Masscan is the fastest Internet port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second.
It produces results similar to nmap, the most famous port scanner. Internally, it operates more like scanrand, unicornscan, and ZMap, using asynchronous transmission. The major difference is that it's faster than these other scanners. In addition, it's more flexible, allowing arbitrary address ranges and port ranges.
NOTE: masscan uses a custom TCP/IP stack. Anything other than simple port scans will cause conflict with the local TCP/IP stack. This means you need to either use the -S option to use a separate IP address, or configure your operating system to firewall the ports that masscan uses.
Install
To install Masscan on Ubuntu 14.04.03 LTS Desktop :
SpiderFoot is an open source intelligence automation tool. Its goal is to automate the process of gathering intelligence about a given target, which may be an IP address, domain name, hostname or network subnet.
SpiderFoot can be used offensively, i.e. as part of a black-box penetration test to gather information about the target or defensively to identify what information your organisation is freely providing for attackers to use against you.
Install
To install Spiderfoot on Ubuntu 14.04.3 LTS Desktop :
Recon-ng is a full-featured Web Reconnaissance framework written in Python. Complete with independent modules, database interaction, built in convenience functions, interactive help, and command completion, Recon-ng provides a powerful environment in which open source web-based reconnaissance can be conducted quickly and thoroughly.
Recon-ng has a look and feel similar to the Metasploit Framework, reducing the learning curve for leveraging the framework. However, it is quite different. Recon-ng is not intended to compete with existing frameworks, as it is designed exclusively for web-based open source reconnaissance. If you want to exploit, use the Metasploit Framework. If you want to social engineer, use the Social-Engineer Toolkit. If you want to conduct reconnaissance, use Recon-ng!
Install
To install Recon-ng on Ubuntu 14.04.3 LTS Desktop :
*** Please note that all the tests are testing on Linux host (Ubuntu 14.04.3), Windows host may have some different results. ***
*** Updated on August 14, 2015 : VirtualBox 5.0.2 for Linux fixed the slow speed (VMM: fixed an issue causing artifically high load averages on Linux hosts). ***
Kali Linux 2.0 is released on today (August 11, 2014 EST). I downloaded 64-bit full version and installed it on VirtualBox 5.0. The host computer has Intel Celeron(R) CPU N2930 @ 1.83GHz × 4 and 8 GB RAM. I assigned 5 GB RAM to Kali Linux 2.0. It is quite slow for it to run with 5GB RAM on my VirtualBox 5.0. Meanwhile, the sound always mute on every start up even you have set it before.
(A) Installation
When installing via non-graphic interface, you may encounter no network mirror repos, you need to bypass it by selecting "Continue without a network mirror? Yes" and we will edit the /etc/apt/sources.list later. Graphic interface may also has the same problem too.
After the installation is completed, we can edit the /etc/apt/sources.list if you encountered no mirror repos when install.
nano /etc/apt/sources.list
The content of the file should be looking like this :
deb http://http.kali.org/kali sana main non-free contrib
deb-src http://http.kali.org/kali sana main non-free contrib
deb http://security.kali.org/kali-security/ sana/updates main contrib non-free
deb-src http://security.kali.org/kali-security/ sana/updates main contrib non-free
(B) Install VirtualBox 5.0 Guest Additions CD
When you are going to install VirtualBox 5.0 Guest Additions CD, you need to install dkms first :
apt-get install dkms
* It will also install related headers files. If not, you need to install the headers files yourself.
When install VirtualBox Guest Additions CD, you may encounter the following error :
*** Error in `systemctl': double free or corruption (fasttop): 0x00007fc0cb648ae0 ***
It should be systemctl error. I do not know what it will be affected so far. After checking the dmesg message, the error is due to :
systemd[1]: Cannot add dependency job for unit vboxadd-service.service, ignoring: Unit vboxadd-service.service failed to load: No such file or directory.
It is recommended to uninstall the Guest Additions CD at the moment and some features will be not available on the guest virtual machine.
(C) Uninstall VirtualBox 5.0 Guest Additions CD
To uninstall VirtualBox Guest Additions, run :
/opt/VBoxGuestAdditions-5.0.0/uninstall.sh
This error will show again :
*** Error in `systemctl': double free or corruption (fasttop): 0x00007f124e3f2ae0 ***
(D) Not working properly applications
The following applications are launched from the Quick Menu on the left hand side of the screen.
armitage - it cannot be launched Maltego - it launches but it cannot be operated and it cannot be quit too BeEF - it shows an error and no login screen is displayed UNLESS you start the "beef start" at "System Services" under "Applications" menu
There may be some more other applications that cannot work, such as "system log", "VLC media player", "ImageMagick" and etc. I cannot test them all one by one as they are too many.
* Even the VirtualBox Guest Additions is uninstalled or reinstall the Kali 2.0, the captioned applications still do not working properly
** Other applications on the Applications menu are not tested as well as those are not in the Applications menu
*** Running BeEF, it produces the following error : (process:1371): GLib-CRITICAL **: g_slice_set_config: assertion 'sys_page_size = 0' failed
(E) Conclusion
Kali Linux 2.0 is not well tested before it is released. It is very disappointed. Kali 2.0 is slower than 1.1.0a on the same testing machine. Or you may need a more powerful computer or laptop to do with it. Some applications cannot be running properly on the Quick Menu in this release. DISAPPOINTED!
That's all! See you.
Update on August 12, 2015
I conducted a random test on Kali Linux 2.0, I found the following :
redis-server is running in the background.
Apache2 is listening on TCP6 only instead of TCP4 and TCP6 at the same time.
OpenVAS cannot be started properly via "Applications", "System services", "openvas start". Systemd error produced.
It seems that systemd is buggy.
Update on August 13, 2015
After talking with the founder of Offensive Security (muts), I going to install Kali Linux 2.0 to other virtual machine software to see the result.
I try to install Kali Linux 2.0 on VMWare Workstation 11 for Linux on a laptop (Lenovo Thinkpad X200 with 4GB RAM) but it failed in the middle and the installation never completed. I do not have Workstation 12, so I cannot test it.
