It had to happen sooner or later; as Linux gains an ever-increasing foothold (Linux market share to reach 7% in 2008 ) in the market, it will become a viable target for criminal hackers. According to the U.S. Computer Emergency Readiness Team (CERT) in US-CERT Current Activity, attacks are already underway:
US-CERT is aware of active attacks against linux-based computing infrastructures using compromised SSH keys. The attack appears to initially use stolen SSH keys to gain access to a system, and then uses local kernel exploits to gain root access. Once root access has been obtained, a rootkit known as “phalanx2″ is installed.
Phalanx2 appears to be a derivative of an older rootkit named “phalanx”. Phalanx2 and the support scripts within the rootkit, are configured to systematically steal SSH keys from the compromised system. These SSH keys are sent to the attackers, who then use them to try to compromise other sites and other systems of interest at the attacked site.
For now, the attack is easily detected (though variants of the rootkit will likely change its behavior): The attack creates a directory “/etc/khubd.p2/” that is hidden from “ls,” but it can be entered with “cd /etc/khubd.p2″. Any directory named “khubd.p2,” regardless of its location, is hidden from “ls” but can be entered using “cd.” Additionally, “/dev/shm/” may contain files from the attack, so anything unusual in there is suspect. You can also try searching for hidden processes and checking the reference count in “/etc” against the number of directories shown by “ls”.
Check out the full article, “SSH Key-based Attacks” for complete details on risk mitigation and compromise response.
Houston, we have malware. (Sorry, I had to do that.)
Apollo 13 had real live mechanical malfunctions that could have resulted in the mission earning a place in our space program’s disaster timeline between Apollo 1 in 1967 and the Challenger disaster in 1986. Fortunately, that didn’t happen–Apollo 13 went down in history as a close call. Unfortunately, physical problems with the heat shield tiles resulted in the Columbia disaster in 2003. Now, the space program faces another threat–this time, a non-physical one–in the form of malware invading laptops aboard the International Space Station (ISS).
In the article, “Houston, we have a virus” in The Register, “The infected machines were not considered mission critical, meaning they weren’t responsible for command and control. The NASA spokesman was unable to say if the infected laptops were connected to mission-critical systems.”
What if there are?
Security is not optional–it’s mandatory. Especially when lives are at stake.
According to Panda Security, the Oscarbot.UG virus, first detected on August 17, 2008, uses intelligent stealth techniques to avoid detection. “It deletes the original file from which it was run once it is installed on the computer. It uses several methods in order to avoid detection by antivirus companies [one of them being that it] terminates its own execution if it detects that it is being executed in a virtual machine environment, such as VMWare or VirtualPC.”
As reported by Help Net Security, the worm “stops running if it finds that it is being tried on virtual machines such as vmware, a sandbox or in a honeypot (these tools are often used to check in a controlled environment if an executable file is running malicious commands).
The good news is that anyone running a virtual environment is safe from infection: The worm won’t run and when you shut down the virtual machine, it’s gone. The bad news is that malware using this type of intelligent stealth is on the rise, raising the bar for anti-malware researchers.
At what point do we switch from a reactive anti-malware approach (blacklisting) to a pro-active one (whitelisting)? The day is fast approaching (it may already be here) when the programs designed to protect us become so huge and so invasive that they prevent us from getting any useful work done.
The best way to combat malware would be to take the profit out of spam, phishing scams, and other cyber-fraud crimes.
I don’t have the answer for that one.
Though you probably don’t think of it as software, Microsoft Windows Update is a web-based application that’s a vital part of your secure computing initiative. As recently as last month, I had to clean up a system that had been severely infected with malware. One of the steps in my cleanup process was to check the service pack; turns out this user was still on service pack 1a because automatic updates had been turned off. (While some argue against it, I recommend that all home users turn them on; in a corporate environment, the IT department usually manages things.) If you’re still running XP, go ahead and install service pack 3.
