Internet Security

Quick way to generatre Cronj obs

2015-07-03T03:50:00.001-07:00

Upgrade complete !

2012-12-01T20:49:00.000-08:00

Hello all

So i have completed the upgrade to my new blog with a new url

you can follow me @ www.seanmancini.com

Click here to go to the new site !

Again Thanks for all your support !

upgrading my blog

2012-11-02T18:19:00.000-07:00

Hello All,

I am currently in the process of upgrading my blog to a wordpress blog which allows me to present information in a much better way and the ability to catagorize my sibjects in a website form

i will still update this blog until ive completed the switch

i will provide the new link to my blog shortly

till then stay secure !

a little continuation of my fail2ban post

2012-10-27T00:05:00.001-07:00

Recently i was able to capture some real data from my servers fail2ban logs

this is how fail2ban logs look for banning ips

2012-10-21 12:54:16,032 fail2ban.actions: WARNING [ssh] Ban 112.4.172.217
2012-10-22 17:05:48,080 fail2ban.actions: WARNING [ssh] Ban 222.73.24.10
2012-10-22 18:36:55,892 fail2ban.actions: WARNING [ssh] Ban 202.96.199.150
2012-10-22 23:23:10,053 fail2ban.actions: WARNING [ssh] Ban 111.74.82.33
2012-10-23 05:06:53,861 fail2ban.actions: WARNING [ssh] Ban 74.206.235.92
2012-10-23 13:11:05,652 fail2ban.actions: WARNING [ssh] Ban 112.216.140.51
2012-10-24 19:31:55,504 fail2ban.actions: WARNING [ssh] Ban 60.161.124.10
2012-10-24 22:52:47,324 fail2ban.actions: WARNING [ssh] Ban 125.210.190.190
2012-10-25 04:20:06,184 fail2ban.actions: WARNING [ssh] Ban 109.163.234.238
2012-10-26 11:11:12,332 fail2ban.actions: WARNING [ssh] Ban 122.139.60.134

very straigt forward and easy to understand which is always a good feature now lets look at the iptables entries

DROP       all -- 122.139.60.134       0.0.0.0/0
DROP       all -- 109.163.234.238      0.0.0.0/0
DROP       all -- 125.210.190.190      0.0.0.0/0
DROP       all -- 60.161.124.10        0.0.0.0/0
DROP       all -- 112.216.140.51       0.0.0.0/0
DROP       all -- 74.206.235.92        0.0.0.0/0
DROP       all -- 111.74.82.33         0.0.0.0/0
DROP       all -- 202.96.199.150       0.0.0.0/0
DROP       all -- 222.73.24.10         0.0.0.0/0
DROP       all -- 112.4.172.217        0.0.0.0/0
DROP       all -- 31.3.214.241         0.0.0.0/0
DROP       all -- 193.104.68.200       0.0.0.0/0
DROP       all -- 219.146.225.147      0.0.0.0/0
DROP       all -- 64.185.226.120       0.0.0.0/0
DROP       all -- 58.221.252.194       0.0.0.0/0
DROP       all -- 212.68.50.132        0.0.0.0/0
DROP       all -- 205.251.141.29       0.0.0.0/0
DROP       all -- 121.10.140.215       0.0.0.0/0
RETURN     all -- 0.0.0.0/0            0.0.0.0/0

fail2ban as i say in my post is a must have for ssh based security
with dynamic editing to the iptables firewall and clear logs it really is a
admins must have app

stay secure !

cyber bullying : what parents can do

2012-10-20T01:12:00.002-07:00

Hello All,

Latley in the news we have been hearing alot about online bullying or cyber bullying
this is brings a new issue that today parents have to deal with

some parents are asking them selves what can be done to protect thier children again such attacks

here are some tips parents can use

1.) parental controls on mobile devices

now a days kids and teens are carrying what used to be a phone but is now virtually a computer in thier pockets and with the new issue of things likes sexting and camerphones there is a need for parents to step in a control what thier children and teens have the access to certain features on the devices of today some examples would be software mechnisum to not allow mms messages or textmessages to anyone other than an allowed contact

