How to protect your computer from attacks

Very good to everyone, before entering the hardening of your team, I want to tell you that the installer that I am developing for Gentoo is already in its pre-alpha phase 😀 this means that the prototype is robust enough to be tested by others users, but at the same time there is still a long way to go, and the feedback from these stages (pre-alpha, alpha, beta) will help define important features of the process 🙂 For those interested…

https://github.com/ChrisADR/installer

. I still have the English-only version, but hopefully for beta it already has its Spanish translation as well (I'm learning this from runtime translations in python, so there's still a lot to discover)

Hardening

When we talk about hardening, we refer to a great variety of actions or procedures that hinder access to a computer system, or network of systems. That is precisely why it is a vast subject full of nuances and details. In this article I am going to list some of the most important or recommended things to take into account when protecting a system, I will try to go from the most critical to the least critical, but without delving much into the subject since each of these points it would be the subject of an article of its own.

Physical access

This is undoubtedly the first and most important problem for teams, since if the attacker has easy physical access to the team, they can already be counted as a lost team. This is true of both large data centers and laptops within a company. One of the main protection measures for this problem are the keys at the BIOS level, for all those to whom this sounds new, it is possible to put a key to the physical access of the BIOS, in this way if someone wants to modify the parameters of login and start the computer from a live system, it will not be an easy job.

Now this is something basic and it certainly works if it is really required, I have been in several companies where this does not matter, because they believe that the security "guard" at the door is more than enough to prevent physical access . But let's get to a slightly more advanced point.

LUKS

Suppose for a second that an "attacker" has already gained physical access to the computer, the next step is to encrypt every existing hard drive and partition. LUKS (Linux Unified Key Setup) It is an encryption specification, among other things LUKS allows a partition to be encrypted with a key, in this way, when the system starts, if the key is not known, the partition cannot be mounted or read.

Paranoia

Certainly there are people who need a "maximum" level of security, and this leads to safeguarding even the smallest aspect of the system, well, this aspect reaches its peak in the kernel. The linux kernel is the way in which your software will interact with the hardware, if you prevent your software from "seeing" the hardware, it will not be able to harm the equipment. To give an example, we all know how "dangerous" USB with viruses are when we talk about Windows, because certainly USB can contain code in Linux that may or may not be harmful to a system, if we make the kernel only recognize the type of usb (firmware) that we want, any other type of USB would simply be ignored by our team, something certainly a bit extreme, but it could work depending on the circumstances.

Services

When we talk about services, the first word that comes to mind is "supervision", and this is something quite important, since one of the first things an attacker does when entering a system is to maintain the connection. Performing periodic analysis of incoming and especially outgoing connections is very important in a system.

Iptables

Now, we have all heard about iptables, it is a tool that allows you to generate data entry and exit rules at the kernel level, this is certainly useful, but it is also a double-edged sword. Many people believe that by having the "firewall" they are free from any type of entry or exit from the system, but nothing is further from the truth, this can only serve as a placebo effect in many cases. It is known that firewalls work based on rules, and these can certainly be bypassed or tricked into allowing data to be transported through ports and services for which the rules would consider it to be "allowed", it's just a matter of creativity 🙂

Stability vs rolling-release

Now this is quite a contentious point in many places or situations, but let me explain my point of view. As a member of a security team that watches over many of the issues in the stable branch of our distribution, I am aware of many, almost all of the vulnerabilities that exist on our users' Gentoo machines. Now, distributions like Debian, RedHat, SUSE, Ubuntu and many others go through the same thing, and their reaction times can vary depending on many circumstances.

Let's go to a clear example, surely everyone has heard of Meltdown, Specter and a whole series of news that have flown around the internet these days, well, the most "rolling-release" branch of the kernel is already patched, the problem lies In bringing those fixes to older kernels, backporting is certainly hard and difficult work. Now after that, they still have to be tested by the developers of the distribution, and once the testing is complete, it will only be available to normal users. What do I want to get with this? Because the rolling-release model requires us to know more about the system and ways to rescue it if something fails, but that is good, because maintaining absolute passivity in the system has several negative effects for both the administrator and the users.

Know your software

This is a very valuable addition when managing, things as simple as subscribing to the news of the software you use can help you to know in advance the security notices, in this way you can generate a reaction plan and at the same time see how much It takes time for each distribution to solve the problems, it is always better to be proactive in these issues because more than 70% of attacks on companies are carried out by outdated software.

Reflection

When people talk about hardening, it is often believed that a "sheltered" team is proof against everything, and there is nothing more false. As its literal translation indicates, hardening implies making things more difficult, NOT impossible ... but many times many people think that this involves dark magic and many tricks such as honeypots ... this is an additional, but if you cannot do the most basic things like keeping a software or language updated programming ... there is no need to create phantom networks and teams with countermeasures ... I say this because I have seen several companies where they ask for versions of PHP 4 to 5 (obviously discontinued) ... things that today are known to have hundreds if not thousands of flaws security, but if the company cannot keep up with technology, it is useless if they do the rest.

Also, if we are all using free or open software, the reaction time for security bugs is usually quite short, the problem comes when we are dealing with proprietary software, but I leave that for another article that I still hope to write soon.

Thank you very much for getting here 🙂 greetings