How to Secure Your Computer

Linux is widely considered one of the most secure operating systems around. On a basic level, Linux is built from the ground up to be fundamentally sound, and it forces users to work with security in mind. For instance, it enforces the system of ordinary users who are limited in what they can do, thus making it harder for security breaches like virus infections to occur.
In addition, Linux contains a firewall that is hardwired into the kernel. It’s called iptables(www.netfilter.org) and is considered among the best solutions by practically all computer security experts. Not only that, but it can protect your home PC just as well as it can protect the most powerful supercomputer.


Windows Security vs. Linux Security

If you’ve switched to Ubuntu from Windows, there’s a very good chance that the security failings of Windows featured in your decision. Windows Vista contains many improvements, but Microsoft’s record on security over the past few years has been appalling. New and serious security warnings appeared on an ongoing basis, and even now, new and devastating viruses make news headlines with worrying frequency (usually described as “a PC virus” rather than what it actually is—a Windows virus).
One argument is that Windows is the target of so many viruses merely because it’s so
popular. Although it’s true that some of those who write viruses do so because they dislike Microsoft, there’s also little doubt that Windows has more than its fair share of security issues.
While Vista offers reasonable security, Microsoft’s previous operating system,
Windows XP, is considered an easy target for hackers and virus writers. Upon installation, the default user is given root powers. True, a handful of tasks can be performed only by the genuine administrator, but the default user can configure hardware, remove system software, and even wipe every file from the hard disk. While you would never intentionally damage your own system, computer attackers use various techniques to get you to run malicious software (by pretending it’s a different file, for example) or simply infect your computer across the Internet without your knowledge, which is how most worms work.
Viruses and worms also usually take advantage of security holes within Windows software. As just one example, a famous security hole within Outlook Express some years ago allowed a program attached to an e-mail message to run when the user simply clicked a particular message to view it. In other words, infecting a Windows machine was as easy as sending someone an e-mail message!
It’s a different story with Linux. Viruses and worms are far rarer than they are on Windows. In fact, the total number of viruses and worms that have been found in the wild infecting Linux systems number far less than 100 (one report published in 2003 put the number at 40, and the number is unlikely to have grown much since then). Compare that to Windows, where according to the Sophos antivirus labs (www.sophos.com), approximately 1,000 new viruses are discovered every month! The Sophos antivirus product now guards against just under 120,000 viruses.

Note The high number of Windows viruses may be because of the quantity of Windows PCs out there. After all, for a virus to spread, it needs computers to infect, and it won’t have trouble finding other Windows computers.

But while we would love to say that security holes are not found on Linux, the sad truth is that they’re a fact of life for users of every operating system. Many so-called rootkits—specialized software toolkits that aim to exploit holes within the Linux operating system and its software—are available.
The bottom line is that while writing a virus or worm for Linux is much harder than doing the same thing on Windows, all Linux users should spend time securing their system and never assume that they’re safe.

Root and Ordinary Users

As we’ve mentioned in earlier chapters, Linux makes use of something called the root user account. This is sometimes referred to as the superuser account, and that gives you an idea of its purpose in life: the root user has unrestricted access to all aspects of the system. The root user can delete, modify, or view any file, as well as alter hardware settings.
Linux systems also have ordinary user accounts, which are limited in what they can do. Such users are limited to saving files in their own directory within the /home directory(although the system is usually configured so that an ordinary user can read files outside the /home directory, too). But an ordinary Ubuntu user cannot delete or modify files other than those that he created or for which he has explicitly been given permission to modify by someone else.
The user account you created during the installation of Ubuntu is a limited account,
but on some Linux systems, it’s possible to type root at the login prompt and, after providing the correct password, actually log in as root and perform system maintenance tasks. Ubuntu is slightly different in that the root account is disabled by default, and users are instead able to borrow superuser powers whenever they’re required. For this to happen, they simply need to provide their own login password. With desktop programs, a password prompt dialog box will appear automatically, but at the command prompt, users need to preface commands with sudo. Although the root account is disabled, most key operating system files “belong” to the root user, which is to say that only someone with superuser powers can alter them. Ordinary
users are simply unable to modify or delete these system files, as shown in Figure 9-1. This is a powerful method of protecting the operating system configuration from accidental or even deliberate damage.