Then, I pick up another laptop (Lenovo Thinkpad X201s with 8GB RAM) which is running VirtualBox 4.3.30 on Ubuntu 14.04. I assigned 4GB RAM to Kali. The installation is smooth. May be the Kali Linux repos server is out of the DDoS. (Kali Linux repos server has been DDoS for hours since it is released according to the founder of Offensive Security).
The VirtualBox Guest Additions CD is installed without problem. However, "armitage", "system log", "VLC media player" and "ImageMagick" do not launched. Meanwhile, "redis-server" is running in the background; "Apache2" is listening on TCP6 only. "systemd" errors will be produced on selecting "openvas start".
On the other hand, "Maltego" and "BeEF" are working properly with only one click.
Kali Linux 2.0 is running fast and responsive on VirtualBox 4.3.30.
Some users at #kali-linux (IRC channel) found some weird problems, such as "thin.services" is running and making the system very slow.
Ubuntu 14.04.4 desktop is running smoothly on VirtualBox 5.0. It is suspected that Kali Linux 2.0 selects hardware and virtual machine software.
The conclusion is changed to ACCEPTABLE! Kali Linux Team should be doing better.
Update on August 13, 2015 (Part 2)
This time, I want to test Kali Linux 2.0 VirtualBox 64-bit image and it is running 2GB RAM and 30GB hard drive.
There is a "kali-proposed-updates.list" at /etc/apt/sources.list.d/ and the content is :
deb http://http.kali.org/kali sana-proposed-updates main contrib non-free
Running on VirtualBox 5.0 on Ubuntu 14.04.3 host :
"armitage" cannot be launched.
"maltego" cannot run properly and it cannot be quit.
"BeEF" launched but no login screen UNLESS run "beef start" at "System services" under "Applications".
"VLC media player" and "ImageMagick" do not work.
"system log" works.
"Apache2" is listening on TCP6 only.
"redis-server" is running in the background.
"dkms" accompanied with only one headers file.
Guest Additions CD install with the same "systemctl" error message.
"systemd" errors will be produced on selecting "openvas start".
Running on VirtualBox 4.3.30 on Ubuntu 14.04.3 host :
"armitage" cannot be launched.
"maltego" and "BeEF" can be launched with one click.
"VLC media player" and "ImageMagick" do not work.
"system log" works.
"Apache2" is listening on TCP6 only.
"redis-server" is running in the background.
"dkms" accompanied with only one headers file.
Guest Additions CD install with the same "systemctl" error message.
* Not kidding, it has error message.
"systemd" errors will be produced on selecting "openvas start".
Obviously, Kali Linux Team did not well test their work before it is released. The content of VirtualBox image is different from the ISO. The rating is still remain as ACCEPTABLE!
I will not test any ISO or image files for this release any more. May be wait for the next release.
* It seems that this VirtualBox image is installed VirtualBox 5.0 Guest Additions CD
Update on August 14, 2015
muts stated that I am misinformed. Therefore, I make a very boring video (about 26 minutes long) to proof which is posted at the beginning of this article today.
Armitage is updated yesterday by Kali Linux Team. Therefore, it is working fine now. Meanwhile, VirtualBox is updated from 5.0.0 to 5.0.2 and the high CPU loading on Linux host is fixed.
I also test Debian 8.1 (latest update) on the same environment and installed the Guest Additions CD. I also encounter the "systemctl double free or corruption (fasttop)" error. This error may be from VirtualBox 5.0.x or from Debian.
However, Kali Linux Team forgot to test their amazing Kali Linux 2.0 with VirtualBox 5.0.x on Linux host. Therefore, the rating is still ACCEPTABLE.
Update on August 17, 2015
Fedora 22 is systemd by default. I install Fedora 22 (64-bit) on VirtualBox 5.0.2 with Ubuntu 14.04 host without any problem or error, including Guest Additions CD install.
I also test Kali Linux 2.0 (64-bit) on VirutalBox 5.0.2 with Mac OSX 10.10.5 and it has the similar errors.
Update on August 25, 2015
Since I do not like Kali Linux 2.0, I install my favourite tools on Ubuntu 14.04 LTS recently (please refers to here). I find out that at least BeEF is running very difference between Kali Linux 2.0 and Ubuntu 14.04 on VirtualBox 5.0.2. Kali Linux 2.0 will produces error messages while Ubuntu does not. Both version of BeEF are 0.4.6.1-alpha. I make a video on that, here you are :
Android devices running Android versions 2.2 through 5.1.1_r5 contain vulnerabilities in the Stagefright media playback engine. Exploitation of these vulnerabilities may allow an attacker to access multimedia files or potentially take control of a vulnerable device.
Detection
To test your Andorid if it is vulnerable to Stagefright vulnerabilities, you can use the following Apps by Zimperium INC.
It is recommended to update/upgrade your Android ROM to non-vulnerable version. If your vendors do not release any update/upgrade, you can perform the following steps for a workaround.
I confirmed that CyanogenMod 12.1 Nightly for OnePlus One is fixed the Stagefright vulnerabilities by using Google Play - Stagefright Detector by Zimperium INC while OnePlus One v5.0.2 (Cyanogen OS version 12.0-YNG1TAS2I3) and Google Nexus 5 v5.1.1 (Build number LMY48B) are still vulnerable to Stagefright vulnerabilities at the time of this writing.
It is also confirmed that CyanogenMod 12.0 and 12.1 are fixed for the vulnerabilities. Or, you may consider to flash CyanogenMod ROM if your devices are supported.
If you have OnePlus One, you can follow this guide to update/upgrade your OnePlus One.
The Node Chat Room (NodeChat) is developed with Node.js and it is forked from "Smashing Node.js: JavaScript Everywhere" Chapter 6. It is modified by Samiux and is released under GPLv3 License.
It provides basic chat room features, including private message. It will not save anything in the server.
Hardware : OnePlus One 64GB (Black) (CyanogenMod 12, Android 5.0.2)
Desktop : Ubuntu Desktop 14.04.2 LTS
Accessories : OTG USB cable and 32GB USB thumb drive
I am running Ubuntu Desktop 14.04.2 LTS. However, the android-tools-adb is out of date to operate with Android 5.1. So, we use OTG USB to copy all the required files to the OnePlus One ("storage" directory) instead of using adb command.
