CleanTalk's blog

    Category: Security

    • ‘WordPress Security by CleanTalk’ Review– Is it Potent Enough to Safeguard you?

      ‘WordPress Security by CleanTalk’ Review– Is it Potent Enough to Safeguard you?

      WordPress is a very popular open source website creation tool. But this is not only a blogging platform, WordPress is an open source content management system used by millions of people worldwide. It is popular mainly because WordPress is very easy to use and easy to start with. Also, very good support from WordPress itself and different forums are available. According to a research, more than 22.5% of the websites are powered by WordPress in 2017.

      Due to its huge popularity and continuous growth as the world’s most used CMS, WordPress is naturally vulnerable to security threats and attacks. WordPress security attacks from the very beginning are handles by WordPress security releases. But there is new type of attacks is coming in the picture every day and everything does not come under WordPress Security Release. Here comes the WordPress Security Plugins.

      WordPress Security by CleanTalk is one of the most important security plugins which helps your WordPress site protected and secured from the Brute Force attacks by creating a firewall. Check out what kind of attacks your website may face and how can you secure yourself from these attacks:

      Why does a WordPress site is attacked anyway?Why does a WordPress site is attacked anyway?

      There is a cut-throat competition in the market in any venture and everyone wants to get the success at the end of the day. Due to the huge pressure, hackers want to access your website to get all the sensitive information, block your access from the site, redirect your users to any other malicious websites, remove or delete your user and all the content from the website or simply use the backlinks from your website. Stealing your backlink information and using it in their website will just improve their page ranks in any search engine.

      Most of the popular websites get thousands of attacks every week or even every day.

      How does a good security plugin work to prevent a different type of attacks on a WordPress site?

      There are several types of security attacks a WordPress website gets every day. A good security plugin applies optimized algorithms to prevent those vulnerabilities and keep the website secure. Following are some form of security threats a WordPress website gets:

      1. Malicious Software: After hitting your website, hackers leave some malicious software or script, also known as malware into your website. Your security plugin should scan all the files, contents, data files, database, changes in the DNS, comments or any kind of post to find out the malicious code that could possibly be hidden in the website’s source code, or URL. These malwares are scanned and removed by the WordPress security plugin.

      2. Brute Force Attacks: This type of attack is performed using permutation and combination of possible login information. Hackers attempt to log in to the website using thousands of possible username and password combination through automated scripts. Security plugins block the users with the attempt of too many login attempts or clicking on forgot password option. It also prevents WordPress from giving sensitive information like username or password hints etc. or multiple entry point options to the hackers.

      3. Zero Day Exploits: There are some obvious vulnerability issues in WordPress websites or any kind of website. Hackers attack those using bots. The security plugins use known algorithms and security firewall for these already published vulnerabilities and stop them.

      4. Spear Phishing and Social Engineering: Spear phishing & social engineering are among some techniques through which hackers can crack the most difficult password too. Security plugins provide a two-factor authentication which can neutralize the risk of password cracking. This facility is used by banks, financial institutions or websites with very sensitive data.

      5. Rate Based Throttling: This type of attack is the most critical type till date. Hackers overwhelm your website, database, servers and network, all resources using bots or automated scripts. This will prevent your genuine customers from accessing your website and search engine crawlers. Also, script crawlers aggressively crawl the website to overwhelm the website contents and resources. Security plugins provide security through IP blocking. If access request exceeds the accepted threshold of a maximum number of requests from any IP address, security plugin blocks that specific IP address. It also prevents the bot crawlers from aggressive crawling.

      6. Country attacks: Hackers using IPs of different countries and networks attack the WordPress websites to find vulnerabilities and overwhelm its resources with aggressive crawling. Security plugins use the same mechanism as rate based throttling, blocks the specific countries from accessing the website.

      7. Password Cracking: Security plugins use password auditing to find out the password of your admin account is weak or strong; suggest changing the password or making a rule to change the password monthly etc. This will prevent attackers to use password cracking or brute force attacking using the similar script.

      8. Spam Ads: Hackers often use the website they have compromised to post spam ads. These ads include a link to some other malicious website or simply a virus to download. Security Plugins scan your site regularly to check if there is any kind of spam ad that has been posted, identify and remove it.

      9. Hacker Reckon: Hackers find vulnerabilities using the information like software version, operating system version, and software installed etc. and security plugin prevents your WordPress website from giving this information anyhow to these hackers.

      What is WordPress Security Plugin by CleanTalk? 

      WordPress Security Plugin by CleanTalk is a premium security plugin for WordPress Site. This is an end to end protection system for a WordPress site which helps to prevent and securing a site from brute force attacks, brute force account counting, blocking IPs and users using a firewall, providing security for WordPress forms and backend filter malicious IPs, networks or countries.

      It also sends daily security logs, audit logs and reports through emails to the users so that user can analyze and monitor vulnerabilities to their WordPress Websites.

      How to Install Security Plugin by CleanTalk?

      Installation of Security Plugin by CleanTalk is very easy both through the automated and manual way. Following are the steps to follow to install WordPress Security by CleanTalk into your WP.

