Morning pages

CentOS 7 and MATE as my main Workstation

2015-12-28T06:50:00.001-08:00

I have had opportunity to use several operating systems as workstation for everyday tasks (Windows, Mac OS and Linux). Mac OS is very reliable and easy to use, no doubt. Recently I was using Windows 8.1 Enterprise with Hyper-V to run some virtual machines and I think it was a good experience (very stable and good performance).

For me, the considerations to use one or another operating system depends of the tasks to do in my daily job and also the type of applications the company is running (for example, if some corporate applications only run in Windows it will be better for me to use Windows as my workstation). My usual priority order is Linux, Mac and Windows as the last option, but I as I said, my last experience with Windows was very good.

Some years ago I was using Ubuntu 12 LTS with Cinnamon (instead of Unity) as my workstation and it worked very well. Recently, I have changed to a new company and I received a new laptop. This was a good opportunity to consider install Linux again on my workstation.

I spent a couple of days to review what has changed and what other options I could have for my workstation. I read several articles in Internet and I installed and tested Fedora 23, Ubuntu 14 LTS and CentOS 7.

Finally I decided to use CentOS 7 with MATE as desktop environment. I have installed the CentOS 7 Minimal Install and then the specific packages I needed. This configuration offers me a lot of good things, first it provides me a very stable operating systems and a graphical interface that it's enough for my tasks. Secondly, this configuration has a good performance because it doesn't consume too much resources.

I have been using CentOS 7 with MATE for several days and I have found that is very comfortable to use for my daily tasks. I use regularly Firefox and Chrome as Internet browsers. I have installed LibreOffice but I use Google Docs almost all the time. I have Docker installed and for sure, I have installed VirtualBox and I'm running Windows, CentOS and Ubuntu as virtual machines.

As reference note, in order to allow to VirtualBox install 64-bit guests operating systems, verify the following:

Your Host OS is 64-bits
Intel Virtualization Technology and VT-d are both enabled in the BIOS
The Hyper-V platform is disabled in your Windows Feature list.

A last note to say that CentOS 7 derives from Fedora 19 (Red Hat Enterprise Linux 7), just in case you need to install some package from Fedora.

---
References:

Download CentOS Linux ISO images
https://wiki.centos.org/Download

Installing MATE on CentOS 7
http://www.45drives.com/wiki/index.php/Installing_MATE_on_CentOS_7

MATE Desktop Environment
http://mate-desktop.com/

Why does virtualbox only have 32-bit option, no 64-bit option on Windows 7?
http://superuser.com/questions/866962/why-does-virtualbox-only-have-32-bit-option-no-64-bit-option-on-windows-7

The Difference Between Fedora, Redhat, and CentOS
https://danielmiessler.com/study/fedora_redhat_centos/

Red Hat Enterprise Linux
https://fedoraproject.org/wiki/Red_Hat_Enterprise_Linux

Kaspersky Security Bulletin 2013. Corporate threats

2013-12-05T08:00:00.001-08:00

When it comes to the mass distribution of malicious programs any company can be affected.

Employees who regularly have to communicate with people outside their corporate structure are often the recipients of malicious emails.

Cybercriminals are interested in stealing information of all kinds. It could be cutting-edge technology developed by companies and research institutes, source codes of software products, financial and legal documents, personal information about employees and clients, and any other information that may constitute a commercial secret.

Cybermercenaries are given a contract which stipulates the goals and a description of the task, after which they start to thoroughly prepare for and then launch the attack. While earlier attacks tended to steal information indiscriminately, cybermercenaries now aim to lay their hands on very specific documents or the contacts of people who might own the target information.

Source:
Kaspersky Security Bulletin 2013. Corporate threats

Red October Cyberespionage Operation

2013-01-16T09:11:00.000-08:00

Several Computer Emergency Response Teams (CERTs) have uncovered evidence of a cyberespionage operation, dubbed Rocra or Red October, that has been targeting organizations in 39 countries, including Iran, the US, and members of the Russian Federation. Red October gathers data from "mobile devices, computer systems, and network may have been active for at least five years.

The campaign hit hundreds of machines belonging to following categories:

Government
Diplomatic / embassies
Research institutions
Trade and commerce
Nuclear / energy research
Oil and gas companies
Aerospace
Military

This discover has been announced by Kaspersky Lab’s Global Research & Analysis Team result of an investigation after several attacks hit computer networks of various international diplomatic service agencies.

