RHCSA Howto ... Tips and Tricks - Episode 1

Introduction

As I recently started to study to improve my knowledge in Red Hat Enterprise Linux (RHEL), I thought it was a good idea to use the Blog like a notepad where I will write information on the topics of the certification, links to external websites which provide tutorials and whatever matters with the topic!

The RHCSA certification is the introductory Red Hat System Administrator certification and a mandatory step for the Red Hat Certified Engineer (RHCE) certification.

As the topic are subject to change by Red Hat, if you want to take my same journey, I suggest you to check the following link and print-out the "Study Point".

At the moment of writing this post (July 2017), the topics are divided into the following chapters:

• Understand and use essential tools
• Operate running systems
• Configure local storage
• Create and configure file systems
• Deploy, configure, and maintain systems
• Manage users and groups
• Manage security

As written at the end of the webpage of the mentioned Red Hat link, quote "Red Hat reserves the right to add, modify, and remove objectives. Such changes will be made public in advance through revisions to this document" ... unfortunately there is no "revision number" in the document itself so ... check the document multiple times during the preparation.

I would not suggest to take this certification journey if you don't already have a couple of year of experience with Linux! You will possibly waste time and money and this certification is not cheap... currently the exam cost around 470£ + VAT ... quite expensive!

Training Material

After downloading the topic list you need to figure out where to get information, which training material to study, which books, videos ...
I love Linux for many reasons, one is that you can find so many information for free. Perhaps when it comes to a certification, in my opinion you need to have an official certification guide: this will help you to divide and conquer each topic, have a set of exercises and labs and have one or more exam simulation to verify if what you learnt is enough to pass the exam or if you need to review any topic.

I have been able to review several books (thanks to some friends) and the one I found perfect for my study-style is:
Cert Guide - Red Hat RHCSA/RHCE 7 - by Sander Van Vugt

As I like to read the same topic from different authors I am using these other books as well:

The Linux Bible - Ninth Edition - by Christopher Negus
which is a good "comprehensive" book full of tutorials and resources.

How Linux works, what every superuser should know - by Brian Ward
more about troubleshooting but with interesting information even for a System Admin

Note: I don't have any interest/profit by mentioning the above books but I found good to suggest them and promote the authors work.

As you will read on all the books, for any command you will come across during your journey, you should have a proper look to the man page and to the info page (if any): these resources will be the only one available to you during the exam ... so better to know how to use it to your advantage!!

Lab and first experiences

That's the first step! What Sander suggest is to create 3 virtual environments:

• server with CLI
• server with GUI
• server for LDAP authentication and other shared services

You can create an account and download the official Red Hat 7 image and then create the 3 VMs or, more simply, download CentOS 7. At the moment of writing (July 2017) it seems like the exam will focus on versions 7.1 and 7.2 of Red Hat Enterprise Linux. You can use CentOS with the same version number as basically CentOS is a Red Hat Enterprise "stripped of the Red Hat" logo.
So what is the difference between Red Hat and CentOS and why companies are paying for Red Hat? When it comes to the ISO, the same versions of the 2 distribution has the same packages version and pretty similar configurations; they are basically interchangeable.
When it comes to apply patches, CentOS provides free access to its repositories while to get access to Red Hat you need to pay an annual fee. The fee does not entitle you only to get access to the repository but also to get free high quality, 24H 7/7 365 support! That's the main difference ... an enterprise level support which will take care of providing you quick and expert answer to your queries.
So, setup your VMs and start to play around with the basics! If you already have a Linux machine running CentOS you may find useful to read my post about deployment of VM using KVM.