Copy the CyanogenMod ROM, such as cm-12.1-20150729-NIGHTY-bacon.zip, to "storage" directory of OnePlus One.
Flash CyanogenMod ROM :
Reboot to TWRP Recovery. Select "Backup". To backup the OnePlus One stock ROM (CyanogenMod 12).
Select "Wipe". To delete all data EXCEPT "System" and "Internal storage" as your CyanogenMod 12.1 ROM is there. This step must do, otherwise; your flash will be failed due to "incorrect signature".
Select "Install". To select "/0" and then "/storage", select the CyanogenMod 12.1 Nightly image file.
Copy the gapp-5.1-arm-2015-07-17-13-29.zip to "storage" directory of OnePlus One.
Boot to TWRP Recovery and select "Install" to install Google Play.
Now you can configure your OnePlus One with CyanogenMod 12.1 ROM and download the Apps from Google Play.
Optional :
If you want to replace the TWRP Recovery with the CyanogenMod Recovery, you can enable "Cyanogen recovery" at "Developer options". When the next Nightly update is available, you can OTA it and it will replace the TWRP Recovery with CyanogenMod Recovery :
Enable Cyanogen recovery
You can consider to lock your bootloader back too :
sudo fastboot oem lock
*** If you unlock the bootloader, all your data will be destroyed ***
You can also consider to turn off the "Developer options" and disable "Advanced root" as well as "Android debugging".
Remark
CyanogenMod stated that the recent Stagefright vulnerabilities has been fixed in CyanogenMod 12 and 12.1 Nightlies before the time of this writing. Please refer to here.
Since Android ROM may have vulnerabilities, it is better to buy Google Android products as it will provide the most latest fix or update to their devices. Or you can consider to flash responsible 3rd party ROM developers, such as CyanogenMod. However, my Google Nexus 5 (5.1.1) does not have the fix OTA at the time of this writing. So sad.
UPDATE on August 06, 2015
I confirmed that CyanogenMod 12.1 Nightly for OnePlus One is fixed the Stagefright vulnerabilities by using Google Play - Stagefright Detector by Zimperium INC while OnePlus One v5.0.2 (Cyanogen OS version 12.0-YNG1TAS2I3) and Google Nexus 5 v5.1.1 (Build number LMY48B) are still vulnerable to Stagefright vulnerabilities.
This article and accompanied youtube video are showing you that TLS/SSL RC4 is now considered vulnerable. If you are running website that using RC4 cipher, please consider to disable it. If you are using Firefox, you can disable it by using the following command :
At the url address field, enter "about:config" and then search for "rc4". After that, change all the entries from "true" to "false". Please note that there should be 4 entries for RC4.
Recently, Hacking Team (a team of hackers which help governments to monitor and hack their citizens) has been hacked and some (at least 3 at the time of this writing) Flash player 0day expolits by Hacking Team were disclosed. Flash is now considered as vulnerable for all systems as it has no fix at the moment.
Firefox has been disabled the Flash from being played unless you enable it. How to watch Youtube videos? I suggest you to install "Youtube Flash-HTML5" add-on if you are using Firefox. You can enable Flash or HTML5 at anytime.
Croissants is an Intrusion Detection and Prevention System and running with Suricata. The components also including Snorby (Event Manager & Web Interface), Pigsty (Event Spooler) and Pulledpork (Rules Manager).
Suricata is a high performance Network IDS, IPS and Network Security Monitoring Engine. Croissants running on AF_PACKET with Suricata and it throughtput is up to 10Gbps traffic. AF_PACKET is one of Linux kernal modules since version 3.6 and it is designed for packet capturing. It is almost plug and play.
AF_PACKET can be running on a very low power consumption x86 computer, such as Intel Avoton C2750 Octa-Core CPU with 8GB RAM or more. This CPU is only running at 20W. I recommend to use at least 8GB RAM for home security purpose. More memory and faster as well as more cores Intel CPU for Home Office or larger business is suggested.
What Is My Home Network Looks Like?
I have 10Mbps internet connection. I do not run with any modem. I have a home router (TP-LINK TL-WR1043 v1.x with stock firmware). I have two home switches (TP-LINK TL-SG1008D, it is like a hub more than a switch in general).
I have a Linux web server, a Windows 7 desktop, several Linux boxes and some Mac machines as well as a Time Capsule. I connect these boxes to the home switches. I disabled the wireless function on my home router and use Time Capsule as wireless router and Time Machine for Mac machines.
I implement two IPS on my home network. The IPS is connected between ISP and the home router. The other IPS is connected between home router and home switches. Therefore, I can monitor the traffic outside and inside my home network. I do not trust internet and intranet at all.
What Is The Hardware?
I use Asrock Rack C2750D4I motherboard with one more Intel Gigabit Desktop LAN card as my IPS.
Since Asrock Rack C2750D4I motherboard comes with 2 network interfaces, I need one more Intel Gigabit Desktop network interface on each box for monitoring purpose.
I installed 32GB RAM and 320GB Hard Drive on each box as IPS.
Internet -- IPS -- router -- IPS -- switch -- PCs and Time Capsule (including web server)
How About The Installation?
I select Ubuntu 14.04.2 LTS Server as the OS of the IDS/IPS. Since the network interfaces of Asrock Rack C2750D4I are Intel i210, the name of the interfaces on Ubuntu 14.04 is p119p1 and p121p1. While the Intel Gigabit Desktop network interface is eth0.
Install Ubuntu Server on the Asrock Rack C2750D4I as usual. Make sure you only connect the network cable to one of the network interfaces. I recommend you to install the OpenSSH when asks. Update and/or upgrade the Ubuntu Server when necessary.
Download the Croissants from here. The current version at the time of this writing is version 0.1.2 dated July 01, 2015.
Please follow the instructions on the official site to install. Configure the nsm.conf. Make sure to remember the password of MySQL as it will be asked when install. The username and password of control panel (Snorby) will also be configured. At the end of the installation, you will be asked for the time zone. Please select UTC. By the way, you may notice that there will have some error warning on the screen when installing. You just ignore it.
