Security Reliks

One of the common things an attacker may do once they are inside your machine is to rename the process they are running as. In many cases they will try to imitate or get very close to normal system process names. One common process to spoof is the svchost process.

What is svchost?

Microsoft states that “svchost.exe is a generic host process name for services that run from dynamic-link libraries”. So when a piece of software starts a service from a dll, it will be found connected to an svchost instance.

So what?

Well, if that is the case then we can rest assured that any svchost process will also have some services running under it. The following command will show us the svchost instances and what services are under it:
C:\> tasklist /SVC

If we then notice any svchost.exe instances running without any services under it, then it is most likely another process that has renamed itself to look like svchost.

Sorry I have been busy for the past week or so. Hopefully things will calm down next week or the week after Thanksgiving. However, I wanted to share this quick bit of info, along with some CLI kung-fu (compliments of  John Strand).

IPS

In the world of network perimeter defense, the integration of an IPS is desired. There are a few reasons for this, primarily that it not only detects attacks, but can then STOP the attack from occurring. One of the possible ways to do this is by dynamically filtering an IP address that is launching attacks against you. I wont go into too much detail about how an IPS works, but for the context of this post I will outline some of the issues with Intrusion Protection Systems:

1. Cost – a budget may not be available for an effective and efficient IPS that meets the needs of your system.
2. Denial of Service – Depending on the IPS, a spoofed IP address may cause a dynamic filter to be created for a valid web page. This allows the attacker to use your defense against you and compromise your availability.

Enter HoneyPorts

This is where the idea of HoneyPorts comes in.

HoneyPorts (in this example a Windows implementation) utilizes netcat, and built in commands. The idea is like this:

You set up a listener which simulates an attractive open service for an attacker. Upon their connection, your script will execute netstat to locate the attackers IP. The script will then use netsh to add a firewall rule to block that IP. Pretty simple idea. Here are the benefits:

1. Free!
2. Will only filter a full connection, which (apparently due to initial seq. numbers) is very hard to do when spoofing. Thus reducing the likelihood of the previously described DoS.
3. By utilizing a port that would only be queried by someone using a port scanner, you ensure that innocent people arn’t cut off.

here is the syntax (Found here at PaulDotCom; also includes full article):

.bat file:

@echo off
for /L %%i in (1,1,1) do @for /f "tokens=3" %%j in ('netstat -nao ^| find ^":[port]^"') do
@for /f "tokens=1 delims=:" %%k in ("%%j") do netsh advfirewall firewall add rule
name="WTF" dir=in remoteip=%%k localport=any protocol=TCP action=block

Start netcat listener (the actual port):

C:\>nc -L -p [port] -e [file].bat

Thats all there is to it! Try a port scan, connect the the port, and then rescan (using nmap of course). You will notice the prior to your connection the port is listed as ‘open’, and after your connection it is now seen as ‘filtered’.

enjoy!

There are some pretty basic attacks that any use can mitigate against without any special software. In fact, your linux kernel allows direct interaction via the /proc/sys file structure. For those unfamiliar with it, /proc/ contains a reference to processes running on your machine. /proc/sys obviously then references system processes. In this series we will discuss certain system processes that can toggled and configured to defend against basic attacks, and information gathering processes. This issue we will go over ICMP security.

Note: The commands themselves are very simple. It involves echoing on (“1″), or off (“0″) into a “folder” within /proc/sys/net.

Prevent Ping

Pinging is the basic way to test connectivity and the state of a target machine. It does this by using the ICMP protocol. The originating machine issues an ECHO REQUEST, and the target machine responds with an ECHO RESPONSE. If you disable ECHO RESPONSE, then an attacker could possibly give up by believing that your host is not even there.

Here are the commands relating to ECHO packets:

//disable

echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all

//enable

echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all

Notice that I also ignored broadcasts. There is a reason for this. If you have been following my blog, you may recall a post I did a while ago about Smurf Attacks. Although it is best to defend you network from being used in a smurf attack by using the ‘no ip directed broadcast’ setting on your router, you can defend each host using the aforementioned commands.

ICMP Redirects

You may also want to prevent ICMP redirects. If you are acting as a router, you should probably avoid using this function. However, if you arn’t then this may be a good idea:

//disable

echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects

//enable

echo "1" > /proc/sys/net/ipv4/conf/all/accept_redirects

Prevent Log Attacks

In some scenarios an attacker may try to flood your logs to hinder your incident handling abilities. They may cause routers to send incorrect responses to broadcast frames. This can quickly fill up your logfile. You can disable this with the following command:

//disable

echo "0" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

//enable

echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

I hope this is helpful! come back to see the rest of the series!