Read More

Installing Compiz and Emerald in Backtrack.

Installing Compiz Fusion in Backtrack.
Now this is a wierd thing to do and useless too but I tought that some who use BT as a main OS would get borred and want to add a little graphic.


First of all let's grab all that we need:

Code:

root@bt:~#apt-get install compiz compiz-fusion-plugins-extra compiz-fusion-plugins-unsupported emerald simple-ccsm fusion-icon

Now go to backtrack menu -> system -> compiz fusion
You should see the icon in the toolbar, right click on it and select "Reload Window Manager".


Adding compiz to startup:

Go to /etc/ and edit the file called "rc.local". And just add the files you installed to it, like this:

#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.

compiz
compiz-fusion-plugins-extra
compiz-fusion-plugins-unsupported
emerald
simple-ccsm
fusion-icon

exit 0

Now open a terminal and type in

Code:

chmod u+x /etc/rc.local

and you're done, reboot and enjoy.

http://www.backtrack-linux.org/

Read More

Create a Fake AP (auto bash script)

Fake AP

fake AP can refer to:
A Honeypot computing, which is a fake access point made to attract hackers and other wireless intruders in order to collect information about them. Black Alchemy's Fake AP-application, which is a program able to create a large amount of fake Access Points (AP) to conceal a true AP among them, so an attacker will have a hard time finding the true access point to penetrate. An AP faked by a hacker in order to trick a user (of a wireless network he or she is attacking) into using it. Information gathered from this user or his/her system itself (ports, etc.) can be used to break into the wireless network. This may be done through a man-in-the-middle attack. A common program used for this purpose is AirSnarf.


Had a go at making a bash script to automate creating a 'Fake AP' (Access Point) and 'pwn' who connects to it!

This is a bash script and a few other things to make a fake access point which is transparent (allowing target afterwards to surf the inter-webs after they have been exploited!).

How does this work?

• Creates a fake AP and DHCP server.
• Runs a web server & creates an exploit with metasploit.
• Waits for target to connect, download and run the exploit after it allows them to surf the Inter-webs.
• Uses a backdoor, SBD (Secure BackDoor - bit like netcat!), though this could be replace with VNC if attacker wishes!
• Then starts a few 'sniffing' programs (dnsiff suite) to watch what target does!

What do the needs?

• Two interfaces, one for Internet (wired/wireless) and the other for becoming an access point (wireless only!)
• A Internet connection (though you could mod it so its non transparent)
• Airmon-ng, dhcpd3, apache,metasploit, dnsiff suite <--- All on BackTrack! > The script! FakeAP_pwn.7z (17.7KB, MD5 006ee8522deb5c4d71c754e94282a516)
  

Whats in the 7z file?

> FakeAP_pwn.sh <--- Bash script to run > FakeAP_pwn.rc <--- Metasploit resource > sbdbg.exe <--- Backdoor > dhcpd.conf <--- My DHCP script (in-case you need it) > index.html <--- The page the target is force to see before they have access to the Internet.

How To Use

1. Extract the 7z file to /root/FakeAP_pwn.
2. Edit FakeAP_pwn.sh with your gateway, Internet interface, wireless AP interface.
3. sh /root/FakeAP_pwn/FakeAP_pwn.sh
4. Wait for a connection...
5. Game Over ...
   

Read More

Netcat

As you will see throughout this book, a plethora of network security and hacker tools are at your disposal. In most cases, each tool is used to focus on a specific goal. For example, some tools gather information about a network and its hosts. Others are used directly to exploit a vulnerability. The most beneficial and well-used tools, however, are usually those that are multifunctional and appropriate for use in several different scenarios. Netcat and Cryptcat are such tools.


NETCAT

Simply stated, Netcat makes and accepts TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) connections. That's it! Netcat writes and reads data over those connections until they are closed. It provides a basic TCP/UDP networking subsystem that allows users to interact manually or via script with network applications and services on the application layer. It lets us see raw TCP and UDP data before it gets wrapped in the next highest layer such as FTP (File Transfer Protocol), SMTP (Simple Mail Transfer Protocol), or HTTP (Hypertext Transfer Protocol).

