57
securing a client Matsuzaki ‘maz’ Yoshinobu <[email protected]>

securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

  • Upload
    others

  • View
    1

  • Download
    0

Embed Size (px)

Citation preview

Page 1: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

securingaclientMatsuzaki ‘maz’Yoshinobu

<[email protected]>

Page 2: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

hardeningahost

Page 3: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Hardeningahost

• Differsperoperatingsystem• Windows:userscannotbetrustedtomakesecurityrelateddecisionsinalmostallcases• OSX:makethingsworkmagicallyforusers.Trytohandlesecurityissuesinthebackground• Linux:variesbydistribution:

• Ubuntu:trylikeOSXtomakethingsjustwork.• RedHat:includeveryusefultoolsbutturnedoffbydefault

• BSD:userswillfigureitout• Changeswithtime

Page 4: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Generalconsideration

• Defineapersonalusageprofileandpolicy.• Whathardwaredoyouuse?• Whatsoftwaretasksdoyoudoonyourcomputer?• Dothefirsttwochangewhenyoutravel?• Whathabitsfromtheabovetwodoyouneedtochangetobemoresecure?• Decideifyoureally needVPNaccesstoyournetworkwhiletravelling.

Page 5: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Generalpractices

• Installonlytheservicesandsoftwareyouactuallyneed.• Uninstallordisableallsoftwareandservicesyoudonotuseorneed.• Periodicallyactivelyscanyourmachineforvulnerabilities.• Haveasfewuseraccountsonyoursystemsaspossible

• Protectyouradministrativeaccount.Haveastrongpassword,donotpermitremotepasswordbasedloginsanddonotloginasanadministratorunlessyouneedtodoanadministrativetask.

Page 6: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Hardware

• Rule1:allbetsareoffwithphysicalaccesstoyourdevices.• Considerremovinghardwareyouneveruse– saybluetooth.• DisableinBIOSorEFIoryouroperatingsystemthehardwareorfeaturesyoucannotremovephysically.• wakeonlan• Bluetoothdiscoverability• USBports?

• BIOSpasswordsnotthatuseful• BIOSlevelencryp8on/lockingofharddisksmaynotbeportable

Page 7: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

antivirus

Page 8: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Malware

• Thegenerictermforcomputervirus,worms,spywareandothermalicioussoftware• Skilledattackercanmakeit,funattackercanuseit.• eventherearemalwarebuildtoolswithGUIL

Page 9: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Infection

• attackerstrytomakeyourdevicesinfectedinmanyways• securityholes,e-mail,web• USBmemory,fileservers

Page 10: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Causes

• vulnerability• 0-daysecurityholes• oldsecurityholesarestillusedtoinfect

• auto-executionforremovalmedia• USBmemory,CDloading

• users’carelessopen• infectedfiles• sometimeshappentoexecutemalwares

Page 11: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Detection

• signature-baseddetection• blacklistofmalwares• checkafilewiththesignatures• updateneededtodetectnewermalware

• heuristicsdetection• behavior,characteristiccode

Page 12: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

When?

• writeoperationstakeplace• creatinganewfile,modifyinganexistingfile

• newmediaisinserted• USBmemory,CD

• periodicormanually• scanallorimportantfiles

Page 13: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Where?

e-mailserverfileserver

webproxyclient

finaltargethere

Page 14: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Hiding

• attackersmodifymalwares• nottobedetectedbyanti-virusdetectors• theycancheckthislocally

• updatingyoursignatureDBisneeded

Page 15: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Fakesecuritysoftware

• Donothing,orisjustamalware• alsoknownas‘scareware’

Page 16: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Compromisedsystem

• Anyfileonthesystemisalreadysuspicious• Youmaybeabletoremoveamalware• therecouldbeanotheronethatyoucannotdetect

Page 17: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Wipe

• Don’tusefilesinthecompromisedsystem• programs• documents• images

• Cleanupthestoragesthatwasconnectedtothesystem• HDD• SSD• flashmemory

Page 18: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Howcanwerescueinformationfromsuspiciousdatafiles•convertitintoanotherformat• png ->jpg,jpg ->png• doc->txt• excel->csv• pdf->png/jpg

• infectedcodecannotsurvivesuchadrasticmodification

Page 19: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Wipetogiveaway

• dataisstillthereevenifit’sformatted• expertscanreadthedatabyusingspecialtools• anelectricmicroscopecanreadmore• leakageofsecretdata

• youneedtomakesurethedataiserased• #dd if=/dev/urandom of=/dev/<disk>bs=16M

Page 20: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Recover

• ‘cleaninstall’fromascratch• formatthedisk,useaproperOSimage

• applylatestOSpatchestobeup-to-date• itcouldbevulnerablebeforepatched• doupdateinasecurenetwork

• installneededapplications• checkupgrades,ofcourse

Page 21: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Recover(cont.)

