Updates and upgrades

Upgrades and updates: everybody knows them, but ... when it is time to install them. OK, you get the picture.

What's the main difference between an update and an upgrade? An update brings mostly fixes for vulnerablities, an upgrade new features and fixes.

Both are equally important for the fixes: some of these are application improvements, speed or crashes, but others concern security vulnerabilities, bugs that an attacker may use to execute other programs without being suspected.

Many Operating Systems (Windows, Linux, Mac Os X) have a feature to auto check for updates and upgrades. Be aware that it concerns only the operating system itself and usually the applications from the same vendor. Other applications installed may have to be manually updated or upgraded.

For a long time, Microsoft has been providing a way to automatically update its Operating Systems and key applications. In Windows XP - and if you kept the themes - this function lives under "Control Panel" > "Security Center" > "Automatic Updates"

The default setting of "Turn on Automatic Updates" is to download and install the recommended updates every day at 3AM. However, unless you don't really care about your power consumption, at that time your computer will be off.

I usually edit these settings, accessible at the bottom of the same window under "Automatic Updates". and change them to "Download updates for me, but let me choose when to install them." As soon as new updates  are available, your computer will notify you with the "little yellow shield."

 As I said, this will install the recommended updates, not all the updates. There are two additional types of updates available from Microsoft: "optional updates", which don't fix anything critical, and "hardware updates", which improve the hardware support and correct driver issues.

These are available through the website "Windows Updates", operated by Microsoft. In IE, go to "Tools" and click on "Windows Updates."

At the screen offering to chose "Express" or "Custom", select "Custom". For each category, you may click on "select all". However, from time to time, you may have to choose between certain patches: for instance you cannot install in the same sweep .net framework 4 and .net framework 1.1. In that case, the system will show you what patches need to be installed independently.

Remains the other applications. Most of us have, in addition to Windows and Office, a browser for the non IE users, adobe reader, adobe flash, various players, possibly iTunes and so forth. All the modern applications have an option to check whether you are up-to-date, and this usually lives under "?" -> "About" or "Help" -> "Check for updates".

Windows 7 has a built-in interface you may invoke by typing "windows update" in the search bar in the Start Menu. There, you can select what to upgrade. By clicking on "Check Upgrade", you will start the detection process.

Optional updates are not selected by default. Click on it to select these additional packages.

In all cases, when upgrading, it is important to close all running applications, to avoid losing data should one be closed.

If an update fails, retry after having disabled your AV: from time to time, an AV may stop the installation of system components thus preventing the correct installation of an update.

To do

• Configure the windows automatic updater to download new updates and notify when they are available;
• Go from time to time (once every month or so) and force all the updates, if possible including the optional updates;
• On a regular basis (once every month or so), for all used applications, check if there are updates, either using the built-in mechanism or by visiting the vendor's website.

Happy surfing.

Entropy calculator - dev version in progress

My "entropy.py" scripts computes the entropy a file, indicating how random its content is. Possible uses include finding encrypted or compressed files.

• A Shebang to allow execution without having to specify "python entropy.py"
• The "-t" command-line parameter to specify a minimal entropy. Files whose entropy is below the threshold won't be displayed.

You will find my git repository here.

How to protect your home wireless

Nowadays most, if not all, of the small routers provided to connect a DSL or Cable connection includes a wireless access-point. Developed to facilitate the connection of multiple devices, it also changed the security landscape by extending the area of reception.

With a wired network, it is easy: in order to connect to a network, you need a physical access to a port on a hub, a switch or a router. This limits the possibility for someone outside a house to connect: in order to do that, that person would have to run a cable, going through walls and concrete.

However, with a wireless network, those boundaries don't exist anymore: the radio waves can get through brick, walls, glass and wood and still be demodulated by a wireless card.As a result, some layers of protection are needed to prevent any undesired presence on a home wireless network.

First, what are the risks? Well, you have the risk that someone abuses your wireless network to commit some abuse on the Internet: visits to less than reputable web sites, downloads of protected material, spam, distribution of malware. The list is almost endless. In addition to that, someone on your internal network may also abuse your local resources, and for example abuse a network printer, access your files or plant a virus on your computer.

The first protection that was devised for wireless devices is WEP (Wired Equivalent Privacy). A key is entered on both the access-point and the network clients to allow the access. Unfortunately, a flaw was present in the design and can be exploited to "crack" a network and find the key.

All recent devices offer another mode, called WPA (Wi-Fi Protected Access), followed by WPA2. It avoids WEP's flaw by using  proven encryption algorithms, such as TKIP or AES. WPA/WPA2 requires a key shared between the access-point and the networked clients. That key, of course, needs to be robust and selected as a password: although it is tempting to use something easy, this also facilitates an intruder's job by making guesses based on a list of common words.

In addition to that, almost all devices offer a way to filter what devices connect to the network, based on its MAC address. This latter is the physical identity of a network card and is unique worldwide.

