Penetrationtester.com

As on ABC Radio when I was interviewed along with Alastair MacGibbon on IT Security, I mentioned several resources and key tasks to ensure you maintain a good level of security for your organisation or family PC. Here is a quick summary and a list of resources.

• Passwords
  • Weak password selection by users is still the most common way to compromise and organisation. Choose a phrase and use the first letter from each word as your password.

• Protecting your system from Malware;
  • There are several good solutions some are even free my preferences are my pick of the free is AVG offering.
  • The commercial offerings are always battling it out it the reviews and some shine above others. Sophos is something I often see in the field doing a good job IMHO.
  • When selecting an antivirus or these days malware protection look for something that protects all of your online activity  (Email, Web Browsing and Social Media)

• Patch your software;
  • Windows users are often compromised due to lack of updating your software. The windows OS makes use of the built in software update process which should be set to Automatic.
  • Third party software also needs to be regularly updated not sure if your it's up to date? Try using a free online tool from Secunia to check if there are any vulnerabilities for the software on your machine.

• Data Encryption
  • Windows Encryption tools are very effective against casual attackers. There has been encryption in windows for many years all seamless to the enduser. Windows 7 and Vista have the Bitlocker tool which is simple to very simple to enable.

• Firewalls
  • Are you concerned you might have some services exposed to the internet perform a quick free scan at the Shields up website and discover which ports are open.
  • If your organisation is starting to look at something more than just a ADSL modem between you and the internet or you need more control on activities your employees are performing online then an entry level firewall will assist. They often do many if not all of the tasks of the corporate big boys without the need for costly staff or $$$. My recommendation for ease of use and features is the Watchguard range of systems.

• Online/Social Media
  • The benefits of using facebook, myspace, linkedin and other social media sites to promote your business or catch up with friends and family is wonderful. But as online criminals increase there attack vectors be conscious of what you post online. My advice is don't post anything online that you are not prepared to pin to your letter box at the front of you house.

• Outsource
  • If you are about to set up online but don't have the time or money to buy the right equipment or hire staff of consultants (Like myself). Consider looking at Rackspace who provide online virtual servers which you can get full access to and consult there excellent support staff.

I left Pure Hacking yesterday after 2.5 years I had a great time but it is now onwards and upwards as the Director of HackLabs. HackLabs is a new boutique penetration testing company looking forward to making a significant impact on the industry.

I come up against Watchguard Firewalls and these little guys and they are not bad little firewalls for the small to medium size organisations. This is mostly because they have quite a bit enabled by default. One of them is the port scan detection module which locks any IPs when it detects a port scan. One of the problems for pen testers is that it does not have a whitelist so for a client it's either on or off.

When you are performing an infrastructure penetration testing its important to get good reliable port scans. So often we ask customers to turn it off to ensure we capture every open port as often we don't have the luxury of time to allow us to run slow scans to bypass the detection rules. As clients who run Watchguard only have the option of on or off it will most often remain enabled and force the tester to do a slow scan.

After playing with a few different timings to get the best result I found against the default Watchguard settings was the following nmap command to get them done the quickest but without getting my IP blacklisted.

nmap -sS -iL targetlist.txt -P0 -sV -T4

When done with a full port range (-p1-65535) on four IP's it takes 1000 seconds to complete. The -T4 option is the time setting, T1 is the slowest.

I was listening to the the Risky Business podcast this morning (by the way thanks Patrick you do a great job putting the show together). In episode 85 (http://itradio.com.au/?p=206) Patrick talks to one of his sponsors and legendary security expert Marcus Ranum. Old Marcus has some funny views on pen testing and I think they are slightly missing the mark.

Marcus believes that tools such as CORE Impact and Metasploit are not a good idea as it makes a pen tester lazy (If I could generalise his comments to mean that). The things were left out which are an argument as to why tools such as the above are needed and why pen testing is still a valuable exercise are illustrated by the following points;

1. A pen test is not just exploitation of devices ! A pen test is about using the technical access you gain to gather business sensitive information to highlight the risk of weak IT Security controls. It's not about just getting the access !!!! Whilst the tech's in the target organisation understand the impact. It's about highlighting the business impact should someone malicious exploit the same vulnerability and attempt to extract sensitive business information or disrupt operations, this is what senior management are interested in.

2. The tools that assist a penetration tester such as CORE Impact and Metasploit are only as good as the person driving them. CORE Impact whilst having a automated wizard is handy but the manual process is required to get complete coverage. The reason customers like this tool being used is that it has great logging and reporting of all actions taken. Also as a tester when you are finished all you have to do is select cleanup and it removes all the agents (control modules you have installed whilst you have been exploiting systems). Once again great to show compromised hosts but unless you link these to business risk it's not that good for the customer. (Disclosure: Pure Hacking are re-sellers for CORE Impact)

3. Coverage - The old problem with any consulting job is time and with a pen test time is always limited. Customers might not want to dedicate much time to the assessment but still expect a tester to find all the holes ! That is obviously a tough job, with scanning tools at least you get coverage of the target environment and whilst it's working away you focus on the other manual tasks of the test.

4. The win or Loose scenario for a pen testers. This is not something we are too concerned about it's great to compromise a customer network and illustrate a security attack vector that they had not though of. But we still get paid even if we don't find any security weaknesses. In saying that however there are always security controls that can be strengthened to help reduce the risk a environment is exposed to.

5. Secondly both tools have very limited Web Application security support and the shift to Web Application security testing has been very significant in the last 3 years. Most pen testing I perform (70%) is now on Web Applications.

Happy to hear constructive thoughts on my post.

Found it hard to find some of this info so thought I'd mention it my blog for fellow hackers/ Pen testers.

Passwords for the Cisco IP Phone 7936;

User Level Access @ Web interface: 7936

Admin Level Access @ Web Interface:**#

No actual username is required ! and after doing a bit of research it turns out if you change the accounts the rightful owner has no mechanism to change them back. If you thought a re-flash might be the answer the device requires administrator access to perform that function! So there is no mechanism to reset to factory defaults without admin access! There are a few stories of bricked phones as a result !