Today itself, a friend sent me a message about free travel ticket with Emirates airline through WhatsApp. On seeing the URL, I immediately doubt about the authenticity of such kind of strategy spammers are using to make money as well as to harvest data about you. Once you fill in the form, it will prompt you to share the information to 30 people on WhatsApp to get your ticket. Common, this does not make sense at all and I believe that the website should be reported and Emirates Airline to make an official announcement on its website about these scammers.
The message sent to me was in French. Since I’m well conversant in French, I could easily read and interpreted it. The message received is as follows:
“Pour le 33° Anniversaire, la compagnie aérienne *Emirates Airline* donne à tout le monde *2 billets d´avion gratuits*. Récupérez votre billets d´avion immédiatement. http://bit.ly/Emirates-airline”
The translation looks like this in English:
“For the 33rd Birthday, the aviation airline “Emirates Airline” is giving a free *2 air travel tickets. Get your airline tickets immediately. http://bit.ly/Emirates-airline”
If you observed carefully the real URL has been shortened on bit.ly. There is nothing wrong when using bit.ly which is a great tool for URL shortener. However, if you try to access the URL, you will be redirected on http://5ack.com/Emirate/ which is well known for attacks.
Let’s see what does the whois tool said about 5ack.com:
Please don’t click on the link otherwise you might eat those baits and be a victim of Phishing attacks. I wonder how come those links ended in Mauritius which is probably due to French-speaking people here in Mauritius. Otherwise, several French-speaking countries in Africa is at risk. I wish someone from the security team of Emirates Airline read that blog and made an official announcement soon about those spammers hovering everywhere on the Internet. Let’s work together for a safe and secure Internet and keep on passing the message.
As promised days back on my Tunnelix.com Facebook Page, I would blog about setting up a Litecoin button on your website for payment or donation purpose which I did myself. See on the top right corner of the blog. I would strongly suggest using the XpressLiteCoin payment gateway for such type of transaction. Some days back during the operation JASK, I contributed to the LiteCoin repository and I thought why not set up a Litecoin donation button. The funds received will be used to renew my server hosting and tunnelix.com domain. Below are some instructions to start with.
For some who are not well acquainted to cryptocurrencies, Litecoin is one amongst many and it is a fork from the Bitcoin. Litecoin is an experimental digital currency that enables instant payments to anyone, anywhere in the world. Litecoin uses peer-to-peer technology to operate with no central authority: managing transactions and issuing money are carried out collectively by the network. Litecoin Core is the name of open source software which enables the use of this currency. – Litecoin
Imagine, you want to receive payments for your business in a more secure way. Of course, when it comes to cryptocurrencies, no one wants to take the risk. XpressLiteCoin is here to provide merchants with a cheap and convenient way to integrate Litecoin in their business payment process. – XpressLiteCoin
How to start with XpressLiteCoin payment gateway?
1. First, you will need to register yourself on the XpressLiteCoin.com website. This is pretty straightforward. Make sure you received the confirmation email once you have to sign up on the website.
Create a Litecoin address.
2. You can create a paper-based wallet but the procedures can be lengthy and you will have to secure your key and record all transactions. However, using the online wallet is pretty simple with Jaxx.
3. After installing Jaxx, you will have the option to create a new wallet.
4. Then, you will have the option to choose the paper-based wallet or an online wallet which is easier.
You can create your wallet and scan the QR code to use the same wallet on your mobile device such as Android, IOS etc..
5. After configuration, you will have an LTC Address.
Merge your Litecoin address with XpressLiteCoin gateway
6. Save your Litecoin address and enter it on the prompt which you received when logging for the first time on the prompt as shown below:
By this time, you should have been able to access the dashboard as a user. Now it’s time for some basic installation on the server.
Some basic installations on the server
7. On the server, install the “npm” package manager:
yum install npm
8. You can also upgrade your version of npm as follows:
npm install npm -g --ca=""
9. Use known registrars for the current version of npm
npm config set ca ""
10. Some installations with npm package manager which are required:
13. There are two parameters in the code to tweak: First is the port number your application will be listening and second is the token which you will get from the XpressLiteCoin dashboard on the merchant settings option.
14. Copy the token and insert it at line 10 of the code. Example:
const api_token = "XXXX<Token Value here XXXX";
15. By default, the port runs on 8080. In case, you want to change it, feel free.
16. You will also need to run your application. I would, however, recommend you to have a script on autostart for this service :
17. Since the application need to be inserted as a plugin on your website, you can create a ProxyPass on your web server. For Nginx proxy use the following parameter
18. For Apache HTTPD ProxyPass, see the documentation here.
Create the payment button
Apart from the IETF hackathons, the cyberstorm.mu team also focused on internal hackathon either remotely or on-site participation. Another remote hackathon was already in progress since Saturday the 16th of June 2018. It was named Operation JASK – Just a Single Keystroke. Announced publicly on Sunday the 17th of June 2018 after noticing that several Crypto currency mining tools were vulnerable to CVE-2018-12356. By the time, many members of the team were already mobilised even if it was a public holiday in Mauritius. The operation was named JASK – Just a Single Keystroke as the security issues is concerned with the hardening of a regular expression, in particular requiring [GNUPG:] to be at the beginning of a line (^\[GNUPG:\]). We had to fire a single keystroke at the right place to fix a single vulnerability.
