Surrendering our privacy to mobility

Last week of September 2014 I was honored to be invited by ISACA to present in EuroCACS in Barcelona a hot topic regarding privacy and mobility. You can find my presentation on this link.

NGINX HTTP(S) Reverse Proxy with ModSecurity Protection

I would like to welcome you to my new project: building a reverse proxy powered by Nginx software, with a ModSecurity web application firewall enabled module.

There are many articles on how to do this configuration on the Internet, but I couldn't find any which had a holistic approach, from a to z, giving you all the steps on how to perform the above installation.

Nginx is an open-source HTTP and reverse proxy server. ModSecurity, an open-source web application firewall, has released packages in order to work together with nginx. Taking advantage of this architecture, you can redirect all the requests to nginx, let them get parsed and sanitised by ModSecurity and as a consequence, have your websites protected.

Ingredients:

• Debian Linux 7.3.0
• ModSecurity source code
• NGINX source code

First of all we need to fulfill some requirements before configuring ModSecurity to work with nginx.

1. Install gcc:
   $> apt-get install gcc
2. Install Apache apxs:
   $> apt-get install apache2-threaded-dev
3. Install libxml2-dev:
   $> apt-get install libxml2-dev
4. Install libcurl4-gnutls-dev:
   $> apt-get install libcurl4-gnutls-dev
5. Install lua:
   $> apt-get install liblua5.1-dev

Then configure and build ModSecurity to be ready to get integrated in NGINX (following exactly the instructions as publish in ModSecurity website here):

Navigate to ModSecurity directory:

$> ./configure --enable-standalone-module

$> make

$> make install

Then we change to the directory where nginx source code is downloaded.

We configure NGINX to include ModSecurity and SSL support:

$> ./configure --add-module=../modsecurity-apache_2.7.7/nginx/modsecurity/ --with-http_ssl_module

$> make

$> make install

And the rest is pure configuration! Some references for your next steps are:

• http://www.cyberciti.biz/tips/using-nginx-as-reverse-proxy.html
• http://www.modsecurity.org/documentation/
• http://eu.wiley.com/WileyCDA/WileyTitle/productCd-1118362187.html
• https://www.feistyduck.com/books/modsecurity-handbook/gettingStarted.html
• https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project

Enjoy protecting your websites!

SYNTAX Application Security Report

I am very proud to annouce the publication of SYNTAX IT Group Application Security Report (ASR)!

The Application Security Report is an annual SYNTAX publication summarizing the vulnerabilities discovered on application security engagements and provides an insight on current web and mobile application vulnerabilities.

As the primary author of this publication, I would like to thank my team and my colleagues for their help and support.

You can download the report by following this link:

https://dl.dropboxusercontent.com/u/75624475/SyntaxAppSecAnnualReport.pdf

Fine-tunning Spamassassin and Citadel

This is actually a follow-up article of the previous publication: RPi Home Mail Server Project.

Unfortunately there are not enough articles regarding the configuration needed in order to integrate the open source spam filter Spamassassin and Citadel mail server.

First of all you should install Spamassassin by issuing the following commands:

> apt-get update

> apt-get install spamassassin spampd

Spam daemon (spampd) works as an incoming MTA which scans the emails and then forwards them to the mail server. By default, spampd listens to port 10025 and connects to port 10026, after the relevant processing.

Following this architecture, your firewall should forward SMTP and SMTPS incoming connections to spampd at port 10025 (one simple scenario is by creating a port forwarding rule) and then forward them to Citadel mail server at port 25. 

In order to achieve this, you have to edit /etc/default/spampd and change value DESTPORT from 10026 to 25. 

And you are done! Enjoy!

RPi Home Mail Server Project

It has been a while since I last updated my blog. I am quite happy to write another article regarding my latest project: my own mail server based on my Raspberry Pi.

The reason is quite simple: since Google, Microsoft, or whatever provider, considers that it has the right to read my emails, the only way to "revoke" this right is by discontinuing the use of those providers' services. However, bear in mind that putting an email server into your internal network poses a great risk and you should be aware of the means how to mitigate those risks (implement DMZ, VLANs, buying firewalls, etc.). Those means cost money of course.

After a research regarding the most appropriate software for home -and RPi- use, I chose Citadel. I haven't tested it yet under extreme circumstances.

In order to configure Citadel you can use this very useful tutorial:
http://www.ducky-pond.com/posts/2012/Jul/installing-citadel-on-rpi/

Citadel offers integration with ClamAV, an open source antivirus and Spamassasin, an open source antispam software.

ClamAV

Unfortunately Citadel website offers only a high-level configuration guide for both ClamAV and SpamAssassin. As a consequence we have to dive a little bit deeper in order to make them work together.

