Perimeter
2/14/2012
04:56 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Linux Live Environments: Cool Tools Even For Windows Folks

Preconfigured Linux environments provide powerful tools to aid in pen testing, mobile security testing, malware analysis, and forensics

The recent release of the MobiSec Linux Live Environment and the update of REMnux to version 3 are reminders that there is a whole world of Linux-based tools available that security professionals focused only on Windows are missing out on. Please don't mistake that statement as ding against Windows. I've worked in many well-designed and stable environments where Windows was the standard platform for desktops, laptops, and servers. I'm sure many of you have, and there's nothing wrong with that.

What concerns me is that I've seen a large percentage of those same Windows environments where the security professionals never step outside of their comfort zones. Tell them about a great security tool, and if it doesn't run on Windows, they have absolutely no interest in using it. Sure, there are a large number of great Windows-based tools, like Network Miner and NetWitness Investigator, that are easy to use and powerful, but offer a similar tool originally developed for Linux, and it gets dismissed immediately if it doesn't have a GUI or is written in an interpreted language like Ruby or Python.

Security tool developers have recognized this disconnect and have started to address the gap. Many of the tools I use daily in penetration testing under Linux and Mac also have Windows counterparts, like nmap, Metasploit, and netcat. Sometimes there is a small loss in functionality as the tool is ported to Windows, but the core features and power of the tool are still present. I think this is helping to open a few eyes, but not many.

I can't fault these security pros for wanting to focus on Windows. If it is the standard platform in their environments, then it's what they need to know backward and forward. However, that's not all that's really in their environments, is it? Let's step back a moment and think about things like embedded devices, printers, switches, firewalls, mainframes, and security appliances (i.e., spam/Web filters, IDS) that are likely to be present. How many of those do you think have some sort of Unix-based operating system? Anything less than somewhere upward of 95% would surprise me. It's the turning of a blind eye that bothers me.

I think it's important to point out to them that the key feature with the preconfigured Linux environments mentioned above is their ease of use. They are typically designed to be easy for anyone to use no matter the level of their familiarity with Linux. When discussing this with a friend involved in developing MobiSec, he stated they were making it and the MobiSec lab exercises in their mobile security course accessible to Windows, Mac, and Linux users. Similarly, take a look at REMnux, and you'll see that Lenny Zeltser has provided a cheat sheet and links to articles to help guide users on the use of the tools included within REMnux for malware analysis.

If you're a Windows admin, then take a look at what's out there that can help with your security efforts. For general network security, Backtrack is a great distribution with tons of tools and lots of available documentation due to its popularity. SIFT is a powerful solution for forensics used in SANS training. And, of course, there's REMnux and MobiSec. Try them all to see what fits your needs, or at least have a familiarity with them for when the need to use them arises.

John Sawyer is a Senior Security Analyst with InGuardians. The views and opinions expressed in this blog are his own and do not represent the views and opinions of his employer. He can be reached at johnhsawyer@gmail.com and found on Twitter @johnhsawyer.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3580
Published: 2014-12-18
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVE-2014-4801
Published: 2014-12-18
Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x through 2.0.1.1, 3.x before 3.0.1.6 iFix 4, 4.x before 4.0.7 iFix 2, and 5.x before 5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6076
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site.

CVE-2014-6077
Published: 2014-12-18
Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVE-2014-6078
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.