After the installation is completed, you can plug in the other network cables. Then, reboot the box. One more important thing is that you should configure your router to either DHCP or static IP addresses. If you selected DHCP, make sure it is reserved for the monitor interfaces (that is the Intel Gigabit Desktop network interfaces). The p119p1 and p121p1 do not have any IP address.
If everything correct, you can access to the monitor interfaces by using your browser, such as http://192.168.20.180. Enter your pre-set username and password when login. At the top right corner, select "Settings" to configure your time zone. Make sure you enter your password at "Current password (we need your current password to confirm your changes)" and then update the settings.
At this moment, your two boxes are in IDS mode. How to enable it to IPS mode?
You may need to change the name of the Intel Gigabit Desktop network interfaces when they are changed unexpected. You can change the name back to eth0 with the following command :
Log in to the two boxes via ssh or terminal. Then run the following command to configure the DROP rules.
sudo nano /etc/pulledpork/dropsid.conf
I suggest to append the following lines at the end of the files. They will block most unwanted traffic.
# HTTP request header invalid
1:2221013
# HTTP missing host header
1:2221014
# masscan port scanner
1:2017615,1:2017616
# DOS possible ssdp amplification scan
1:2019102
# DoS attacks -- UDP & ICMP Invalid checksum & packet too small
1:2200075,1:2200038,1:2200076,1:2200024
# IP & TCP Invalid checksum
1:2200073,1:2200074
# TCP packet too small
1:2200033
# stream established retransmission packet before last ack
#1:2210021
# stream established packet out of window
#1:2210020
# GPL attack response id check returned root
1:2100498
# COMPROMISED & DROP & CINS Active Threats
pcre:ET\sCOMPROMISED
pcre:ET\sDROP
pcre:ET\sCINS
# MALWARE, TROJAN, WORM, MOBILE_MALWARE, Amplification DoS, DDoS
pcre:ET\sMALWARE
pcre:ET\sTROJAN
pcre:WORM
pcre:ET\sMOBILE_MALWARE
pcre:ET\sSCAN
#pcre:ET\sSHELLCODE
pcre:Amplification
pcre:ET\sDOS
pcre:ET\sEXPLOIT
pcre:ET\sUSER_AGENTS
pcre:ET\sWEB_SERVER
pcre:GPL\sSNMP
#pcre:SURICATA\sSTREAM
pcre:ET\sCURRENT_EVENTS
pcre:ET\sWEB_SPECIFIC_APPS
# Outgoing basic auth base64 http password
1:2006380
# Quantum Insert Attack (by NSA)
# (SURICATA STREAM reassembly overlap with different data - 2210050)
# (LOCAL QI 302 and possible inject - 12345)
# https://github.com/fox-it/quantuminsert/tree/master/detection/suricata
1:2210050,1:12345
# GPL WEB_SERVER 403 Forbidden
1:2101201
# ET POLICY Suspicious inbound to MSSQL port 1433
1:2010935
# ET POLICY Suspicious inbound to mySQL port 3306
1:2010937
# SURICATA HTTP Host header ambiguous
1:2221015
# ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
1:2016149
*** Please remember that you may enable some already disabled rules by the captioned setting. If you encounter any false positive alert, you can disable such rule(s) by the following.
sudo nano /etc/pulledpork/disablesid.conf
Append the following at the end of the file, for example.
# TROJAN 1.1.1.1
1:2017000
# DELETED
pcre:ET\sDELETED
# MOBILE_MALWARE Google Android Device HTTP Request
1:2012251
# MALWARE WhenUClick.com Weather App Checkin (2)
1:2000915
# SURICATA STREAM alerts
#pcre:SURICATA\sSTREAM
# SURICATA STREAM
#1:2210000-1:2210049
#1:2210051-1:2210057
# SURICATA STREAM alert when downloading
1:2210021
1:2210020
1:2210029
1:2210045
1:2200074
1:2210038
1:2210044
# ET CURRENT_EVENTS Possible Dynamic DNS Exploit Pack
1:2014445
# ET WEB_SERVER WebShell
1:2016683
1:2016992
# ET TROJAN Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)
1:2009207
1:2009205
1:2009208
# ET TROJAN UPX compressed file download possible malware
1:2001046
# ET TROJAN VMProtect Packed Binary Inbound via HTTP
1:2009080
# ET WEB_SERVER Fake Googlebot UA 1 Inbound
#1:2015526
After that, you can reload the rules by the following command.
sudo nsm_cronjob_rules_update
or
sudo nsm_rules_update
How To Delete All Testing Traffic?
It is very easy to delete all testing traffic if you want to. However, it only delete all the traffic in the Snorby and leave all other setting untouched.
sudo nsm_snorby_db_reinstall
In addtion, I also suggest you to install anti-virus program on your Windows boxes for play safe. Meanwhile, you can classified the traffic on Snorby too.
The last thing should inform you that you are recommend to set the QoS at your router. Otherwise, the bandwidth will be consumed by one of the connections.
How About Performance Tuning?
You can follow this guide to tune the IDS/IPS to make it running more smoothly.
To have a more secured IDS/IPS, you can append the following line to the "/etc/fstab".
I developed NightHawk which allows users to use Tor Network in transparent mode. NightHawk has more advantage than Tor Browser. You not only can surfing the internet via Tor Network with your favorite browser but also can use any application software to connection to internet via Tor Network.
However, there are some restrictions to use NightHawk (or even Tor) safety in order to prevent your IP address from being leaked. First of all, you need to prevent DNS leaking by not using your ISP DNS. Secondary, you are advised not to install Flash on your browser as it has potential to leak your IP address when you visit a malicious website. Thirdly, make sure you do not use Google Search Engine as you may be banned by Google. Fourthly, make sure you disable javascript when possible. However, it is not possible to do so in modern websites. Javascript web pages are heavily implemented. Lastly, do not download as well as do not reverse connect back to your box via the Tor Network.
I think that there are only five restrictions to use Tor Network. When I seeing Chloe's research, I realized that there is one more restriction. It is, you make sure do not login to any website via Tor Network. According to the research, some exit nodes are sniffing traffic even some exit nodes are running for a very long time that granted "Guard" flag in the Tor Network.