2.) use of social media such as facebook

parents should sit down with children and set ground rules on the use of social media it is also a good idea for you to add yourself on your childs friends list so you can see what is being posted and some of thier activites if your child is under a certain age one of which you can decide up until that point you may also want to choose to have your childs password for thier account so you can review the activites

3.) parental controls on a pc/laptop

another approach is to instal parental controls that record conversations that take place on the web from your childs computer and also record activites such as image uploads for you review later

what to do if you discover you childs a victim of cyber bullying

1.) report the imncident to the authorites if you use parental control software or monitoring software you can show the autorirea the information you have obtained as proof

2.) report the incident to your childs school

3.) talk to your child and educate them on awareness of network saftey
such as dont give out personal information to strangers such as address or phone number
as the assumption always is that the bully is someone your child know this is not always the case

if you have anymore ideas on what could be done please leave a comment !

thank you all for reading

Protecting your linux ssh server with fail2ban

2012-10-06T02:25:00.001-07:00

Protecting your public servers is crucial we have talked before on a previous post on how to mitigate Ssh attacks on a cisco router now let’s talk Ssh on a server

an ssh server is no different you still have the same issues to fend off from DDOS attacks to brute force attacks ssh servers such as openssh are vulnerable here is a good module you can install on any Linux based server to protect again a brute force attack on your ssh tunnel ,

There is a free open source product called fail2ban   www.fail2ban.org/

this free solution scans logs files of the ssh service and looks for a set of criteria mostly an x amount of failed login attempts on the ssh service   and then creates a rule in the iptables firewall which will drop all future traffic to the ssh port it also supports ftp applications such as pure ftp in the same way

The below steps assume you are using a debian based distribution of Linux in our example we are using Ubuntu server 12.04

To install this application run the following command from your terminal window

sudo apt-get install fail2ban

Once the package is installed we can now start configuring it
Fail2ban uses a file called jail.conf to set the parameters for things like maximum attempts
Before banning the offending IP

the location of the jail.conf file is /etc/fail2ban

Once in the proper directory we can edit the config file using a text editor i personally like the VI editor

So you would issue the following command

sudo vi jail.conf

This will open the fail 2 ban configuration file
In this configuration file you are going to look for a section that looks like this

[ssh]

enabled = true
port     = ssh
filter   = sshd
logpath = /var/log/auth.log
maxretry = 3

the above configuration allows for 3 unsuccessful attempts (default is 6 ) before banning the offending IP address   you can change the log file name and path if you like also by default there will be a # symbol before enable you will want to remove that symbol the enable this rule or you can just copy and paste the config above

Once you have matched the default config to the one above you will then save the file in the vi editor using the :wq combination in command mode within the vi editor

you have now completed the setup of fail2ban for the ssh service

View Banned IP addresses

In order to see what IP's have been banned issue the following command

sudo iptables -L -n

look through the output for the fail2ban chain
Banned IP addresses will shows up like the one below in bold

Chain fail2ban-ssh (1 references)
target     prot opt source               destination
RETURN     all -- 0.0.0.0/0            0.0.0.0/0
Drop all - 10.10.10.10    0.0.0.0/0

Remove banned ip addresses

in order to remove a IP address from the banned list issues the following command

sudo iptables -D fail2ban-ssh -s 10.10.10.10 -j DROP

this will allow the IP on the server

The following post shows how to protect again bruteforce attacks on linux based ssh servers
using the fail2ban application this tool is a simple and free yet powerful application that should be installed to add a layer of protection to you servers ssh service

Till next time

Stay secure !

SSH bruteforce attack on cisco routers and ways to stop it !