In my next post I will focus on the objective of the first chapter "Understand and use essential tools":

• access a shell prompt and issue commands with correct syntax
• use input-output redirection
• use grep and regular expression to analyze text
• access remote system using ssh
• log in and switch users in multiuser targets
• archive, compress, unpack, and uncompress files using tar, star, gzip and bzip2
• create and edit text files
• create, delete, copy, and move files and directories
• create hard and soft links
• list, set, and change standard ugo/rwx permissions
• locate, read and use system documentation including man, info and files in /usr/share/doc

In the post I will introduce the commands that you need to know focusing on the tasks which maybe required in the exam.

Recommendations

If you decide to take a journey into a certification the most common recommendation is to schedule your study activities and have a target day for the exam! There is no better recommendation. I know that sometimes life and work does not help to keep you on track but without any target milestone you will never meet the desired result!
Please feel free to add comments; they may be helpful for other geek who would like to learn the topic! I hope you enjoyed reading this post.
Stay tuned!

Study of a ransomware: how does it work ?

Hi all!
In this article we would like to explain what is a Ransomware and how they infect systems.
We hope you will enjoy reading the post. If you have any question or comments, feel free to write and we will try to reply as soon as possible!
Let's start by defining what is a Ransomware.

Introduction

A ransomware as defined by Wikipedia is "a type of malicious software that threatens to publish the victim's data or perpetually block access to it unless a ransom is paid."

A ransomware is technically made of a malware which encrypt the data; the malware can be delivered to the system in many different ways (for example through a Trojan).
If the malware is well written there is really low chance to be able to decrypt the data without having the encryption key.
The ransom is usally paid through digital currencies such as bitcoin. In this way it is almost impossible to trace who is going to receive the transaction.

Infamous Ransomwares

To start with a bit of story, you may have read about CryptoLocker and CryptoWall. The first was a Ransomware which happeared at the end of 2013 and made companies pay a total of about 3 Milion $ before it was stopped (May 2014).
CryptoWall is a Trojan ransomware which infected systems during 2014. In the same year the owners of infected systems payd an estimated amount of about $18m to get the decryption keys.

How it works

Like the TCP handshake, the ransomware operate in 3 steps:

1. The attacker generate a key pair (asymmetric key) and place the public key in the malware. The malware is deployed using different "media" such as trojan, email spam, infected websites...
2. On the victim system, the malware generate a random symmetric key and encrypts victim's data with it. The symmetric key is then encrypted using the public key. Only the private key which was generated in the key pair (step 1) is capable of decrypting the symmetric key!! At the end of process 2, the victim will have selected data encrypted with the random symmetric key and the same key encrypted with the asymmetric key (step 1): this is call hybrid encryption. The symmetric key and the original "not encrypted" data are deleted (with "proper" processes). The victim is informed of the attack with a message of some form, which provide the cyphertext (encrypted using the public key of the key pair) and information about how to pay the ransom.
3. The criminal receive the ransom (normally through digital currencies) and the cyphertext. The cyphertext is decrypted using the attacker private key (of the original key pair). The decrypted cyphertext is the "symmetrical key" created at point 2. The attacker send the symmetric key to the victim which can decrypt the data.

It is interesting to know that in literature you will find "3 steps of a ransomware attack", "5 phases of a cyber attack", "6 Phases of a Ransomware Attack"... whatever the number, the above is a good short explanation of how the attack happens.

This is an example of a message which the malware will display to the victim (from the infamous Wanna Cry ransomware):

As you can see in the picture, the victim is intimidated to pay before the time runs out, otherwise the attacker will delete the his private key!

The malware can be design to target an OS or to be specific against a particular product or solution such as the NAS produced by Synology (August 2014) or a ransomware built to target Linux-based web server (January 2015).

Within Windows, most of modern ransomware are taking advantage of PowerShell for their attacks. Clearly this show that PowerShell is somehow not a secure environment compare to Bash (one point for Linux!).

Apart from the malware itself, there are 2 major factors that helps the ransomware threat to grow: the development of BitCoin and of the DarkNet. The first allow to deliver the ransom with an almost impossible to trace transaction. The DarkNet through Tor services allows ransomware to communicate with their command centre. With the two it is almost impossible to trace the origin of the attack.

