Category Archives: privacy

Malware Virtual Test Environment: Fail-secure network isolation and VPN routing

Posted on by

There are many reasons you might need to isolate a PC or operating systems from a local network. For example, I often work on live malware and ransomware and I want to minimise the risk to the rest of my network.

Many types of malware (ransomware for example) will attack local network devices. As such, a live malware instance can compromise your internal network. It is essential that you protect yourself from the increased risk from the active infection inside your network.

Malware will also try to communicate with Command and Control (C2) servers. This communication can pass along all sorts of data and because the data comes from your local network, it can also reveal your real-world IP address. Perhaps not such a good idea when dealing with malicious actors.

Fail-secure network isolation and routing

When I do any sort of malware research or network shenanigans, I make sure I’m configured so my home and office networks are not accessible from my testing machines. Christophe Tafani-Dereeper wrote an excellent blog post with detailed instructions on the subject.

To protect my identity from malicious C2 servers, I like to add an extra layer of protection. I use an anonymising VPN provider and a fail-secure firewall configuration. This means if if the VPN disconnects, the test network drops too and my test machines don’t keep spraying network traffic out through my regular internet connection.

The best way to accomplish isolation is to route all anonymous traffic through an intermediate router. For example, a Linux box can be configured to ensure all simulated-network’s access is restricted to the VPN tunnel. Consequently, if the VPN tunnel goes down, the Firewall blocks all traffic to and from the ‘hidden’ machines.

Diagram of virtual machine routing and VPN configuration

Routing a Virtual Machine through a Linux router to direct all internal traffic over an anonymising VPN (click to enlarge)

Virtual machines and network connections

The easiest way to get multiple machines up and running quickly is to use a virtual environment. I find Oracle VirtualBox perfectly fine for this purpose.

The basic configuration is to run-up two virtual machines. A routing and analysis VM running Kali Linux with two network interfaces, and the isolated test machine that connects to the ‘world’ through the Linux instance.

Address, OpenVPN and iptables rules

The magic of network isolation is accomplished on the Kali machine:

  1. The NAT (eth0) interface is allowed to see the world using the default local wired configuration, the Internal interface adapter (eth1) is given a different IP and subnet range.
  2. An OpenVPN link is established on the Kali VM. This starts a new tunnel network interface (tun0)
  3. The ‘hidden’ computer has an ‘internal only’ network adapter.
  4. The ‘internal only’ network has an IP address on the same subnet as the eth1 interface on the Kali VM.
  5. iptables firewall rules are configured to masquerade traffic on the tun0 interface, and allow data between eth1 and tun0 (the isolated machine and the tunnel).
  6. Finally, the rules drop packets from eth1 to anywhere else to stop the isolated machine seeing local resources.
IPTables firewall rules that limit connectivity of internal eth1:
# iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
# iptables -A FORWARD -i tun0 -o eth1 -m state \
           --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
# iptables -A FORWARD -i eth1 ! -o tun0 -j DROP
# iptables -A FORWARD -i tun0 -o eth0 -j DROP

Bonus capabilities

Because you have a Kali Linux box in between your isolated environment and the rest of the world, you are perfectly positioned to sniff traffic, route data over TOR, or peek at secure connections with mitmproxy.

What success looks likes

A successfully isolated machine showing ping results and apparent IP address

When correctly routed the isolated machine will be able to ping the world but not any local network IP addresses. The apparent ‘real-world’ IP address will also belong to the VPN service provider

With the correct configuration, you should be able to ping the ‘world’ from your isolated machine, but you shouldn’t be able to ping any local network resources. The network is safe, the bad guys can’t see your real-world IP address, and dropping the VPN link will also drop the link to the world.

PRINT FRE(0)
 64

READY.

Gone in 60 seconds: your phone is the Achilles heel of your security!

Posted on by

For many, the security of your online life relies on the security of your phone and phone number.

I’ve recently been speaking about the security of mobile phone numbers, and how losing your number can result in serious identity theft and account compromise.

Email providers, online stores, social media sites and others need to make it easy for us to ‘get back in’ when we forget our passwords, or lose access to our accounts. A common solution to resetting your password is to verify you through another email address, or by sending you a text message.

Phone number porting attack

Related: ABC Local Radio Interview – Louise Saunders interviewing Nikolai about mobile phone number porting scams (Feb 2017)

With phone number porting scams, the bad guys go in to a mobile phone shop or online, and they ‘buy a new phone’ or sim. The scammer tells their provider “hey, I want to port my old number across”. Surprisingly, usually all they need is: account name, date of birth and account number! If they know these things about you, it’s not hard to impersonate you as far as the phone company is concerned!

In Australia, the carrier is required (by law) to release your phone number pretty quickly. If the attacker managed to convince their carrier that they are you, they’ll soon have complete control over your mobile number.

Into Facebook with just a mobile phone

For those who have never done it, here’s a walk through of how easy it is to recover a Facebook account if you have control of a mobile phone. Keep in mind, never do I enter any detail other than the phone number.

Click on the “Forgotten Account” link under the Facebook login. Enter the phone number in to the box:

Recover your account with mobile phone

Now select the phone number as the recovery method.

Sending a reset code to mobile

Sending a reset code to mobile

Here’s the SMS with a ‘password reset code’.