We can install ClamAV by issuing the following commands:

> apt-get install clamav-daemon
> apt-get install clamav

Make sure you have included the following lines on /etc/clamav/clamd.conf:

TCPSocket 3310
TCPAddr 127.0.0.1

Make sure clamAV deamon is running:
/etc/init.d/clamav-daemon start

Then, add the localhost address on Citadel's administration page as mentioned on the guide.

SpamAssassin

Installing SpamAssassin by issuing the following commands:
> apt-get install spampd
> apt-get install spamassassin

Make sure you reconfigure the listening address and port for spamassassin (I have searched for a conf file but I didn't find it. So I include the following workaround.)

Edit /etc/init.d/spampd script and locate the following lines:

[ -n "${LISTENPORT}" ] && ARGS="${ARGS} --port=${LISTENPORT}"
[ -n "${LISTENHOST}" ] && ARGS="${ARGS} --host=${LISTENHOST}"


Alter them according to the following ones:

[ -n "${LISTENPORT}" ] && ARGS="${ARGS} --port=783"
[ -n "${LISTENHOST}" ] && ARGS="${ARGS} --host=127.0.0.1"

Spamassassin must listen on port 783 in order to cooperate with Citadel.

Now the only thing to do is to configure accordingly your domain name and MX records in order to send and receive emails.

Last but not least, consider implementing PGP keys in order to communicate safely. Bear in mind that the email service is plaintext, anyone suitably positioned on the Internet (ISPs, network administrators, etc.) can intercept and read your emails.

Enjoy your email service!

Why you should not buy an iPhone 5

Following Apple's announcement of new iOS, I think this is the most suitable time to publish this post; a post explaining why you should not buy an iPhone 5!
Although I am a fan (was?) of Apple devices, I own an iPhone 5 for two months and I have already regretted the purchase I made. Because there is no hope with Apple's support, even if you have spent a fortune for buying this "device", I prefer sharing my experience rather than contacting Apple.

Below I sum up the main reasons why you should not buy an iPhone 5:

• Scratches

iPhone 5 is more fragile than a bohemian vase. I had iPhone 4 for 2 years, it had some "deep" dives to the ground but no scratches. On the other hand, iPhone 5 looks like somebody hit it with a hammer...

• "No service"

Another innovation by Apple. While we are in 2013, we have bought smartphones (iPhone I mean) that can do everything, but, they cannot place or receive a call. While I am not doing anything, even with my 3G connectivity OFF, iPhone drops the connection with the carrier. So simple. And I am asking: if I bring this to Apple's support attention, will they respond? And why will they? Many other people with the same issue, they haven't received any help.

• Wifi

It's the longest issue of iPhone, I think, since its birth? Either disconnects, or does not connect at all, wifi could be considered as a missing functionality since you cannot rely on it. Maybe Apple's marketing has done a great job in order to get promoted by carriers and promote the use of 3G instead of wifi.

• Regional Settings

I decided to switch my phone to english language and keep the greek regional settings (for example km instead of mi). But, you cannot do that! Even if you choose english language with regional settings based on the metric system, you WILL get the British metric system. Simply, there is no sense.

So if you decide to buy an iPhone 5 after this post, and numerous others, good luck! :D

Luring the Bots for Fun!

Project Introduction

These days I am hosting a custom honeypot which is based on Metasploitable VM. Unfortunately I didn't have the time to build a new one, so I based it on Metasploitable VM. Initially, I wanted to capture all the wordlists hosted on the machines that would target me. Secondly, I wanted to make a statistical analysis of the regions which attack the most. Obviously, a honeypot situated in Greece wouldn't be a good statistical sample, however after a month of honeypot's "production" state I have gathered very interesting data which I would like to share (apart from the wordlists!).

Honeypot Services

The first service which is built in order to lure the bots is the SSH. This has given me a very interesting amount of data and wordlists of the brute force attacks. SSH service by default does not log any failed login attempts. That's why I had to download SSH source code and recompile it in a way that the SSH daemon would log any failed logon attempt. The altered source code (auth_passwd.c) can be found here.

The second service is HTTP. I wanted to lure any bots or blackhats (script kiddies to be more accurate because no one serious blackhat would like to hack a useless site!) who would try to hack a web application. I uploaded to the Apache server a PHP project I had written during my first degree, which is full of vulnerabilities (in the 3rd semester no one had made me an introduction to web application security, I admit it!). In order to log the attacks I installed and configured ModSecurity as I have described in a previous article (later I found that modsecurity can be linked with online honeypot projects! Just google it!). Unfortunately, HTTP service has not faced any attack attempt yet, so this project did not go well!...

Attacking Hosts by Region

Below there is a graph of the number of attacks and the region from which these attacks came from!

I am sure that you had imagined that China would win the race easily!

Conclusion

In the near future I am looking to add more services to my honeypot, so stay tuned for future posts!
And remember: The bots are out there! (like X-Files motto? :p)