The attackers have targeted various devices such as enterprise network equipment and mobile devices (Windows Mobile, iPhone, Nokia), hijacking files from removable disk drives, stealing e-mail databases from local Outlook storage or remote POP/IMAP server and siphoning files from local network FTP servers.

Evidences collected during the investigation let security specialists to believe that attackers have Russian origins, but strangely they appear unrelated to any other cyber attacks detected until now. The exploits appear to have been created by Chinese hackers.

Sources:
SANS NewsBites - Volume: XV, Issue: 4
The Hacker News

The (ISC)² Global Information Security Workforce Study (GISWS)

2013-01-04T16:18:00.000-08:00

The (ISC)² Global Information Security Workforce Study (GISWS) reflects the opinions of a dynamic information security workforce. The GISWS is the largest study of its kind and provides detailed insight into important trends and opportunities within the information security profession. It aims to provide a clear understanding of pay scales, skills gaps, threat priorities, training requirements, corporate hiring practices, budgets, career progression and corporate attitude toward information security that is of use to companies, hiring managers and information security professionals. The 2013 GISWS will be released in February 2013 at RSA in San Francisco, California, USA.

Meanwhile we can comment the last survey. As a result of 2011’s survey, Frost & Sullivan (responsible of survey) sees the information security professional under increasing pressure to provide even more services to the organization to protect not just the organization’s systems and data, but also its reputation, its end-users, and its customers.

Security management will always require the proper balance between people, policies, processes, and technology to effectively mitigate the risks associated with today’s digitally connected business environment.

Conclusions:
• Consumerization has end-users bringing technology to the enterprise instead of the opposite; information security professionals should work to securely embrace these new technologies instead of acting as roadblocks. (the famous BYOD: Bring Your Own Device).
• Cloud computing and software development are areas of information security that require new skills, not just incremental advances.
• Compliance is driving organizational behavior from changes in spending levels to shifts in accountability, to requirements in new skill sets.
• As emerging sub-markets, Latin America, Africa, and Oceania offer attractive employment incentives and opportunities for information security professionals over the next five years.
• Certifications will continue to be an important differentiator as the number of professionals necessary to effectively secure organizations continues to increase.

Source:
(ISC)²® Global Information Security Workforce Study

Research in cloud computing security

2012-11-16T12:20:00.000-08:00

The cloud computing it's a great tool because of their scalability and economies of scale, of course there are multiple benefits in their utilization. But it's important to stay informed about the new research in security.

A study proves that software hosted in one part of the cloud can spy on software hosted nearby.

The researchers (from RSA) have shown it is possible for software hosted by a cloud-computing provider to steal secrets from software hosted on the same cloud.

The attack demonstrated is so complex that it is unlikely to be a danger to customers of any cloud platform today, but the experiment answers a longstanding question about whether such attacks are even possible.

The new attack undermines one of the basic assumptions underpinning cloud computing: that a customer’s data is kept completely separate from data belonging to any other customer.

Source:
How to Steal Data from Your Neighbor in the Cloud

Cyberespionage

2012-11-13T19:07:00.000-08:00

Malware just a small piece of the puzzle in advanced attacks, and traditional cybercriminals are also getting more 'persistent'.

Targeted attacks are evolving faster than victims can detect them, and it's not just about cyberespionage anymore, either: Financially driven cybercriminals are also using advanced persistent threat (APT) methods for longer staying power in order to increase their spoils.

The trick is spotting and analyzing the behaviors and not just the malware, security experts say.

The APT attacker traditionally has been associated with Chinese cyberspies, but the types of attacks waged to steal intellectual property are increasingly blurring as new players and regions enter the landscape. Among the newcomers to this attack model are traditional, financially motivated cybercriminals and cyberspy attackers from Russia.

Source:
APT-Type Attack A Moving Target

Simplicity for complexity

2012-10-01T20:36:00.000-07:00

"Simplicity is the ultimate sophistication" - Leonardo da Vinci.

Distinctive design—clean and friendly and fun—would become the hallmark of Apple products under Jobs.

“It takes a lot of hard work,” Jobs said, “to make something simple, to truly understand the underlying challenges and come up with elegant solutions.” As the headline of Apple’s first marketing brochure proclaimed in 1977, “Simplicity is the ultimate sophistication.”