      Automated Installation

      1. Go to ‘Plugin’ option at the left panel of your WordPress and click on it.
      2. Search ‘WordPress Security by CleanTalk’.
      3. It will show the plugin on the page.
      4. Click on ‘Install Now’ button.
      5. Now click on the ‘Activate’ button
      6. Click on ‘Get access key Automatically’
      7. This will take you to the ‘Security Log’ page of the plugin.
      8. Click on ‘Save Changes’ option.

      Manual Installation

      Installation can be done manually too.

      1. You need to go to ‘https://wordpress.org/plugins/security-malware-firewall/#description’ and click on Download button.
      2. Zip file with an Installer will be downloaded. Save the installer and login to your site’s WP Admin.
      3. Click on ‘Add New’ button and then click on ‘Upload Plugin’
      4. Select the Zip file from the Dialog Box and click OK.
      5. The plugin will be installed. Then click on Activate
      6. The rest of the steps are similar.

      Features of WordPress Security Plugin

      Brute force attacks

      Brute force attacks are very different from cracks or in layman words ‘hacks’. Brute force attackers try to login into the WP admin using the easiest method of login, i.e., the username and password. They use permutations and combinations of common and most possible username and password to try logging in until they are successful. The easiest attack is the weakest link and username like ‘admin’ and password like’12456′.

      1. Brute force attacks come from different countries and IPs. If you have single access and IP, it is easy to block all the IPs other than your IP using the .htaccess file. But, if you have multiple users, log in from multiple locations, it is very difficult to identify the IP of the attacker and prevent it.
      2. WordPress Security plugin, blacklists all the IPs and users with too many attempts of login, scripts, failed attempts of forgot passwords. It also prevents WordPress from providing users multiple login points and giving away login information to the hackers. WordPress security plugin blocks or locks out any user who is using an invalid username and password.
      3. It sends email to the user as soon as a brute attack attempt is done. It also shows the attacker’s IP, location, and country through the email.

      Cleantalk Security Log

      Along with the plugin, Cleantalk security log is the additional feature which helps the user keep track on the logs for different events performed on their website.

      The security log consists of Date, Status, IP, Country and other details for the Admin Login for the user’s website for events like Login, Logout, Invalid Username, Invalid Email, Authentication Failed and Invalid Email. Logs can be filtered for different services like Anti- Spam, Hosting Anti-Spam, Database API, Site Security or SSL Certificates.

      Email Notifications

      Email notifications are very important and must have feature for any security firewall to have. Emails are sent to registered admin user’s email whenever an activity is logged in a WordPress site. WordPress Security by Cleantalk sends email for the following activities:

      Admin Login:
      It sends email to the registered admin user’s email so that the user is aware that an admin login has taken place on his website.

      New installation and Signup:

      Cleartalk WordPress Security plugin sends a notification to the user’s email when he installs and signs up for the plugin.

      Access Key:

      Email notification is sent when a user opts to get access key manually.

      Daily Security Report:

      Daily security Report email notification is sent to admin user which includes information about the SITE Time, Username, IP and Country and a number of brute attacks, failed login and authentication failures have taken place.

      CleanTalk Security Firewall

      The WordPress Security plugin security firewall works like a fence against the security attacks to a WordPress website. It uses CleanTalk database of bad IP’s and blocks the vulnerabilities from compromised IP’s. Firewall runs even before other codes run including the WordPress site and this prevents the security threats to attack the WordPress site. The firewall shields the site and blocks the threats even before they appear.

      And provides the WordPress sites security features like

      • Personal Blacklist Management
      • Country and IP blocking
      • Protection from aggressive users and web crawlers

      Traffic Control Analysis

      Traffic analysis is one of the important features for any WordPress website, in terms of security and CPU overloading. From which IP, country and location traffic is coming, the users that are online, who is on your page and how much time they have spent, etc. information is easily provided by the WordPress Security Plugin to the admin user.

      Unlike other plugins, it enables traffic control analysis to all the visitors even if they have not enabled javascript in their browsers. It gives information about visitors on traffic parameters like:

      • Date and Time of the visit to the website
      • Visitor’s spent time on the website
      • Source Country
      • Visitor’s IP Address
      • Browser
      • Operating System and version
      • Type of the visitor – Person, Bot, Search Bot or suspicious bot, script etc.
      • Number of page hits

      Cleartalk Traffic control can block the IP addresses from any country or any network from the interface itself. IP addresses will be automatically blocked by the Traffic Control if they exceed the threshold of the average page visit quantity. This helps the monitoring and blocking of the traffic real time.

      BlackIP Database

      This is the new feature launched by CleanTalk. BlackIP database is the collection of blocked or blacklisted IP addresses. This database helps to analyze which type of IPs, locations or countries from which the most frequent brute attacks come from. You can also manage the blacklisted IPs from your CleanTalk Dashboard-> “Use CleanTalk Database of Dangerous IP Addresses”. If you want to add an exception to your blacklisted IP addresses, you may add any IP to the whitelist IPs and it will not be blocked.