That takes care of Windows, but what about security updates and patches for all of the other software on your system? Windows isn’t the only security risk — every application you run has potential issues. You need to keep ALL of your applications patched. Secunia’s Online Software Inspector is an excellent tool for scanning your system to discover commonly installed applications that need updates. It first looks for missing Microsoft updates then checks other software such as Apple QuickTime, iTunes, Adobe Flash Player, and Sun Java. My most recent online scan took less than three minutes and found 9 of 15 applications had missing updates. Needless to say, I patched them all.
Worth repeating: Keeping your system patched is a vital part of your secure computing initiative.
In the 1986 hit movie, The Karate Kid – Part II, the kid’s instructor, Mr. Miyagi, uttered this famous line: “Best way to avoid punch, no be there!” Good advice, indeed; it’s one of those universal pieces of truth that’s so obvious, it’s overlooked. The beauty of it is that it can be applied to anything. In this case, I’ll apply it to spam email, the electronic equivalent of a punch: “Best way to avoid spam, no have email address!”
That’s not exactly practical; we all have an email address. Some of us have several of them (at last count, I have at least nine addresses and I’m sure I’ve missed a couple somewhere). In my final installment of the “How to Secure Your Computer” series, “If Spam has You Irate, Obfuscate!” I gave examples of how you can make your email address unreadable by web bots. Well, that can be a bit of work, forcing you to cut and paste, and make other efforts that can quickly become tedious. There’s an easier way.
Enter Mailinator, the completely anonymous email address that you create on-the-fly when you need to enter an email address but don’t want to use your real one. From their site:
How do I create an account at Mailinator? It’s simple, you just send email to it. Temporary accounts are created when email arrives for them. First, you give out the mailinator email address you created, and then you check it. It’s that simple.
Do I have to sign up? No sign-up, you don’t even have to tell Mailinator you’re coming.
It’s a valid, working email address that you can check just by visiting the site. Of course, anyone can check it just by entering the address in the “Check your inbox” box. Not the best of situations, so they fixed it by providing alternate inbox names . In a nutshell, you use the alternate inbox name for your email address when you post it publicly. Anyone who enters the alternate inbox name will simply get a “no messages” message. Pretty slick.
The beauty of Mailinator is that it provides a valid email address; you can download stuff from and subscribe to those sites that require clicking links in confirmation emails without having to worry about exposing yourself to spam. Use the alternate inbox name or even a different email address every time you need one.
Best way to avoid spam, no have email address — or at least use one you can throw away at will. Either way, you avoid the punch and the security risk.
Two of the biggest mistakes Microsoft ever made were tying Internet Explorer into the Windows OS and ActiveX. Exploits took advantage of both and some of the nastiest malware ever written entered millions of PCs through these vectors. I’ll be the first to acknowledge that IE7 has enhanced security and MS has taken some of the hooks out of the OS, but the old adage, “Once burned, twice shy” is my operating basis. Yes, you can configure IE to be relatively secure, but it’s more work than the average user is willing to do. Why not just use a browser that’s relatively secure to begin with?
Some things still (unfortunately) require IE, so you’ll have to use it sometimes; but, for everyday use, I don’t recommend it. Firefox 3 and Opera 9.5 are both inherently more secure than IE. Take your pick. Either way, you’ll be more secure on the Web.
I recently posted the last article in my How to Secure Your Computer series of security maxims (an eBook will be available shortly–stay tuned for details). While editing the book, I realized there’s a wealth of free and Open Source software available that can help anyone from the novice to the professional practice secure computing.
My “Nine Steps to System Security – 2008” (originally posted as “Seven Steps to System Security – 2004“) is the latest iteration of what is essentially the basis of all the maxims. It lays out a plan that’s been proven highly workable and will serve as a rough guide for the sequence of articles in the new series. The maxims will provide additional layers as the series develops.
At last count, there were 26 pieces of software mentioned in the main articles. Many of those will be grouped into a few general categories, but I believe the Software for Secure Computing series will be substantial.