2012-09-30T17:40:00.000-07:00

Here is what a ssh bruteforce attack looks like from a cisco router log

uthentication Failed] at 01:13:18 UTC Sun Sep 30 2012
*Sep 30 01:13:18.463: %SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching failures is 0 secs, [user: root] [Source: 211.144.68.163] [localport: 22] [Reason: Login Authentication Failed] [ACL: 100] at 01:13:18 UTC Sun Sep 30 2012
*Sep 30 01:13:24.967: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: root] [Source: 211.144.68.163] [localport: 22] [Reason: Login Authentication Failed] at 01:13:24 UTC Sun Sep 30 2012
*Sep 30 01:13:24.967: %SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching failures is 0 secs, [user: root] [Source: 211.144.68.163] [localport: 22] [Reason: Login Authentication Failed] [ACL: 100] at 01:13:24 UTC Sun Sep 30 2012
*Sep 30 01:13:31.447: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: root] [Source: 211.144.68.163] [localport: 22] [Reason: Login Authentication Failed] at 01:13:31 UTC Sun Sep 30 2012
*Sep 30 01:13:31.447: %SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching failures is 0 secs, [user: root] [Source: 211.144.68.163] [localport: 22] [Reason: Login Authentication Failed] [ACL: 100] at 01:13:31 UTC Sun Sep 30 2012
*Sep 30 01:13:37.963: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: root] [Source: 211.144.68.163] [localport: 22] [Reason: Login Authentication Failed] at 01:13:37 UTC Sun Sep 30 2012
*Sep 30 01:13:37.963: %SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching failures is 0 secs, [user: root] [Source: 211.144.68.163] [localport: 22] [Reason: Login Authentication Failed] [ACL: 100] at 01:13:37 UTC Sun Sep 30 2012
*Sep 30 01:13:44.307: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: root] [Source: 211.144.68.163] [localport: 22] [Reason: Login Authentication Failed] at 01:13:44 UTC Sun Sep 30 2012
*Sep 30 01:13:44.307: %SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching failures is 0 secs, [user: root] [Source: 211.144.68.163] [localport: 22] [Reason: Login Authentication Failed] [ACL: 100] at 01:13:44 UTC Sun Sep 30 2012
*Sep 30 01:13:50.771: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: root] [Source: 211.144.68.163] [localport: 22] [Reason: Login Authentication Failed] at 01:13:50 UTC Sun Sep 30 2012
*Sep 30 01:13:50.771: %SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching failures is 0 secs, [user: root] [Source: 211.144.68.163] [localport: 22] [Reason: Login Authentication Failed] [ACL: 100] at 01:13:50 UTC Sun Sep 30 2012
*Sep 30 01:13:57.239: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: root] [Source: 211.144.68.163] [localport: 22] [Reason: Login Authentication Failed] at 01:13:57 UTC Sun Sep 30 2012
*Sep 30 01:13:57.239: %SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching failures is 0 secs, [user: root] [Source: 211.144.68.163] [localport: 22] [Reason: Login Authentication Failed] [ACL: 100] at 01:13:57 UTC Sun Sep 30 2012

The above shows a perfect example why you should have a radiius server or tacas server for authentication with an ip ban mechanism this prevents scripts such as the above one from constantly trying to bruteforce attack your edge router from the same ip which would force the script to either use a different proxy or change servers not a total solution but an effective layer of security you can also use things like vpn so an administrator would vpn into your local network and then locally access your equipment

Just a little tid bit of knowledge

Till next time

Stay secure !

Been a while

2012-09-12T16:38:00.002-07:00

Hello All ,

sorry it has been a very long time since I posted on this blog

I will be making regular updates to this blog starting this week

we will still follow the same weekly topics !

if you have any suggestions or a topic you wish to be covered

please contact me !

till then

Have a safe internet experience !

New Spam Email recived today

2010-12-28T09:50:00.000-08:00

Emailed from jamilah.norchamber@hotmail.my

Ashirin Jamilah & Nor (K.Sel)
No. 9A, Jalan Melati 3/21,
Bandar Melawati.
45000 Kuala Lumpur
Selangor
Tel:+60163722712

