Hosting file to pull via wget

Occasionally, I may need to host a file that I will need to pull from Linux via wget.

This short tutorial will detail how to upload a file to Dropbox and share a link in such a way that can be retrieved via wget.

The first step is to upload the file onto https://www.dropbox.com.

Subsequent step will involve sharing a link that will be available to the internet.

1. First select the Share button



2. Once uploaded select the Copy link
 

3. Change the end of the download link to have dl=1 rather than dl=0
 

Once this is done, this link can now be used to download files via wget.

This can be useful to pull binaries such as Splunk add-ons.

Mergers & Acquisitions (M&A) Data Security Due Diligence

I recently read a New York Times article called "The Chinese Hackers in the Back Office" and one paragraph especially troubled me.

"Not all companies heed the warning. A security consultant for one victim, who spoke on the condition of anonymity because of nondisclosure agreements, said that his client chose not to act on a tip from Area 1 last year out of concern that a scandal over a successful online attack against the company would jeopardize its recent acquisition. It figured its acquirer would not have been thrilled to learn that the start-up’s proprietary technology was now in Chinese hacker’s hands." - NYTimes

This is one area where information security does not get enough attention. When a larger company purchases a smaller company or organization. How much due diligence is taken to ensure that the acquisition target hasn't been already been compromised? What steps are taken to ensure that the intellectual property of the acquisition target is secure and not already in the hands of the adversary? It maybe worth the while to hire a 3rd party to audit and hunt the network to ensure that there isn't APT already in the network. 

There are implications when the acquisition target is discovered to be compromised. Does this impact the valuation? It likely does. This will also impact integration efforts. Some M&A's assume cost savings that result from the merger. Do some of those savings come from IT consolidation efforts? Depending on the extent of the compromise, you may never be able to integrate the network into your corporate environment. Depending on the capabilities of the attackers it can takes years to expunge them from the network. Or in extreme cases the existing infrastructure will need to be destroyed and built from the ground up. 

One of the reasons why I believe this doesn't get enough attention is hinted in the article. Much of this is not in the public domain. For every breach disclosure there are likely other parties that either a) don't know they have been breached b) keeping it secret.

These opinions are my own and not those of my employer. 

My wifi setup

My personal wifi setup involves using one access point connected to the back of the router provided by the ISP, with an additional access point that serves as a repeater for better coverage.

For my wireless access points, I wanted to select equipment that was close to enterprise grade that will not burn a hole in my pocket. I am looking at you Cisco Aironet. I ultimately decided with an access point from Ubiquity.

• Reputation for stability
• Affordable cost
• Good reviews 

I specifically went with the Unifi AP-AC-LR Access Point. I personally think this AP is one of the best values for a 802.11ac wireless access point. For the average consumer, the Apple Airport Extreme is a good choice.

Installation Procedure

Getting the Unifi controller to properly install and recognize the unprovisioned access points was quite the challenge. I initially tried installing the software in Windows with no success. For those installing on Windows made sure that the Windows Firewall is either off or set to allow the controller software to communicate inbound and outbound. 

I decided to install the controller on Ubuntu 14.04 and it worked! 

During the initial setup you will need to choose a name for your network and password. In addition, you will need to adopt the access point into your network.

To setup the access point that will serve as the repeater you will need to connect the device to the same layer 2 network, aka the same switch. Once you do that, adopt the AP into your network. Then disconnect the device from the switch. After a few minutes the AP will display isolated in the controller then go into settings and configure the Wireless Uplink settings to the Access Point you want it to uplink to. After this is done, both Access Points should be blue.

To setup the wireless uplink, I found the following blog entry to be helpful.

http://www.tongfamily.com/2014/05/wireless-uplink-unifi-ap/

Note: There are some versions of the Ubiquity controller that will require you to manually set the Access Points to the same channel. 

Setting up a network tap

The SecurityOnion github page is an excellent resource for those looking for the hardware needed to capture packets. There are multiple ways to tackle the problem of gathering network packets, ranging from the ghetto to full enterprise solutions. 

Basic LAN Tap
For those with a simple network, you can buy a Star LAN Tap. You can find these through a simple Google search or on the hakshop at myshopify. This is great for those that want to try out a network tap without making a large investment, as these can be had for less then $20.

Network Tap
For an enterprise network, I highly recommend buying a network tap for two reasons.
1. Network Tap captures all traffic. Other solutions may drop packets.
2. A passive Network Tap can fail over and allow traffic when power is disrupted.

I have heard good things about Netoptics/Ixia taps and would advise getting one with the ability to do port aggregation.

Span port / Port mirroring
Port spanning is another option and can use your existing network infrastructure if your switches support this capability. However, there needs to be careful consideration as the network traffic being mirrored on the Span port can overflow and lead to packet loss. For example, if the span port only supports up to 100 megabits, and you have three ports on the switch already consuming 50 megabits each, this results in a total of 150 megabits being mirrored on the span port. As a result the extra data beyond 100 megabits will get dropped.

For my own personal network, I decided to use the Netgear, GS105Ev2, switch with port mirroring capabilities. The switch was listed SecurityOnion website as possible hardware to use. The switch has had fairly stable performance but requires Windows for configuration and initial setup.

To setup the switch, you would need to first download the Prosafe Plus Configuration Utility which only works on Windows. Then run the Prosafe Plus Configuration Utility.



The software requires that the computer in which you are administering the device and the switch must be on the same subnet otherwise you will receive the following error.



I have personally found that a common cause is using a wireless connection when attempting to change the settings on the switch.