In my opinion, HTTPS is also not safe for surfing via Tor Network with bad exit nodes. Chloe's project - BADONIONS - Honeypot the Honeypot can find exit nodes that sniffing traffic. I am waiting for the final result of the project and hope Chloe can release the bad exit nodes list to the public.
I am running Croissants - Intrusion Detection and Prevention System on Ubuntu 14.04.2 LTS Server. Recently Ubuntu update kills the networking features that making no IP address interface to fetch IP address. Even making the interface in promiscuous mode still fetches IP address on that mode. That would drop the performance of the Croissants with more than one IP address with the same subnet in the same system. After try and error, the workaround is as the following.
sudo nano /etc/network/flush-ip
ip addr flush dev p2p1
ip addr flush dev p4p1
ip -6 addr flush dev p2p1
ip -6 addr flush dev p4p1
* where p2p1 and p4p1 are the incoming and outgoing interfaces for Croissants
sudo chmod +x /etc/network/flush-ip
Create a cron job to flush the ipv4 and ipv6 address on every 15 minutes interval :
sudo crontab -e
Append the following line to the file :
*/5 * * * * /etc/network/flush-ip
To double check the cron job entry :
sudo crontab -l
The interfaces should be looking like this :
The ipv4 and ipv6 addresses of p2p1 and p4p1 have been deleted.
When the Kali cannot ping the internet on every boot up in VirtualBox, or the network interfaces is "Device Not Managed", or you cannot connect to PPTP VPN or similar, you can :
Shield is a very small device that can protect your home and small business network from being attack by malicious hackers. The attacks include viruses, scams, phishing, website and browser exploits as well as operating system and application exploits. Shield protects your incoming and outgoing traffic. Even your system or network is compromised before using Shield, malicious hackers cannot control and access your system or network any further when Shield is implemented. Shield is also protecting your system or network from being scanning of vulnerabilities. That is excellent for preventing your system or network from being attack.
Shield acts as Intrusion Prevention System (IPS) or Unified Threat Management System (UTM). When it acts as IPS, the core engine is Suricata (Intrusion Detection and Prevention System). It is the simplest way to implement the device and its throughput is more than 1 Gbps. When it acts as UTM, its core engine is Snort (Intrusion Detection and Prevention System). This mode has a lot of features, such as web content filtering, anti-virus, VPN, QoS and etc. However, the slower throughput is the drawback for UTM mode.
Suricata and Snort are using Emerging Threats Open Rules for the operation. Emerging Threats Open Rules include malicious IP addresses, virus signatures, exploit signatures and attack signatures. It also include scanner signatures. According to Suricata developers, the maximum throughput of Suricata is more then 30 Gbps.
Shield includes a free lifetime subscription to stay up-to-date against the latest threats with automatic essential security updates. There is no number of user limitation in the device. It is designed for general users with no professional training in Information Security. It is very easy to setup and use. Plug, Play and Forget!
Business or DIY
There are some UTM or IDS/IPS available in the market. Those devices are developed for business and the prices are not reasonable for home or small business users. The cost will be over $1,000-USD. Meanwhile, the power consumption of those devices would be higher than Shield. Shield is only between 10W and 15W. Commercial UTM or IDS/IPS will have number of users restriction as well as cost for subscription annually of the rules and services.
On the other hand, we can build an UTM with Untangle; or, we can build a Suricata or Snort based IDS/IPS without paying for the software. However, the cost of hardware would be higher than the Shield for sure. For example, this motherboard costs about $399.99-USD. You also need to purchase hard drive, memory and computer case too. The power consumption for this hardware is between 35W to 80W. Shield would be cost around $300-USD only.
Recommended Setup
We suggest to plug Shield between your modem (if any) or Internet Service Provider (ISP) and router (wired or wireless) in Bridge Mode for excellent performance and protection.
If you do not have any router or you have a slower internet connection and the speed of the intranet is less than 1 Gbps, Router Mode can be implemented. The setup for Bridge and Router Modes are very easy and simple. No skill is required, believe me.
IPS (Bridge Mode)
UTM (Router Mode)
Technical Specifications
- 2 x 1.0 GHz MIPS64 CPU
- 1 GB DDR3 RAM
- 4 GB eMMC
- 3 x 1 GB Ethernet
- 1 x RJ45 Serial console port
- 5 x 3.5 x 1 inches
- between 10W and 15W power consumption
Features
Router Mode and Gateway Mode (UTM)
- Snort Engine
- Emerging Threats Rules
- Intrusion Prevention
- Network Anti-Virus
- NAT Firewall
- Content Filtering
- Web Proxying
- Dynamic DNS
- SSLVPN
- Quality of Service
- Graphical Web User Interface
- Realtime Traffic Monitor
- Realtime Connection Monitor
- Advanced and Basic Mode
- 10 Mbps throughput
- Plus More!
Shield is well designed and the performance will not worse than other similar devices in the market. However, the price is rivalry. It is the first IDS/IPS/UTM for home users and small business. Being a Shield beta tester and developer of Croissants, I am fully satisfied with the performance, price, size and power consumption of Shield. It is really can be "Plug, Play and Forget!". Recommended!
VirtualBox is a virtual machine which can be running on desktop and server. We can running VirtualBox as server (Headless mode) with PHPVirtualBox as front end. PHPVirutalBox can be running with Apache flawlessly. However, I would like it to be running on Hiawatha. There is no database required for the Headless mode.
Part A - Hardware
Motherboard : ASRock Rack C2750D4I server board
CPU : Intel Atom C2750
RAM : 4 x 8GB (32GB) DDR3-1600
Hard Drive : 2 x Western Digital 4TB WD4000F9YZ
Western Digital 4TB WD4000F9YZ is not certified by ASRock, so, it cannot boot from SATA3 ports. The SATA2 ports are used in this case.
The performance of C2750 is similar to Xeon E3-1220L. Please the comparison page at here.
The power consumption of this setup is between 30W to 80W.
Make sure you have enabled "Virtualization" (VT-x) in the BIOS.