      Generic Tips and Tricks to keep your WordPress website safe:

      Other than using CleanTalk’s WordPress Security plugin and its advanced features, you can use these simple tricks to keep your WordPress website safe and secure all time:

      • Use email for login other than username. Usernames are easy to predict but hackers can’t easily guess any unique email ID. WordPress use unique email Id as login identifier for each user.
      • The default login URL for all the websites are similar. For example: wp-login.PHP, /wp-admin/ etc. You should change them to something your unique and own. This will prevent the hackers to get the admin logged in page’s URL or the dashboard URL.
      • Password of a WordPress site should consist capital letters, small letters, numeric and all type of symbols. Generally, an eight character password is considered as a strong password. Make it 16, it will be stronger and permutation and combination will be difficult.
      • Secure the WP-Admin directory from getting accessed by hackers.
      • SSL should be used to encrypt your sensitive data.
      • If your site has multiple admins, add them carefully after thorough scanning.
      • Admin username should not be kept as “Admin”.
      • Keep backup of your site regularly. You may buy professional services for backup and recovery routine.
      • Protect your wp-config.php file from hackers by keeping it one step higher than the root directory.
      • If you have multiple admin access, just do not allow the dashboard to be edited, by changing it in the wp-config.php file.
      • You should disable the directory listing using .htaccess.
      • Update your plugins and themes regularly.
      • Do not download or install any theme from an unknown site or provider. You do not know what is written in their code.
      • Plugins and WordPress itself should be updated regularly to get all the new security features.
      • Last but not the least, take precaution before installing any plugin. You should check the documentation, ratings, and reviews before installing them and that should be from a trusted source.

      Conclusion

      WordPress Security Plugin by CleanTalk is one of the best world-class security plugins for WordPress which facilitates your WordPress Website an end to end security solution and helps to grow your business without getting the headache of being attacked. CleanTalk’s Security Feature plugin is regularly updated with new features to cope with the new type of attacks and threats and to provide you smooth and flawless security services. Follow the tips and tricks and install a good security plugin will provide all round your WordPress website.

    • CleanTalk Traffic Control — analyze web traffic in real-time

      CleanTalk Traffic Control — analyze web traffic in real-time

      We are happy to inform you about launching our new feature for the WordPress CleanTalk Security plugin.

      One of the most important component of Traffic Analysis is ability to monitor traffic in real time.

      Tracking of your website activity in real time. You can see how many visitors of your website or blog are online and what pages they are on, plus how much time they spent being there.

      Many tools only track traffic of visitors who enabled JavaScript in their browsers, thus they are not capable to show you the whole picture. CleanTalk Traffic Control will track every single visitor no matter if they are using JavaScript or not and provides many valuable traffic parameters such as:

       • Date and time of the visit to your website;
       • Spent time on your website;
       • IP-addresses;
       • Source country;
       • Browser;
       • Operational System;
       • Type of the visitor — Visitor, Search Bot, different bot, suspicious bot and so on;
       • A number of visited pages.

      Abilities:

       • Block specific IP-address, network or country directly from the interface.
       • Block IP-address automatically if the threshold of average quantity of visited pages was exceeded.

      This is great monitoring tool to see attacks in real time and to block them if necessary.

    • AI will play an increasing role in online security

      AI will play an increasing role in online security

      Neural Networks were introduced as far back as the 40’s of the 20th century and first works about them started in the 50’s. Nowadays this technology is being used in different fields. We believe that the CleanTalk machine teaching technologies of spam detection could be upgraded with the help of Artificial Intelligence and the CleanTalk features could be expanded to define an emotional aspect of a comment.

      Theoretical researches of spam filtering with Neural Networks say that these algorithms could achieve 100% efficiency.

      The CleanTalk Company has started to develop Neural Networks Algorithms for spam presence analysis of comments and messages which could provoke negative effects, rudeness, abuse or fraud in discussions.

      There is a big data safety problem in online security. There are too much data to process anomalies that could be the signs of spambots presence.

      There are about 1.5 millions of requests the CleanTalk Cloud processes every day and each request contains set of about 40 parameters. The Cloud uses them to decide whether a request should be approved or blocked so AI could improve our possibilities in spambot patterns detection.

      We intend to supplement technology of spam protection and moderation with more reliable feature and take into account such things as slang, typos, context and other traits of a visitor behavior.

      About CleanTalk

      CleanTalk is a SaaS spam protection service for Web sites. CleanTalk uses protection methods which are invisible for site visitors. Connecting to the service eliminates needs for CAPTCHA, questions and answers and other methods of protection, complicating the exchange of information on the site. Their solutions are reliable, easy and efficient. The module is completely invisible to the visitors and allows you to permanently abandon the ways of protection that impede the communication of visitors to the site (CAPTCHA, question-answer, etc.). CleanTalk allows you to automate protection against distributed from spam and registration spam bots.

      The CleanTalk team has been developing a cloud spam protection system for 5 years and has created a truly reliable anti-spam service designed for you to ensure your safety.

    • Email Notifications when administrators are logged in

      Email Notifications when administrators are logged in

      Do you want to receive a notice each time a user with administrator rights is logged into the WP Dashboard?

      We added this option to our security plugin. Now you can receive notifications if you want to know about an unauthorized entrance to your WP Dashboard.

      Notification will be sent only when a user was able to authorize entering login and password. If you are logged into the admin panel from the saved session, then the alert won’t be sent.

      You can enable the option “Receive notifications for admin authorizations in your CleanTalk Dashboard. Choose “Site Security” in the “Services” menu, then click “Settings”.

      Download Security & Firewall by CleanTalk.

