Perimeter
2/14/2012
04:56 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Linux Live Environments: Cool Tools Even For Windows Folks

Preconfigured Linux environments provide powerful tools to aid in pen testing, mobile security testing, malware analysis, and forensics

The recent release of the MobiSec Linux Live Environment and the update of REMnux to version 3 are reminders that there is a whole world of Linux-based tools available that security professionals focused only on Windows are missing out on. Please don't mistake that statement as ding against Windows. I've worked in many well-designed and stable environments where Windows was the standard platform for desktops, laptops, and servers. I'm sure many of you have, and there's nothing wrong with that.

What concerns me is that I've seen a large percentage of those same Windows environments where the security professionals never step outside of their comfort zones. Tell them about a great security tool, and if it doesn't run on Windows, they have absolutely no interest in using it. Sure, there are a large number of great Windows-based tools, like Network Miner and NetWitness Investigator, that are easy to use and powerful, but offer a similar tool originally developed for Linux, and it gets dismissed immediately if it doesn't have a GUI or is written in an interpreted language like Ruby or Python.

Security tool developers have recognized this disconnect and have started to address the gap. Many of the tools I use daily in penetration testing under Linux and Mac also have Windows counterparts, like nmap, Metasploit, and netcat. Sometimes there is a small loss in functionality as the tool is ported to Windows, but the core features and power of the tool are still present. I think this is helping to open a few eyes, but not many.

I can't fault these security pros for wanting to focus on Windows. If it is the standard platform in their environments, then it's what they need to know backward and forward. However, that's not all that's really in their environments, is it? Let's step back a moment and think about things like embedded devices, printers, switches, firewalls, mainframes, and security appliances (i.e., spam/Web filters, IDS) that are likely to be present. How many of those do you think have some sort of Unix-based operating system? Anything less than somewhere upward of 95% would surprise me. It's the turning of a blind eye that bothers me.

I think it's important to point out to them that the key feature with the preconfigured Linux environments mentioned above is their ease of use. They are typically designed to be easy for anyone to use no matter the level of their familiarity with Linux. When discussing this with a friend involved in developing MobiSec, he stated they were making it and the MobiSec lab exercises in their mobile security course accessible to Windows, Mac, and Linux users. Similarly, take a look at REMnux, and you'll see that Lenny Zeltser has provided a cheat sheet and links to articles to help guide users on the use of the tools included within REMnux for malware analysis.

If you're a Windows admin, then take a look at what's out there that can help with your security efforts. For general network security, Backtrack is a great distribution with tons of tools and lots of available documentation due to its popularity. SIFT is a powerful solution for forensics used in SANS training. And, of course, there's REMnux and MobiSec. Try them all to see what fits your needs, or at least have a familiarity with them for when the need to use them arises.

John Sawyer is a Senior Security Analyst with InGuardians. The views and opinions expressed in this blog are his own and do not represent the views and opinions of his employer. He can be reached at johnhsawyer@gmail.com and found on Twitter @johnhsawyer.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1978
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via a request to auth/process.php, (2) delete an administrator via a request to auth/admi...

CVE-2015-0741
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596.

CVE-2015-0742
Published: 2015-05-21
The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registrati...

CVE-2015-0746
Published: 2015-05-21
The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.

CVE-2015-0915
Published: 2015-05-21
Cross-site scripting (XSS) vulnerability in RAKUS MailDealer 11.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted attachment filename.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.