Perimeter
2/14/2012
04:56 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Linux Live Environments: Cool Tools Even For Windows Folks

Preconfigured Linux environments provide powerful tools to aid in pen testing, mobile security testing, malware analysis, and forensics

The recent release of the MobiSec Linux Live Environment and the update of REMnux to version 3 are reminders that there is a whole world of Linux-based tools available that security professionals focused only on Windows are missing out on. Please don't mistake that statement as ding against Windows. I've worked in many well-designed and stable environments where Windows was the standard platform for desktops, laptops, and servers. I'm sure many of you have, and there's nothing wrong with that.

What concerns me is that I've seen a large percentage of those same Windows environments where the security professionals never step outside of their comfort zones. Tell them about a great security tool, and if it doesn't run on Windows, they have absolutely no interest in using it. Sure, there are a large number of great Windows-based tools, like Network Miner and NetWitness Investigator, that are easy to use and powerful, but offer a similar tool originally developed for Linux, and it gets dismissed immediately if it doesn't have a GUI or is written in an interpreted language like Ruby or Python.

Security tool developers have recognized this disconnect and have started to address the gap. Many of the tools I use daily in penetration testing under Linux and Mac also have Windows counterparts, like nmap, Metasploit, and netcat. Sometimes there is a small loss in functionality as the tool is ported to Windows, but the core features and power of the tool are still present. I think this is helping to open a few eyes, but not many.

I can't fault these security pros for wanting to focus on Windows. If it is the standard platform in their environments, then it's what they need to know backward and forward. However, that's not all that's really in their environments, is it? Let's step back a moment and think about things like embedded devices, printers, switches, firewalls, mainframes, and security appliances (i.e., spam/Web filters, IDS) that are likely to be present. How many of those do you think have some sort of Unix-based operating system? Anything less than somewhere upward of 95% would surprise me. It's the turning of a blind eye that bothers me.

I think it's important to point out to them that the key feature with the preconfigured Linux environments mentioned above is their ease of use. They are typically designed to be easy for anyone to use no matter the level of their familiarity with Linux. When discussing this with a friend involved in developing MobiSec, he stated they were making it and the MobiSec lab exercises in their mobile security course accessible to Windows, Mac, and Linux users. Similarly, take a look at REMnux, and you'll see that Lenny Zeltser has provided a cheat sheet and links to articles to help guide users on the use of the tools included within REMnux for malware analysis.

If you're a Windows admin, then take a look at what's out there that can help with your security efforts. For general network security, Backtrack is a great distribution with tons of tools and lots of available documentation due to its popularity. SIFT is a powerful solution for forensics used in SANS training. And, of course, there's REMnux and MobiSec. Try them all to see what fits your needs, or at least have a familiarity with them for when the need to use them arises.

John Sawyer is a Senior Security Analyst with InGuardians. The views and opinions expressed in this blog are his own and do not represent the views and opinions of his employer. He can be reached at johnhsawyer@gmail.com and found on Twitter @johnhsawyer.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2130
Published: 2015-03-05
Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and configuration files, and consequently execute arbitrary code, by leveraging administrative privileges, aka B...

CVE-2014-9688
Published: 2015-03-05
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.

CVE-2015-0598
Published: 2015-03-05
The RADIUS implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted IPv6 Attributes in Access-Accept packets, aka Bug IDs CSCur84322 and CSCur27693.

CVE-2015-0607
Published: 2015-03-05
The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connecti...

CVE-2015-0657
Published: 2015-03-05
Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet, aka Bug ID CSCur69192.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.