Note : Technically, Netcat doesn't make UDP connections because UDP is a connectionless protocol. Throughout this chapter, when we refer to making a UDP connection using Netcat, we're referring to using Netcat in UDP mode to start sending data to a UDP service that might be on the receiving end.

Netcat doesn't do anything fancy. It doesn't have a nice graphical user interface (GUI), and it doesn't output its results in a pretty report. It's rough, raw, and ugly, but because it functions at such a basic level, it lends itself to being useful for a whole slew of situations. Because Netcat alone doesn't necessarily obtain any meaningful results without being used in tandem with other tools and techniques, an inexperienced user might overlook Netcat as being nothing more than a glorified telnet client. Others might not be able to see the possibilities through the command-line arguments detailed in the lengthy README file. By the end of this chapter, however, you'll appreciate how Netcat can be one of the most valuable tools in your arsenal.

Implementation

Most modern Linux-based and BSD systems now include Netcat as part of the operating system's default utility set. Even Cygwin now includes Netcat as an install option. This is a testimony to Netcat's usefulness. If your system already has Netcat installed, or you can easily find the RPM or package from which to install it, then skip to the command-line section to learn how to start using it. Take note that most of these pre-installed versions do not support the –e option to execute commands over the socket, although you can pipe commands into it without that option. So, if Netcat isn't present or you want access to that additional piece of functionality, then you need to download and install the tool from source code.

Download
Netcat can be obtained from many sources, and even though many Unix distributions come with Netcat binaries already installed, it's not a bad idea to obtain the Netcat source code and compile it yourself. By default, the Netcat source doesn't compile in a few options that you might want. By downloading the source and building it yourself, you can control exactly which Netcat capabilities you'll have at your disposal. Netcat can be downloaded from many sites; one of the more reliable ones is http://www.vulnwatch.org/netcat/.

Note The GNU Netcat project is a rewrite of the original tool. It shares the command-line options but only compiles on Unix-like systems such as Linux, the BSD family, Solaris, and MacOS X. It doesn't compile natively for Windows. This version can be downloaded from http://netcat.sourceforge.net/.

Install
We won't cover the details of downloading, unpacking, and building most of the tools discussed in this book. But because Netcat is the first tool introduced, and because it has some compile-time options that might be of interest to you, it's important that we go into the nitty-gritty details.

Once you've downloaded the nc110.tgz file, create a directory and extract the files:

[root@originix tmp]# ls nc110.tgz
[root@originix tmp]# mkdir nc
[root@originix tmp]# cd nc
[root@originix nc]# tar zxf ../nc110.tgz
[root@originix nc]#

Note Unlike most "tarballs" (archives created with the Unix tar utility), most Netcat archives don't include a convenient subdirectory. It might seem trivial now, but if all your tarballs and subdirectories have been downloaded into one directory, and you discover that Netcat has placed all its files in the root download directory, it can be a bit of a pain to clean it all up.

Now you're ready to compile. Following are two compile-time options of importance:

• GAPING_SECURITY_HOLE As its name suggests, this option can make Netcat dangerous in the wrong hands, but it also makes Netcat extremely powerful. With this option enabled, an instance of Netcat can spawn off an external program. The input/output (I/O) of that program will flow through the Netcat datapipe. This allows Netcat to behave like a rogue inetd utility, allowing you to execute remote commands (like starting up a shell) just by making a TCP or UDP connection to the listening port. This option is not enabled by default because there is so much potential for abuse or misconfiguration. Used correctly, however, this option is a critical feature.

• TELNET Normally, if you use Netcat to connect to a telnet server (using nc servername 23), you won't get very far. Telnet servers and clients negotiate several options before a login prompt is displayed. By enabling this option, Netcat can respond to these telnet options (by saying no to each one) and allow you to reach a login prompt. Without this feature, you'd have to script out a solution of your own to respond to the telnet options if you were looking to do something useful with Netcat and telnet.

The significance of these options probably isn't apparent to you yet, but you'll see why we bring these up when you take a look at some examples used later in the chapter.