    • Strengthening brute force protection

      We added the new logic to prevent brute force attacks. Service will check your log in status once per hour and if some IP’s have 10 and more attempts to log in, then these IP’s will be banned for next 24 hours.

      It makes the brute force protection tougher and doesn’t waste the server’s resources on these IP’s.

      Download Security & Firewall by CleanTalk.

    • New version of the Security Service by CleanTalk

      New version of the Security Service by CleanTalk

      As we informed CleanTalk launched its website security project. The service protects administrator control panel from brute-force attacks and records users’ actions.

      Since the 29th of November Security by CleanTalk has become the Cloud Service and now all main data will be available in The Service Dashboard. The cost of the service is $20 per year for 1 website.

      Switching to Cloud Data Storage allows to show more data and use the information more flexible thanks to different filters in your Dashboard.

      In the previous versions all data were being stored in a website database and big amount of information alongside with its operations would affect website speed, all this could give a result of bad website ranking of search engines. Cloud Data Storage is safer than website database. If an intruder could get access to your website then he could delete all data he might be traced with.

      Cloud Service provides data storage for the last 45 days including users action log, brute-force attacks statistics and successful backend logins and you can always get to know who and what actions were made if it is necessary.

    • DDoS on 600 GB/s as the democratization of censorship

      DDoS on 600 GB/s as the democratization of censorship

      Well-known American journalist Brian Krebs for a long time writes on the topics of information security, revealing the identity of dark speculators mainly from Eastern Europe. Over the years, Brian had to over pass through a lot. Evil Ukrainian hacker has gathered on the forums for two bitcoins to buy heroin and send it to Krebs by post, other hackers have sent a SWAT team into the house on call 911 supposedly his number, took out a loan for $20 thousand to his name, has transferred $1000 to his Paypal account with stolen payment card. The authors of malicious software mention Brian Krebs even in the code of their programs. What can we do, these are the costs of the work of journalists in the field of information security.

      Now Krebs has been targeted with new attacks. This time the attackers organized the most powerful DDoS-attack 600 Gbps on the website KrebsOnSecurity.com. A few days later the company Akamai gave up. To protect other customers, it brought out KrebsOnSecurity.com from under its protection.

      The attack began on the evening of Tuesday September 20. Initially, it had no effect thanks to the operational work of Akamai engineers. Traffic was filtered out, but experts Akamai have admitted that this attack was almost twice as powerful as the biggest DDoS ‘ and what they saw in life. And probably one of the biggest in the history of the Internet in general.

      September 20 at 20:00 the flow of garbage traffic reached 620 GB/s. This is more than enough to drop any website. Up to this maximum DDoS -ttack on Akamai resources was 363 Gbit/s.

      DDoS was not organized by the standard method with amplification of queries through DNS servers. Instead, most of the traffic consisted of packets of data generic routing encapsulation (GRE). Communication protocol GRE is used to establish direct P2-connections between network nodes. Such a large amount of traffic surprised the experts – it is not entirely clear hot the amplification is carried out. If amplification was not, it turns out that the attacker used to attack hundreds of thousands of infected machines. It’s some kind of record botnet. Perhaps it consists of IoT devices such as routers, IP-cameras and digital consoles (DVR).

      Brian Krebs is not offended by Akamai. For four years they are many times together with a subsidiary firm Prolexic protect it from DDoS-attacks. Just the current DDoS was too large. When it became obvious that the attack will affect other customers, the company Akamai in advance on September 21 at 16:00 warned Brian Krebs that he has two hours to go to another network, and at 18:00 they remove the protection.

      The company’s management later explained that otherwise the reflection of such an attack would cause them loss of millions of dollars. Perhaps the head is a bit exaggerated, but in fact protect against attacks of this scale really worth from $100 thousand to $150 thousand per year. They always defended Krebs for free.

      In order not to fail their host, the journalist asked to redirect all traffic to 127.0.0.1, and he tried to use the services of Project Shield — Google’s charity project, designed specifically to protect journalists from DDoS attacks. It turned out that this is ideal, so that on 25 September the site was back online and still works flawlessly.

      These events pushed Brian Krebs to philosophical thoughts about the nature of Internet censorship. He recalls the famous words of businessman and libertarian John Gilmore about the impossibility of censoring the Internet. Gilmore said: “the Network recognizes censorship as damage and avoids it.” Those are some great words that have been repeatedly confirmed by life. Even now in Russia can be clearly seen how ineffective censorship of the Internet. Attempts of Roskomnadzor and other censors to block specific network resources really perceives as damage to the integrity of its structure, as an anomaly in normal operation — and offers options to work around this anomaly.

      But this principle applies only in the case of “political” censorship, which is traditionally implemented by governments of different countries, limiting free access of its citizens to information.

      In the case of a DDoS-attack, we see another example of an attempt to “gag” an opponent, to silence him. Here the state is not involved. Censorship is implemented by the coordinated efforts of many people or bots. In this sense, we can say that a DDoS-attack is a “democratic” version of censorship when the majority imposes its will on the minority and silences the opponent (of course, to a true democracy, such actions are irrelevant).

      Brian Krebs believes that currently the greatest threat of censorship are just not the toothless attempts by state officials to ban something on the Internet (officials still understand absolutely nothing about technology and are not capable of inflicting significant damage), and namely acts of experienced professionals. Underground hacker community in recent years quietly turned into a powerful transnational organization, in whose hands is concentrated the enormous computer resources. These resources under certain conditions can turn into cyber weapon.