Part C.1 - Operating System and Software RAID 1 Installation
RAID 1 requires two hard drivers for the installation. When you are installing Ubuntu Server 14.04.2 LTS, you are required to do the partitioning. Select "Automatically partitioning" for each drive. The partitions will be (1) 1MB for "biosgrub"; (2) Free Space for root directory; and (3) Free Space for SWAP.
Then select "Configure Software RAID" to configure the Software RAID 1 on Free Space for root directory and Free Space for SWAP partitions. Do not RAID the "biosgrub" partitions. Set the "Free Space for root directory" to be mount at "/" and use as "Ext4 jouraling file system". Set the "Free Space for SWAP" to be used as "SWAP".
Finally, you should select to install "OpenSSH" when asked.
After the installation, your box can be booted up as expected. You can check the status of Software RAID 1 by the following commands :
cat /proc/mdstat
mdadm --detail /dev/md0
mdadm --detail /dev/md1
Make sure to change /etc/network/interfaces :
Add "allow-hotplug p119p1" just below "auto p119p1".
Part C.2 - VirtualBox Installation
After the Ubuntu Server 14.04.2 LTS is installed, you can install VirtualBox on it.
sudo nano /etc/apt/sources.list.d/vbox.list
Append the following line to it :
deb http://download.virtualbox.org/virtualbox/debian trusty contrib
wget http://www.cmake.org/files/v3.2/cmake-3.2.3.tar.gz
tar -xvzf cmake-3.2.3.tar.gz
cd cmake-3.2.3
./configure
make
sudo make install
wget http://www.hiawatha-webserver.org/files/hiawatha-9.13.tar.gz
tar -xzvf hiawatha-9.13.tar.gz
cd hiawatha-9.13/extra
./make_debian_package
cd ..
sudo dpkg -i hiawatha_9.13_amd64.deb
sudo nano /etc/php5/fpm/php.ini
Make changes as is.
zlib.output_compression = On
zlib.output_compression_level = 6
RouterCheck is an Android security tool for your router. It is very easy to install and use. It can test up to 3 router vulnerabilities at the moment, such as LinkBleed and Kafeine as well as ShellShock.
This tool cannot fix your problem (if any), but it will advise you how to fix it. Good tool, recommended!
Recently, a Hong Kong based company carrying out a KickStarter Campaign for a coffee machine (Arist). Their goal is $120,000-USD and it is funded over 580% ($845,139-USD). The design of the coffee machine gets an ICT Awards 2015 in Hong Kong too.
However, the backers messages or questions have not been answered since it is funded. Many backers asked for refund and they lost their faiths too. The creator of the campaign posts recently that their server has been hacked and sensitive data have been stolen. The creator believed that it was done by some of the backers. Meanwhile, some backers created a Arist Scam to gather the evidence of the "scam". According to the comments of KickStarter, the mother company of Arist is a Windows Phone Apps development company namely nBition Development.
Arist claims to change the specifications of the coffee machine after the "hack" according to some of the backers who find "Subject to be Changed" in the web site. This is what the backers most unsatisfied.
I wonder if the creator of the campaign is a scammer or their server is really being hacked? I then carry out a quick and dirty check on the server.
First of all, the CEO and founder of Arist, Mr. Benson CHIU is an ex-staff of Microsoft (source is in Traditional Chinese). According to the article, Mr. Benson is doing programming work. His brother Nelson is running a new company after the campaign, namely Kick Start HK.
What I find so far? The web site of Arist is hosting on Cloud Server at RackSpace. The web application is running Wordpress 4.1.1, Microsoft IIS 8.0 and PHP 5.4.38. The shopping cart application is WooCommerce. It is a plugin for Wordpress. The shopping cart part is running SSL/TLS. The site is believed to be protected by Cloudflare as I find Cloudflare javascript on the site.
So, what's wrong with the web site? We know that Wordpress 4.1.1 has vulnerabilities on Same-Origin Method Execution and Unauthenticate Stored Cross-Site Scripting. There is also a SQL injection vulnerability on WooCommerce recently (dated March, 2015). Meanwhile, the most interesting thing is that the site is running a private SSL certificate for the shopping cart part. In addition, the site is running quite slow and the WooCommerce do not accept PayPal. It accepts credit cards only.
After my quick and dirty test on Arist web site, it is believed that the site may vulnerable to (1) Same-Origin Method Execution and (2) Unauthenticate Stored Cross-Site Scripting on Wordpress as well as (3) SQL injection on WooCommerce. Those vulnerabilities may lead to data abuse and loss.
Finally, if the Arist is not a scammer, their web site may properly being hacked and suffering from sensitive data loss. However, it is still unknown that the reason why the design and patent have been stolen too. They are keeping those confidential data in a web server? Or, the network of Arist can be pivot to other servers for the "data loss"? May be the Arist is a scammer?
Anyway, I am not going to comment that why Arist do not response to their backers' questions and queries. I am not going to comment if Arist is a scammer or not. However, I doubt that why an IT guy (Mr. Benson CHIU) will overlook this fault. In my opinion, businessmen should not overlook Information Security or you will lost your reputation very easily.
That's all! See you.
Update on April 28
I find something weird on Arist.
Benson and Nelson are running their web sites for their companies, nBition Development and Kick Start HK, with Tengine web server. However, Arist is running on Microsoft IIS.
Meanwhile, nBition Development and Kick Start HK are protected by WAF (Akamai Technologies Inc). The web applications of those sites cannot be detected easily. However, Arist is not protected by any WAF although Cloudflare javascript is found on the site. The web application can be identified very easily and it is hosting at RackSpace.
I believe that Kick Start HK web site should be built later than Arist's.
My question is that Arist is not as important as nBition Development and Kick Start HK? Or, it is really a scam? We need to wait until the October this year for the product delivery.
Update on April 28 (Part 2)
The Arist web site has been checked again and the captioned said vulnerabilities are still there.
I almost read all the comments by Benson and Arist team on the KickStarter and they are summarized as the following :
- During the campaign, they often answer questions and urge others to be backers.
- They said they will release the video to all arist backers personally. However, they failed to do so. It is because of the patent pending. However, they show the video to the reporters of unwire.hk. Why not backers?
- They said that they will update the backers often several times, but it is failed too.
