Posted by

DanielHeth

Posted on

October 17, 2017

Posted under

Security

Comments

Leave a comment

Cyber Hygiene Basics

The following is a list of very simple cyber security things you can do to protect your digital life.

Use a password manager. I recommend LastPass as it is exceedingly useful, accessible from many devices and relatively cheap. $2/month for premium users and includes feature called Security Challenge which allows you to evaluate the strength of your credentials.
Patch and patch often, in fact just set windows update to automatic! (Windows 7 and Vista, Windows 10)
Anti-malware… Windows Defender (SCEP) comes standard on Windows 10 and you should be using it!
Firewall… if it is disabled, you’ll have trouble. Enable it and keep it running!
Do not plug USB Flash/Thumb drives in that you do not own or are certain where it is coming from.
Same goes for unknown software. Be sure you are aware of what you’re installing and that it comes from a solid source.
Do not click on links within emails!!!! If you want to go to some site like your bank or something, open a web browser separately and access your bank the “normal” way you’ve been trained to do. Even if the email looks legit… never click on the links!
Never trust “open” or free wifi!!!!! Look into tethering your cell phone’s data to your laptop or tablet rather than using that “free” internet from the local internet cafe. If you’ve been trained in network security and protecting yourself, then you can get away with the risk… but if you are not… please do not connect to free wifi!
Backup, backup, and backup! Use a good online backup service like Crashplan to keep copies of your data. They are cheap, roughly $10/month/device, but it is well worth the cost if your laptop is stolen, destroyed or hacked.

Lastly, I want to leave you with the simplest recommendation of all… keep track of all your computers and devices!

Posted by

DanielHeth

Posted on

September 21, 2016

Posted under

Cameras, Home Automation, Security, Technology

Comments

Leave a comment

Surveillance and Ubiquiti Video

My upcoming new office and home-lab space has inspired me to review some of my past technology choices. The first review comes in the form of video monitoring.

The setup I’m using at my current home involves a NightOwl 16-camera DVR with cheap BNC cameras. I was very pleased with it until I went to extend or even check for software updates… then I hit a serious brick wall! I learned it is basically a cheap DVR that hasn’t been updated in, at least, a decade. Well behind the curve for this tech geek. Time to upgrade!

I began my research where I began… a DVR, but this time I’d have it professionally installed. Well… the cost started to pile up very quickly. At the end of the quote, each of the 7 cameras were going to cost $450 each! That is insane!! Back to the drawing board.

Having a fondness for networking, I started researching IP cameras again. I’ve played with IP Camera software before (Blue Iris) and figured if I ever started over, I’d go that route. My research quickly brought me back to them as a possible option. I also discovered that my Synology NAS had a plugin Surveillance Station. Ultimately I realized that IP Cameras were the direction I wanted to go and this was perfect timing for our new home construction. I switched from the DVR/cameras to purely Cat6 network drops. Tons of IP Cameras had PoE capabilities so I wasn’t concerned with powering them. On the plus side, IP Cameras may range in price… but even the best options are below $450 per camera.

After research, I ordered a camera I thought had all the interesting features… A Ubiquiti Unifi G3 Dome camera. Picked for the fact that it was an IP Camera, Wide angle lense and PoE. Initial review… I am blown away by this camera, quality and features.

It all starts with their software. It requires either one of their NVR devices to connect, record and manage the camera or a Windows, Ubuntu or Debian computer running their NVR software which is free. I installed it onto my workstation since I’m currently evaluating… and connected to the camera almost instantly.

I installed their iOS app and it was effortless to point it at my workstation where the NVR software was running and start viewing the camera. This software blows NightOwl out of the water and well it should as NightOwl’s app is old as dirt.

I have only scratched the surface of what this camera and software can do… but I will be modifying my network diagram to include a custom built Ubuntu 1U server with DVR hard drives to run the NVR software locally. Plus side, is the Ubuntu server I’m designing can be managed from my Tanium infrastructure and all the benefits that goes with that are included with this setup.

As a treat, here are a few of the images I captured from the iOS software after connecting to the Workstation NVR.

