6 Steps to a more secure home wireless network

With the proliferation of home wireless networks it is sometimes easy to forget that they are not as inherantly secure as a wired network and can be compromised.  However you can obtain a reasonable secure home wireless network fairly easily and without a lot of technical knowledge.

1. Change Default Administrator Username and Password
At the core of the Wi-Fi home networks is the access point/router. To set up these pieces of equipment, manufacturers provide an administration page that allow owners to enter their network address and account information. These admin pages are usually accessed by a web browser and typing in the default gateway IP address such as 192.168.0.1.  These administration web pages are protected with a login screen (username and password) so that only the rightful owner can login. All home wireless routers have a default username and password that is used to login for the first time such as admin and admin (for the username and password).  These should be changed immediately

2. Turn on (Compatible) WPA / WEP Encryption
All Wi-Fi equipment supports some form of encryption. Encryption technology scrambles messages sent over wireless networks so that they cannot be easily read by humans. Several encryption technologies and standards exist for Wi-Fi today, the strongest being WPA2 with AES. However, all the devices must be able to support that.  If not, you will have to "step down" to a authentication and encryption scheme that they do support.

3. Change the Default SSID and disable SSID broadcasts
Access points and routers all use a network name called the SSID which is the name that shows up when you view wireless networks. Manufacturers normally ship their products with the same SSID set. For example, the SSID for Linksys devices is normally "linksys." True, knowing the SSID does not by itself allow your neighbors to break into your network, but it is a start. More importantly, when someone finds a default SSID, they see it is a poorly configured network (which it more then likely is) and are probably more prone to attack it.  This SSID is also broadcast at regular intervals and is designed to permit roaming in and out of range of the access point.  For your home network, you probably won't be roaming out of range so SSID broadcasts can be turned off

4. Enable MAC Address Filtering
Each piece of Wi-Fi gear possesses a unique identifier called the physical address or MAC address. Access points and routers keep track of the MAC addresses of all devices that connect to them. Many access points permit the configuring of permissable MAC addresses that can connect, restricting access to only those devices. Keep in mind though that this is not that powerful a feature and MAC addresses can be spoofed

5. Assign Static IP Addresses to Devices
Most home networkers gravitate toward using dynamic IP addresses. DHCP technology is indeed easy to set up. Unfortunately, this convenience also works to the advantage of network attackers, who can easily obtain valid IP addresses from your network's DHCP pool. Turn off DHCP on the router or access point, set a fixed IP address range instead, then configure each connected device to match. Use a private IP address range (like 10.0.0.x) to prevent computers from being directly reached from the Internet.

6. Enable Firewalls On Each Computer and the Router
Modern network routers contain built-in firewall capability, but the option also exists to disable them. Ensure that your router's firewall is turned on. For extra protection, consider installing and running personal firewall software on each computer connected to the router.

Using metasploit to find vulnerabilites

I installed metasploit in an earlier post.  Today I will use it to attack a service running on another machine.  I will be using two VM's for this.  Ubuntu which has metasploit installed and a fully patched version of XP which contains the service we want to target.  In this case, the service is Niprint - a small print server application.

I first installed Niprint and then opened it, so it was running and active as shown in the following screenshot:

I also recorded the IP address that the XP machine was using:  192.168.248.128.

Next I loaded up metasploit on the Linux machine which I did by typing "msfconsole" in a terminal window.

Once metasploit is running, we need to configure the IP address of the host we will be exploiting:192.168.248.128.  The following screenshot shows this command:

I also pinged the host to ensure connectivity.

Next we need to select the exploit that we are going to use.  The exploited service is Niprint.  We add the exploit with the set exploit command as shown in the next 2 shot.

I was able to see the list of exploits using "show exploits" at the command line.

next we neet to apply a payload to the exploit.  We can see the various paylaods using "show payloads"

I applied the VNC reflective injection payload with the command: "set payload [path to payload]

eg "set payload windows/vncinject/bind_tcp"  (without the quotes).  Then I ran the exploit with the "exploit command".  Both are shown in the following screenshot.

This particular exploit did not work with Niprint, but finding one that did, would only require loading a new payload and trying again.