To enable either of these options, you'll need to add a DFLAGS line to the beginning of the makefile:

# makefile for netcat, based off same ol' "generic makefile".
# Usually do "make systype" -- if your systype isn't defined, try "generic"
# or something else that most closely matches, see where it goes wrong, fix
# it, and MAIL THE DIFFS back to Hobbit.

### PREDEFINES

# DEFAULTS, possibly overridden by recursive call:
# pick gcc if you'd rather, and/or do -g instead of -O if debugging
# debugging
# DFLAGS = -DTEST --DDEBUG

DFLAGS = -DGAPING_SECURITY_HOLE --DTELNET
CFLAGS = -O

You can include one or both of these options on the DFLAGS line.

If you want to play along with the following examples, you'll need to make this modification. However, before you make changes, make sure that you either own the system you're working on or have completely restricted other users' access to the executable you're about to build. Even though it's easy enough for another user to download a copy of Netcat and build it with these options, you'd probably hate to see your system get hacked because someone used your "specially-built" Netcat as a backdoor into the system.

Now you're ready to compile. Simply type make systemtype at the prompt, where systemtype (strangely enough) is the flavor of Unix that you're running (that is, linux, freebsd, solaris, and so on—see the makefile for other operating system definitions). When finished, you'll have a happy little "nc" binary file sitting in the directory.

For Windows users, your Netcat download file (nc11nt.zip) also comes with source, but because most people don't have compilers on their Windows systems, a binary has already been compiled with those two options built in by default. So simply unzip the file and you've got your "nc.exe" ready to go.

Command Line
The basic command line for Netcat is nc [options] host ports, where host is the hostname or IP address to scan and ports is either a single port, a port range (specified "m-n"), or individual ports separated by spaces.

Now you're almost ready to see some of the amazing things you can do with Netcat. First, however, take an in-depth look at each of the command-line options to get a basic understanding of the possibilities:

• -d Available on Windows only, this option puts Netcat in stealth mode, allowing it to detach and run separately from the controlling MS-DOS command prompt. It lets Netcat run in listen mode without your having to keep a command window open. It also helps a hacker better conceal an instance of a listening Netcat from system administrators.

• -e <command> If Netcat was compiled with the GAPING_SECURITY_HOLE option, a listening Netcat will execute command any time someone makes a connection on the port to which it is listening, while a client Netcat will pipe the I/O to an instance of Netcat listening elsewhere. Using this option is extremely dangerous unless you know exactly what you're doing. It's a quick and easy way of setting up a backdoor shell on a system (examples to follow).

• -g <route-list> Using this option can be tricky. Netcat supports loose source routing (explained later in the section "Frame a Friend: IP Spoofing"). You can specify up to eight –g options on the command line to force your Netcat traffic to pass through certain IP addresses, which is useful if you're spoofing the source IP address of your traffic (in an attempt to bypass firewall filters or host allow lists) and you want to receive a response from the host. By source routing through a machine over which you have control, you can force the packets to return to your host address instead of heading for the real destination. Note that this usually won't work, as most routers ignore source routing options and most port filters and firewalls log your attempts.

• -G <hop pointer> This option lets you alter which IP address in your –g route list is currently the next hop. Because IP addresses are 4 bytes in size, this argument will always appear in multiples of four, where 4 refers to the first IP address in the route list, 8 refers to the second address, and so on. This is useful if you are looking to forge portions of the source routing list to make it look as if it were coming from elsewhere. By putting dummy IP addresses in your first two –g list slots and indicating a hop pointer of 12, the packet will be routed straight to the third IP address in your route list. The actual packet contents, however, will still contain the dummy IP addresses, making it appear as though the packet came from one location when in fact it's from somewhere else. This can help to mask where you're coming from when spoofing and source routing, but you won't necessarily be able to receive the response because it will attempt to reverse route through your forged IP addresses.

• -i <seconds> The delay interval, which is the amount of time Netcat waits between data sends. For example, when piping a file to Netcat, Netcat will wait seconds seconds before transmitting the next line of the input. When you're using Netcat to operate on multiple ports on a host, Netcat waits seconds seconds before contacting the next port in line. This can allow users to make a data transmission or an attack on a service look less scripted, and it can keep your port scans under the radar of some intrusion-detection systems and system administrators.