Dear Sean,

I am Ashirin Jamilah,an attorney at law. A deceased client of mine, by name Mr
Adams Mancini,who was here and after shall be referred as my client,he died with his
family
in gulf air flight crashes in Persian gulf near Bahrain aired.aired august 23,
2000-2:50 p.m.
I have contact you to assist in distributing the money left behind by my
client before it will confiscated or declared unserviceable by the bank when
this
deposit valued at $15.5million dollars is lodged.This bank has issued me a
notice to contact the next of kin, or the fund will be transferred into the
federal government reserve.
My proposition to you is to seek your consent to present you as the next-of-kin
and beneficiary of my late client,so that the proceeds of this account can be
paid to you.Then we can share the amount on a mutually agreed-upon
percentage.All legal documents to back up your claim as my client's next-of-kin
will be provided.All I require is your honest cooperation to enable us see the
transaction through.
This will be executed under a legitimate arrangement that will protect you from
any breach of law If this business proposition offends your moral values,do
accept my apology.I must use this opportunity to implore you to exercise the
utmost indulgence to keep this matter extraordinary confidential,
Please contact me at once to indicate your interest.This transaction will be
treated private with absolute confidentiality and sincerity.

Best Regards,
Barr :Ms Ashirin Jamilah

ddos attack on amazon seems imanent

2010-12-10T11:55:00.000-08:00

Network security news from networksecurity.tk

be advised everyone the team supporting wikileaks has said on thier twitter account they are voting to take down a companies website that was apart of the wikileaks.org take down

New African Scam Email Recived

2010-12-10T08:19:00.000-08:00

Today i recived a new scam email from a "dr" say he would like to transfer money from a bank in africa that has been unclaimed to a sum of $12,000,000 this is a common scam going around where the scammer steal your idenity by luring you to give up certain info like account numbers etc

I have posted the body of the mail below

Good day,

I am Dr. Johnson Okechuku the Branch Manager of Agricultural Development Bank (A.D.B) Achimota Branch in the Greater Accra Region of Republic of Ghana .

I am writing you following a deal in my bank that will be of an immense benefit to both of us but if you are not willing to get involved in the Deal, do not REPLY THIS E-MAIL, as you will never hear from me again.

I have contacted you to solicit your assistance in the transfer of $12,000,000.00 (Twelve million United States dollars) which have been abandoned for 7 years now in our bank without claim. The said fund was deposited by a foreign customer of our bank who unfortunately lost his life and that of his entire family in the 25th December, 2003 Chartered UTA Guinea - Boeing 727-223 air crash in Cotonou-Republic of Benin.

Since this incident occurred, our bank has waited for any of his relatives to come up for the claim but until date no body has done that and this compelled me as the branch manager to place the funds in a escrow coded/suspense account without a beneficiary until I can get a reliable, honest and a trust worthy person who will stand as the beneficiary and receive the funds into his/her bank account.

My decision to execute this deal is because according to my bank's policy which is in line with constitution of Republic of Ghana if an estate remains unclaimed after 7 years such estate will be confiscated by the Government and coupled with the fact that with all necessary legal documents the funds will be paid to any person who is presented as the beneficiary to our management team without any problem.

As a staff of the bank, I cannot be directly connected to this money as the beneficiary thus I contacted you to solicit your assistance to stand as the beneficiary and receive the funds into your bank account because of the geographical nature of where you live; particularly due to the sensitivity of the deal and the confidentiality herein.

Be informed that the funds will be released and transferred to your bank account as the beneficiary under a legitimate arrangement that will protect us from any breach of the law; And for your full maximum cooperation and support that guaranteed the success of this deal, I am offering to give you 40% of the funds while 60% will be for me.

Importantly be informed that this is going to be a bank-to-bank transfer without any risk involved and you are free to come to Ghana for confirmation.

All we need to do to succeed in this deal is to obtain all necessary legal documents in your favor as the beneficiary from the respective ministries in Republic of Ghana which will back up this claim and ensure the release/transfer of the funds to any bank account you will provide.

If you are interested and willing to execute this deal with me, I will appreciate your timely response at johnsonokechuku@gmail.com

another interest this is this the reply to email address is a gmail address

but the from email id is officeinfoorji20@att.ne

when you search this email id in Google you can see many people have fallen for this type of email

be smart stay secure

Sink hole Bots

2010-11-30T15:20:00.000-08:00

Read this interesting pdf on how sinkhole works to kill ddos bots on the internet

let me know what you think

you will find the pdf here

Link from www.cert.org

security tools you can use for free!!!!

