Unit 4: Securing Devices

1. Types of computing devices (4.1.A)

Everyday devices with embedded computers are often called Internet of Things (IoT) devices. They run transportation, critical infrastructure such as substation breakers and water plant pumps, medical equipment such as insulin pumps, and home devices such as thermostats 4.1.A.5.

2. Malware (4.1.B)

Malware is malicious software that can damage or destroy a device or network, or give an adversary access to a device and its data 4.1.B.1. It is usually one tool in a bigger plan 4.1.B.2.

Fileless malware is different: instead of files, it is code living in random access memory (RAM) that misuses legitimate programs already installed 4.1.B.3.

YOUR FILES ARE ENCRYPTED
Documents, photos and projects on this computer can no longer be opened.
To receive the decryption key, pay within 72:00:00.
# ransomware: encrypts files, demands payment, sets a deadline [4.1.B.2]

3. How device weaknesses are exploited (4.1.C)

4. Rating device risk (4.1.D)

Device risks come from unauthorized access or malware that let an adversary impersonate a user, control the device remotely, encrypt its drive for ransom, or wipe it. The level depends on how critical the device, its services and its data are 4.1.D.1.

Rate by what could be compromised: if sensitive data or critical operations are at stake, the finding is high even when the weakness is weak authentication.

Now audit a real device report.

1. Why passwords are stored as hashes (4.2.A)

A cryptographic hash function (also called a message digest function) takes data of any length and outputs a fixed-length string called the hash (also a checksum, message digest or digest) 4.2.A.1. Well known ones: MD5; SHA-1, SHA-256 and SHA-512 (Secure Hash Algorithm); NTHash; RIPEMD-160.

An n-bit hash has 2ⁿ possible outputs but the inputs are infinite, so two inputs will eventually share a hash: a collision 4.2.A.2. Good hash functions have four properties 4.2.A.3:

If someone finds an efficient way to force collisions, the function is deprecated; MD5 and SHA-1 are examples 4.2.A.4.

Systems should never store passwords in plaintext. They store the hash; at login they hash what you typed and compare 4.2.A.5. To stop identical passwords producing identical hashes, a unique random salt is hashed with each password 4.2.A.6.

username   salt       hash
ana        9f2c      b144...f5bb
ben        71d0      aed5...2f72   # same password as ana
chen       c48a      993b...9be2

2. Password attacks (4.2.B)

If an adversary gets a legitimate user’s password and the organization has no MFA, they can act with all that user’s access 4.2.B.1.

3. Authentication factors (4.2.C)

Authentication mechanisms are technical controls that verify identity; each piece of proof is a factor 4.2.C.1.

Multifactor authentication (MFA) uses more than one factor, so it is more secure than single-factor authentication 4.2.C.6.

4. Login settings that make a device more secure (4.2.D)

Try the hashing lab below, then audit a computer’s login settings, like a junior system administrator setting up a shared desk.

1. Managerial controls for devices (4.3.A)

2. Anti-malware software (4.3.B)

Anti-malware software (sometimes called antivirus) has tools to quarantine and remove malware that can corrupt, spy on or destroy a system. Malware contains indicators that make it detectable, called signatures 4.3.B.1. The software keeps a database of signatures, periodically scans the device’s files, and quarantines and removes any file that matches 4.3.B.2.

Scanned 48,212 files   Signatures updated: today 06:00
C:\Users\Public\Downloads\invoice_scan.pdf.exe
  Match: Trojan.Agent (signature 7741)   Action: quarantined
1 threat found · 1 quarantined · removal scheduled

3. Updates and patches (4.3.C)

When a vulnerability is found in an operating system or software, the vendor fixes it and sends an update; a small update is called a patch 4.3.C.1. Keeping the operating system and applications on the newest version stops adversaries from exploiting known vulnerabilities 4.3.C.2.

4. Host-based firewalls (4.3.D)

• A host-based firewall allows or denies traffic into or out of a single device, adding a layer of protection if the device is on a compromised network 4.3.D.1.
• It is software on the device that follows an access control list (ACL): rules applied in order, first match wins, just like a network firewall 4.3.D.2.
• It can also block specified outbound traffic, and should block every port or service the device does not need 4.3.D.3. For example, a library catalog kiosk might allow outbound traffic only to the catalog server and the update server, and deny everything else.
• Rules can allow or deny by source or destination port or internet protocol (IP) address, service, protocol or application 4.3.D.4.

Audit a laptop’s host-based firewall below.

1. What devices record (4.4.A)

• Systems log processes and settings, login attempts, file downloads and user actions; logs help reconstruct what happened before and during an incident 4.4.A.1.
• An indicator of compromise (IoC) is evidence that an adversary has compromised a device or network 4.4.A.2.
• Authentication logs (auth logs) record every attempted login; analyzing them can reveal attacks 4.4.A.3.

2. Choosing device detection (4.4.B)

3. Judging a device detection method (4.4.C)

• Speed and performance: signature-based detection is faster, and the gap is bigger on devices with little processing power; heavy tools can slow the device 4.4.C.1.
• Phase of the attack: to act on a device, the adversary has already passed physical and network controls. Catching them at the device can still protect sensitive data and critical services 4.4.C.2.
• False positives versus bypass: most device tools are signature-based, with few false positives, but they are easier to bypass 4.4.C.3. Bypassing detection creates a false negative: an attack that happens without an alert. Signature-based tools miss attacks with no known signature; anomaly-based tools can catch new attacks because they look for unusual behavior instead.

4. Reading authentication logs for password attacks (4.4.D)

Now be the forensic analyst: hunt through a factory server’s authentication log.