Basic Security Guide (no, no antivirus included)

[Akolyte]

This is my basic security guide for your technology.  This will include basic settings on routers, modems, servers and computers as well as techniques, tools and other things you can use to find and remove malware/backdoors and prevent exploitation.  This guide will not include antivirus software, if you want one.  Go for it, I use one but these days there are only a select few which are even decently good and most people already know of them.  

 

And besides, is an antivirus going to protect you against getting exploited, getting a payload run and backdoors remotely controlled from a machine done by a hacker in their bedroom?  Nope. 

 

Post-introduction notes: If you have an LTT theme, and cannot see the text.  Post a comment and I will try to fix it.  Just so you know. 

 

Network Security:

Everything coming from the WAN starts at your home network.  (pretty much).  And so its important to make it as secure as possible, One of the most important features of your router (hopefully ) is your firewall.  This controls what is allowed in and out.  The default configuration allows all traffic out of the network but no traffic in, unless its through certain ports such as port 80.  

This is why there is port forwarding, so you can allow connections through your firewall to a computer, so a server can be accessed by the internet. 

 

So, because of this generally its not a good idea to port forward unless you have a reason too.  This will increase your protection significantly, as there isn't a directly open port an attacker can get through.  

 

Anonymity is very precious in the Security world because it allows you to be at more security, if someone doesn't know you exist how can they attack you. For that same reason, if you 'stealth' your open/closed ports then an attacker doesn't know which ports are open or closed.  Or even available for that matter.  

This is actually a pretty easy process as long as your router actually offers a setting for it, most routers will actually come with this by default.  But, if you can drop incoming packets which aren't authorized, then an attacker will have no response.  And generally your router will not respond with anything.  

 

The easiest and most accessible way of testing this out for yourself is to head over to GRC (The Gibson Research Cooperation) and go to Shields Up.  

https://www.grc.com/shieldsup

 

This will, in short terms.  Run a port scan of several ports remotely to see if they are open, closed or not responding (invisible).  

 

This is useful as it allows you to see what your router does in reaction to a probe. Some router firewalls will do nothing, until they detect the probe and then will proceed to stealth the ports.  This is good, but also bad.  So, run it on common ports and all service ports to see what your router's reaction is.  If it shows up as failed, try to change some settings to stealth yourself.  

 

DNS servers can also be a factor here, but generally its only a threat in large attacks on an ISP aiming at lots of people.  So in short terms, trust your isp security and if their dns servers get spoofed, the cache gets poisoned or something blame them.  

 

Intranet Security: 

This part is more a local part. There might be a black hat living across the road.  if so, you should definitely follow this

 

Wifi encryption is pretty important to keeping the badguys out.  I was running a local scan and found a couple neighbors with WEP security. Which is pretty useless these days.  You probably already know to use WPA2.  Which most routers have unless your running a very old one.  

 

The settings you should turn off is WPS (unless you plan on using it). Which isn't necessarily as insecure and people think.  None the less, its quite insecure and should be turned off unless you actually plan on using it, which most people never do.  You should also turn off UPNP which can allow acess to your network even through your firewall, and can be exploited.  However, if you want to torrent without port forwarding or something, its a good idea to have it on.  But, don't have it on unless you plan on using it. 

 

Lastly, try to change your wireless password every so often, about every 30 to 90 days.  Its certainly not needed, but it can be useful considering every network can be hacked into.  Its just a matter of time.  So, its a good habbit to get into.  Also, try to make your passwords at least 16 characters long.  Preferably 30 characters.  With numbers, letters, symbols, spaces and also hex codes if you want even more security. 

 

Moving on from wifi, the setting and firewalls of your network computers are also very important.  Generally, you want every computer inside the network to have a firewall.  While it doesn't need to be hardcore, it just needs to be able to handle the personal connections, as well as the inside-the-network connections.  This can help if someone is trying to compromise a computer inside the network, while being inside the network as it is entirely possible.  

 

Windows Firewall is all you need, it has pretty good settings by default.  

 

Protection For Individual Computers:

This is a pretty crucial part.  Hackers can still gain access to systems through drive by downloads and malware so its important to protect yourself as best as you can.  As said previously, this will not include antivirus software.  

 

A great way of securing your computer against exploitaion is using EMET, short for Enhanced Mitigation Experien Toolkit 

https://technet.microsoft.com/en-us/security/jj653751

 

This enhances the default Windows security features which just allow DEP for programs that want it.  This will do that for certain programs you choose, and will also add other security features such as ASLR.  

Note: Some antivirus software have this built in, if yours does.  There is no need to use EMET.  If your using Avast, AVG, Avira or Microsoft Security Essentials which are popular antivirus suites, they do NOT include these features by default. 

 

Other ways you can improve your security is by using a different browser than, internet explorer.  And hopefully get a script blocking addon with a default deny system.  Blocking all scripts unless allowed.  These can be inconvenient.  But, if you think of it from an attackers perspective, a browser is a tool.  Which automatically runs scripts on their computer allowing you to pull off pretty sophisticated attacks. 