Posted by

DanielHeth

Posted on

February 4, 2015

Posted under

Configuration, Configuration, Security, Tanium

Comments

1 Comment

Configuring Windows Update with Tanium

There really is only two ways to configure the Windows Update Agent: Manually through UI or the Windows Update API. Unfortunately as an enterprise admin, you need to use command line utilities to configure endpoints and Microsoft does not provide that. Thus, I’ve put together a really quick command line utility that uses the Windows Update API to allow you to configure using our favorite platform… Tanium.

Download Solution Pack

First thing you must do is download the entire Tanium solution pack for Windows Update. Once you’ve downloaded the Windows_Update.xml, you must import it through your Console->Authoring->Import Content.

You’ll find it contains multiple sensors, packages and saved questions for reading and changing the configuration.

Ensure Package Files Download

One of the packages requires external files that are downloaded from files.danielheth.com. These files are served up via https and thus you must configure my Certificate Authority in order for your Tanium Server to properly download from that location. You must also configure a White Listed URL as well. You can read more about doing this at https://danielheth.com/2015/02/02/secure-downloading-of-package-files-with-tanium/

OR you can simply download the three files manually and update the Distribute Windows Update Tools package. We will explore this second option in this article:

Download all following files:

Then edit the Distribute Windows Update Tools package by going to Console->Authoring->Packages, filtering by “Distribute Windows Update Tools” and edit the correct package. Then “Delete” all three files linked to this package…

Now we will “Add Local Files…” for each of the three files we downloaded earlier.

Now that we have all three “local” files uploaded into the package we’re ready to start using this solution…

Windows Update Dashboard

Included in the solution pack is a new dashboard which groups all the functionality together in a single location. Browse to that dashboard by looking under “Other Dashboards” and finding the one called Windows Update.

As you can see from the screenshot, there are two included saved questions. One lets you know about the installation status of the special utility we’re using and the other uses that utility to return the current status of the Windows Update Agent using the API.

Deploy Windows Update Tools

I already have one system deployed with the utility, but my other 9+ systems do not have it. I can drill down to determine what the names of these systems are and distribute to specific machines, but I want my entire infrastructure to have this utility. Thus I will right click on the “No” answer and deploy the package we edited before, the Distribute Windows Update Tools package. Complete the deployment of that action and within 10 or so minutes, you should start seeing the Windows Update Configuration appear in the right answer grid.

Configure Windows Update Status

The Windows Update Agent has a few modes of operation:

Not Configured means “not configured” by the user or by a Group Policy administrator. Users are periodically prompted to configure Automatic Updates.
Disabled is self explanatory… Users are not notified of important updates for the computer.
Notify Before Download prompts users to approve updates before it downloads or installs the updates.
Notify Before Installation will download the updates but prompt users to approve the updates before installation.
Scheduled Installation will automatically install updates according to the schedule that is configured by the user or by the wu4tanium utility.

To make changing this mode-of-operation status easy, I’ve included a Configure Windows Update Status package with the above described options. Select the configuration answers that are not configured as you want and launch this package to change it.

Configure Windows Update Schedule

If you chose to schedule the automatic installation of updates you can use the Configure Windows Update Schedule package to change the day and time updates will install.

I would like all my systems to download and automatically install updates every day at 1am. To do that, select all the configurations that do not match your desires, Right click and Deploy Action. Select the Configure Windows Update Schedule package from the dropdown and two parameters will appear. One to specify the day of the week and the other the hour. The hour is specified in 24-hour “military” time and is only configurable for on-the-hour.

After 10 minutes, the Windows Update Configuration answer grid will start updating with the newly configured schedule. The Windows Update Config sensor is set with a max age of 10min, thus we must wait that long before the sensors script is executed again and the new configuration starts appearing in the answer grid.

Conclusion

I hope this helps those of you who wish to use the Windows Update Agent to update your systems rather than using a more involved patching solution.

Note that this solution DOES NOT USE the Tanium file/shard downloading functionality… each endpoint will download updates directly from Microsoft.

Also I have only tested this on Windows 7 systems. It is possible the Windows Update API will not function as coded on other versions of Windows. If you wish to view the code for the wu4tanium utility, it is available on github. Feel free to fork that project to add functionality or compatibility with other versions of Windows.

