Category Archives: Linux

HOTforSecurity: Uh-oh. How just inserting a USB drive can pwn a Linux box

Remember the notorious Stuxnet worm?

It was a highly-sophisticated piece of malware – developed by the United States and Israeli intelligence – which targeted Iran’s Natanz uranium enrichment facility.

One of the things which made Stuxnet so notable was that it exploited a zero-day vulnerability in Windows, meaning that it could infect a Windows computer (even with Windows AutoRun and AutoPlay disabled) just by plugging in an infected USB stick.

The exploit was in how Microsoft Windows handled .LNK shortcut files, and meant that malicious code could be run on a computer without any user interaction – just inserting the thumb drive was enough.

Of course, this vulnerability was uncovered back in 2010. Nothing like that would ever happen these days… right?

Sadly for Linux users running the KDE Plasma desktop environment, they find themselves now facing a similar scenario. If anything it’s worse, according to a security advisory released late last week.

In short, if a USB memory stick is plugged into a vulnerable computer has a volume label containing the characters `` or $(), the text contained within the characters will be executed as shell commands.

Or, to put it another way, give a USB drive the volume name `rm -rf`, and hand it to a friend who runs KDE Plasma on their Linux box, and they won’t be your friend much longer.

Of course, this isn’t the sort of attack that could be conducted remotely. An attacker needs to have physical access to the vulnerable computer, or maybe sneakily leave it lying around in a car park in the hope that an unsuspecting user will plug it into their computer out of curiosity.

It’s easy to imagine how both malicious attackers and immature pranksters might attempt to abuse this flaw, so make sure that any vulnerable Linux computers under your control are properly protected.

KDE Plasma users are advised to update their systems as soon as possible to version 5.12.0 or later.

Astonishingly, in 2015 it was discovered that Microsoft’s 2010 attempt to patch the USB flaw had been insufficient, and so it had another go.

Let’s hope KDE Plasma has better luck than Microsoft.



HOTforSecurity

Uh-oh. How just inserting a USB drive can pwn a Linux box

Remember the notorious Stuxnet worm?

It was a highly-sophisticated piece of malware – developed by the United States and Israeli intelligence – which targeted Iran’s Natanz uranium enrichment facility.

One of the things which made Stuxnet so notable was that it exploited a zero-day vulnerability in Windows, meaning that it could infect a Windows computer (even with Windows AutoRun and AutoPlay disabled) just by plugging in an infected USB stick.

The exploit was in how Microsoft Windows handled .LNK shortcut files, and meant that malicious code could be run on a computer without any user interaction – just inserting the thumb drive was enough.

Of course, this vulnerability was uncovered back in 2010. Nothing like that would ever happen these days… right?

Sadly for Linux users running the KDE Plasma desktop environment, they find themselves now facing a similar scenario. If anything it’s worse, according to a security advisory released late last week.

In short, if a USB memory stick is plugged into a vulnerable computer has a volume label containing the characters `` or $(), the text contained within the characters will be executed as shell commands.

Or, to put it another way, give a USB drive the volume name `rm -rf`, and hand it to a friend who runs KDE Plasma on their Linux box, and they won’t be your friend much longer.

Of course, this isn’t the sort of attack that could be conducted remotely. An attacker needs to have physical access to the vulnerable computer, or maybe sneakily leave it lying around in a car park in the hope that an unsuspecting user will plug it into their computer out of curiosity.

It’s easy to imagine how both malicious attackers and immature pranksters might attempt to abuse this flaw, so make sure that any vulnerable Linux computers under your control are properly protected.

KDE Plasma users are advised to update their systems as soon as possible to version 5.12.0 or later.

Astonishingly, in 2015 it was discovered that Microsoft’s 2010 attempt to patch the USB flaw had been insufficient, and so it had another go.

Let’s hope KDE Plasma has better luck than Microsoft.