      It is difficult to imagine that the government of any country could organize a DDoS-attack with a capacity of 600 GB/s, it’s incredible. But transnational hacker community — can. In this sense, Brian Krebs speaks of “the democratization of censorship”.

       

      This text is a translation of the article “DDoS на 600 Гбит/с как демократизация цензуры”  published by @alizar on habrahabr.ru.

      About the CleanTalk service

      CleanTalk is a cloud service to protect websites from spam bots. CleanTalk uses protection methods that are invisible to the visitors of the website. This allows you to abandon the methods of protection that require the user to prove that he is a human (captcha, question-answer etc.).

    • Vulnerabilities of CCTV systems allow hackers to create massive botnets

      Vulnerabilities of CCTV systems allow hackers to create massive botnets

      According to a statement from US-CERT, in the firmware of digital video products (DVR) AVer Information EH6108H+ found serious vulnerabilities that could allow attackers to easily get to them with remote access and even to form botnets.

      Vulnerabilities

      Security researchers have found three critical vulnerabilities. The first (CVE-2016-6535) is the presence of two hidden accounts to connect remotely. Each of them has root-rights, the password to access code written in the firmware — as a result, accounts cannot be disabled or removed from the system. As a result, an attacker who knows the IP specific camera can easily connect to it by Telnet.

      In addition, attackers can gain access to the admin panel and all without administrator passwords through an error in the authentication system (CVE-2016-6536).  To access the control panel, the hacker just need to go to the address [IP-device]/setup and choose the option “handle” — then the administrative page opens without a password. To access it, an attacker can change the device settings and even change the passwords for all users of the system.

      The third vulnerability (CVE-2016-6537) leads to the disclosure of confidential information — the problem occurs because of an error in the mechanism of processing user credentials.

      How to be protected

      According to a statement from US-CERT, at the moment there are no patches to fix discovered vulnerabilities. Manufacturer of AVer firmware on its website describes it as “no longer supported” (discontinued).

      The only effective way to prevent the attack using these holes is to limit access to devices through a firewall or network hardware setup.

      The extent of the problem

      The presence of simple-to-use vulnerabilities and “backdoors” in DVR devices is not news. Previously, Positive Technologies experts have found critical vulnerabilities and the so-called “master passwords” that allow attackers to easily get access to these devices, hundreds of thousands of which are available from the Internet. For example, problems have been found in video surveillance systems Samsung, as well as popular firmware DVR-systems used by many vendors.

      Also, not so long ago it became known that the worm BASHLITE were infected more than 1 million DVR devices — attackers formed them into botnets for DDoS attacks.

      Also earlier this year, researchers from the company Sucuri found the botnet of 25,000 Internet connected devices for video surveillance. In addition, the botnet to conduct DDoS attacks, consisting of infected Webcams was found by specialists from the Security Engineering and Response Team of the company Arbor (ASERT).

      It is important to understand that the attackers often do not need to apply a much effort to detect gaps in the protection of surveillance systems, because, as a rule, they contain the vulnerabilities which are very primitive.

      The situation is aggravated by the fact that the manufacturers of DVR-system often not themselves fully create firmware for their devices, and use third-party development. Such firmware can be distributed in various dubious ways, potentially, they may contain a hidden undocumented logic, about which manufacturers of the final DVR cannot know nothing at all.

      For example, our experts discovered vulnerabilities present in the popular firmware, which was used in its own way and complements many of the DVR manufacturers. Accordingly, vulnerabilities in these firmwares endanger a lot of different devices from different manufacturers.

      However, many manufacturers do not pay enough attention to release updates and develop mechanisms to centrally deploy them on end-devices or user notifications. In the case of using firmware third party, the remediation process becomes more complicated: in such cases, the manufacturer of the DVR cannot fully control the firmware and not be able to change it.

      For example, with one of the producers of such a popular and vulnerable firmware, we have not been able to establish contact, so they can correct any problems found. More detailed information was provided in the report at the forum Positive Hack Days III:

      Vulnerabilities and hacking DVR devices are a serious threat to private companies. With access to the CCTV system, the attacker can use them as a springboard for further attacks invisible within the network of the company (APT). The typical remedies that are used in companies are often unable to detect such penetration (e.g., the classic antivirus approach is powerless here).

      In fact, in the corporate network appears malicious device – a minicomputer, inside of which an attacker could install their software. Backdoor in such devices can be very long and imperceptible to exist.

      What to do

      In order to protect themselves, experts Positive Technologies advise to isolate access to digital video systems from the Internet (for example, the settings of the router and/or firewall). It is desirable for devices from the internal network to limit access to the DVR and give access to only those addresses, which it definitely needed (e.g., administrators only). And similarly to limit the network access of the DVR, giving him access only to the desired locations. It is best to place these devices in a separate isolated network.

      In general, with the development of “Internet of things” opportunities for the creation of such botnets increase significantly, many new gadgets are developed and delivered to market without any regard for safety (on the contrary: connection schemes to the Internet are simplified as much as possible). In this situation, we can advise private individuals and companies to be more selective in the purchase of equipment and to carry out the security analysis of new devices.

