Blocking Advertisements and Malvertising

This is an interesting topic, blocking advertisements for me is a must. I not only feel much safer, I know I am safer browsing pages on the net with an Ad Blocker, I personally use Ad Block Plus for Firefox. There has been lots of press regarding malvertising of late, Huffington Post and FHM being victim. IT governance are seen to be quoting RiskIQ figures from this years Blackhat conference of malvertising being up 80% from last year. The Malvertising that we are seeing across the net coming from bad ad companies are particularly dangerous not requiring interaction from users, simply visiting the site being enough to become infected with malware. IT Security folk often have very clean surfing habits, however average users that aren’t as aware browsing the net will be susceptible to downloading malware without them even knowing. The malvertising needs a vessel in order to carry itself over to the victims computer in order for it to be exploited, that usually being a vulnerability in flash or Java. Keep it up to date – better still if you can live without it, do so, or block it with a add-on like ‘no script‘ for Firefox.

I do however sympathise with sites that rely on advertising to stay on the net, I realise I’m not supporting my favorite sites by blocking their ads as they are not receiving revenue from the ad companies however I’m not willing to compromise my own security either.

One interesting idea being the Google Contributor Service where people pay to not see advertising on sites that use google ads, instead they see a banner thanking them for contributing. One idea that will remain in play is paying our favorite sites  for their content on a subscription basis.  It will be interesting to see how this problem unfolds itself, one thing is for sure the problem is increasing and as malvertising increases, so will the use of Ad blockers which will only concatenate the problem of content providers not getting paid!

What are your thoughts…

Installing VirtualBox Guest Additions in Kali Linux v1.x

A brief summary of the commands needed to install VirtualBox Guest Additions in Kali Linux v1.x. Having the Guest Additions installed is very useful, being able to copy and paste text like bash lines like the below is extremely useful. There is also the extra screen options such as the transparency mode. Being able to copy files in and out of the system into the host is also very useful.

Linux headers need to be updated.

#apt-get update && apt-get install -y linux-headers-$(uname -r)

Copy the VBoxLinuxAdditions.run file to the Desktop.

Restart.

#cp /media/cdrom/VBoxLinuxAdditions.run /root/Desktop/
#cd /root/Desktop/

Make it executable:

#chmod 755 VBoxLinuxAdditions.run

Install it:

#./VBoxLinuxAdditions.run
kali Virtualbox
Installing VirtualBox Guest Additions on Kali Linux version 1.x

Reboot for a final time.

After it has successfully installed you will now be able to go full screen, add in file sharing options, copy and paste and clipboard functionality. Enjoy.

 

Cisco ASA in GNS3

Having spent many hours over several days trying to get to a point were I could run a Cisco ASA in GNS3 in stable condition has proven to to be harder than first thought. However I now have a set of configuration options specific to the Cisco ASA to keep it running in a stable manner in GNS3. Check it out under my  Labs and Projects menu here, let me know your thoughts or any other better ways to achieve this.

Follow the link here to creating a Cisco ASA in GNS3 here : https://www.adamcouch.co.uk/labs-projects/cisco-asa-firewall-in-gns3/

Cisco ASA in GNS3

Quick SSL Scan

OK so with a my new website up my first thought was ‘right lets secure it!’. Now if only more people thought this way surely we wouldn’t see half the info sec issues we see today. So I’m probably slightly biased on the subject being a Pentester. Not sure if biased or paranoid is better word.

I’m supposed to be on holiday in wales for the bank holiday however 8 hours into the site build and can’t help but think, security. A few tasks later and I navigate to Qualys, lets see where we currently stand, 10 minuets later and I’m building a Kali 2.0 virtual machine in Virtual Box on my laptop in the hopes of pentesting it over 3G!

So a Grade B on ssllabs.com . A little work needed I think.

sslgrabeB

Qualys.com is a great resource for scanning URL’s to see what SSL/TLS cipher suites are in use. Check it out!

Disabling SSL v2, v3 and also RC4 in Apache2.

By the time I had finished typing this post I was up to a A- having disabled RC4 in the SSL.conf file in mods-enabled folder be appending the ‘SSLCipherSuite’ with :!RC4. Disabling SSL v2 and v3 is also a simple step by appending the ‘SSLProtocol’ line with ‘-SSLv3 -SSLv2’ in the same file.

This is very much only a small step towards securing a site, although a good start!

sslA

Greetings!

Greetings! Welcome to my InfoSec Site!

Here I will be mostly be talking to myself about Information Security Topics, News, and mini guides. Feel free to join in and comment!

I am also going to be sharing some of the latest Labs and Projects that I am currently working on, short tutorials that I have been through and had to learn along the way. This will be both Windows and Linux based. I will also be sharing some Security techniques, not only in an effort to raise awareness for Information Security, but also to use as my own quick lookup when I need to remember something!

I was inspired to create this site after listening to Defensive Security Podcast and subsequently reading an article titled How to build a successful information security career on their site.