To do

• Select WPA/WPA2 instead of WEP
• Set a strong and secure password for the pre-shared key
• (optional) Create a MAC filter and allow only your devices

Happy Surfing!

How to select a good password

"How to chose a good password" is a recurring theme. There is not a single company that hasn't had at some point that kind of question or concern, and most IT/security guys are usually losing their voices trying to spread the good word.

"What is a good password?" is in itself an interesting question. People tend to answer this in term of length, complexity, entropy, presence in a dictionary or not and so forth. Let's explain a few terms.

Length

The easiest of all. This is purely the number of characters constituent of the password. 

Complexity

This relates to the individual "components" of the password. Usually, there is a distinction between four big sets:

• Lowercase letters: a through z
• Uppercase letters: A through Z
• Digits: 0 through 9
• Special characters or symbols: anything that's not either a letter nor a number

The definition of "letters" is in itself quite fun: English speakers may consider accentuated characters as special characters, where (for example) French speakers may consider these as normal letters. In addition, non-roman alphabets also exist, which furthermore expands the definition of letters. 

For the sake of simplicity, let's consider as "letters" the non-accentuated letters from the roman alphabet.

Entropy

A fun word, which relates to the distribution of characters in the password. For instance, "aaaa1111::::" would have a low entropy, as there are only three different characters, where "abcd:;.,1234" would have a higher entropy.

Presence in a dictionary

Pretty much everybody agrees to say that using "password" for the password is either lame or in Hollywood movies. However, according to the analysis from the passwords leaked by LulzSec, "password" is indeed in the top three. But a dictionary is also more than the usual list of words we all know: sequences of characters are also mapped into lists (123456,abcde, qwerty ...), nick and pet names (Sweetycakes, Rufus, Catzie ...), even phone numbers and car plates may be used.

How to chose it?

OK, now that we have this information, we can start answering. For decades, IT and security people tried to teach users into selecting obscure, hermetic and hard to remember passwords, thinking that if someone can't remember, someone else won't be able to find it.

This approach led to situations where users would request a password change every other week, because they would forget it or would write down the password on a sticky note posted on the monitor (I have seen that one).

Let's find another way.

Things we usually remember are words: table, bed, teddy, dog are four words that you would probably remember from this text in an hour. So why not combine them?

Is "1Table2Beds,3Teddy&aDog" a good password? You betcha! Can you remember it? It will most likely take a few minutes to learn it, but once done, you will probably not forget it.

Method to create the password:

• Think of 3 or 4 words, if possible each 3 characters or longer
• Imagine a fun way of mixing them together, using numbers and punctuation signs
• Think of it as a melody or as a story

And ... voila! You have a secure password. By having 3 words of at least 3 characters, your password is already longer than 8 characters. Add to that 2 characters in between and a final punctuation sign, you have 11 characters. 

Happy Surfing!

Trinity Rescue Kit to the ... rescue!

So, after playing with my virtual machine and the malwares I downloaded from my e-mail account, time for some experiments from the other side: the clean-up effort.

Cleaning up after a virus infection is probably the most horrible task I have ever had to perform. Not only it takes a long time, but you can't rely anymore on the installed Operating System, all systems have to be taken down or isolated to control the spread of the infection, the users call every 30 seconds asking when "they will be able to work because they have important things to do" and, of course, it always happen when there is something else interesting to do.

Until recently, when I had to be involved in a clean-up effort, I tended to ask for the hard drives to be imaged - to keep a copy of the infection - then I connected the drive to another machine known to be clean, and I ran the antivirus tools from there. Not only this was extremely time consuming, but there was a need to have access to the machine, which is possible with workstation or stand alone servers, not so much with virtual machines, and I don't mention the fact that servers have, nowadays, multi terabyte storages drives on SANs. Another solution had to be found.

There comes a cool distro: TRK - the Trinity Rescue Kit. It does way more than just virus scans, but that's a non negligible part of its job. Among the other tasks, let's just mention the password recovery, the junkfile clean up, the backup/restore and the imaging facility.

Back to the virus clean-up. TRK comes with not less than five different AVs: ClamAV, F-Prot, BitDefender, Vexira and Avast. This last one requires that you register to get a key, and it's free.

To access these tools, two solutions, either the menu-driven way or the command line.

First stop: mounting the local file systems. The menu-driven has an option to mount all the local file systems automatically, and all the operations are taken care of: if your NTFS was not unmounted cleanly, i.e. you powered the machine off in a rush, the automated mount will mount it after taking care of the possible issues. A small caveat though: these file systems are mounted read-write when possible, so be aware that there is a risk of touching things on the hard drive.

An interesting point: in one of my tests, I ran TRK on a mac book pro. It automatically mounted the local drive (UFS), but read-only.

If you want to keep a maximum control, I recommend opening a shell and mounting the relevant file systems by hand, using mount. For the NTFS file system, the suite ntfs-3g is present and can be used to achieve that purpose.