 

Making sure Windows Settings can also help allot:

• Make sure your system is frequently patched.  It not being patched gives attackers options, as previously discovered vulnerabilities can be exploited if your system isn't patched. 
• Don't install software you don't need. Every piece of software and every program is an entry point if vulnerable. 
• Make sure UAC is enabled, and if possible don't run as administrator/root unless you need too. 
• Disable File Sharing and IPV6 if you don't need or use it.  IPV6 can be exploited on Windows.  
• If you use file sharing make sure its password encrypted.  If you don't use RDP disable remote connections and if you don't use powershell.  Make sure running scripts is disabled. 
• Make sure to never let any program you don't trust run as root.  It could cause quite allot of damage. 

 

Also keep in mind viruses aren't just .exe files.  They can be hidden in images, run in text files, batch files, VBS scripts and even be third party scripts such as Python and Ruby, which antivirus software doesn't protect against, unless the heuristics are top notch. 

 

What Should You Take From This?

Only the stuff you think you could use, I don't even do all of this.  This is pretty basic stuff, but can make a difference.  

 

Keep in mind too, that safe browsing habbits and common sense doesn't protect you.  Your brain does.  

 

The best protection is access control.  So, its best to lock everything down.  

Think of it like this.  Because you have connections coming in and out of your computer all the time its almost like letting strangers into your house.  Do you leave your house completely open to them or be smart and lock certain doors and make sure the locks change every so often to people cant break the locks over time. 

 

-If there is anything you want to add, tell me and i will add it  

 

 

Thanks! 

 

 

[DimasRMDO]

[kung.lao]

Wow great work, writing this all down here. Really good job!

[SImoHayha]

You might need anti-virus lol. You just said one thing hackers can do is that certain files can be infected. What does a anti-virus do ? Protect you against infected files.

 

Bitdefender is a good lightweight anti-virus and you just need to sign up for free, Zonealarm Firewall is also a good thing as it protects your ports and makes then invisible.

[Guest]

You might need anti-virus lol. You just said one thing hackers can do is that certain files can be infected. What does a anti-virus do ? Protect you against infected files.

 

Bitdefender is a good lightweight anti-virus and you just need to sign up for free, Zonealarm Firewall is also a good thing as it protects your ports and makes then invisible.

 

I used to use ZoneAlarm, but it would cause my ping in BF4 to spike and so was constantly being kicked from servers

[SImoHayha]

I used to use ZoneAlarm, but it would cause my ping in BF4 to spike and so was constantly being kicked from servers

really?

[Akolyte]

You might need anti-virus lol. You just said one thing hackers can do is that certain files can be infected. What does a anti-virus do ? Protect you against infected files.

Bitdefender is a good lightweight anti-virus and you just need to sign up for free, Zonealarm Firewall is also a good thing as it protects your ports and makes then invisible.

Not really actually. It scans executables from a set of pre-downloaded signatures. Zero day protection is most important here. Things like behaviour analysers and heuristics come in very important. But signatures can be overrun and the vulnerabilities of a computer may actually lay in the antivirus software you are running as they can also present vulnerabilities. If your going to use an antivirus at all I would advise Symantec, Kaspersky or Trend Micro. They are the top of the real threat prevention game. Norton has so many underlying features no one knows about. Saying that, having no antivirus is sometimes safer then having one at all.

Zone alarm is probably worse than windows firewall due to the vulnerabilities in its intrusion detection system which can be bypassed. Bitdefender has good signatures but also lacks in zero day prevention. You really need exploit protection these days.

I used to use ZoneAlarm, but it would cause my ping in BF4 to spike and so was constantly being kicked from servers

Wow great work, writing this all down here. Really good job!

Thanks. After working for avg for 2 years as a software penetration tester (hacking past its security) and now being a malware analyst and all round hacktavist I thought I would make a basic security guide

This is a good resource to add https://www.cyberstreetwise.com/

Awesome I'll take a look at it

Your awesome too

[SImoHayha]

Well common sense plus everything else is better than nothing.

[Akolyte]

Well common sense plus everything else is better than nothing.

True. I agree

But I also want to add something which is common sense can also be your downfall. Common sense can only get someone so far, the main thing I that can protect you is your mind.

*if you are aware of your surroundings nothing can pounce without your knowledge. Much like if you know your computer operating system well how it is you will know differences and they alone should be enough evidence.

*being creative actually helps too, generally the more something stays static the more easier it is to compromise. So, in retaliation changing things is a good way of protection. That's why good security guys will sometimes change their identities often

*knowledge and experience

Being able to know how an attack is executed can help allot in preventing it. Although you might not how to execute and develop an attack boosting your knowledge will help you become better prepared.

*dont get comfortable

Never use a windows administrator account and keep your security on. The more comfortable or get in a hostile world the more dangerous it becomes. Remember. The Internet is a public network. It was never designed to be safe, private and heavily controlled.

*silence is your friend.

The more anonymity you have the harder it is for people to find you, the easier it is to avoid attacks or even know before you are attacked