CIT 480: Securing Computer Systems Operating System Security CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems Topics OS Security Features Bypassing OS Security Boot time security BIOS security System Logs CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems OS Security Features Authentication Access Control Auditing (Logging) Encryption (Filesystems) Isolation (VM) Patching (Updates) CIT 480: Securing Computer Systems

The Boot Sequence The action of loading an operating system into memory from a powered-off state is known as booting or bootstrapping. When a computer is turned on, it first executes code stored in a firmware component known as the BIOS (basic input/output system). On modern systems, the BIOS loads into memory the second-stage boot loader, which handles loading the rest of the operating system into memory and then passes control of execution to the operating system.

CIT 480: Securing Computer Systems Boot Process Detail CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems BIOS CIT 480: Securing Computer Systems

Reconfiguring Boot Media Attacker boots with their OS that ignores your ACLs CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems BIOS Passwords CIT 480: Securing Computer Systems

Removing the BIOS Password http://www.darklab.rutgers.edu/MERCURY/t15/pe2850dell.html CIT 480: Securing Computer Systems

Protecting the BIOS Password CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems Bootloader CIT 480: Securing Computer Systems

Reconfiguring the Bootloader CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems Single User Mode CIT 480: Securing Computer Systems

Single User Mode Password http://www.nextstep4it.com/categories/how-to/single-user-mode/ CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems Changing init CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems GRUB Password CIT 480: Securing Computer Systems

Hibernation Modern machines have the ability to go into a powered-off state known as hibernation. While going into hibernation, the OS stores the contents of machine’s memory into a hibernation file (such as hiberfil.sys) on disk so the computer can be quickly restored later. 1. User closes a laptop computer, putting it into hibernation. 2. Attacker copies the hiberfil.sys file to discover any unencrypted passwords that were stored in memory when the computer was put into hibernation.

CIT 480: Securing Computer Systems Cold Memory Attack http://citpsite.s3-website-us-east-1.amazonaws.com/oldsite-htdocs/memory-content/memory_3.jpg CIT 480: Securing Computer Systems

Startup Processes: Windows CIT 480: Securing Computer Systems

Startup Services: Linux CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems System Logs Logs record status and error conditions. Where do log messages come from? Kernel Accounting system System services Logging methods: Service records own logs (apache, cron). Service uses system service to manage logs. CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems Windows Event Log https://en.wikipedia.org/wiki/File:Windows_XP_Event_Viewer.png CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems Finding UNIX Logs Most logs are stored under /var/log /var/adm Check syslog's configuration /etc/syslog.conf To find other logs, read startup scripts /etc/init.d/* and manuals for services started by scripts. CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems Finding Logs Log file Program Contents messages syslog Various program/kernel logs. auth.log su, ssh, login Authorization fail/success. lastlog login, xdm Logins, commands. wtmp login Login accounting data. acct/pacct kernel UNIX process accounting. Xorg.log X-Windows X-Windows failures/info. CIT 480: Securing Computer Systems

Example Syslog Messages Feb 11 10:17:01 localhost /USR/SBIN/CRON[1971]: (root) CMD ( run-parts --report /etc/cron.hourly) Feb 11 10:37:22 localhost -- MARK -- Feb 11 10:51:11 localhost dhclient: DHCPREQUEST on eth1 to 192.168.1.1 port 67 Feb 11 10:51:11 localhost dhclient: DHCPACK from 10.42.1.1 Feb 11 10:51:11 localhost dhclient: bound to 10.42.1.55 -- renewal in 35330 seconds. Feb 11 14:37:22 localhost -- MARK -- Feb 11 14:44:21 localhost mysqld[7340]: 060211 14:44:21 /usr/sbin/mysqld: Normal shutdown Feb 12 04:46:42 localhost sshd[29093]: Address 218.38.30.101 maps to ns.thundernet.co.kr, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT! Feb 12 04:46:44 localhost sshd[29097]: Invalid user matt from ::ffff:218.38.30.101 CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems References Anderson, Security Engineering 2nd Edition, Wiley, 2008. Goodrich and Tammasia, Introduction to Computer Security, Pearson, 2011. CIT 480: Securing Computer Systems