocol analyzers and insecure transmissions.  The easiest way to explain to people about insecure protocols such as FTP and Telnet is to capture one of the sessions.  It becomes clear as day how insecure these protocols are and how a protocol analyzer can capture the data.  There is even protocol analyzer software available which monitors the network for these insecure connections and provides them in a GUI for the user to review.