Marcus Brinkmann, who is a free software activist explained “An issue was discovered in password-store.sh in the pass in Simple Password Store 1.7 through 1.7.1. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extensions scripts. Modifying the configuration file allows the attacker to inject additional encryption keys under their control, thereby disclosing passwords to the attacker. Modifying the extension scripts allows the attacker arbitrary code execution.”
However, simply the patch is, the attack aimed GnuPG signature verification process which is specific to pass the Simple Password Store. It can give the attacker access to passwords and remote code execution. On theRegister.co.uk – Pass gets a fail: Simple Password Store suffers GnuPG spoofing bug, Loganaden Velvindron core member of the cyberstorm.mu explained, “It’s hard to identify just how many downstream projects inherit a vulnerability as the one Brinkmann spotted, but the number of problem projects will likely be non-trivial because the GnuPG cryptography suite has applications beyond e-mail protection.”
Lime is a Loadable Kernel Module (LKM) which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimises its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition. – Lime. Volatility framework was released at Black Hat DC for analysis of memory during forensic investigations.
Analysing memory in Linux can be carried out using Lime which is a forensic tool to dump the memory. I am actually using CentOS 6 distribution installed on a Virtual Box to acquire memory. Normally before capturing the memory, the suspicious system’s architecture should be well known. May be you would need to compile Lime on the the suspicious machine itself if you do not know the architecture. Once you compile Lime, you would have a kernel loadable object which can be injected in the Linux Kernel itself.
Linux memory dump with Lime
1. You will first need to download Lime on the suspicious machine.
git clone https://github.com/504ensicsLabs/LiME
2. Do the compilation of Lime. Once it has been compiled, you will noticed the creation of the Lime loadable kernel object.
3. Now the kernel object have to be loaded into the kernel. Insert the kernel module. Then, define the location and format to save the memory image.
6. Now, we will create a Linux profile. We will also need to download the DwarfDump package. Once it is downloaded go to Tools -> Linux directory, then create the module.dwarf file.
yum install epel-release libdwarf-tools -y && make
7. To proceed further, the System.map file is important to build the profile. The System.map file contains the locations of all the functions active in the compiled kernel. You will notice it inside the /boot directory. It is also important to corroborate the version appended with the System.map file together the version and architecture of the kernel. In the example below, the version is 2.6.32-696.23.1.el6.x86_64.
8. Now, go to the root of the Volatility directory using cd ../../ since I assumed that you are in the linux directory. Then, create a zip file as follows:
zip volatility/plugins/overlays/linux/Centos6-2632.zip tools/linux/module.dwarf /boot/System.map-2.6.32-696.23.1.el6.x86_64
9. The volatility module has now been successfully created as indicated in part 8 for the particular version of the Linux and kernel version. Time to have fun with some Python script. You can view the profile created with the following command:
python vol.py --info | grep Linux
As you can see the profile LinuxCentos6-2632 profile has been created.
10. Volatile contains plugins to view details about the memory dump performed. To view the plugins or parsers, use the following command:
python vol.py --info | grep -i linux_
11. Now imagine that you want to see the processes running at the time of the memory dump. You will have to execute the vol.py script, specify the location of the memory dump, define the profile created and call the parser concerned.
I find the LiMEaid tools really interesting to remote executing of Lime. “LiMEaide is a python application designed to remotely dump RAM of a Linux client and create a volatility profile for later analysis on your local host. I hope that this will simplify Linux digital forensics in a remote environment. In order to use LiMEaide all you need to do is feed a remote Linux client IP address, sit back, and consume your favorite caffeinated beverage.” – LiMEaid
Linux architecture is very important when dealing with Lime. This is probably the first question that one would ask.
The kernel-headers package is a must to create the kernel loadable object.
Once a memory dump have been created, its important to take a hash value. It can be done using the command md5sum Linux64.mem
I would also consider to download the devel tools using yum groupinstall “Development Tools” -y
As good practice as indicated in part 8 when creating the zip file, use the proper convention when naming the file. In my case I used the OS version and the kernel version for future references.
Not all Parsers/Plugins will work with Volatile as same might not be compatible with the Linux system.
You can check out the Volatile wiki for more info about the Parsers.
Auditing a Linux System is one of the most important aspect when it comes to security. After deploying a simple Centos 7 Linux machine on virtual box, I made an audit using Lynis. It is amazing how many tiny flaws can be seen right from the beginning of a fresh installation. Lynis Enterprise performs security scanning for Linux, macOS, and Unix systems. It helps you discover and solve issues quickly, so you can focus on your business and projects again. – Cisofy.
