Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 45 guests and 2 members online
 
Free Business and Tech Magazines and eBooks

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Malwarearrow 12 Steps to a malware free existence
EH-Net
May 21, 2013, 12:47:01 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: 1 [2]   Go Down
  Print  
Author Topic: 12 Steps to a malware free existence  (Read 10999 times)
0 Members and 1 Guest are viewing this topic.
Hudson185
Newbie
*
Offline Offline

Posts: 12


View Profile
« Reply #15 on: November 28, 2012, 11:57:08 AM »

I assume that the sd cards are read-only and that no hard disk is not mounted. The files on the read only sd card are encrypted with truecrypt and the password for truecrypt is on a Yubikey to decrypt. The passwords are in Keepass a password manager and require keyfile on a separate read only sd card. Also I assume the power user is smart enough to change the default root password and run no-script on firefox.
Logged

Certifications:
OSWP
chrisj
Hero Member
*****
Offline Offline

Posts: 1163


View Profile WWW
« Reply #16 on: November 28, 2012, 01:58:08 PM »

I assume that the sd cards are read-only and that no hard disk is not mounted. The files on the read only sd card are encrypted with truecrypt and the password for truecrypt is on a Yubikey to decrypt. The passwords are in Keepass a password manager and require keyfile on a separate read only sd card. Also I assume the power user is smart enough to change the default root password and run no-script on firefox.

Read only or not, it's still accessible. I don't need to write to things, to have the ablitly to start copying your data.

however as root, the command mount -o rw <insert target drive> is a thing as well.

Keypass has stuff in memory, not hard to do a memory dump as root.

As for the power user... At DerbyCON, lots of clue full people there, a network scan turned up over 100 backtrack boxes with default login creds of root /toor.

Like I hinted before, if you want to be serious about it. Load TAILS.
Logged

OSWP, Sec+
Hudson185
Newbie
*
Offline Offline

Posts: 12


View Profile
« Reply #17 on: November 28, 2012, 02:11:27 PM »

TAILS is for anonimity not security Tor's security sucks (http://nspill.blogspot.com/2010/04/tor-exit-node-sslstrip.html) but it's anonymity is good. Using backtrack 5 R3 with vpn is much more secure but it's not anonymous. Also the chances of having a attacker that is dedicated is really low. Compared to Windows and Mac and Ubuntu your much more secure.
Logged

Certifications:
OSWP
tturner
Sr. Member
****
Offline Offline

Posts: 432


View Profile WWW
« Reply #18 on: November 28, 2012, 04:36:21 PM »

Using backtrack 5 R3 with vpn is much more secure ...

More secure than what? a soggy napkin? If you want secure, run a stripped down gentoo or *BSD box with only the bare necessities, no compiler, services disabled, FDE, etc. BT5 not only runs as root (yes you can change but, I run a BT5 VM with a locked down user and su when I need root but it's still very insecure) but has so much cruft installed you will have an extremely hard time making it secure. That's not what it's designed for. Choose the right tools for the job. Hell I'm pretty sure my Windows 7 box the way I have it locked down is more secure than most BT5 installs.
Logged

Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GCIH, GSEC, OPSE, CSWAE, CSTP, VCP

WIP: OSWP, GSSP-JAVA, GXPN

Udacity on hold, again. I suck.

http://sentinel24.com/blog  @tonylturner http://bsidesorlando.org
jinwald12
Jr. Member
**
Offline Offline

Posts: 77



View Profile
« Reply #19 on: November 28, 2012, 09:24:52 PM »

Why is everyone saying BackTrack is outdated? It's based off an LTS version of Ubuntu and is still completely supported: https://wiki.ubuntu.com/LTS

it's based off of 10.04 (lucid) which while in theory is still LTS but does not get nearly as much attention as other releases and BT uses different repos then normal lucid for most of it's programs which have out dated versions (with the exception of firefox and a few others) and they slapped on a kernel version that is no where near what lucid was designed to work with.
Logged

where did all the fun go?
ajohnson
Recruiters
Hero Member
*
Offline Offline

Posts: 1057


aka dynamik


View Profile WWW
« Reply #20 on: November 29, 2012, 08:26:31 AM »

it's based off of 10.04 (lucid) which while in theory is still LTS but does not get nearly as much attention as other releases and BT uses different repos then normal lucid for most of it's programs which have out dated versions (with the exception of firefox and a few others) and they slapped on a kernel version that is no where near what lucid was designed to work with.

I guess that depends on your definition of "outdated" then. A 10.x release is obviously not going to have all the bells and whistles as a 12.x release, but it's not unsupported or neglected either.

Back to the main topic, BackTrack really shouldn't be used as a "secure" distro since that's not its purpose. As mentioned by others, it has numerous changes that make it less secure right out of the gate (default password of toor, root SSH login enabled, etc.) Are you really going to change your password and disable root SSH logins every time you launch the live CD? Why would you even want to deal with having to harden your system every time you boot it? Spend $8 on another thumb drive and use a distro that's designed for security.
Logged

WIP: GCFA | www.infosiege.net | @infosiege

The day you stop learning is the day you start becoming obsolete.
chrisj
Hero Member
*****
Offline Offline

Posts: 1163


View Profile WWW
« Reply #21 on: November 29, 2012, 10:34:53 AM »

TAILS is for anonimity not security Tor's security sucks (http://nspill.blogspot.com/2010/04/tor-exit-node-sslstrip.html) but it's anonymity is good. Using backtrack 5 R3 with vpn is much more secure but it's not anonymous.