Nintendo Switch hacked to run Debian Linux

Hackers run Linux on Nintendo Switch, claim exploit cannot be patched

Hackers have a particular liking when it comes to hacking Nintendo consoles, be it the Wii, DS, or 3DS. Not making it easier for Nintendo, now a hacker group named ‘fail0verflow’ has successfully managed to run Debian Linux on Switch by exploiting its boot code. fail0verflow is the same hacking group who hacked the Nintendo Wii and Sony PlayStation 4.

fail0verflow announced their discovery in a post on Twitter with an image that displayed the Nintendo console running the Debian Linux distro and user login, along with a serial adapter that was connected to one of the Joy-Con terminal on the right side.

According to fail0verflow group, the exploit triggers a flaw in the boot ROM process of the Nvidia Tegra X1 chip that powers the console. The boot ROM is stored on the chip when Nvidia manufactures it and no changes can be made to it after that. Since, the console loads the boot ROM immediately after pressing the power button, the exploit cannot be patched via future software or firmware updates as it won’t affect the ROM, the hacker group claimed.

However, Nintendo could work with Nvidia and manufacture new Nvidia Tegra X1 chips so that new consoles don’t have this vulnerability.

While several sources are of the opinion that the Switch exploit is possibly a fake hack, most industry experts believe it to be true given fail0verflow’s hacking track records. Whatever be the case, Nintendo will definitely be looking to quickly fix the potential weaknesses in its code and hardware to avoid opening up any possibilities for installation of home brew apps and pirated games on the Nintendo Switch.

Source: TechCrunch

The post Nintendo Switch hacked to run Debian Linux appeared first on TechWorm.

Skype now available as a snap app for Linux users

Skype Is Now Available As A Snap For Linux

Microsoft’s Skype, the widely popular VoIP client, is now available as a snap, according to an announcement made by Canonical, the company behind Ubuntu.

“Skype is used by millions of users globally to make free video and voice calls, send files, video and instant messages and to share both special occasions and everyday moments with the people who matter most. Skype has turned to snaps to ensure its users on Linux, are automatically delivered to its latest version upon release. And with snaps’ roll-back feature, whereby applications can revert back to the previous working version in the event of a bug, Skype’s developers can ensure a seamless user experience,” says Canonical.

The Ubuntu-maker further added, “The Skype snap will work natively on all Linux distributions that support snaps, including Linux Mint, Manjaro, Debian, Arch Linux, OpenSUSE, Solus, and Ubuntu. This Skype desktop application is compatible across the wide range of Linux platforms, opening it up to an increased range of devices and to millions of users.”

With Skype being available as a snap, will allow easy installation of Skype in popular Linux distributions such as Ubuntu and Linux Mint, and keep it updated. Skype joins the current list of snap packages such as the music program ‘Spotify’, and the team instant messaging client ‘Slack’ for its Linux desktop client.

Jonáš Tajrych, Senior Software Engineer at Skype, Microsoft said, “Skype has been enabling the world’s conversations for over ten years. We want to be able to deliver the same high quality experience on Linux as we do on other platforms. Snaps allow us to do just that, by giving us the ability to push the latest features straight to our users, no matter what device or distribution they happen to use.”

Launched in 2016, Snap was created by Canonical as a universal Linux package that works natively on all Linux distributions that support snap packaging. Snaps are containerised software designed to work on any Linux platform, whether that be on desktop, the cloud, or IoT devices. It offers additional benefits to developers including automatic software updates. It also has roll-back features, which means that if anything goes wrong with the latest version, users can easily revert back to the previous working configuration. This allows Skype’s developers to ensure a seamless user experience.

Jamie Bennett, VP of Engineering, Devices & IoT at Canonical said, “We’re delighted to welcome Skype to the snaps ecosystem. Skype, and the ever growing number of snaps it joins, looks to put the Linux user first, allowing them to enjoy the latest versions upon release and provide a wider range of application for users to choose from.”

If you wish to install the Skype Snap on your Linux box, you can go to the Snapcraft.io website and download it. Alternatively, you can install it by typing “snap install –classic skype” without quotes from your Linux desktop shell.

The post Skype now available as a snap app for Linux users appeared first on TechWorm.