      Identifying botnets and investigating incidents is also more complicated when the infected are not personal computers, and many automated systems, the behavior of which no one is watching.

      This text is a translation of the article “Уязвимости систем видеонаблюдения позволяют хакерам создавать масштабные ботнеты”  published by @ptsecurity on habrahabr.ru.

      About the CleanTalk service

      CleanTalk is a cloud service to protect websites from spam bots. CleanTalk uses protection methods that are invisible to the visitors of the website. This allows you to abandon the methods of protection that require the user to prove that he is a human (captcha, question-answer etc.).

    • How to protect a Linux system: 10 tips

      How to protect a Linux system: 10 tips

      At the annual LinuxCon conference in 2015 the Creator of the GNU/Linux core Linus Torvalds has shared his opinion about the safety of the system. He stressed the need to mitigate the effect of the presence of certain bugs by competent protection order in violation of one component to the next layer overlaps the problem.

      In this article we will try to uncover this subject from a practical point of view:

      • start with the presets and recommendations for choosing and installing Linux distributions;
      • then talk about simple and effective item of protection — security update;
      • next, consider how to set restrictions for programs and users.
      • how to secure the connection to the server via SSH;
      • we give some examples of configuring firewall and limit unwanted traffic;
      • in the concluding part will explain how to disable unnecessary programs and services, as further to protect the servers from intruders.

      1. To configure the environment preloading before installing Linux

      Take care of the security of the system is necessary before installing Linux. Here is a set of recommendations for the settings of the computer, which should be considered and executed before the installation of the operating system:

      • Booting in UEFI mode (not legacy BIOS –a sub-section of it below)
      • Set a password on the UEFI setup
      • Activate SecureBoot mode
      • Set a password on UEFI level to boot the system

      1. Select the appropriate Linux distribution

      Most likely, you will choose popular distributions — Fedora, Ubuntu, Arch, Debian, or other similar branches. In any case, you need to consider the obligatory presence of these functions:

      • Support of forced (MAC) and role-based access control (RBAC): SELinux/AppArmor/GrSecurity
      • Publication of security bulletins
      • Regular release of security updates
      • Cryptographic verification of packages
      • Support for UEFI and SecureBoot
      • Support of full native disk encryption

      Recommendations for installing distributions

      All distributions are different, but there are moments that are worth to pay attention and perform:

      • Use full disk encryption (LUKS) with reliable key phrase
      • The process of paging needs to be encrypted
      • Set a password for editing the boot-loader
      • Reliable password on root access
      • Use an account without the privileges, belongs to the group of administrators
      • Set for user a strong password different from the password for root

      1. Set up automatic security updates

      One of the main ways to ensure the safety of the operating system – to update the software. Updates often fix found bugs and critical vulnerabilities.

      In the case of server systems, there is the risk of failure during the upgrade, but, in our opinion, problems can be minimized if automatically install only security update.

      Auto-update works only for installed from the repositories, not compiled independently packages:

      • In Debian/Ubuntu for updates use the package unattended upgrades
      • In CentOS to auto-update use yum-cron
      • In Fedora for these purposes there is the dnf-automatic

      To upgrade, use any of the available RPM-managers of packages by commands:

      yum update

      or

      apt-get update && apt-get upgrade

      Linux can be configured to send notifications of new updates by email.

      Also , to maintain the security of the Linux core there are protective extensions, e.g. SELinux. This extension will help keep the system from incorrectly configured or dangerous programs.

      SELinux is a flexible system of forced access control, which can work simultaneously with selective access control system. Running programs are allowed to access files, sockets and other processes, and SELinux sets limits so that harmful applications are unable to break the system.

      1. Limit access to external systems

      Next after the update method of protection is to limit access to external services. For this you need to edit the file /etc/hosts.allow and /etc/hosts.deny.

      Here is an example of how to restrict access to telnet and ftp:

      In file /etc/hosts.allow:

      hosts.allow in.telnetd: 123.12.41., 126.27.18., .mydomain.name, .another.name  
in.ftpd: 123.12.41., 126.27.18., .mydomain.name, .another.name

      Example of the above will allow you to perform telnet and ftp connections to any host in IP-classes 123.12.41.* and 126.27.18.*, and also the host with the domain mydomain.name and another.name.

      Next, in file /etc/hosts.deny’:

      hosts.deny 
in.telnetd: ALL 
in.ftpd: ALL

      Adding a user with limited rights

      We do not recommend to connect to the server as root user — it has the right to run any commands, even critical to the system. Therefore, it is better to create user with restricted rights and work through it. Administration can be performed through sudo (substitute user and do) – this is a temporary elevation to administrator level.

      How to create a new user:

      In Debian and Ubuntu:

      Create a user, replacing administrator with the desired name and specify the password in response to the request.  Input password characters are not displayed it the command line:

      adduser administrator

      Add the user to the sudo group:

      adduser administrator sudo

      Now you can use the prefix sudo when executing commands that require administrator rights, for example:

      sudo apt-get install htop

      In CentOS and Fedora:

      Create a user, replacing administrator with your desired name, and create a password for his account:

      useradd adminstrator && passwd administrator

      Add the user to the group wheel for the transfer of the rights sudo:

      usermod –aG wheel administrator

      Use only strong passwords — minimum of 8 letters of the different register, digits and other special characters. To search for weak passwords among users of your server, use the utilities as “John the ripper”, change the settings in file pam_cracklib.so to set passwords forcibly.