T.A.I.L.S is about more than anonymity. T.O.R. is just one of the things it uses, it's just the one that gets the most press. It has other features built in, so if you're running it, your protected. It boots more secure than BT5r3 does. Firewall on by default. Blocking inbound connections. You also don't have to use TOR on it if you don't want to.
Logged

OSWP, Sec+
Hudson185
Newbie
*
Offline Offline

Posts: 12


View Profile
« Reply #22 on: November 29, 2012, 01:55:07 PM »

Tried out T.A.I.L.S it's cool and user friendly but it lacks wine and truecrypt. So I still would say backtrack 5 r3 is a better choice if your only going to use a live cd.
Logged

Certifications:
OSWP
Hudson185
Newbie
*
Offline Offline

Posts: 12


View Profile
« Reply #23 on: December 24, 2012, 10:22:07 PM »

Also posted this on hak5.org encouraging people to come to ethicalhacker.net

157 views so far...
http://forums.hak5.org/index.php?/topic/28192-12-steps-to-a-malware-free-existence-using-a-backtrack-5-r3-live-cd/
Logged

Certifications:
OSWP
chrisj
Hero Member
*****
Offline Offline

Posts: 1163


View Profile WWW
« Reply #24 on: December 25, 2012, 01:53:27 PM »

You can install other packages as you need them. Sine T.A.I.L.S. is already dvd sized, it would be worth a try to contact the dev to install those in the next version of the dvd.
Logged

OSWP, Sec+
Hudson185
Newbie
*
Offline Offline

Posts: 12


View Profile
« Reply #25 on: December 25, 2012, 07:52:45 PM »

You can install other packages as you need them. Sine T.A.I.L.S. is already dvd sized, it would be worth a try to contact the dev to install those in the next version of the dvd.

That's defiantly a good idea. It would be great to see wine and truecrypt on a more user friendly OS like  T.A.I.L.S.
Logged

Certifications:
OSWP
Hudson185
Newbie
*
Offline Offline

Posts: 12


View Profile
« Reply #26 on: December 26, 2012, 09:51:54 PM »

I wrote the developers I doubt we will see Wine on T.A.I.L.S.
Aslo the developers do not like truecrypt

"... Tails developers do not recommend TrueCrypt. We include TrueCrypt only to allow users of the (old and now unsupported) Incognito live system to access the data on previously created media. In the future, we would like to provide proper alternatives and stop distributing TrueCrypt. This means that you should not create new TrueCrypt media if you intend to stay with Tails in the long run."
I would say that backtrack 5 R3 is still the best choice at the moment

Please add Wine and TrueCrypt
Inbox
   x
Hudson Seiler <>
   
Dec 25 (1 day ago)
      
to tails-dev
Hello recently I wrote an article about avoiding banking trojans and bots on http://www.ethicalhacker.net using Backtrack 5 r3 live cd. I thought that Backtrack 5 r3 was okay for the power user, but not the common user. Then I was told about Tails my only complaint with it is the lack of Wine and TrueCrypt. It would be awsome if you could add Wine and TrueCrypt to the live cd.

article
http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,9571.0/

sincerely,
Hudson Seiler

Reply

   
5:27 PM (4 hours ago)
      
to Tails, me
> Truecrypt is very useful indeed, but it can be installed on Tails,
> simply download the tar.gz package from truecrypt.org and execute the
> script, it will install it.
>
> I also recommend to the development team that truecrypt should be
> included by default and come with the DVD already.

TrueCrypt is already included in Tails, please refer to the doc:

https://tails.boum.org/doc/encryption_and_privacy/truecrypt/.

Regarding Wine, Tails is not meant to be a general purpose operating
system but a selection of tools designed to answer some particular use
cases, see our design doc:

https://tails.boum.org/contribute/design/

Apart from the fact that I really doubt we want to encourage people
running probably non-free software through Wine. How would Wine help us
fulfil better our goals?
« Last Edit: February 13, 2013, 09:59:13 PM by Hudson185 » Logged

Certifications:
OSWP
encryptedmind
Newbie
*
Offline Offline

Posts: 8


View Profile
« Reply #27 on: April 17, 2013, 04:43:51 AM »

For most of the layusers getting to work on complicated software is not really their thing. A simple truecrypt based encryption works well.

Couple that with a top ranking AV product and a top ranking firewall (free or fee) should do the trick.

2 step verification is recommended. Local downloaded mails should be encrypted as well.

The think I would do optimally is to create a virtual hard disk in vmware and use that sandboxed environment for much of the daily tasks. Keep the fully installed and configured virtual machine image as a backup in an external HD for retrieval.

Use a sandboxed browser like chrome in a sandboxed environment like sandboxie within a virtual machine. Use shared folder only when really required. Couple more security with deep freeze for total recall. Optimally use a vpn / tor.

Take system file hashed once in a while to make sure of the system integrity.

The rest is just net common sense, dont surf dubious link, download software from suspicious sources. Scan files before installation.

THE MOST IMPORTANT RULE OF ALL -- TAKE REGULAR BACKUPS OF EVERYTHING YOU THINK IS USEFUL, EVERYDAY/EVERYOTHER DAY.

The above rule has saved my a*** many many a times.

Computers and computer software are not perfect because we humans are not perfect.

« Last Edit: April 17, 2013, 04:48:23 AM by encryptedmind » Logged
Pages: 1 [2]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.069 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.