Metasploit is a very powerful tool for finding and exploiting vulnerabilites in software.

News: Zero-day vulnerability found in Internet Explorer

Microsoft has issued a security warning about a new zero-day vulnerability that could allow remote code execution in its IE browser.  This vulnerability effects versions 6 through 8.

From thier security advisory page: "The vulnerability exists due to an invalid flag reference within Internet Explorer. It is possible under certain conditions for the invalid flag reference to be accessed after an object is deleted. In a specially-crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution."

There are several factors that could mitigate this particular attack.

First enabling Data Execution Protection (DEP) in the browser (which is on by default in version 8).  "DEP, a feature first implemented in 2005, prevents the exploit from executing successfully, said Wolfgang Kandek, chief technology officer at security firm Qualys".

Secondly, using protected mode in "Internet Explorer on Windows Vista and later Windows operating systems helps to limit the impact of the vulnerability as an attacker who successfully exploited this vulnerability would have very limited rights on the system."

Cross Site Scripting (XSS)

Today I will look at Cross site scripting or XSS.  What is XSS ?

According to Wikipedia it is: " a type of computer security vulnerability typically found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users".  There are two types of XSS - persistant and non-peristant.

Persistant XSS is when data provided by a web client, most commonly in HTTP query parameters or in HTML form submissions, is used immediately by server-side scripts to generate a page of results for that user, without properly sanitizing the response.

Non-peristant XSS occurs when data provided by the attacker is saved by the server, and then permanently displayed on "normal" pages returned to other users in the course of regular browsing, without proper HTML escaping.

I will examine non-persistant XSS here.  For this short demonstration I used Mutillidae which is an open source web vulnerability project that allows you to test and see how some of the most common web vulnerabilities work in a kind of virtual environment (clearly I would not want to inject XSS in someones actual website or blog - that would be illegal)

This is a simple example but shows how dangerous XSS could be.  Many websites are still vulnerable to this type of attack and have not corrected thier code to mitigate against them.

In the screenshot above I have added some code to a virtual blog as an anonymous user that displays a dialog box that says "XSS".

The above screenshot shows what happens when that script is run and shows the comments left by the anonymous user.

The interesting thing is that the code does not show up when you list the comments made for all users - including the anonymous users.

This screenshot shows the script being run for a different user. That is the danger of cross site scripting.  A malicious script can be loaded into a webpage (or blog) and will run for whomever is logged into the page.  The script I used in this example is harmless but scripts could be created that deliver malware to the enduser, deletes files or any number of other malicious things.

How to defend against XSS ?  Disabling scripts from running in your broswer could be one way.  Using a browser like chrome that virutalizes the browser environment so scripts do not have access to the system as a whole, but more importantly, the web developer needs to code the web site in such a way as to not allow comment boxes to accept scripts. In the first screenshot the script starts with <script>.  The website should coded to look for strings like that and disallow them from being entered.

Using Regshot

When you are using security tools like metasploit and want to analyse malware it can be helpful to have a tool that that quickly show you what changes a program (either good or bad) has made to your system.

There are plenty of tools that will do this for both windows or Linux (and Mac too).  I will look at one for the windows platform.  Specifically regshot.

The program can be downloaded from sourceforge at the following address : http://sourceforge.net/projects/regshot/

Once the program has been downloaded, extract it using your favorite file extractor such as winrar, winzip or 7zip.  Then launch the regshot.exe file to open the program.

You can choose to save the output file as either a text file or HTML.  HTML is a bit easier to read, so I'll use that.  Then decide where you want to save the file. I'll put mine in "My Documents"

Once that is done you can take your first "shot" which records the state of the machine prior to installing anything as the first screen shot shows (choose "shot", instead of "shot and save").

Once you have saved your first shot, install some software (I installed audacity - an audio editor for this demo) as the next screen shows.

Finally, take your 2nd shot after the software has completed installing (again using "shot and save")

When that is complete the "compare" button which was previously greyed out should now be available.  The resulting window should look something like this:

As you can see from the output Regshot will show you exactly what files were added to the machine, what registry entries were added and what values were added to those keys, as well as how many changes total there were.