      Set the expiration period of the password with the command chage:

      chage -M 60 -m 7 -W 7 UserName

      Disable password aging with the command:

      chage -M 99999 UserName

      Find out when a user’s password will expire:

      chage -l UserName

      Also, you can edit the fields in the file /etc/shadow:

      {UserName}:{password}:{lastpasswdchanged}:{Minimum_days}:{Maximum_days}:{Warn}:{Inactive}:{Expire}:

      where

      • Minimum_days: the Minimum number of days before the expiration of the password.
      • Maximum_days: the Maximum number of days before password expiration.
      • Warn: Number of days before expiration when the user will be warned of the approaching day shift.
      • Expire: the exact date of the expiration of the login.

      Also it is necessary to limit reuse of old passwords in module pam_unix.so to set a limit on the number of failed login attempts of the user.

      To see the number of failed login attempts:

      faillog

      Unblock account after failed login:

      faillog -r -u UserName

      To lock and unlock accounts, you can use the command passwd:

      lock account

passwd -l UserName
      unlocak account

passwd -u UserName

      To make sure that all users set passwords with the command:

      awk -F: '($2 == "") {print}' /etc/shadow

      To block users without passwords:

      passwd -l UserName

      Make sure that the UID parameter was set to 0 only for root account. Enter this command to see all users with UID equal to 0.

      awk -F: '($3 == "0") {print}' /etc/passwd

      You should see only:

      root:x:0:0:root:/root:/bin/bash

      If there are other lines, then check whether you have installed for them UID to 0, delete unnecessary lines.

      1. Set access rights for users

      After you install the password is worth to make sure that all users have access appropriate to their rank and responsibility. In Linux you can set access permissions on files and directories. So there is the ability to create and control different levels of access for different users.

      Access categories

      Linux is based on work with multiple users, so each file belongs to one specific user. Even if the server is administered by one person for various programs created multiple accounts.

      To view users in the system with the command:

      cat /etc/passwd

      The file /etc/passwd contains a line for each user of the operating system. Under services and applications can be created separate users who will also be present in this file.

      In addition to the individual accounts there is a category of access for groups. Each file belongs to one group. One user can belong to several groups.

      View the groups to which belongs your account, use the command:

      groups

      Display a list of all groups in the system, where the first field indicates the name of the group:

      cat /etc/group

      There is a category of access “other”, if the user does not have access to the file and does not belong to the group.

      Types of access

      For categories of users there is the ability to set types of access. Usually it’s right to run, read and modify the file. In Linux, access types are marked by two types of notations: alphabetic and octal.

      In alphabetic notation, permissions are indicated by letters:

      r = reading

      w = change

      x = start

      In octal notation the level of access to files is determined by the numbers from 0 to 7, where 0 indicates no access, and 7 means full access to modify, read and execute:

      4 = read

      2 = change

      1 = start

      1. Use the keys to connect via SSH

      To connect to the host via SSH is usually used password authentication. We recommend a more secure way – input  a pair of cryptographic keys. In this case, the private key is used instead of a password, which will seriously complicate the selection by brute-force.

      For example, let’s create a key pair. Actions should be performed on the local computer, not on a remote server. In the process of key generation you can specify a password to access them. If you leave this field blank, you will not be able to use the generated keys to store them in keychain-manager of the computer.

      If you have already created the RSA keys before, then skip command generation. To check the existing keys for a start:

      ls ~/.ssh/id_rsa*

      To generate new keys:

      ssh-keygen –b 4096

      Download of the public key to the server

      Replace administrator with the name of the key owner, and 1.1.1.1 with the ip-address of your server. From the local computer, type:

      ssh-copy-id administrator@1.1.1.1

      To test the connection, disconnect and re-connect to server — login must occur with the created keys.

      Setting up SSH

      You can disable connect via SSH as root-user, and to obtain administrator rights to use sudo at the beginning of the command. On the server in the file /etc/ssh/sshd_config you need to find the parameter PermitRootLogin and set the value to no.

      You can also deny SSH connection by entering the password so that all users use keys. In the file /etc/ssh/sshd_config, set for parameter PasswordAuthentification value no. If this line doesn’t exist or it is commented out, respectively, add or uncomment it.

      In Debian or Ubuntu you can enter:

      nano /etc/ssh/sshd_config

... PasswordAuthentication no

      The connection can also additionally secure with two-factor authentication.

      1. Install firewalls

      Recently was discovered a new vulnerability, allowing to carry out DDoS attacks on servers running Linux. A bug in the core system came with version 3.6 at the end of 2012. The vulnerability allows the hackers to embed viruses into boot files, web page and open up the Tor-connection, with no need for hacking a lot of effort to make — work the IP-spoofing method.

      Maximum damage for encrypted HTTPS connection or SSH – termination of the connection, but in the unsecured traffic, the attacker can put new content, including malware. To protect against such attacks is suitable firewall.

      Block access using Firewall

      Firewall is one of the most important tools for blocking unwanted incoming traffic. We recommend you to skip only really need the traffic and fully deny all the rest.

      To filter packages in most Linux distributions there is iptables controller. Usually it is used by advanced users, and to simplify configuration, you can use utilities UFW on Debian/Ubuntu or FirewallD in Fedora.

