Using SMB to access a windows machine through port 139/445 is great, but how can this be used to exploit the system?I know this is gonna get flamed for the nature of hacking, but i'm trying to pen my own windows box with my sec spin of fedora (tried backtrack but didnt like the feel of it, so got the GNOME-security spin)I'm trying to find a way to open up c$ without sitting at my win box and sharing it.
"...The Fedora Security Spin provides a safe test environment to work on security auditing, forensics, system rescue and teaching security testing methodologies in universities and other organizations. The spin is maintained by a community of security testers and developers. It comes with the clean and fast LXDE Desktop Environment and a customized menu that provides all the instruments needed to follow a proper test path for security testing or to rescue a broken system. The Live image has been crafted to make it possible to install software while running, and if you are running it from a USB stick created with the LiveUSB Creator's overlay feature, you can install and update software and save your test results permanently..."
I've been trying to get Security Spin up and running (after having tried unsuccessfully with knoppix STD). I need to be able to connect to my home network, or hell any wireless network.I've tried using iwconfig wlan0 as well as the options in the Network Configuration panel as well as other related panels. I'm able to change and set up profiles for the wireless card, but not to activate them. The button just isn't clickable.If it helps, I'm running Security Spin from a unetbootin usb drive. The wireless card is identified by the system as "Intel Corporation PRO/Wireless 4965 AG or AGN [Kedron] Network Connection" .
Anyone know if the collection of STD tools have been included in Fedora repositories? Would love to recreate a STD disk based off of F12+ live cd and those tools. (Knoppix Secuity Tools Disk that seem to have died out a couple years back) Great tools, just the distro doesnt support new hardware....but if in a F12+package......all would be good.
I am currently running a 64-bit Fedora 14 server which hosts a game server, a voice server, and remote desktop functionality, each on a distinct TCP port. I am currently using the built-in firewall to deny all traffic other than ICMP ping/pong and TCP traffic on those specific ports.I am looking for a graphical application which will let me monitor any connections being made to my server in order to keep an eye out for possible security concerns. To be more specific, I'd like to be able to see the source IP addresses, TCP/UDP ports, and individual bandwidth in use by external connections being made to the server, along with any other information that might be helpful in identifying a possible intrusion attempt.
how efficient and effective are these snort, argus, ossec etc etc for an organization having 3500 PC Network, connected through 700+ Cisco Devices (Layer 2 and Layer 3), and scattered on 130 different sites (geographically)? what should be the combination of products and what should be the architecture for an efficient forensics activity?
I was under the impression the Linux (in my case the Fedora OS) is very secure. However I've learnt with deep concern that that one can have access to the system during system startup i.e one can give various startup directives and bypass the normal login UI to have direct root access.
Is there a way to disble this so that the directives during startup are fixed and cannot be altered. I would like to make the system secure to the maximum extent possible.
iam working on mail server in redhat centos. i want to know how to secure my mail server for heavy loading , any monitoring tools in GUI or console , is any essential tool which is used in Like MNC for mail server..
i know few command in like top,netstat,etc through google but i willing to know some more
Quote: The importance of security should never be underestimated. The consequences of losing data can be disastrous for any organisation. For example, the loss of a single unencrypted laptop may have huge repercussions. This could include breaching data protection legislation with the risk of a significant fine, a loss in the confidence of an organisation, as well as the risk that sensitive data may fall into the hands of a competitor or third party with malicious intent.
I can't get respond through normal channels, all I can use is my phone. My keyboard is disabled. My PC is pretty much a paper weight. Both of them. The only way they could be getting in is through the wifi. I don't know if there is anything I can do. My recovery programsare not accessible. Even onstartup. Is it possible to clear the hard drive another way? I've heard fire purifies, I couldn't get another disc to boot up to reinstall ubuntu. Please text me any ideas, but please be specific with command lines, I have trouble with all the () and / [ and where they go.
I have been setting up multiple security system in the area and was wondering what was the easiest way is to get the camera information that one would need in setting up survellance systems like zoneminder. I use xawtv for testing and
PHP Code: zmu -d <device_path> -q -v
But how can I get specific information about NTSC/PAL cameras or IP cameras. In other words is there a specific tool for that purpose? I can see my video cameras fine using xawtv -c /dev/video but can I look at those log files to see what setting it used for the cameras
Its been two days over, after my search started . But I didn't find answer any where ?. I need to call chroot as part of normal user, but to my surprise it can only be called by SUper user with CAP_SYS_CHROOT capabilities. I am not sure how to add this capability to my user .
I am searching that how i can configure syslogs/rsyslog to receive third party tools or softwares logs. For example i have a program that generates logs like when it is started and logs about its services, alerts if there are any alarms etc. I want to forward these logs using syslogs/rsyslog. Is their any possibility how can i achieve that
Is there a firewall installed and running in 10.04? If so are there any gui tools for configuring it and where are they? If there is not a firewall, what should I install to get one properly up and running?
I've been using pdfTk to encrypt PDFs for distribution to unsophisticated users (that is, users without PGP keys or the will to get one). RC4 encryption, although reasonably adequate for my use, is relatively insecure. I would be more comfortable with AES. Have any gnu tools emerged that implement AES within a PDF container?