“Why do we assume that simple is good? Because with physical products, we have to feel we can dominate them. As you bring order to complexity, you find a way to make the product defer to you. Simplicity isn’t just a visual style. It’s not just minimalism or the absence of clutter. It involves digging through the depth of the complexity. To be truly simple, you have to go really deep. For example, to have no screws on something, you can end up having a product that is so convoluted and so complex. The better way is to go deeper with the simplicity, to understand everything about it and how it’s manufactured. You have to deeply understand the essence of a product in order to be able to get rid of the parts that are not essential.” - Jonathan Ive

Source:
How Steve Jobs' Love of Simplicity Fueled A Design Revolution

Apple Mac OS X updates

2012-09-27T10:17:00.000-07:00

Apple Mac OS X is prone to multiple vulnerabilities.

Attackers can exploit these issues to execute arbitrary code, cause denial-of-service conditions, gain unauthorized access, obtain sensitive information, bypass security restrictions, and perform other attacks.

Updates are available through Apple's updates.

Sources:
SecurityFocus

The deep web

2012-09-22T17:27:00.000-07:00

“What we know is a drop, what we don't know is an ocean.”
- Isaac Newton.

That phrase applies for the human knowledge, as well for Internet's content.

Everyday you use some search engine that find many results (usually millions or billions of results). But it's interesting to know that there is a big huge quantity of resources that remains stealth in Internet.

Thought about that: "The Deep Web (also called the Deepnet, the Invisible Web, the Undernet or the hidden Web) is World Wide Web content that is not part of the Surface Web, which is indexable by standard search engines. The deep Web is several orders of magnitude larger than the surface Web."

The image below shows certains aspects of the deep web (it's simplistic, but you can find many others):

This topic is broad and it's difficult cover all aspects at one stop, and as the topic itself is, we are going to stop here for remain on top of iceberg. There are many information (you can start with the references listed below in sources' section).

Remember: we are browsing only the surface.

Sources:
http://en.wikipedia.org/wiki/Deep_Web
White Paper: The Deep Web: Surfacing Hidden Value
What is the Deep Web? A first trip into the abyss
The Deep Web - Dark Side of the Internet
Some Deep Web's images

Microsoft Internet Explorer vulnerability

2012-09-21T16:54:00.000-07:00

Microsoft Internet Explorer is prone to a remote code-execution vulnerability.

On September 17, 2012, a new zero-day affecting Internet Explorer was discovered. An attacker can exploit this issue using a heap spray technique with the exploit payload that will then be executed.

Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial-of-service conditions. Microsoft Internet Explorer versions 6, 7, 8, and 9 are affected.

It's recommendable exercise caution when visiting unfamiliar websites and to install all applicable updates once Microsoft makes them available.

More information:
http://www.securityfocus.com/bid/55562/

Source:
http://www.symantec.com/security_response/vulnerability.jsp?bid=55562

Microsoft Internet Explorer Image Arrays Use-After-Free Remote Code Execution Vulnerability

Risk

High

Date Discovered

September 17, 2012

Description

Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial-of-service conditions. Microsoft Internet Explorer versions 6, 7, 8, and 9 are affected.

Technologies Affected

Microsoft Internet Explorer 6.0
Microsoft Internet Explorer 7.0
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9

Recommendations

Run all software as a nonprivileged user with minimal access rights.

To reduce the impact of latent vulnerabilities, always run nonadministrative software as an unprivileged user with minimal access rights.

Deploy network intrusion detection systems to monitor network traffic for malicious activity.

Deploy NIDS to monitor network traffic for signs of anomalous or suspicious activity. This includes but is not limited to requests that include NOP sleds and unexplained incoming and outgoing traffic. This may indicate exploit attempts or activity that results from successful exploits

Do not follow links provided by unknown or untrusted sources.

Web users should be cautious about following links to sites that are provided by unfamiliar or suspicious sources. Filtering HTML from emails may help remove a possible vector for transmitting malicious links to users.

Implement multiple redundant layers of security.

Memory-protection schemes (such as nonexecutable stack and heap configurations and randomly mapped memory segments) will complicate exploits of memory-corruption vulnerabilities.

Updates are available. Please see the references for more information.

References

Credits

Reported as a 0-day.

Copyright © 2012 Symantec Corporation.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from secure@symantec.com.

Disclaimer
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

Symantec, Symantec products, Symantec Security Response, and secure@symantec.com are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.