Facebook SMS Reset Confirmation Code

Facebook SMS Reset Confirmation Code

Enter the reset code in to the password recovery page and then enter a new password!

Password Reset Success

Password Reset Success!

Done in one minute!

So if your phone is ported you’re in big trouble. But just losing access to your phone for 10 minutes can be enough. Does your phone display notifications on the lock screen? If so, your attacker just needs to see your screen to reset your passwords.

Codes nabbed from lock screen

Text messages are frequently displayed on the lock screen! No pin, fingerprint or password required!

Other sites are also guilty of weak SMS account reset

Password recovery via SMS is common for many service providers. Even the Australian Government uses SMS to reset logins. They adds one extra layer (a secret question) – but how much have you shared on social media, can someone guess the answer by searching your history?

MyGov Recover Login

Australia myGov “Recover Login”

Australian MyGov Password Reset

Australian myGov Password Reset uses SMS!

Australian Government MyGov - Secret Question

Australian Government myGov – Secret Question

myGov password reset - extra security, a secret question

myGov password reset – extra security, a secret question

Using your mobile phone is indeed convenient for password recovery, but it’s not secure. Even the USA’s National Institute of Standards and Technology (NIST) has declared using SMS for “two factor” authentication a security risk!

Standards body warned SMS 2FA is insecure and nobody listened

What should you do?

It’s difficult! We need to be able to recover lost passwords, but your security is weakened if you provide your phone number to a site that uses SMS to send unlock or 2-factor authentication codes.

Less is best when it comes to what information you put out there. Personally I rarely share my phone number. But that’s not always an option; vigilance is necessary.

Don’t leave your phone laying around, don’t put your date of birth on your social media accounts. Limit what you share and keep an eye out for anything suspicious. Have a plan, think for yourself:

“How should I react if something suspicious happens to my mobile phone, or if my account has been stolen? What do I need to protect, who do I notify?”

PRINT FRE(0)
 199

READY.

Tech Brief: Anonymising sensitive data with entropy and salt.

Posted on by

As researchers or programmers, we will often want to protect our data by anonymising sensitive information like names and addresses. To do this, we can combine pieces of user data to make an ’anonymous’ key that can be used in-place of the sensitive information. Instead of referring to “Jane Smith of Drury Lane”, Jane could have a nonsense identifier like “675AF3C”, which can be used throughout our study.

(Want more info? See security brief: Statistical Linkage Keys and Security)

Anonymising data with hashes and entropy

A common method for anonymising fields such as name and date of birth is to combine them with a hash function. But, because secure hash functions are ’deterministic’, they produce the same identifier for the same set of input data. If we have limited hash inputs, we will have a limited range of possible outputs; if we limit things too far, an attacker can run a brute force search to identify our original inputs. Continue reading →

Security Brief: The Australian Census and Statistical Linkage Keys

Posted on by

There have been concerns among security professionals and privacy advocates about changes to the Australian 2016 Census. The biggest concern is how the ABS plans to combine your private data. The ABS will link your Census records across multiple products, services and share it with other government departments.

In the past, this has never been a problem because the ABS never used our individual name and address data. Consequently, people could answer uncomfortable questions honestly, with the knowledge that even if data were to leak, there would be no back to them.

The Census Data Statistical Linkage Key (SLK)

This year that has changed, the ABS revealed plans to assign Australians a unique identification number called a Statistical Linkage Key or SLK. Continue reading →

Tech explained: What is a hash, what is brute force and are hashes secure?

Posted on by

Identifying Data

Security professionals often use hashes to represent data – think of it like a unique fingerprint or “key” for the data. While there are many ways to make data keys (we could assign them sequentially, or pick them at random) hashes provide a way to build a unique key from the data itself.

The purpose of a key is to allow us to reference a piece of data. Perhaps we need a key to identify movies; we could define a data key as:

- the first letter of each word in the title,
- directors initials
- and the year of release.

So, Indiana Jones and the Temple of Doom, by Steven Speilberg (1984) would have the key: IJATTODSS1984.

This key is pretty simple and easy to reverse. Because we know the key (IJATTODSS1984) and how it’s made, we can identify the movie by searching the Internet for releases in 1984, and directors with the initials S.S. This key is also not guaranteed to be unique, Continue reading →

Security concerns and Census Statistical Linkage Keys explained

Posted on by

An in-depth explanation regarding the security surrounding statistical linkage keys, why they’re important and how their security can be compromised…

The security of the Australian 2016 Census has sparked much debate and consternation among privacy advocates and security professionals alike. At the core of these concerns is a move by the Australian Bureau of Statistics (the ABS) to start linking census records to other data. The mechanism proposed for linking records and data is a ‘random looking’ Statistical Linkage Key. We have been told that the linkage key is secure and will be ‘hashed’ to make it irreversible – but what exactly does that mean, and how does it secure your data?

Introducing the Statistical Linkage Key

Statistical Linkage Keys or SLKs have been used frequently by people doing data research, it provides some very basic anonymity, and a sanity check on the data while retaining a way of identifying an individual throughout a study.

The Australian Bureau of Statistics publishes a standard called the SLK581 cluster. It defines a method for turning “Jane Smith 01/01/2007 Female” in to random looking serial number like “MIHAN010120072”. Continue reading →