A look at computer security
Download as ODP, PDF1 like975 views
1) Computer security involves network security, host security, physical security, and encryption techniques like hashing and public/private key encryption. 2) Passwords should be complex, containing a mix of characters, and different for each account. Strong passwords are at least 16 characters. 3) Hackers can be categorized by their motives - white hats help security, black hats harm systems, and grey hats can be either. Black hats are also called crackers.
![A Quick Look at Computer Security Ahmed D. Mekkawy AKA linuxawy [email_address]](https://image.slidesharecdn.com/cfakepathsecurity-091027083314-phpapp02/85/A-look-at-computer-security-1-320.jpg)
A look at computer security
- 1. A Quick Look at Computer Security Ahmed D. Mekkawy AKA linuxawy [email_address]
- 2. Computer Security Network Security.
- 5. … etc
- 6. Encryption & Hashing Single Key encryption.
- 7. Public / Private key encryption.
- 8. Hashing: a true one way function?
- 9. Md5? Md6 is in the kitchen now.
- 10. Sha1, sha256, sha512, sha1024
- 11. Tunneling.
- 12. Ssl (ssh, https, … etc)
- 13. Data Hiding ?!
- 14. First Things First Mentality: always challenge your work. Wear the offending attackers' hat, and think how to destroy what you have done.
- 15. Never Underestimate your potential opponent.
- 16. Never underestimate how your data/computer is important to others (may be more than how it's important to you).
- 17. Password is like a toothbrush, never share it.
- 18. Use Good Passwords Password less than 8 characters is lame.
- 19. Password containing only lower case characters is lamer.
- 20. Passwords containing your birth date/phone number is more lamer.
- 21. Passwords containing a sequense of digits like 123456 is the lamest.
- 22. Single password used among everything is a DISASTER.
- 23. Good password? 4 types of characters: lower case, upper case, numbers, special characters. At least use 3 of them.
- 24. Good password is 16 digit, the more the better.
- 25. 32 character password equals 256 bit key, I call this secure.
- 28. Hackers Who are the hackers?
- 29. The word 'hacker' originally mean the one who makes furniture only by an axe.
- 30. Hackers means sharp minded, skilled persons.
- 31. Great inventions are hacks.
- 32. Gnu/Linux: an OS made by hackers.
- 33. Hackers' Hats White Hat hacker: A good guy.
- 34. Black Hat hacker: A bad guy.
- 35. Grey Hat hacker: sometimes good, sometimes bad.
- 36. Normally white hats tend to help others (free or for a fee) and make the world a better place. Black hats tend to make the world much worse for their own benefits only.
- 37. Both use the same knowledge, have the same skills.
- 38. Black Hats are also called Crackers.
- 39. Black Hat's levels Level 3: script kiddies, or skiddies: if you know the basics, you don't have a problem.
- 40. Level 2: moderate: can cause sever damage, you must be skilled to deal with them.
- 41. Level 1: Elite. If one of them is after you, run (unless you do know that you can handle him).
- 42. Attack Anatomy Phase I: Info gathering Low tech: social engineering, physical break-in, dumpster diving.
- 43. STFW.
- 44. Whois Database. Phase II: Scanning War driving.
- 45. Network mapping.
- 46. Port scanners.
- 48. Attack Anatomy Contd. Phase III: Gaining Access, or disabling it Application / OS attacks: skeddies exploit trolling, buffer overflows, password attacks (brute force, dictionary), web application attacks (e.g sql injections).
- 49. Network attacks: sniffing, IP spoofing, session hijacking.
- 50. Denial of Service: Stopping service, exhausting resources, remotely exhausting resources (SYN flood, DDoS, .. etc)
- 51. Attack Anatomy Contd. Phase IV: Maintaining Access Trojans, Backdoors, Rootkits. Phase V: Covering Tracks and Hiding.
- 52. Let's go technical Firewalling is what we will discuss today.
- 53. Software firewall in GNU/Linux is IPTABLES.
- 54. Let's do some Packet filtering using iptables.
- 55. What is iptables/netfilter? The native firewall in GNU/Linux is iptables/netfilter.
- 56. Netfilter is a kernel patch (now it's basic in all modern kernels, unless you compiled your own without it)
- 57. Iptables is just a configuration tool for netfilter.
- 58. You can uninstall iptables, but not netfilter.
- 59. Netfilter cannot be stopped. Anyway you can remove all rules so it doesn't do anything.
- 60. Iptables rules are volatile, you have to put them in a startup script to start with booting.
- 61. What are the tables/chains? Tables => Chains => Rules
- 62. We have 3 tables: Filter table
- 63. Nat table
- 64. Mangle table We will focus on the filter table today, in filter table we have 3 main chains, which are: INPUT chain
- 65. FORWARD chain
- 66. OUTPUT chain
- 67. iptables syntax How to add a rule: iptables -t table -A/I chain condition -j target
- 68. iptables -A INPUT -p tcp –-dport 80 -j ACCEPT How to list rules: iptables -t (table) -L (-n) (--line-number) How to delete a rule: iptables -t (table) -D (chain) (condition) (action)
- 69. iptables -t (table) -D (chain) (rule number)
- 70. iptables initialization First, we flush all chains, delete custom chains, zero all counters: iptables -F
- 71. iptables -X
- 72. iptables -Z Turn off IP forwarding: echo 0 > /proc/sys/net/ipv4/ip_forward Enable dynamic IP support. 1: enable, 2: verbose, 0: disable echo "1" > /proc/sys/net/ipv4/ip_dynaddr To use RELATED in ftp rules, add ip_conntrack_ftp: modprobe ip_conntrack_ftp
- 73. Enable pings Enable incoming/outgoing pings:
- 74. Incoming: i ptables -A INPUT -p icmp –-icmp-type echo-request -j ACCEPT
- 75. iptables -A OUTPUT -p icmp -–icmp-type echo-reply -j ACCEPT Outgoing: iptables -A OUTPUT -p icmp -–icmp-type echo-request -j ACCEPT
- 76. iptables -A INPUT -p icmp –-icmp-type echo-reply -j ACCEPT
- 77. Add your rules sport dport ============> CLIENT SERVER <============ dport sport iptables (-t filter) -A INPUT -p tcp –-dport 80 -m state –-state NEW,ESTABLISHED -j ACCEPT
- 78. iptables (-t filter) -A OUTPUT -p tcp –-sport 80 -m state –-state ESTABLISHED -j ACCEPT
- 79. Special connections: ftp You must enable kernel module ip_conntrack_ftp
- 80. FTP has 3 types of connections:
- 81. Control Port: Port 21, normal 3 way connection initiated by client.
- 82. Active connection: Port 20, normal 3 way connection RELATED to the previous connection, initiated by client
- 83. Passive connection: 3 way connection RELATED to the control connection, initiated by the server from a random port on the server to a random port at the client
- 84. ftp - continued # Control Port: iptables -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
- 85. iptables -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT # Active mode: iptables -A OUTPUT -p tcp --dport 20 --sport 1024: -m state --state RELATED,ESTABLISHED -j ACCEPT
- 86. iptables -A INPUT -p tcp --sport 20 --dport 1024: -m state --state ESTABLISHED -j ACCEPT # Passive mode: iptables -A OUTPUT -p tcp --dport 1024: --sport 1024: -m state --state ESTABLISHED -j ACCEPT
- 87. iptables -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state RELATED,ESTABLISHED -j ACCEPT
- 88. Thank You,,,