Vodaphone USB Broadband on Linux

What you will need:

1. usb-modeswitch-2.0.1.tar.bz2
2. usb_modeswitch-data
3. libusb-1.x

Right after you install those files on your linux box, append these three lines in a terminal:

usb_modeswitch -WD -v 12d1 -p 1526 -n -M 555342437f0000000002000080000a11062000000000000100000000000000 -I -w 500

modprobe option

echo "12d1 14cf" > /sys/bus/usb-serial/drivers/option1/new_id

Open your network manager window, select Mobile Broadband, create a new connection and for connection settings leave them as default, just set the password to 1234.

Plug-in your Vodafone USB and that's it !
                                                                                                                                           [Source]

Read more →

Disable ICMP ping responces on your linux box

Depends on the distribution you use you may be able to disable the ping responce in your box to add some complexity for the attackers or the 'bad guys'. In the video below i am going to show you how to append such configuration in your linux distro.

Disable ping reply

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

Enable ping reply

echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all

To make this permanent set the following into /etc/sysctl.conf

net.ipv4.icmp_echo_ignore_all = 1

ICMP Message Types

You can find more about ICMP here.

Read more →

Tips on hardening an enterprise server system

Hardening a system is the process of making it more secure from the default configuration; it is a very important for servers. Before some time, security wasn't a primary concern, but with all the viruses and attacks on servers today, administrators need to consider about everything.

Keep the system updated

The risk of not being up to date is huge in the world we live on. Hundreds of vulnerabilities are being discovered day by day by security experts you should be aware of. It doesn't matter if your anti-virus is special or your firewall is wicked sick, trust me, for a hacker it's not a big deal to write some bof and win.

Follow the updates regularly and don't miss a thing, patch every hole. In windows world you may use WSUS feature in your server to serve updates to your network clients, this will save bandwidth in the network and save you before some unwanted patching.

Minimize the threat

A server should be installed only for the exact needs, if you're dealing with a server which you obviously don`t know what goes in and out, you're finished. Only the required services and protocols should work fine, rest should be disabled or removed. If you're working on windows environment, make sure to use group policy and the security configuration wizard to help you.

1. Use DMZ,.. demilitarization zone is a network added prior to the internal 'protected' network for extra security.
2. Use Firewalls, play your game and create your own rules in order to win. Policy-based filtering, iptables etc.

This tool should help your windows computers.

Read more →

Enable TCP SYN cookie protection on your linux server

Normally when a client attempts to start a TCP connection to a server, the client and server exchange a series of messages which normally runs like this:

1. The client requests a connection by sending a SYN (synchronize) message to the server.
2. The server acknowledges this request by sending SYN-ACK back to the client.
3. The client responds with an ACK, and the connection is established.

This is called the TCP three-way handshake, and is the foundation for every connection established using the TCP protocol.

A SYN flood attack works by not responding to the server with the expected ACK code. The malicious client can either simply not send the expected ACK, or by spoofing the source IP address in the SYN, causing the server to send the SYN-ACK to a falsified IP address - which will not send an ACK because it "knows" that it never sent a SYN.

The server will wait for the acknowledgement for some time, as simple network congestion could also be the cause of the missing ACK, but in an attack increasingly large numbers of half-open connectionswill bind resources on the server until no new connections can be made, resulting in a denial of service to legitimate traffic. Some systems may also malfunction badly or even crash if other operating system functions are starved of resources in this way.

The protection should be enabled by default in many distros.

Commands used:

sysctl -n net.ipv4.tcp_syncookies
nano /etc/sysctl.conf
sysctl -p

Read more →