Posted by

DanielHeth

Posted on

January 29, 2015

Posted under

Security, Tanium

Comments

Leave a comment

Tanium Client Hardening

In any security environment, the first thing that I am asked for is a way to protect the Tanium client from end-user tampering. This is a very common request when it comes to security related software. An innovative TAM at Tanium has built a solution pack which is documented on the community site called “Client Service Hardening”. This solution pack contains a collection of sensors, packages and saved questions related to locking down the Tanium Client service and the file system on Windows endpoints. I would like to explore that solution below.

Acquiring and Importing the Solution

Just like any of the solution packs available from Tanium, to receive a copy of the solution xml, you need to contact your Technical Account Manager and they’d be glad to share it with you.

Once you have the ClientServiceHardening.xml, import it by browsing to your Console->Authoring->Import Content.

Overwrite any database duplicates, although you should not see any unless you’ve imported an older version of this solution pack like I have.

Using the Solution

The first thing you’ll notice after importing is a new Dashboard Group. This group wraps a few dashboards together that pertain to hardening the Tanium Client service on your endpoints. Particularly the following three areas:

1. Hiding the Tanium Client from the Add/Remove Programs Control Panel Applet.
2. ACLs for the Client Service itself
Tanium Client directory permissions.

You should implement all three of these in order to fully lock down the Tanium Client Service. Let’s look at and implement each one sequentially.

Hide from Add-Remove Programs

The first thing we will impellent is to hide the Tanium Client from the Windows Add-Remove Control Panel Applet. This is extremely easy to do. Select the Hide From Add-Remove Programs dashboard…

After the questions have completed, right click the “No” answer within the Tanium Client Visible in Add-Remove Programs answer grid. Choose to “Deploy Action” and the Client Service Hardening – Hide Client from Add-Remove Programs should be the default package selected… then step through the action deployment. I’d recommend setting this package to reoccur at least once a day in order to catch systems that might not be online right now. In my infrastructure, I’ve configured the action to reoccur every 6 hours since I have laptops coming on and off throughout the day. I also know this is a Windows-Only action, thus my Action Group is “All Windows Computers”. Note that the action group was configured ahead of time and only has a single computer group configured with “Operating System contains Win”. This action group gives me assurances that this action will only run my windows systems and not my Linux or Mac systems. This action group could have easily been something else like only “Workstations”, “Laptops”, etc.

Now as this action runs within my environment, the Tanium Client will disappear from the Add-Remove Programs list.

Locking down the Tanium Client Service

The next thing to configure is the ACLs on the Tanium Client service. This will prevent users and/or administrators from stopping the Tanium Client service. Implementing this is also an easy thing to do… Open the Control Service State Permissions dashboard…

Please note that if an end-user has administrative privileges on an endpoint, it is entirely possible they also have advanced knowledge of ACLs and will be able to reset these permissions in order to stop the service.

All of your windows systems should report back “Service Control is set to default permissions” just like in my environment pictured above. Right click on that answer and “Deploy Action”…The default is Client Service Hardening – Allow Only Local Admins to Control Service, however you could lock the service to allow only the SYSTEM account by selecting the Client Service Hardening – Allow Only Local SYSTEM to Control Service package. I chose to lock it down to SYSTEM since many of my users are configured with local admin privileges and just like before, I will have this scheduled action set to run every 6 hours and only apply to my “All Windows Computers” action group.

Set Tanium Client Directory Permissions

Lastly we need to lock down the folder permissions of the Tanium Client. This is the file system level permissions which allow users to browse the “…\Tanium\Tanium Client\” client root directory.

Open the Set Client Directory Permissions dashboard and in the single answer grid, right click on the “Not Restricted” answer to “Deploy Action”.

The default action here is Client Service Hardening – Set SYSTEM only permissions on Tanium Client directory. By default, the Program Files directory is locked down to administrators, thus SYSTEM is the only available configuration package. Just like with the previous two actions, I will configure this to run every 6 hours and only on my windows systems.