Once physically plugged into the ISP provided router / switch, I will sometimes continue to receive the same error message, "switch and manager IP address are not in the same subnet!"

I have found it helps to select IP setting on the bottom right.









Once in the IP settings, either check "Refresh" or toggle DHCP mode to be Disabled then back to Enabled.


Once successfully logged into switch. Go to System > Monitoring > Mirroring

Select Enable to turn on the Port Mirroring feature, then select the ports you want to monitor by checking Source Port, and selection the port you want to be the destination for traffic aka span port.


References:

https://github.com/Security-Onion-Solutions/security-onion/wiki/Hardware

http://hakshop.myshopify.com/products/throwing-star-lan-tap

My personal network setup, multi-part series

It has been almost half a year since I last blogged. It is time to brush off the cobwebs and start blogging! There are many ways to implement network security monitoring at home. My personal network is just one way to setup NSM in a home environment.

Wax on, wax off. 

Before eagerly buying equipment and getting hands on keyboard, general architecture and considerations need to be made. First, understand your environment and needs.

Some considerations

Where do you want visibility in your home network?  

What are your ingress/egress points?

How do most endpoints get to the internet?

Are there specific digital assets you want to gain network visibility?

Many home networks likely consist of one device that serves as the modem, switch, and wireless router. For example, this Actiontec device is usually used by Verizon FIOS customers has a router and wireless router all wrapped into one appliance.

When having a combined network gateway, you need to consider how and if you are going to monitor endpoints that connect wirelessly. If you have one of these all-in-one devices and ISP router serves as the default gateway for both wired and wireless traffic, then you will have a blindspot in your visibility of endpoints connecting to the wireless router. This is because there is no way to place an NSM solution inline before the ISP router. 

For my network architecture, I have another switch with port mirroring enabled connected to the network gateway, then I have setup a wireless access point off the additional switch. 

Stay tuned while I make another post about setting up a network tap.

Configuring Yubikey for SecurityOnion.

Configuring Yubikey for ssh logon into SecurityOnion

Yubikey is a small usb token that generates one time pads (OTP). The token can be used to enable two factor authentication to SecurityOnion.
- Something you know: password
- Something you have: yubikey

I used the documentation from Yubikey as a reference.
Link to their documentation
https://developers.yubico.com/yubico-pam/Yubikey_and_SSH_via_PAM.html

Prereqs
1. Ensure that GCC compiler is installed. It should be already installed if you are using the SecurityOnion ISO.

Install the PAM module for YubiKey

sudo add-apt-repository ppa:yubico/stable
sudo apt-get install libpam-yubico

Configuration for Yubikey Token

<user name>:<yubikey token ID>:<yubikey token ID>: ….

A user name can be associated with multiple yubikey's.
To find the yubikey token id, it is the first 12 characters of the ID. Just open notepad and tap the yubikey and the ID will paste and display onto the screen. You can also visit the Yubikey demo website.

https://demo.yubico.com/

Generate the mapping file. The file can be located anywhere.
Recommended mapping file location ~/.yubico/authorized_yubikeys

Go to the home directory
$ cd auth
$ then mkdir .yubico
$ cd .yubico
$ vim authorized_yubikeys

Append and save the following mapping line into the file

auth required pam_yubico.so id=16 debug authfile=~/.yubico/authorized_yubikeys

pam_unix.so configuration

Save the mapping line into the file Append try_first_pass parameter to the pam_unix.so

vim /etc/pam.d/common-auth  

auth    [success=1 default=ignore]      pam_unix.so nullok_secure try_first_pass

Edit the sshd configuration file to disable challenge response passwords.
This should already be disabled by default if installed through the SecurityOnion iso.

Hardware for Security Onion

Hardware requirements for Security Onion 

The Security Onion wiki is the best resources in learning about the hardware requirements for Security Onion.

When building my personal deployment of Security Onion, I used the wiki as a starting point. Due to my limited budget, I built a box which in hindsight was underpowered. Since this deployed in a home environment, I was willing to incur some packet loss.

CPU
I recommend at a minimum installing an i3 Intel Core or equivalent. A preferred processor will be i5 Intel Core or higher. For my installation, I used a AMD Athlon 5350 2.05 Ghz Kabini Quad Core Processor. For my network, the CPU selected is underpowered. There are times when my htop showed CPU scores greater than 4, which for a quad core processor means it is at full utilization and there are processes waiting for available threads. (Note: Since the upgrade to Bro 2.4 the CPU utilization seems to have gone down)

Memory
The more the better. For networks under 50 Mbps the minimum requirement will be 8GBs of RAM. However, if the network is 30 Mbps or greater, I recommend bumping up the memory to 16 GBs. Otherwise there is a significant risk for packet loss.

Storage
Depends on your storage requirements and amount of traffic going through. For example, if corporate policy limits data storage to 30 days then there is no need to purchase enough storage for 90 days. Be mindful of scripts that run in Security Onion that will purge data once a specified threshold is met. The default is 90%. I have it personally set for 80% for additional buffer.

NIC Card
The Security Onion wiki recommends Intel. I recommend Intel as well due to the availability of drivers across a wide variety of platforms. I personally chose TP-Link. Although, I have had no problems, nonetheless I recommend Intel. Not all NIC cards are created equally.

Power Supply
Do not underestimate the importance of purchasing an efficient and reliable power supply. Since this box will be running 24x7, I recommend buying a 80 Plus Silver and above. In the long run this will result in a lower power bill. More importantly, purchase a power supply from a reputable manufacture such as Seasonic, Antec, and Corsair.