Next step: the virus scanning. Again, either menu-drive and you chose your AV, or at the command-line using the virusscan command.

After selecting the destination to scan, you proceed and select the AV to run.

As mentioned, the other way is to use the virusscan command. This is a form of one-stop shop for scanning a file system, and it takes care of all the necessary steps, such as downloading and installing the relevant packages, updating the virus definitions, and running the scan.

I found I needed to use this way with the mac book pro scan: by default and through the menu-driven, a log file is written in the mount point, which is at the root of the scanned file system. When the mount is done read-only, as it was with my UFS, this is not possible, and the scan will fail.

By default, "ClamAV" will be run. Concerning this one, an important note is that infected files will be reported and quarantined, but not deleted.

An example of the command is:

virusscan -a clam,fprot -d /sda1 -l /

This will run both ClamAV and F-Prot against the file system mounted in /sda1, logs will be written under /, and not on the mounted file system.

A gotcha: if you try to run Vexira, it will fail, due to an error in the command-line switch for the updater.

Here is a workaround:

virusscan -a va -d /<to scan>
# This will fail, that's normal
cd /linkedfs/usr/share/vascan
./vdbupdate.sh

This will start the download of all the updates. After that, you may proceed and run the scan normally

cd /
virusscan -a va -d /<to scan>

Back to the test. My virtual machine was infected with the strain I got in the "Booking.com" e-mail. Running the various scans in sequence I have:


ClamAV - 0 infected file detected
F-Prot - 1 infected file detected
BitDefender - 0 infected file detected
Vexira - 0 infected file detected
Avast - 0 infected file detected

To be fair to BitDefender, Vexira and Avast, they were run after F-Prot, so they may have detected it if given the chance.

The file F-Prot categorized as a malware is "/Users/Administrator/AppData/Roaming/winc.exe", as W32/Trojan.DFP. The file was removed.

However, when the machine restarted and was logged on, another access was made to "yerurr.com", meaning the actual infection was not removed. After rebooting and rescanning with F-Prot, no file found infected, so indeed, something is still present on the system, but not yet detected.

If you recall, in order to execute the malware on my 64bits install of Windows 2008, I had to disable DEP. After enabling it back and rebooting the machine, an executable was blocked: memnvexec.exe. This file lives in /Users/Administrator/AppData/Roaming. This is actually the same file as "servicesa.exe" that I saw downloaded from a website in Germany during my initial run of the strain. As of now, this file is not detected by any AV present on virus total.

Conclusion -

I do like TRK. This is an awesome tool for helping in dealing with outbreaks. However, it suffers from the same ailments as all AVs: this is a reactive business, signatures may take time to make it to the end user and not everything qualifies as a malware.

The menu-driven interface makes it really easy to use. Advanced users will make a heavy use of the command line for a variety of tasks, such as taking images over a network to a NFS server, doing virus scans or deploying images. Additional functions are possible, such as network booting TRK on multiple computers to take care of larger networks.

If you are an IT or a security professional, this definitely has to be in your toolbox.

And another one: booking.com

In the same fashion, I got an e-mail today allegedly from booking.com to give me some information about a reservation I have done. Or so is it written.

Again, a zip file is attached, that contains an executable. Here are the md5 hash values:

46ea3e441be4ba82fa2d059a5ca45f23  Booking-Com-Reservation.exe
e877998eef741bc7ed688584ed7595b6  Booking-Reservation-Details-NUM930833336.zip

It uses the same host (yerurr.com).

Interestingly enough, there is either a timer or a wait for the next reboot: after a reboot and having waited for a while, there was some activity to a site in Germany (www.floodwave.de) to get /services/images/servicesa.exe (md5sum: 8d39f983e08f68ca4ccb3a92f5e4a7ac). This file is not recognized as malware by any antivirus (VirusTotal Report)

When rebooted one more time, the machine followed the same cycle: request to Google, resolution of yerurr.com, POST /was/tnk.php. I stopped there, but I suspect that the machine would probably do something after a time, which I will try this week-end.

And another strain - DHL Express

Another one, again posing to be from a delivery company.

I got an e-mail, with a zip attachement (DHL_Express_Shipment_POST_ORDER_ID92VMUANA.zip, md5 hash: b8d96b95875bc31d9f5448e5d06837cc  ). When decompressed, an executable is present (DHL_Express_Shipment_POST_ORDER_ID.exe, md5 hash: cc6e8193c7475ef34f79ab82ec6f90fc)

As of 02/14/2012, only 3 out of 43 AVs correctly detect the file as infected (VirusTotal report). Once decompressed, that number falls to 2/43 (VirusTotal report).

Funnily, my first attempt to run the executable into my 2008 virtual machine (64 bits) failed - DEP intercepted it and prevented the execution.

As for the previous two strains, this one first makes a request to Google.com (GET / HTTP/1.1). It then resolves yerurr.com and does a POST /was/tnk.php with a very long body. In my case, the activity stopped there.