      1. Disable unnecessary services

      Experts from the University of Virginia recommend to disable all services that you don’t use. Some background processes installed on the startup and operate to shutdown the system. To configure these programs, you need to check the initialization scripts. Starting services can be done using inetd or xinetd.

      If your system is configured with inetd, in the file /etc/inetd.conf you can edit the list of background programs “demons”, to disable startup of service enough to put in the beginning of the line the sign “#”, turning it from the executable to comment.

      If the system uses xinetd, its configuration will be in the directory /etc/xinetd.d. Every file in the directory defines a service, which can be disabled by specifying the item disable = yes, as in this example:

      service finger

{

socket_type = stream

wait = no

user = nobody

server = /usr/sbin/in.fingerd

disable = yes }

      Also worth checking out an  ongoing processes that are not managed by inetd or xinetd. To configure the startup scripts in the directories /etc/init.d or /etc/inittab. After done the changes, run the command under root account.

      /etc/rc.d/init.d/inet restart

      9.Protect the server physically

      It is impossible to completely defend against malicious attacks with physical access to the server. It is therefore necessary to protect the premises where your system is located. The data centers seriously monitor the safety, restrict access to servers, install security cameras and assign permanent guards.

      To enter the data center all visitors must pass certain stages of authentication. Also, it is strongly recommended to use motion sensors in all areas of the centre.

      1. To protect the server from unauthorized access

      System of unauthorized access or IDS collects data about system configuration and files, and further compares these data with the new changes to determine whether they are harmful for the system.

      For example, tools Tripwire and Aide collected a database of system files and protect them with a set of keys. Psad is used to track suspicious activity by using reports firewall.

      Bro is created for network monitoring, tracking suspicious schemes of actions, collection of statistics, perform system commands, and generating alerts. RKHunter can be used to protect from viruses, most rootkits. This utility checks your system by database of known vulnerabilities and can identify unsafe settings it applications.

      Conclusion

      The above tools and settings will help you to partially protect the system, but safety depends on your behavior and understanding of the situation. Without care, caution and constant self learning all the safety measures might not work.

      This text is a translation of the article “Как обезопасить Linux-систему: 10 советов”  published by @1cloud on habrahabr.ru.

      About the CleanTalk service

      CleanTalk is a cloud service to protect websites from spam bots. CleanTalk uses protection methods that are invisible to the visitors of the website. This allows you to abandon the methods of protection that require the user to prove that he is a human (captcha, question-answer etc.).

    • How to reduce a possibility of brute force attacks on WordPress

      How to reduce a possibility of brute force attacks on WordPress

      Until the moment when CleanTalk launched a security plugin, I didn’t pay much attention to the security of the admin account of WordPress and relied only on the complexity of the password.

      The most dangerous thing is when the bots use brute-force; pick up the password to the administrator account of the site. This can lead to very serious problems, as the attacker gets full access to the administrator account. On your website can be added malicious code, the site can be added to a botnet and participate in other attacks or the spread of viruses. The consequences for the reputation can be very sad.

      When the security plugin was launched I began to receive reports on the work of the plugin in which specify the statistics of failed login attempts to the admin account of WordPress. And for each day of such attempts was from 4 to 25, from different IP addresses. These were attempts of bots password guessing.

      What I noticed:

      1. Bots knew my login and password was selected to it.
      2. I do not use the default username Admin and changed it.
      3. In the blog there are other admin accounts, but attempts to break them for a few days of observation did not happen.

      Wondering how the bots found out my account and why not try to hack other accounts of administrators? Quite simply, under my account I place posts and write comments, and other accounts are made for employees, host and other people that perform actions only in the dashboard of the website.

      Based on this, I realized that the bots find out the login via the parsing of pages. Many publish posts and comments from the admin account.

      For example, you publish a blog post; the link to the author will be like this http://example.com/author/admin***/. Bots browsing the code of your website looking for recordings of this type on all pages of the website and collect links from all accounts.

      The same thing will happen if you write a comment from the admin account, only the link will be a bit of a different kind http://example.com/members/admin***/

      Even if you once published a post or comment from admin account, then the bots will find it and will try to crack it.

      I described one of the possible scenarios of obtaining a list of accounts for hacking, there may be others. But experience has shown that if the WordPress administrator account is not used for publications and comments on the website, its bots do not know.

      What to do in order to minimize the possibility of hacking the account of the administrator of the website.

      1. Not to publish posts and comments from the administrator account.
      2. Create an account for each administrator with another role such as Author or Editor. It all depends on your needs.
      3. Change the current administrator user. Attention! Before that, you need to backup your website and databases. I can’t recommend this and if you do this at your own risk, as this may lead to undesirable consequences.

      You will need to create a new user with administrator rights and a user with another role such as Author. Login to the dashboard with the new account and test the capabilities of the Administrator to manage site, settings and users.

      Go to the “Users” and delete the previous admin account, WordPress will ask you to whom to reassign the articles and comments, here is useful pre-created user Author. Reassign articles on it and in the future use to publish posts and comments.

      These actions can be done for other accounts administrators. But for most WordPress users would rather to install one of the plugins for protection from brute-force attacks, such as plugin Security & Firewall from CleanTalk.