• -l This option toggles Netcat's "listen" mode. This option must be used in conjunction with the –p option to tell Netcat to bind to whatever TCP port you specify and wait for incoming connections. Add the –u option to use UDP ports instead.

• -L This option, available only on the Windows version, is a stronger "listen" option than -l. It tells Netcat to restart its listen mode with the same command-line options after a connection is closed. This allows Netcat to accept future connections without user intervention, even after your initial connection is complete. Like –l, it requires the –p option.

• -n Tells Netcat not to do any hostname lookups at all. If you use this option on the command line, be sure not to specify any hostnames as arguments.

• -o <hexfile> Performs a hex dump on the data and stores it in hexfile. The command nc –o hexfile records data going in both directions and begins each line with < or > to indicate incoming and outgoing data respectively. To obtain a hex dump of only incoming data, you would use nc –o <hexfile. To obtain a hex dump of only outgoing data, you would use nc –o >hexfile.

• -p <port> Lets you specify the local port number Netcat should use. This argument is required when using the –l or –L option to use listen mode. If it's not specified for outgoing connections, Netcat will use whatever port is given to it by the system, just as most other TCP or UDP clients do. Keep in mind that on a Unix box, only root users can specify a port number less than 1024.

• -r Choose random local and remote port numbers. This is useful if you're using Netcat to obtain information on a large range of ports on the system and you want to mix up the order of both the source and destination ports to make it look less like a port scan. When this option is used in conjunction with the –i option and a large enough interval, a port scan has a slightly better chance of going unnoticed. In practice, Netcat serves as a poor port scanner compared to dedicated scanners, so you're unlikely to use or need this option.

• -s Specifies the source IP address Netcat should use when making its connections. This option allows hackers to do some pretty sneaky tricks. First, it allows them to hide their IP addresses or forge someone else's, but to get any information routed to their spoofed address, they'd need to use the –g source routing option. Second, when in listen mode, many times you can "pre-bind" in front of an already listening service. All TCP and UDP services bind to a port, but not all of them will bind to a specific IP address. Many services listen on all available interfaces by default. Syslog, for example, listens on UDP port 514 for syslog traffic. However, if you run Netcat to listen on port 514 and use –s to specify a source IP address as well, any traffic going to that specified IP will go to the listening Netcat first! Why? If the socket specifies both a port and an IP address, it gets precedence over sockets that haven't bound to a specific IP address. We'll get into more detail on this later (see the "Hijacking a Service" section) and show you how to tell which services on a system can be prebound.

• -t If compiled with the TELNET option, Netcat will be able to handle telnet option negotiation with a telnet server, responding with meaningless information, but allowing you to get to that login prompt you were probably looking for when using Netcat to connect to TCP port 23. This is another option that is rarely necessary and, unless you know of a situation where this is necessary, you needn't bother with it during compile time.

• -u Tells Netcat to use UDP instead of TCP. Works for both client mode and listen mode. UDP mode isn't reliable for port scanning, but it works well enough for simple packet communication when TCP won't work. Some tricks for making UDP scans more reliable are found later in this chapter.

• -v Controls how much Netcat tells you about what it's doing. Without –v, Netcat only reports the data it receives. A single –v will let you know what address it's connecting or binding to and if any problems occur. A second –v will let you know how much data was sent and received at the end of the connection.

• -w <seconds> Controls how long Netcat waits before giving up on a connection. It also tells Netcat how long to wait after an EOF (end-of-file) is received on standard input before closing the connection and exiting. This is important if you're sending a command through Netcat to a remote server and are expecting a large amount of data in return (for example, sending an HTTP command to a web server to download a large file).

• -z If you care only about finding out which ports are open, you should probably be using nmap (see Chapter 4). This option tells Netcat to send only enough data to discover which ports in your specified range actually have something listening on them. In other words, it just tries to connect, then immediately disconnects if successful. It won't keep the connection open.

Now you have an idea of the things Netcat can do. Before we dive into some practical examples of using Netcat, we'll cover one of Netcat's descendants.

Ref : E-book Anti-Hacker Tool Kit, Third Edition

Read More