The Lynis tool performs both security and compliance auditing. It has a free and paid version which comes very handy especially if you are on a business environment. The installation of the Lynis tool is pretty simple. You can install it through the Linux repository itself, download the tar file or clone it directly from Github.
Scanning Performed by Lynis
1. I downloaded the tar file with the following command:
2. Then, just untar the file and get into it
tar -xzf lynis-2.6.0.tar.gz && cd lynis
3. Once into the untar directory, launch the following command:
./lynis audit system --quick
As you can see from the output above, there are several suggestions at the end of the scan. In case the paid version of the application was used, more information and commands as how to remediate the situation would be given including support from Lynis. As regards to the free version, you can also debug by yourself several security aspects from the suggestions.
Suggestions, Compliance and Improvement.
1.The first two suggestions were about minimum and maximum password age.
Configure minimum password age in /etc/login.defs [AUTH-9286]
Configure maximum password age in /etc/login.defs [AUTH-9286]
To check the minimum and maximum password age, use the chage command :
2. Use chage -m root to set the minimum password age and chage -M root to set maximum password age:
Also, you will have to set the parameter in the /etc/login.defs file
3. Delete accounts which are no longer used [AUTH-9288]
It is also suggested to delete accounts which are no longer in use. This suggestion was prompted as I created a user “nitin” account during installation and did not use it yet. For the purpose of this blog, I deleted it using userdel -r nitin
4. Default umask in /etc/profile or /etc/profile.d/custom.sh could be more strict (e.g. 027) [AUTH-9328]
Default umask values are taken from the information provided in the /etc/login.defs file for RHEL (Red Hat) based distros. Debian and Ubuntu Linux based system use /etc/deluser.conf. To change default umask value to 027 which is actually 022 by default, you will need to modify the /etc/profile script as follows:
5. To decrease the impact of a full /home file system, place /home on a separated partition [FILE-6310]
To decrease the impact of a full /tmp file system, place /tmp on a separated partition [FILE-6310]
To decrease the impact of a full /var file system, place /var on a separated partition [FILE-6310]
6. Disable drivers like USB storage when not used, to prevent unauthorized storage or data theft [STRG-1840]
Disable drivers like firewire storage when not used, to prevent unauthorized storage or data theft [STRG-1846]
To disable USB and firewire storage drivers, add the following lines in /etc/modprobe.d/blacklist.conf then do a modprobe usb-storage && modprobe firewire-core
7. Split resolving between localhost and the hostname of the system [NAME-4406]
This issue is only about hostname and localhost in /etc/hosts which could confuse some applications installed on the machine. According to cisofy, for proper resolving, the entries of localhost and the local defined hostname, could be split. Using some middleware and some applications, resolving of the hostname to localhost, might confuse the software.
8. Install package ‘yum-utils’ for better consistency checking of the package database [PKGS-7384]
The yum-utils and arpwatch are nice tools to perform more debugging and verification. Install it using the following commands:
yum install yum-utils arpwatch -y
9. You are advised to hide the mail_name (option: smtpd_banner) from your postfix configuration. Use postconf -e or change your main.cf file (/etc/postfix/main.cf) [MAIL-8818]
You just have to uncomment the following line and lauch a postconf -e. However, since this is a fresh install, and I’m not using postfix, it is better to stop the service.
10. Check iptables rules to see which rules are currently not used [FIRE-4513]
Since, I’m not on a production environment, it is very difficult to identify unused iptables rules right now. Once on the production environment, this situation is different. According to Cisofy, the best way is to “use iptables –list –numeric –verbose to display all rules. Check for rules which didn’t get a hit and repeat this process several times (e.g. in a few weeks). Finally remove any unneeded rules.”
Again, hardening SSH is one of the most important to evade attacks especially from SSH bots. It all depends how your network infrastructure is configured and whether it is accessible from the internet or not. However, these details viewed are very informative.
Lynis documentation is pretty straight forward with a cheat sheet. The arguments are self explicit. Here are some hints.
1.Performs a system audit which is the most common audit.
lynis audit system
2. Provides command to do a remote scan.
lynis audit system remote <host>
3. Views the settings of default profile.
lynis show settings
4. Checks if you are using most recent version of Lynis
lynis update info
5. More information about a specific test-id
lynis show details <test-id>
6. To scan whole system
lynix --check-all Q
7. To see all available parameters of Lynis
lynis show options
At the end of any Lynis command, it will also prompt you where the logs have been stored for your future references. It is usually in /var/log/lynis.log. The systutorial on lynis is also a good start to grasp the command. All common systems based on Unix/Linux are supported. Examples include Linux, AIX, *BSD, HP-UX, macOS and Solaris. For package management, the following tools are supported:- dpkg/apt, pacman, pkg_info, RPM, YUM, zypper.