Conclusion

The client hardening techniques covered in this article are very close if not exactly the same security measures that Antivirus and other Vendors take to secure their agents on enterprise endpoints.

This solution pack also includes packages for resetting the defaults for each of these security configuration settings… so if you want to un-harden the client, it is certainly possible.

Let me know if you have any questions about this article… If you have questions about the content, I encourage you to reach out to support@tanium.com and one of their extremely helpful Technical Account Managers would be able to assist.

Posted by

DanielHeth

Posted on

December 19, 2014

Posted under

Applications, Security

Comments

Leave a comment

CRITs use of MongoDB and starting automatically on Ubuntu

I recently was playing around with CRITs and followed their installation instructions closely (VERY HARD). They could use some better install scripts to make things smoothly, but what do you expect from a community project.

Anyways, I see in their documentation when it gets to the MongoDB section how to start it at the command line. Getting past that worked well… but i’m wanting to setup a production style instance which requires the database to start automatically on startup. Apache (which runs the CRITs UI starts automaticaly by default) but their instance of MongoDB does not. So i submitted a ticket… which quickly got squashed as “not their problem”. While I agree this is not their problem, they do want people to use their product, right? A few bits of documentation on here’s a link to starting MongoDB automatically would have been helpful. Well… I submit this as that link…

Create /etc/init.d/mongodb with the following info:

#!/bin/sh

### BEGIN INIT INFO
# Provides:          mongodb
# Required-Start:    $remote_fs $syslog
# Required-Stop:     $remote_fs $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: MongoDB
### END INIT INFO

# Change the next 3 lines to suit where you install your script and what you want to call it
DIR=/usr/local/bin
DAEMON=$DIR/mongod
DAEMON_NAME=mongod

# Add any command line options for your daemon here
DAEMON_OPTS="--fork --logpath /var/log/mongodb.log --logappend --nohttpinterface"

# This next line determines what user the script runs as.
# Root generally not recommended but necessary if you are using the Raspberry Pi GPIO from Python.
DAEMON_USER=root

# The process ID of the script when it runs is stored here:
PIDFILE=/var/run/$DAEMON_NAME.pid

. /lib/lsb/init-functions

do_start () {
    log_daemon_msg "Starting system $DAEMON_NAME daemon"
    echo 0 > /proc/sys/vm/zone_reclaim_mode
    start-stop-daemon --start --background --pidfile $PIDFILE --make-pidfile --user $DAEMON_USER --chuid $DAEMON_USER --startas $DAEMON -- $DAEMON_OPTS
    log_end_msg $?
}
do_stop () {
    log_daemon_msg "Stopping system $DAEMON_NAME daemon"
    start-stop-daemon --stop --pidfile $PIDFILE --retry 10
    log_end_msg $?
}

case "$1" in

    start|stop)
        do_${1}
        ;;

    restart|reload|force-reload)
        do_stop
        do_start
        ;;

    status)
        status_of_proc "$DAEMON_NAME" "$DAEMON" && exit 0 || exit $?
        ;;
    *)
        echo "Usage: /etc/init.d/$DAEMON_NAME {start|stop|restart|status}"
        exit 1
        ;;

esac
exit 0

Change /etc/init.d/mongodb to executable:

sudo chmod +x /etc/init.d/mongodb

and configure it for startup:

sudo update-rc.d mongodb defaults

Now your MongoDB instance that is spoken to in the CRITs documentation will start automatically on boot.

Posted by

DanielHeth

Posted on

February 11, 2014

Posted under

Business, Code, Entrepreneurship, Programming, Security

Comments

2 Comments

New Screen Capture Website

I’ve just finished building a brand new website called ScreenDrink.com. The purpose of this site is to provide image screen captures of websites. The key differentiator for this new site is I’m providing https as well as http access to the images.
This means you can keep your sites secure without serving insecure content from services you utilize.

I am currently self-hosting the site but if there is enough interest and usage, I’ll move the site into the cloud for more space and reliability.

Visit http://www.screendrink.com to learn how to use the free service on your own website!