Howto setup a Debian 9 with Proxmox and containers using as few IPv4 and IPv6 addresses as possible

My current Linux Root-Server needs to be replaced with a newer Linux version and should also be much cheaper then the current one. So at first I did look what I don’t like about the current one:

  • It is expensive with about 70 Euros / months. Following is responsible for that
    • My own HPE hardware with 16GB RAM and a software RAID (hardware raid would be even more expensive) – iLo (or something like it) is a must for me 🙂
    • 16 additional IPv4 addresses for the visualized container and servers
    • Large enough backup space to get back some days.
  • A base OS which makes it hard to run newer Linux versions in the container (sure old ones like CentOS6 still get updates, but that will change)
    • Its time to move to newer Linux versions in the containers
  • OpenVZ based containers which are not mainstream anymore

Then I looked what surrounding conditions changed since I did setup my current server.

  • I’ve IPv6 at home and 70% of my traffic is IPv6 (thx to Google (specially Youtube) and Cloudflare)
  • IPv4 addresses got even more expensive for Root-Servers
  • I’m now using Cloudflare for most of the websites I host.
  • Cloudflare is reachable via IPv4 and IPv6 and can connect back either with IPv4 or IPv6 to my servers
  • With unprivileged containers the need to use KVM for security lessens
  • Hosting providers offer now KVM servers for really cheap, which have dedicated reserved CPUs.
  • KVM servers can host containers without a problem

This lead to the decision to try following setup:

  • A KVM based Server for less than 10 Euro / month at Netcup to try the concept
  • No additional IPv4 addresses, everything should work with only 1 IPv4 and a /64 IPv6 subnet
  • Base OS should be Debian 9 (“Stretch”)
  • For ease of configuration of the containers I will use the current Proxmox with LXC
  • Don’t use my own HTTP reverse proxy, but use exclusively Cloudflare for all websites to translate from IPv4 to IPv6

After that decision was reached I search for Howtos which would allow me to just set it up without doing much research. Sadly that didn’t work out. Sure, there are multiple Howtos which explain you how to setup Debian and Proxmox, but if you get into the nifty parts e.g. using only minimal IP addresses, working around MAC address filters at the hosting providers (which is quite a important security function, BTW) and IPv6, they will tell you: You need more IP addresses, get a really complicated setup or just ignore that point at all.

As you can read that blog post you know that I found a way, so expect a complete documentation on how to setup such a server. I’ll concentrate on the relevant parts to allow you to setup a similar server. Of course I did also some security harding like making a secure ssh setup with only public keys, the right ciphers, …. which I won’t cover here.

Setting up the OS

I used the Debian 9 minimal install, which Netcup provides, and did change the password, hostname, changed the language to English (to be more exact to C) and moved the SSH Port a non standard port. The last one I did not so much for security but for the constant scans on port 22, which flood the logs.

passwd
vim /etc/hosts
vim /etc/hostname
dpkg-reconfigure locales
vim /etc/ssh/sshd_config
/etc/init.d/ssh restart

I followed that with making sure no firewall is active and installed the net-tools so I got netstat and ifconfig.

apt install net-tools

At last I did a check if any packages needs an update.

apt update
apt upgrade

Installing Proxmox

First I checked if the IP address returns the correct hostname, as otherwise the install fails and you need to start from scratch.

hostname --ip-address

Adding the Proxmox Repos to the system and installing the software:

echo "deb http://download.proxmox.com/debian/pve stretch pve-no-subscription" > /etc/apt/sources.list.d/pve-install-repo.list
wget http://download.proxmox.com/debian/proxmox-ve-release-5.x.gpg -O /etc/apt/trusted.gpg.d/proxmox-ve-release-5.x.gpg
apt update && apt dist-upgrade
apt install proxmox-ve postfix open-iscsi

After that I did a reboot and booted the Proxmox kernel, I removed some packages I didn’t need anymore

apt remove os-prober linux-image-amd64 linux-image-4.9.0-3-amd64

Now I did my first login to the admin GUI to https://<hostname>:8006/ and enabled the Proxmox firewall

Than set the firewall rules for protecting the host (I did that for the whole datacenter even if I only have one server at this moment). Ping is allowed, the Webgui and ssh.