- They said the arist is in production, but who knows. It is April 2015 now.
- Later, they even do not answer any questions.
- They claimed that their web site has been hacked and confidential data have been stolen. They suspect it was done by backers.
- They stated that the delivery will be delayed till October 2015. Why not deliver the products batch by batch????
They post a "Statement of Clarification" on their web site :
It has come to our attention that there has been posting and circulation of articles with untrue and false information about Arist originated from Hong Kong media groups and individuals since 26 April 2015 (HKT). Given the situation has already led to unnecessary speculation on the capacity and integrity of the Arist Team, we are obliged to clarify as below:
1) Our website and cloud storage account were hacked in mid-April 2015. Being a responsible developer, we have reported the case to the U.S. Police. A notice of such had been posted on our Kickstarter campaign site to notify our backers.
2) We have no plans to delay the planned launch date, which is from October 2015 onwards. As promised, if we cannot ship Arist 3 months after your expected ship date, you will have the option to request a full refund. We stick to this promise with no exceptions.
Despite the recent hacking, and circulation of untrue and biased online messages, we have no intention to stop the work with Arist. As of today, we have more than 25,000+ retail orders to consider as well. We will not stop until we deliver Arist to everyone.
We continue our mission to change the world of coffee. We have come a long way and we are almost there. To those of you who have been with us since the beginning, we thank you most sincerely. We truly appreciate your support, concern and attention.
Update April 28 (Part 3)
Scanomat states that Arist steal their concept and design. He posted the first comment on KickStarter which is dated October 24, 2014.
It seems that all backers missed this comment due to the design of the KickStarter.
I have reported to Arist Scam and they stated that KickStarter has paused the campaign until Arist redesigned the smartphone apps as it is looking very similar to Scanomat one. Meanwhile, Benson states in the comment in KickStarter that they are applying patent to all over the world.
However, Scanomat's coffee maker is in the market at the moment and they may have patented already. Does Benson telling lie? In addition, Nelson states in the recent unwire.hk interview that they also do the manufacturing matter. They are smartphone application development company. Suspicious!
Update April 29 (Part 4)
Nelson said that the Arist was in the market 3 months before the ICT Awards 2015 Competition. The Startup Beat has a report on this (source is in Traditional Chinese). If the coffee maker is already in the market, why they need to change the specifications and delay the delivery for the backers? Another lie?
Meanwhile, it is confirmed that they juice the number of KickStarter backers, please see Arist Scam article.
Update April 29 (Part 5)
After further checking, the WooCommerce plugin version may be 2.3.7 and it is not vulnerable to aforesaid SQL Injection. Therefore, the previous assumption of data leak and data loss may not be occurred. The current version of WooCommerce is 2.3.8 at this time of writing. Meanwhile, the web application does not updated since April 27 even they claimed that they have been hacked. Weird enough.
After reviewing the other manual and auto coffee makers, I suspect that Arist cannot fulfill all the features in a so small footprint machine. The size should be much larger than these designs (version 1 and 2).
Update April 29 (Part 6)
It is very interesting that Benson starts to communicate with the backers at KickStarter since 4 hours ago (about 1700 hours HKT). He failed to do so since the end of the Campaign. He said he need to 'step in" for the matter. Why? Scare?
Update April 30 (Part 7)
Does Benson steals the other's concept and idea? If yes, how can he get the patent? It should be already patented. The following video is posted on Jan 16, 2012 when nBition Development may not be formed :
I doubt that the Jura (the so-called Arist Version 1) has been shown by Benson to the judges of ICT Awards 2015 and the video to shown to the reporter of unwire.hk.
The protocol of the Jura is available. It is the reason why Benson and Nelson told to the reporter of unwire.hk that the cost of the development and manufacturing are not so high as expected by the public. It is because they stole other's idea, concept and work. They even wanted to apply patent as their work too. It is also the reason why they are unwilling to show the working Arist (Version 1) to the backers or public.
Meanwhile, they stole others idea, concept and work to have Hong Kong Government funding.
In addition, it is an impossible project for Arist (Version 2). The awesome features in a so small footprint device is impossible in physic, I think. Where is the water tank? Where is the two bean containers? Where is the milk container? Where is the syrup capsule container? Where is coco powder container? They are the features that stated in Arist project.
Update April 30 (Part 9)
Benson and Nelson are also running a cafe shop at Causeway Bay, Hong Kong, namely Tosavour Cafe (Facebook). I wonder if they use their Arist (Version 1) in their shop or not.
I also wonder why they need to employ Barista as Arist can make a wonderful and professional coffee.
Why I say that? It is because the Arist (Version 1) has been sold over 1,000 units 3 months prior to the ICT Awards 2015 Competition (Source).
Please note that I mean Arist (Version 1) is the Arist on KickStarter while Version 2 is at the ICT Awards 2015 Competition.
Update May 1 (Part 10)
All of sudden, Benson "step in" the backers comment (on April 29, 2015, HKT) and Matthew Lam (later known as Matt Lam, who stated he is buddy of Benson in the early stage of the comment of KickStarter) starts to fire at some backers in order to keep them silent on April 30, 2015 (HKT). Interesting .... Interesting .... Very interesting ....
Update May 1 (Part 11)
It is really surprised me that the web site of Arist still not yet updated/upgrade even they claimed to be hacked.
The initial quick test may have some errors on April 27, 2015. Hereby, I attached the version findings which is conducted today :
Update May 5 (Part 12)
According to PC Market (PCM, Issue 1136 dated May 5, 2015) Page 26 and 27, Nelson told the reporter of PCM that they have sold out 1,000 units of Arist Version 1 to Baristas all over the world in July 2014. Those units are assembled by hand. Those buyers are required to sign a Not-Disclosure Agreement (NDA). (Please also read Update April 29 (Part 4) and April 30 (Part 9) as well as Arist Scam in conjunction.)
I wonder how many buyer will sign an NDA when they paid for the product. Meanwhile, Benson and Nelson should have UL and CE certifications before selling the units, which is mentioned by one of the backers, Dan_R, in KickStarter comments.