Posted by

DanielHeth

Posted on

December 2, 2011

Posted under

Microsoft, Security, Windows Update

Comments

Leave a comment

Allow Windows Update to do more than just Windows

I like to have updated software on all of my computers. Everything from patches to bug fixes are very important to my security profile. Thus I allow Microsoft to update more than just Windows when I activate the Windows Update feature. Here is a quick and easy way to activate that additional functionality.

Since I’ve never before given Internet Explorer to make changes to my system, a security popup has activated asking if it is ok… just hit yes.

Windows Update now starts it’s scan of additional software it has updates for…

Now wasn’t that easy… Leave your comments and suggestions below!

Posted by

DanielHeth

Posted on

December 2, 2011

Posted under

Firewall, Microsoft, Security, SQL 2008r2

Comments

3 Comments

Accessing SQL through the Windows Firewall

Recently I installed a new instance of SQL 2008r2. (Get more details on installing Microsoft SQL Server 2008r2 here…)

Upon my arrival I quickly learned in order to allow applications to access the SQL server instance I needed to open up the following port on my windows firewall: 1433

So here goes…

The Microsoft article described a way to do this via an admin command prompt. I chose the graphical process.

If you have your firewall configured for outbound filtering as well, you may need to follow this process for under outbound filters as well.

Do you have an alternative way of configuring SQL for firewall access? I’d love to hear from you… leave your comments below with your process or comments/suggestions on my process.

Posted by

DanielHeth

Posted on

November 22, 2010

Posted under

BigFix, Firewall, Security, Threat Management Gateway

Comments

Leave a comment

TMG and BigFix BESClient

No series of posts would be complete if I didn’t relate it back to my new fabulous job some how…

The Microsoft Threat Management Gateway is secure by default. This means everything you want to do or rather connect to online must be configured properly within the TMG console. The BigFix Enterprise Client is no different.

By default the BigFix infrastructure communicates on port 52311. Therefore we must let TMG know that we’d like our clients to talk over this port.

Below is a graphical step by step on how this is done:

1. Lets start by creating a new row…

ForeFront TMG->Firewall Policy->Tasks (tab)->Create Access Rule

2. Of course we’ll be Allowing this port to communicate

3. We’ll be creating a brand new protocol… so hit Add then in the Add Protocols window click New->Protocol

4. Name your protocol…

5. We’ll be adding the BigFix TCP port 52311 here… (You may have deployed via a different port… specify your custom BigFix port here…)

6. We have no secondary connections that are needed… so click next and hit finish

7. Next we will expand the “User-Defined” branch and choose our “BigFix Communication Protocol” we just defined and hit Add->Close->Next

8. Specify who is allowed to communicate… Source which should be your internal network.

9. And specify our destination which in my case I am setting up a secondary site and all these clients will communicate with my BigFix Root server somewhere else on the internet. (later on I’ll setup a relay on one of the computers at this location and adjust TMG firewall rules.)

10. Because BigFix is my main management for all my computers, I want every computer to have permissions to communicate via this port… so I’ll leave the default “All Users” here… Next->Finish

We’ll probably want to make sure this is our first firewall rule so it is not interfered with by some other rule. After hitting finish it should look like this:

Lastly we’ll need to “Apply” this new rule set in order to get things working.

Posted by

DanielHeth

Posted on

November 22, 2010

Posted under

HACK-The-Planet, NMAP, Security, Threat Management Gateway

Comments

Leave a comment

Port Scanning?!? oh and Microsoft Threat Management Gateway (TMG)

I am working on learning network security… so I went and picked up the NMAP Network Scanning book (ISBN: 978-0-9799587-1-7) from Gordon Lyon and Insecure.org.
During my reading he talks alot about an Intrusion Detection System (IDS). Apparently IDS’s are used to detect attacks on their networks including something benign as a port scan. This got me thinking… doesn’t my MS Action Pack include something like that… indeed it does… two in fact. The ISA 2006 and it’s newer replacement Threat Management Gateway (TMG 2010).
Any respectable hacker would jump at the chance to set it up and “hack” yourself to see what happens right? OF COURSE!!!

I’ve setup the new system and placed it on the “edge” of my network. This puts it in exactly the right spot to have the largest exposure… right…