I mate sure with

iptables -L -xvn

that the firewall was running.

BTW, if you don’t like the nagging windows at every login that you need a license and if this is only a testing machine as mine is currently, type following:

sed -i.bak 's/NotFound/Active/g' /usr/share/perl5/PVE/API2/Subscription.pm && systemctl restart pveproxy.service

Now we need to configure the network (vmbr0) for our virtual systems and this is the point where my Howto will go an other direction. Normally you’re told to configure the vmbr0 and put the physical interface into the bridge. This bridging mode is the easiest normally, but won’t work here.

Routing instead of bridging

Normally you are told that if you use public IPv4 and IPv6 addresses in containers you should bridge it. Yes thats true, but there is one problem. LXC containers have their own MAC addresses. So if they send traffic via the bridge to the datacenter switch, the switch sees the virtual MAC address. In a internal company network on a physical host that is normally not a problem. In a datacenter where different people rent their servers thats not good security practice. Most hosting providers will filter the MAC addresses on the switch (sometimes additional IPv4 addresses come with the right to use additional MAC addresses, but we want to save money here 🙂 ). As this server is a KVM guest OS the filtering is most likely part of the virtual switch (e.g. for VMware ESX this is the default even).

With ebtables it is possible to configure a SNAT for the MAC addresses, but that will get really complicated really fast – trust me with networking stuff – when I say complicated it is really complicated fast. 🙂

So, if we can’t use bridging we need to use routing. Yes the routing setup on the server is not so easy, but it is clean and easy to understand.

First we configure the physical interface in the admin GUI

Two configurations are different than at normal setups. The provider gave you most likely a /23 or /24, but I use a subnet mask /32 (255.255.255.255), as I only want to talk to the default gateway and not the other servers from other customers. If the switch thinks traffic is ok, he can reroute it for me. The provider switch will defend its IP address against ARP spoofing, I’m quite sure as otherwise a incorrect configuration of a customer will break the network for all customer – the provider will make that mistake only once. For IPv6 we do basically the same with /128 but in this case we also want to reuse the /64 subnet on our second interface.

As I don’t have additional IPv4 addresses, I’ll use a local subnet to provide access to IPv4 addresses to the containers (via NAT), the IPv6 address gets configured a second time with the /64 subnet mask. This setup allows use to route with only one /64 – we’re cheap … no extra money needed.

Now we reboot the server so that the /etc/network/interfaces config gets written. We need to add some additional settings there, so it looks like this

The first command in the red frame is needed to make sure that traffic from the containers pass the second rule. Its some kind lxc specialty. The second command is just a simple SNAT to your public IPv4 address. The last 2 are for making sure that the iptable rules get deleted if you stop the network.

Now we need to make sure that the container traffic gets routed so we put following lines into /etc/sysctl.conf

And we should also enable following lines

Now we’re almost done. One point remains. The switch/router which is our default gateway needs to be able to send packets to our containers. For this he does for IPv6 something similar to an ARP request. It is called neighbor discovery and as the network of the container is routed we need to answer the request on the host system.

Neighbor Discovery Protocol (NDP) Proxy

We could now do this by using proxy_ndp, the IPv6 variant of proxy_arp. First enable proxy_ndp by running:

sysctl -w net.ipv6.conf.all.proxy_ndp=1

You can enable this permanently by adding the following line to /etc/sysctl.conf:

net.ipv6.conf.all.proxy_ndp = 1

Then run:

ip -6 neigh add proxy 2a03:5000:3d:1ee::100 dev ens3

This means for the host Linux system to generate Neighbor Advertisement messages in response to Neighbor Solicitation messages for 2a03:5000:3d:1ee::100 (e.g. our container with ID 100) that enters through ens3.