• disableunnecessaryservices• thesameashardeningprocedure

• checkconfigurations• ifanyweakness

• changeallpasswordonthesystem• anypasswordmightbestolen

Page 22: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Replacingmightbeyourchoice

• securingthecompromisedsystemasis• forfurtherinvestigation• malwarethatstaysinthememoryonly

• justreplacethecompromisedsystem• sparehardware

Page 23: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Backups

• Encryption• Automation• Generations

Page 24: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Encryption

• Assumetheftandlost• Yourbackupsmusthaveatminimumthesameencryptionlevelasthesourcedata

Page 25: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Automation

• Wearelazy!• easytoforget

• automatedbackupwillhelpyou• mostsystemshavescheduledbackup

Page 26: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Generations

• youshoud havea‘good’versionofbackupthere• ifasystemiscompromised,malwaremightbealsobackupinthearchive,youwon’twanttorestorethatthough• ifsomethinggoeswrongbychange,youmayrestorethepreviousversion

• finda‘good’versionfromyourarchives

Page 27: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Off-sitearchives

• 2011Tohokuearthquakeandtsunami• flushedbuildings,datacenters• 4localgovernmentslostwholedataonthefamilyregistrationsystem

• Theyhaveoff-sitebackupsJ• tookabout1monthtorecoverthough• wantedtomakesurenothingismissed

Page 28: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

e-mails

Page 29: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Thekeypoints

• AuthenticityofServers• EncryptedTransport

Page 30: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

It’seasy

• Donotusepop,itisintheclear• Usepop3s,port995overTLS

• Donotuseimap,itisintheclear• Useimap4s,port993overTLS

• AndtheyAuthenticatetheServersusingX.509Certificates.CHECKIT!

Page 31: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

fetchusingIMAP4S

Page 32: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

SMTPoverTLS

Page 33: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

AuthenticateServers

• AssumetheWireisTapped• AssumeSomeonewillSpoofServers• KnowYourServers’RootCertificates• ConfirmCertificatesonConfiguration• ChooseGoodPassphrases

Page 34: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

EncryptCriticalE-Mail

• AssumetheWireisTapped• UseaPersonalX.509PKCS#12UserCertificatewithSMIME– T’Bird etc.• UseaPGPkeywithEnigma– T’Bird

Page 35: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Itunnel&email

$ ssh <ssh.server> -L 4465:<smtp.server>:465

ssh.serverMacBook

POP3S/SMTPS

StepHost

PortonMacBook

TunnelEndPoint

sshtunnel

$ ssh <ssh.server> -L 9955:<pops.server>:995

smtp.server pops.server

Page 36: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

example:LocalForward

.ssh/config

$ssh mail

HostmailHostName <step.host>LocalForward 4465<smtp.server>:465LocalForward 9995<pops.server>:995

Page 37: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

example:stephost

.ssh/config

$ssh internal

HoststephostHostName <step.host>

HostinternalHostName <internal.ssh.server>ProxyCommand ssh -W%h:%pstephost

Page 38: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

webbrowsing

Page 39: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

MicrosoftInternetExplore

• LongHistoryofVulnerabilities• FirstTargetbecauseofPopularity• MicrosoftisNotAlwaysConcernedwithYourPrivacy• ClosedSource,NoOneInspectsit

Page 40: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

MicrosoftEdge

• brand-newwebbrowser• shippedwithWindows10• doesSandBoxing,soreasonablysafe

Page 41: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

IuseGoogleChrome

• ProcessIsolationperTab,soscaleswell

• ButIworryaboutLeakingDatatoGoogle

Page 42: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

IalsouseFireFox

• FreeandOpenSource(i.e.inspected)• StandardsCompliant,noProprietaryTrickstoLockYouIn• Popular,sohasRichExtensionCatalog• RunsonAllSignificantPlatforms

Page 43: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

DoNotLetBrowserRememberPasswords• LoseLaptopandLoseyourBankAccount• PasswordDatabaseEncryptionisWeak

• recommendations• encryptedtextfile(pgp)• 1Password

Page 44: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Prefs

OnlyifyouuseNoScript!

Page 45: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

NewFeature

Page 46: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they
Page 47: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Plug-Ins

Page 48: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they
Page 49: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

1Password

• RunsonMostPlatforms• Plug-InsforMostBrowsers• Passwords,CreditCards,Addresses,…• KeepDataBase inDropBox/iCloudandyouhaveDataonPhone,Laptop,Tablet,…

• ItDoesCostMoneyL

Page 50: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

AddBlock Plus

WithoutAddBlock

WithAddBlock

Page 51: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Collusion– WhoTracks

Page 52: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

DoNotTrackPlus

Page 53: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

NoScript – JavaScript

Page 54: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

HTTPSEverywhere

• IfaSitehasHTTPandHTTPS,itForcesUseofHTTPS

• I.e.YougetAuthenticationofSite

• YourTrafficisEncrypted

Page 55: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Let’sdoit

Page 56: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

RootCAcertificates

• YoursystemhasrootCAsbydefault• SomeapplicationsuseownCertificateStore• AnycertificatesissuedbytheseCAsaretrusted

• Checkitout• Execute‘certmgr.msc’onwindows• open’about:preferences#advanced’onFireFox

Page 57: securing a client · • Do not use pop, it is in the clear • Use pop3s, port 995 over TLS • Do not use imap, it is in the clear • Use imap4s, port 993 over TLS • And they

Windows10

• Execute“compmgmt.msc”andhavealook• disableGuestaccount• disableunusedsystemservices

• VerifytheLocalSecuritySetting• ChecktheWindowsFirewallSetting• Disablehidingoffileextensions• Start->FileExplorer->“Changefolderandsearchoptions”of“Viewtab”->uncheckthe“Hideextensionsforknownfiletypes”