Strange thing happend two days ago. I just wanted to reboot my computer and now I'm no longer able to boot o0. My system is runnig with a full encryption with luks/cryptsetup. I'm using a passphrase to unlock my first partition and it will unlock the others by itself. So far so good. But now it doesnt work anymore... I'm not sure what I did before, but what I know, I didn't change anything! about cryptsetup. I did only a little "update" with the recommended packages from the repositories (guess only 4-5 updated)
I already checked with live cd and same thing there. Not able to unlock any device (what seems strange to me, cause there are 4 of them and all corrupted at the same time...?)
I always get the error message: unlock failed, bad password or options? (on boot) Command failed: No key available with this passphrase (live cd)
First thing I did was checking wheter all modules are loaded:
Code: ubuntu@ubuntu:~$ lsmod Module Size Used by sha256_generic 11580 0
The default Firewall ufw is not enabled by default at the time of installation and it has to be enabled by the user.Isn't this a security risk or is the user whether ufw is enabled or not secured from external threats?I am not much knowledgeable about network security But I am trying to understand the Ubuntu mentality behind this default setting.
this is the allert i got:Code:Summary:Your system may be seriously compromised! /usr/sbin/NetworkManager tried to loada kernel module.Detailed Description:SELinux has prevented NetworkManager from loading a kernel module. All confinedprograms that need to load kernel modules should have already had policy writtenfor them. If a compromised application tries to modify the kernel this AVC willbe generated. This is a serious issue.Your system may very well be compromised.Allowing Access:Contact your security administrator and report this issue.Additional Information:
I'm just curious as to what security measure's I should be taking to make my box a little less vulnerable? I'm still experimenting/playing with Linux, use the net, IM, download this and that and was wondering how secure fedora 10 was out of the box?
During a recent install I made the leap to encryption,but /boot must remain unencrypted.Is there really any legitimate security risk to having an unencrypted /boot partition? I mean basically someone can just see what kernel you're running which they could see during boot anyways right? Oh I and keep all my financial documents in /boot/finances/ (haha ok not really, but I am serious about the first part).
Running Ubuntu 10.04 I noticed my hard disc rumbling for longer than normal and louder. Not doing anything demanding to cause hard disk activity like this so I was suspicious so I checked my process list with 'top' command in the console terminal. At the top was mount.ntfs running. Eventually it stopped running after 20 seconds or so. At the time I have not been accessing NTFS filesystems, but I do have them. I have a dual boot Ubuntu 10.04 and Windows 7. In Ubuntu I've mounted the Windows main C drive and on the same hard disk a partitioned drive for sharing files between the OSs. I know mount.ntfs is a standard program but was it being run on my machine, instigated externally here? Was the running of mount.ntfs an attempt from outside to hack into Ubuntu and the mounted Windows areas of my machine via a backdoor connection or vulnerability? I've restarted my machine since then. Are there any logs I can check for malicious attempts to break in?
If I leave the computer running for a few minutes without doing anything on it, this screen appears demanding that I enter my password, otherwise I can't get back to Fedora. I understand the necessity for this security feature in a work environment, but I'm just a home user and this security screen is just a nagging problem I don't know how to get rid of.
I just putup the fedora15 on my PC. there are several msg coming up from selinux saying permission denied, though I am not doing any administrative activity. the PC being a workstation for reaserch. how can I know the denial is for an security intrusion attempt. how can I set conditions to see the logs of all security intrusions. how can I set exclusive msg-ing from selinux that the denial is for a security intrusion attempt.
Does any one knows how to set an schedule for fire fox to terminate loading some IP. or restricting people to accessing some websites from your system..?I mean to set some restriction option to Fire Fox for third party..
Firefox 3.5 has a critical java script vulnerability as noted in the recent news. I had to manually update to 3.5.1 using the mozilla tarball because there's still no Firefox 3.5.1 in Fedora Updates or even Fedora Updates Testing repositories. Is this normal? I didn't want to resort to using the mozilla one because now I can't use flash (my system is 64 bit and mozilla only seems to offer a 32bit tar file of Firefox) and having two Firefoxs means dealing with the ProfileManager, separate bookmarks and so on.
I'm trying to find out if I'm just looking in the wrong place, I tried the normal mirrors for "updates" for Fedora 11 and then updates-testing and also the baseurl for "updates" to get rid of the mirror update delay. None of them seem to have 3.5.1 ?
Problem that may require several tools available on Fedora. I don't know if its possible or not.
Given: Surveillance video box based on Fedora & Zoneminder. Internet connection is via a private 10.x.x.x network connection to the local phone company/ISP. That's the only connection available and they are the only ISP in the area. The ISP uses NAT to ultimately provide a routeable IP address, but that only works on outbound initiated traffic.
Problem: How can someone out on the Internet hit this box? i.e Is there any way to rig a method that will ultimately allow a connection initiated from the Internet to see the surveillance video that this box has stored via an http session?
I thought of one idea but don't have the tools to implement it. User sends an email to a server out on the Net somewhere. Surveillance box retrieves mail ever minute. The mail contains the users IP address. Surveillance box sends an outbound packet to that IP address to get NAT functional. The users box then uses that address to hit the box on the private network. The snag with this is that NAT is specific to ports, and I have no sway over the ISP's NAT capability.
Is there any way to push an http session outbound to the waiting end user? i.e. initiate a push of http traffic from the private box to the end user?