In addition, why Benson and Nelson do not deliver the Arist Version 1 to backers when the there are only about 2,000 backers in KickStarter? The Arist Version 1 does not exist?
Update May 8 (Part 13)
According to anonymous source (I have seen the evidence but I will not post them here in order to protect the contributor) that Benson was doing Netduino/Arduino things around July 2014 in which he claimed that Arist Version 1 had been sold 1,000 units to Baristas all over the world.
Is he still inventing the machine? If yes, why he said Version 1 had been sold over 1,000 units? If no, why he cannot show the demo video to backers? Or, is he telling lie? Or, is he thinking too big in the early beginning that he realized today that it is an project impossible?
Update May 17 (Part 14)
The owner of Arist Scam, Jake, states that he has been refunded this morning and he is no longer can post to KickStarter due to the refund. Meanwhile, another backer, Dax, states that he also got his refund this morning. It is confirmed that Benson dislikes Jake and Dax very much and make them shut up.
It is interesting that, Benson starts to post to the KickStarter since then. He states that he cannot reply to backers these days due to busy to response to the media about the false reports. For real?
Benson just posts to the KickStarter a few minutes ago that he denied to refund to anyone when someone else asks for his refund after reading Jake's site (link). Benson says that they (Jake and Dax) may be kicked by KickStarter. Really? Does Jake and Dax do any harm to KickStarter? No! But to you, Benson!!!
Benson fears to open the refund flood gate!
Update May 18 (Part 15)
Benson is arguing and insulting to the backers who lost their faiths on the project.
Benson and Nelson CHIU are starting to issue refunds to everyone who complains about their scam!
After you, backer, receive your refund, please contact info@aristscam.com, so that they can build a community and bring justice to the Benson and Nelson.
Meanwhile, the web site of the AristCafe is updated to Wordpress 4.2.1 but it still has a private SSL certificate. In addition, the web site is vulnerable to DoS.
Benson sent 2 emails to Jake (the owner of the Arist Scam web site) to threaten Jake to shut down the web site (link). Meanwhile, the proof of refund from Benson is here.
From anonymous source that Hong Kong Identity card numbers and addresses of Benson and Nelson have been obtained. I think they will be published to public very soon.
Benson, Benson, you have a very wrong and dead move!
"Chiu demonstrated Arist for the Post using the accompanying iPhone app to produce two espressos after engineers had made a few tweaks to the prototype using screwdrivers and a black and yellow pencil."
Did Benson say that they already sold over 1,000 units of Arist all over the world to Baristas in July 2014? Does every Barista, who purchased the said Arist, requires to use screwdrivers and pencil to tweak the Arist and then produce coffee?
Benson and Nelson are scammers for sure in my opinion!
Meanwhile, I have Benson and Nelson's HKID card numbers.
Ah, I forgot to mention that Benson posted the link of the article of SCMP to KickStarter to proof something. However, he is suicide as he overlook the last sentence of the article.
Update May 21 (Part 17)
More evidence on Benson cheats at Kickstarter launch at here (Read with "Update April 29 (Part 4)"). It is not ethical.
Update May 24 (Part 18)
aristcafe.com is now well protected by Cloudflare and it has valid SSL certificate now. However, it used private SSL certificate between August 6, 2014 (domain creation date) and May 21, 2015 (GoDaddy SSL certificate). Benson also claims that the site takes 25,000 pre-orders. Read with "Update May 1 (Part 11)" and "Update May 18 (Part 15)".
Although aristcafe.com is well protected by Cloudflare, I am sure that it is still vulnerable to DoS attack. It can be taken down within minutes.
In the update #17, Benson stated that his team is still developing the prototype (the current is at Phase 4A). He use all backers' money to develop a prototype instead of a working prototype before the KickStarter campaign.
His website (aristcafe.com) is protected by Cloudflare recently and he has a valid SSL certificate (begins on May 21, 2015). He showed a graph of his website on the update #17 to proof his website has a lot of visitors. I doubt that those traffic are from the bot of Cloudflare or Google (I am also running a website behind Cloudflare too). It only shows the traffic between 0555 and 0655 hours on a day (which day?). Why not between August 6, 2014 and today? May be the traffic are from the one who want to see what is going on due to they read the media recently?
He also said that the engineer use "screwdriver" and pencil to turn off the sensor in order to brew the coffee when the cover is removed. I doubt that why he needs to take off the cover to brew the coffee. To show to the SCMP reporter that the machine is so complicate? Or, it needs to remove the cover to brew the coffee?
In conclusion, Benson is telling lie that he had shipped 1,000 units of Arist to the Baristas all over the world. He uses backers' money to develop the prototype. He also spent all the backers' money too. He cannot proof that he has 25,000 pre-orders. He is still telling lie in the update #17 again.
Almost all Intrusion Detection and Prevention Systems (IDS/IPS) can be bypassed. No matter it is commercial or open source, they can be bypassed by any skilled attacker. I am running my home brewed Intrusion Prevention System for over 2 years. It becomes mature and I decided to carry out a bypass test against it.
My plan is to conduct the Application Layer (Layer 7) exploitation behind my IPS. Normally, almost all attacks are from the external. However, I am trying to do it from internal to external.
I picked up one live web site which is vulnerable to Wordpress vulnerability. I carried out the exploitation from the internal and it is not surprised that I can dump the database from the said site. I successfully bypass the IPS from my internal network. I know that there are different rules for external and internal traffic. At least I know that I can do it from internal and it is not very hard from external, I think.
The following are the database that dumped from the said site (some characters are masked in order to protect the victim) :
Several years ago, I conducted an exploitation test to see if the system can log down the attack or not. The final result is that it cannot. You can watch the video at here. Similarly, I also conducted a test to bypass some famous Anti-Virus programs. The final result is that it can be bypassed very easily. You can watch the video at here.
In conclusion, those security measures are just like our lock on the door and metal gate in front of our houses. They should be there but they cannot fully protect you from being burgled if intruder find a way in. Therefore, we should not fully relying on those security devices and/or programs as well as log checking. Make sure your networks or systems are in excellent security condition. Be remember that the strongest security is at the weakest point. 99 percent secure is a 100 percent insecure. The most dangerous is that you believe it is secured.