First in the series will be “Software for Secure Computing: Secure Browsers.”
I’m flattered that Windows Secrets took my suggestion and published an article based on it. (Thanks, Scott!) I can’t give you a link because the article is only available to paid subscribers of the newsletter, but I will give you an excerpt:
By modifying the Hosts file yourself, you can prevent anyone using the PC without an administrator account from accessing unwanted sites. Prime candidates for blocking via this method are sites that host advertising, which can sometimes be a conduit for malware, as I explained in my Apr. 17 story.
To block a file served by the DoubleClick ad server, for example, you would add this line to your Hosts file:
My article on using a hosts file is the basis for this. Do it. You’ll be safer on the web.
You’re in luck. Call it the lazy man’s way to system security; if you install protection against the the three biggest threats to your on-line security–infections by viruses, worms and Trojans, malicious software (spyware, adware, browser hijackers) and crackers who wish to secretly access and control your PC–you’ll be protected from the worst of security problems. One caveat, however: if you go to questionable sites (you know the ones I mean!) and are in the habit of clicking on links in pop-ups and spam emails, you’re out of luck—nothing can help you because you’re inviting infection.
But, for those who generally try to avoid the bad stuff, these are the four bare security essentials: a NAT router; a good antivirus program; a good anti-malware program; and, a good software firewall. Simple, and highly effective for most users.
Before you ask, the answer is yes, you still need a software firewall, even if you already have a NAT router or hardware firewall. Most hardware firewalls are configured to keep bad traffic from getting in, but will let most traffic from your network out, so they don’t keep those sneaky tracking programs from phoning home. A software firewall will at least give you some warning when a program is trying to access the Internet and you can decide whether to allow it. Besides, it gives you an extra layer of protection, just in case.
I highly recommend you read and apply Nine Steps to System Security – 2008, but if you’re feeling a bit lazy today, the four essentials will get you by.
CAN-SPAM did little to deter or eliminate spammers, and today the spam problem is even worse thanks to huge botnets run by organized cyber-crime syndicates. Phishing attacks are harder to detect and more frequent. Recently, I spent the better part of two days cleaning up the aftermath of a mass mailer worm infection for one of our clients; their email is still being blocked by some servers. In its September 2005 issue, Consumer Reports said, “One Third Of Net Users Damaged By Malware.” Considering that article is three years old, I’d wager that the number of infected computers has doubled since then.
In my job as a systems engineer for Connective Computing, Inc., I deal with the effects of malware nearly every day. My previous releases of this article, “Seven Steps to System Security – 2004″ , and “Eight Steps to System Security – 2005“, listed the field-proven steps I recommend to everyone I know. It’s been nearly three years since I published the last guide, but those eight steps haven’t changed much; they just need to be brought up to date, and a new step involving disabling scripting in the browser has been added. Computer users still haven’t learned safe surfing practices, however (will they ever?), and must modify their on-line behavior–particularly by applying the first step–for rest of these steps to be truly effective.
Did I mention these things are proven? They are. These are practices have been protecting computer users in homes and businesses for as long as I’ve been using them. This is free advice that’s really worth something:
- Repeat after me: I will NEVER, EVER click on any pop-up of any kind – NEVER, EVER. Not even on the “X” (it’s usually safe, but why take the chance?). Use the key combination Alt-F4 instead; it safely closes the current window. In the slimy world of sleaze-ware, “No” means yes, “Cancel” means yes, “Close” means yes – ANY click on a button means yes. So many times users ask, “How did I get that? I clicked ‘no’ when it asked me!” Well, sorry, but you clicked, so they got you. NEVER, EVER CLICK!
- Although Internet Explorer 7.0 has enhanced security and has been detached somewhat from the Windows operating system, it is still too big a target. Crackers are still writing malware that exploits IE security flaws. I recommend you use Firefox or Opera to browse the Web. (Some web sites still require IE, so you’ll be forced to use it for those, but you should minimize its use otherwise.) Whatever browser you use, be sure you configure your preferences to block all unwanted pop-ups or install a pop-up killer like the Google Tool Bar. And while you’re at it, re-read #1!