2010-11-18T08:13:00.000-08:00

Hey eveyone

Been a while since my last post if you are wondering i have transferd my blog from one site to blogger

the key to keeping your data safe is having a secure computer

here are some free tools you can use to scan your computer for viruses and secure it from hackers

Antivirus

Avast antivirus located at www.avast.com is a very light and powerful antivirus program

Microsoft security essentials http://www.microsoft.com/security_essentials/ free and light

Online antivirus scanners

NOD32 online scan http://www.eset.com/online-scanner
use this online scanner when your installed antivirus has failed

im working on my list more to come

new bank scam email recived

2010-11-16T15:41:00.000-08:00

this is a classic scam here are the 4 signs this is a fake

1.) spelling notice some of the spelling mistakes

2) any reputable back would never correspond with you via email for security issues you most definitely would be contacted by phone

3) look at the copyright first mistake the corporate name is TD Canada trust

4) this is a alarming thing that even the most non- technical person can catch

if your right mouse click on the link in the email and click save link location this is where you truly will be directed to
http://www.vinners.pl/skin/frontend/tdcanadatrust.com/easyweb/xxxxxxxxxxxxx

important points
1.) this email did not end up in spam until i put it there
2.) when you clicked the link in internet explorer it did not advise this was a phishing website but Mozilla Firefox did !

this is just another reason why just having a antivirus/firewall updated browser is not always enough !

be smart stay secure !!!

the dangers of chat rooms and children

2010-11-16T15:40:00.000-08:00

as parents and adults its our responsibility to ensure we protect our children from threats of the world just like we would protect them from being chased by the school bully we should be doing the same for their online security

its is very easy for a child to gain access to a chat room and start chating from that time your child
may be prone to internet predictors or other threats

ways to protect your child

1.) use parental control software to restrict what websites they can surf to
2.) keep your computer in a open area where you can see your child's activity
3.) there is software available that logs all chat activity which i will post in the software section of this page
4.) look for unusual long internet activity for example if your child usual use the internet for about 1 hour but all of a sudden now its 4 hours look into it as this may be an issue the reason is if your child is now talking to someone online they may be luring in your child to "meet up " or a "relationship"

and the end know your child know thier friends and keep involved with thier activites

be smart stay secure !!

Protect your self from spammers

2010-11-16T15:39:00.000-08:00

Hey everyone

One popular question is how do i protect my self from a spammer getting a hold of my email address

for one posting your email address on a forum or a website is a bad idea unless you have to for example your business website

another suggestion is to choose your email address wisely for example if your name is john it is a wise idea not to chose something like john@hotmail.com the reason for this is it protects you from one of the most popular spamming techniques a "dictionary spam attack " the logic behind this attack is when the attacker or the spammer goes against a email server in this case the hotmail email server the hacker goes by a dictionary of names so john being a popular name it would be one of the prime targets for spamming in this type of attack

when the spammer does not get a bounce back says hey this email address doesn't exist he or she now knows that this is a active email address

but if john were to select john.doe@hotmail.com he cuts the probability in half that this type of attack would effect him

be smart stay secure !

The misconceptions about network security for both home and business

2010-11-16T15:37:00.000-08:00

everyday millions and millions of computers around the world are compromised and the users of these computers don’t even know from the big corporations to the home users everyone is at risk and the scary part about it is that most of the users of the computers don’t even know !!!
the problem is number one EDUCATION some people think just because they have an antivirus/firewall on their computer that they are in some sort of untouchable zone wrong !!! millions of different types of malware is launched onto the internet a day and for security professionals to keep up is near impossible security is a balance between education and common sense for instance a common thing now is to get a spam message from a bank asking for information such as your account number now site back and think now why would a bank ask for your account number ?

live by this rule if a person were to call me and ask for this information would i give it to them without challenging them ? if not then why would you just give your information to a computer without questioning it ?

be smart stay secure !