While proxy_arp could be used to proxy a whole subnet, this appears not to be the case with proxy_ndp. To protect the memory of upstream routers, you can only proxy defined addresses. That’s not a simple solution, if we need to add an entry for every container. But we’re saved from that as Debian 9 ships with an daemon that can proxy a whole subnet, ndppd. Let’s install and configure it:

apt install ndppd
cp /usr/share/doc/ndppd/ndppd.conf-dist /etc/ndppd.conf

and write a config like this

route-ttl 30000
proxy ens3 {
router no
timeout 500
ttl 30000
rule 2a03:5000:3d:1ee::/64 {
auto
}
}

now enable it by default and start it

update-rc.d ndppd defaults
/etc/init.d/ndppd start

Now it is time to boot the system and create you first container.

Container setup

The container setup is easy, you just need to use the Proxmox host as default gateway.

As you see the setup is quite cool and it allows you to create containers without thinking about it. A similar setup is also possible with IPv4 addresses. As I don’t need it I’ll just quickly describe it here.

Short info for doing the same for an additional IPv4 subnet

Following needs to be added to the /etc/network/interfaces:

iface ens3 inet static
pointopoint 186.143.121.1

iface vmbr0 inet static
address 186.143.121.230 # Our Host will be the Gateway for all container
netmask 255.255.255.255
# Add all single IP's from your /29 subnet
up route add -host 186.143.34.56 dev br0
up route add -host 186.143.34.57 dev br0
up route add -host 186.143.34.58 dev br0
up route add -host 186.143.34.59 dev br0
up route add -host 186.143.34.60 dev br0
up route add -host 186.143.34.61 dev br0
up route add -host 186.143.34.62 dev br0
up route add -host 186.143.34.63 dev br0
.......

We’re reusing the ens3 IP address. Normally we would add our additional IPv4 network e.g. a /29. The problem with this straight forward setup would be that we would lose 2 IP addresses (netbase and broadcast). Also the pointopoint directive is important and tells our host to send all requests to the datacenter IPv4 gateway – even if we want to talk to our neighbors later.

The for the container setup you just need to replace the IPv4 config with following

auto eth0
iface eth0 inet static
address 186.143.34.56 # Any IP of our /29 subnet
netmask 255.255.255.255
gateway 186.143.121.13 # Our Host machine will do the job!
pointopoint 186.143.121.1

How that saved you some time setting up you own system!

Accessing Mikrotik RouterOS via MAC Telnet from a Linux box

If you know Mikrotik Routers you know that you’re able to access them via MAC Telnet (see here for more details) via Layer2 with Winbox. But running Winbox via Wine on a Linux is not that great for using MAC Telnet, and there is a better way .. just use MAC-Telnet from Håkon Nessjøen. On Ubuntu/Debian you can just install the package with

sudo apt-get install mactelnet-client

and you see its feature like this:

$ mactelnet -h
MAC-Telnet 0.4.2
Usage: mactelnet <MAC|identity> [-h] [-n] [-a <path>] [-A] [-t <timeout>] [-u <user>] [-p <password>] [-U <user>] | -l [-B] [-t <timeout>]

Parameters:
MAC MAC-Address of the RouterOS/mactelnetd device. Use mndp to
discover it.
identity The identity/name of your destination device. Uses
MNDP protocol to find it.
-l List/Search for routers nearby (MNDP). You may use -t to set timeout.
-B Batch mode. Use computer readable output (CSV), for use with -l.
-n Do not use broadcast packets. Less insecure but requires
root privileges.
-a <path> Use specified path instead of the default: ~/.mactelnet for autologin config file.
-A Disable autologin feature.
-t <timeout> Amount of seconds to wait for a response on each interface.
-u <user> Specify username on command line.
-p <password> Specify password on command line.
-U <user> Drop privileges to this user. Used in conjunction with -n
for security.
-q Quiet mode.
-h This help.

So lets give it a try, first with searching for my home router

$ mactelnet -l
Searching for MikroTik routers... Abort with CTRL+C.
IP MAC-Address Identity (platform version hardware) uptime
10.x.x.x 0:xx:xx:xx:xx:xx jumpgate (MikroTik x.x.x. xxxx) up 139 days 5 hours XXXXX-XXXX vlanInternal

and then we’ll connect

$ mactelnet 0:xx:xx:xx:xx:xx

and we’re connected.