This tool can be very handy if you want to examine malware (hopefully in a VM) and want to know what changes it has made to your system.

Python Program to Scan IP's and Ports

Here is a program I wrote in Python to scan a range of IP's and a chosen port :

I started with this code first from class :

**************

Here's the code we started with:
import socket
IPRange = raw_input('Enter an IP Address: ')
Port = input('Enter the Port Number: ')
a, b, c, d = IPRange.split('.')
for x in range(1, 254):
    ip = a + '.' + b + '.' + c + '.' + str(x)
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        s.connect((ip, Port))
    except socket.error:
        print '%s: Port Closed' % ip
        continue
    print '%s: Port Open' % ip


****************


import socket
IPRange = raw_input('Enter an IP Address: ')
UserInput = raw_input('Enter IP Class to scan (A/B/C): ')
Port = input('Enter the Port Number: ')
a, b, c, d = IPRange.split('.')

if UserInput == 'C':
    for x in range(1, 254):
        ip = str(a) + '.' + str(b) + '.' + str(c) + '.' + str(x)
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        try:
            s.connect((ip, Port))
        except socket.error:
            print '%s: Port Closed' % ip
            continue
        print '%s: Port Open' % ip
elif UserInput == 'B':
    for y in range(1, 254):
        for x in range(1,254):
            ip = str(a) + '.' + str(b) + '.' + str(y) + '.' + str(x)
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            try:
                s.connect((ip, Port))
            except socket.error:
                print '%s: Port Closed' % ip
                continue
            print '%s: Port Open' % ip
elif UserInput == 'A':
    for z in range(1, 254):
        for y in range(1,254):
            for x in range(1,254):
                ip = str(a) + '.' + str(z) + '.' + str(y) + '.' + str(x)
                s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                try:
                    s.connect((ip, Port))
                except socket.error:
                    print '%s: Port Closed' % ip
                    continue
                print '%s: Port Open' % ip
else:
    print '%s: Input Error try again'

The above screenshot shows how the program works.  It prompts you first for an ip address, then class and finally a port number (this would fail as the ip that I entered is not a web server).

Although I can see how this is useful to be able to write some apps using python, I much prefer using some prebuilt apps like Nmap which is far more flexible and powerful to be able to scan a range or ip's and ports.

Installing Metasploit on Ubuntu

Metasploit is an open source tool that provides information about security vulnerabilities and aids in penetration testing.

Written first in Perl and then Ruby, it provides a powerful tool for investigating potential security vulnerabilities.  Its most well known sub-project is the metasploit framework for developing exploit code to be used against a target machine.

To install metasploit on Ubuntu Linux, I used Ubuntu 10.04.1 in VMware Workstation 7.1.0 build 261024 with 2 NIC's.  One was set to NAT and the other to bridged (but disconnected)

I booted up Ubuntu and logged in as a normal user and then used Firefox to download the latest version of Metasploit.  I used version 3.4.1 i686 of the metasploit framework.

I then changed to root using the linux su command and moved the framework-3.4.1-linux-i686.run file to the root folder.  But before I could install metasploit I needed to install Ruby as well as it has dependancies that the framework needs.

To install ruby use this command :  apt-get install ruby

Once Ruby has installed install the Metasploit framework with the following command :  ./framework-3.4.1-linux-i686.run

That's pretty much all there is too it.  The tool can be launched by running the command "msfconsole" (without the quotes).  The screenshot below is what it looked like on my machine once it is running.

It may interest you to know that metasploit has a web interface as well that can be used to select exploits, targets and payloads as well.

To use the web interface, it needs to be started at the command line.  Type "msfweb" (no quotes) and then open firefox.  Metasploit listens on port 55555 by default (although this behaviour can be changed).

The following screencapture shows msfweb starting:

Once msfweb is running, open firefox and point the address to the localhost IP, which is 127.0.0.1 on port 55555.

The last screenshot shows metasploits web interface.  From here you can explore the application, see what vulnerabilites are in its database and direct a payload to an 'unsuspecting' victim.

This concludes the installation of metasploit, a powerful tool for discovering security vulnerabilities and penetration testing.