- Patch your system. If you’re still running XP, make sure you have at least service pack 2. If you’re a home user, install service pack 3. (I still see systems that are running XP with service pack 1 or 1a, probably because they turned off automatic updates. While some argue against it, I recommend you turn them on.) And be sure to install any recommended security updates and patches for ALL software on your system, – especially Microsoft Office – not just Windows. If you’re running Windows Vista, you benefit from its enhanced security, but you still need to keep ALL of your applications patched. Secunia’s Online Software Inspector is an excellent tool for scanning your system’s applications to discover those that need updates.
- Besides installing a NAT router (see How to Secure Your Computer: Maxim #2), run a properly-configured, proven software firewall. Don’t rely only on Windows XP’s built-in firewall – it blocks inbound attacks only (see this article) and it has flaws of its own (see this article). It will not stop back-door trojans, adware, spyware, and the like from “phoning home” with your sensitive information. (See this article for more info.) While Vista’s firewall does offer outbound filtering, it isn’t much better (see this article for more information). My favorites are the Comodo Personal Firewall (free), and the Sunbelt Kerio Personal Firewall (full-featured for 30 days, then runs free in limited-feature mode, $19.95/yr for full version).
- Run a good anti-virus program. Choices abound. I have used AntiVir Personal Edition (free) and Grisoft’s AVG (free). Other good ones are Avast! and Comodo AntiVirus.
- Run multiple anti-spyware/anti-adware programs and keep them updated. I recommend: a. Spyware Blaster. This free program blocks adware and spyware from installing in the first place and is frequently updated; b. Ad-Aware. Scan weekly, more frequently if you are a heavy surfer; c. Spybot S&D. Run it on the same schedule as Ad-Aware; d. Microsoft’s Windows Defender is an excellent product and is installed by default in Windows Vista. Configure it for real time protection and automatic updates. One of the best commercial anti-spyware applications is Sunbelt Software’s CounterSpy. It is a PC World Best Buy award winner. Comodo BOClean:AntiMalware is also a good one and it’s free.
- Run a spam blocker to isolate junk e-mail. Most malware and all phishing attempts rely on spam. You want to isolate this stuff and delete it. NEVER, I repeat, NEVER, EVER click on a link in any e-mail you are not absolutely certain is legitimate. And to be as safe as possible, always type in the address of your bank, credit card companies, and any other site that you want to keep secure. (See #1 above and apply that principle to links, too!) One of the best programs is Open Field Software’s ella for Spam Control. It uses wizards to “train” it to your personal specifications. There are free and paid versions that work with Outlook, Outlook Express. My clients swear by it. Another good program is Sunbelt Software’s iHate Spam.
- On Windows XP, set up a restricted user account and use that for routine tasks. Only log on with administrative privileges when you need to install or configure software. This will prevent rogue programs from affecting your system – they won’t be able to install. You can activate the “run as” feature so you can do administrative tasks while logged in as a restricted user. Microsoft Knowledge Base article Q294676 explains how to activate and use this feature. If you are running Vista, you don’t have to worry about this step: User Access Control (UAC) takes care of it.
- Finally, disable scripting in your browser. If you use IE (you probably shouldn’t, see Step 2), Tony Bradley gives you an excellent step-by-step procedure to accomplish this. Firefox users have a more elegant solution in the form of an add-on: NoScript. I use it on every PC. Scripts are blocked globally by default, but you can selectively activate them if you trust the site. For example, you can trust the main site’s scripts but keep blocking any advertising or other third party scripts with no ill effects.
While total immunity is impossible – new infections and variations on existing exploits appear daily – these nine steps will help prevent, catch, or clean 98 percent of the junkware out there. As for the other two percent – or if you are already badly infected – you’ll need to hire a geek like me.