Perimeter
2/14/2012
04:56 PM
John H. Sawyer
John H. Sawyer
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Linux Live Environments: Cool Tools Even For Windows Folks

Preconfigured Linux environments provide powerful tools to aid in pen testing, mobile security testing, malware analysis, and forensics

The recent release of the MobiSec Linux Live Environment and the update of REMnux to version 3 are reminders that there is a whole world of Linux-based tools available that security professionals focused only on Windows are missing out on. Please don't mistake that statement as ding against Windows. I've worked in many well-designed and stable environments where Windows was the standard platform for desktops, laptops, and servers. I'm sure many of you have, and there's nothing wrong with that.

What concerns me is that I've seen a large percentage of those same Windows environments where the security professionals never step outside of their comfort zones. Tell them about a great security tool, and if it doesn't run on Windows, they have absolutely no interest in using it. Sure, there are a large number of great Windows-based tools, like Network Miner and NetWitness Investigator, that are easy to use and powerful, but offer a similar tool originally developed for Linux, and it gets dismissed immediately if it doesn't have a GUI or is written in an interpreted language like Ruby or Python.

Security tool developers have recognized this disconnect and have started to address the gap. Many of the tools I use daily in penetration testing under Linux and Mac also have Windows counterparts, like nmap, Metasploit, and netcat. Sometimes there is a small loss in functionality as the tool is ported to Windows, but the core features and power of the tool are still present. I think this is helping to open a few eyes, but not many.

I can't fault these security pros for wanting to focus on Windows. If it is the standard platform in their environments, then it's what they need to know backward and forward. However, that's not all that's really in their environments, is it? Let's step back a moment and think about things like embedded devices, printers, switches, firewalls, mainframes, and security appliances (i.e., spam/Web filters, IDS) that are likely to be present. How many of those do you think have some sort of Unix-based operating system? Anything less than somewhere upward of 95% would surprise me. It's the turning of a blind eye that bothers me.

I think it's important to point out to them that the key feature with the preconfigured Linux environments mentioned above is their ease of use. They are typically designed to be easy for anyone to use no matter the level of their familiarity with Linux. When discussing this with a friend involved in developing MobiSec, he stated they were making it and the MobiSec lab exercises in their mobile security course accessible to Windows, Mac, and Linux users. Similarly, take a look at REMnux, and you'll see that Lenny Zeltser has provided a cheat sheet and links to articles to help guide users on the use of the tools included within REMnux for malware analysis.

If you're a Windows admin, then take a look at what's out there that can help with your security efforts. For general network security, Backtrack is a great distribution with tons of tools and lots of available documentation due to its popularity. SIFT is a powerful solution for forensics used in SANS training. And, of course, there's REMnux and MobiSec. Try them all to see what fits your needs, or at least have a familiarity with them for when the need to use them arises.

John Sawyer is a Senior Security Analyst with InGuardians. The views and opinions expressed in this blog are his own and do not represent the views and opinions of his employer. He can be reached at johnhsawyer@gmail.com and found on Twitter @johnhsawyer.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.