Linux.Agent malware sample – data stealer



Research: SentinelOne, Tim Strazzere Hiding in plain sight?
Sample credit: Tim Strazzere


List of files

9f7ead4a7e9412225be540c30e04bf98dbd69f62b8910877f0f33057ca153b65  malware
d507119f6684c2d978129542f632346774fa2e96cf76fa77f377d130463e9c2c  malware
fddb36800fbd0a9c9bfffb22ce7eacbccecd1c26b0d3fb3560da5e9ed97ec14c  script.decompiled-pretty
ec5d4f90c91273b3794814be6b6257523d5300c28a492093e4fa1743291858dc  script.decompiled-raw
4d46893167464852455fce9829d4f9fcf3cce171c6f1a9c70ee133f225444d37  script.dumped

malware_a3dad000efa7d14c236c8018ad110144
malware fcbfb234b912c84e052a4a393c516c78
script.decompiled-pretty aab8ea012eafddabcdeee115ecc0e9b5
script.decompiled-raw ae0ea319de60dae6d3e0e58265e0cfcc
script.dumped b30df2e63bd4f35a32f9ea9b23a6f9e7


Download


Download. Email me if you need the password


Which operating system is the most secure? Four points to remember.

No, you are almost certainly wrong if you tried to guess. A recent study shows that products from Apple actually are at the top when counting vulnerabilities, and that means at the bottom security-wise. Just counting vulnerabilities is not a very scientific way to measure security, and there is a debate over how to interpret the figures. But this is anyway a welcome eye-opener that helps kill old myths.

Apple did for a long time stubbornly deny security problems and their marketing succeeded in building an image of security. Meanwhile Windows was the biggest and most malware-targeted system. Microsoft rolled up the sleeves and fought at the frontline against viruses and vulnerabilities. Their reputation suffered but Microsoft gradually improved in security and built an efficient process for patching security holes. Microsoft had what is most important in security, the right attitude. Apple didn’t and the recent vulnerability study shows the result.

Here’s four points for people who want to select a secure operating system.

  • Forget reputation when thinking security. Windows used to be bad and nobody really cared to attack Apple’s computers before they became popular. The old belief that Windows is unsafe and Apple is safe is just a myth nowadays.
  • There is malware on almost all commonly used platforms. Windows Phone is the only exception with practically zero risk. Windows and Android are the most common systems and malware authors are targeting them most. So the need for an anti-malware product is naturally bigger on these systems. But the so called antivirus products of today are actually broad security suites. They protect against spam and harmful web sites too, just to mention some examples. So changes are that you want a security product anyway even if your system isn’t one of the main malware targets.
  • So which system is most secure? It’s the one that is patched regularly. All the major systems, Windows, OS X and Linux have sufficient security for a normal private user. But they will also all become unsafe if the security updates are neglected. So security is not really a selection criteria for ordinary people.
  • Mobile devices, phones and tablets, generally have a more modern systems architecture and a safer software distribution process. Do you have to use a desktop or laptop, or can you switch to a tablet? Dumping the big old-school devices is a way to improve security. Could it work for you?

So all this really boils down to the fact that you can select any operating system you like and still be reasonable safe. There are some differences though, but it is more about old-school versus new-school devices. Not about Apple versus Microsoft versus Linux. Also remember that your own behavior affects security more than your choice of device, and that you never are 100% safe no matter what you do.

 

Safe surfing,
Micke

 

Added February 27th. Yes, this controversy study has indeed stirred a heated debate, which isn’t surprising at all. Here’s an article defending Apple. It has flaws and represent a very limited view on security, but one of its important points still stands. If someone still thinks Apple is immortal and invincible, it’s time to wake up. And naturally that this whole debate is totally meaningless for ordinary users. Just keep patching what you have and you will be fine. 🙂 Thanks to Jussi (and others) for feedback.