Reverse Engineering Malware

While the best protection from a ransomware attack is maintaining a backup of your valuable information (data), researchers are fighting a war to develop defences against the attack and to analyse the malware to find way to stop it and to eventually decrypt the victim's files.
We are not going to duplicate the effort of experts and write a tutorial about this difficult discipline which involves several competences. If you are interested in how researchers do reverse engineering against a malware I would suggest you to follow this link. It is from Lenny Zeltser's website. He is a guru in cyber security!

Conclusion

We hope you enjoyed reading this post and we welcome your comments. Share the post if you liked it and follow us!

How to become an hacker !

It is interesting how many times since I started this blog I came into "Cyber security" forum where the predominant questions were:

1.  How do I become a hacker
2. Which computer languages do I need to learn?
3. Which are the steps to become a Security Expert

In this post, I am going to try to answers to these questions. I will open other questions, which I will answer in my following posts.

Let me know your opinion.

Operating Systems

For sure the starting point, if you are green on IT is knowing how a PC works, how it does boot, the BIOS/UEFI, the boot sectors and the different type of partitions and bootloaders.

You should not focus on a specific OS, perhaps at this stage. There are loads of websites that provide free training and free PDF.

Windows 7 & Windows 10

In my opinion, the best way to learn an OS is by installing it on your PC. If you are still "green" than you should start with a "desktop" OS such as Windows 7 or Windows 10.

It is possible to get trial licenses directly from Microsoft. Just create an account, go into the download area and search for trial licenses. The best way is to create an acocunt under "TechNet":

Microsoft Technet

Then you can click on "Downloads", select the OS you wish to try and click on Evaluation. You need to further register but at the end you can download a fully functional ISO which will allow you to install the product and use it without limitation for 90 days... and 90 days are enough to follow a basic/intermediate training (2 weeks) and then do some more advanced "stuff"!!

I am not a Micorsoft "guy" but I can tell you that Technet website is good, with a lot of information.

Now that you have the ISO, you need to find a good training website. For Windows 10 I would suggest to have a look at this tutorial:

How to use windows 10

Linux

That's my area! Learning Linux is not difficult, especially if you don't have any IT knowledge at all! If otherwise you are a GUI-guy then you should have more problem; but when you will discover the power of Bash ... nothing will stop you anymore.

So, you want to learn Linux; that's come free, forever! Just download a distribution (collection of the OS kernel and free softwares) and install it on your computer.

Now you should be good enough to do an installation within a VM (Virtual Machine). In this way you will be able to mess-up your system as much as you want and restart from a working snapshot.

I am not going to explain you how to create and work with a VM (it is out of the scope of this article), but you can have a look at this link:

How to install Linux on your Windows using Virtual Box

Which distribution to use... this is an easy question!! Easy because all the Linux distros are based upon the same Kernel (Linux kernel) and a similar set of tools (utilities). Hence if you want to learn the command line (learn the hard way), any distros is good for you.

You do not need any fancy GUI interface; most of the servers does not use a Graphical User Interface at all.

Perhaps, one of the most used server distribution is RedHat Enterprise Linux (RHEL) so similar distributions maybe the right starting point: CentOS, Scientific Linux, Fedora.

Personally, I use CentOS 7 on my Laptop and on several VM which I use to make tests.

You may find a good training (basic training) at this link:

Introduction to linux

The Linux Foundation sposnsors it (with a brief video introduction by Linus Torvalds). I followed that training years ago as a refresh of my knowledge, just before starting a position as Tech Support, which required the use of Linux CLI commands. I highly suggest you to follow the training, complete the proposed exercises, and after that search for "The Linux Bible" book. It is a good intermediate level training manual which you can use to increase your knowledge quite a bit.

Networking

If you completed the above steps (which requires you quite some time if you are studying after working hours), you should already have learnt a basic knowledge of Networking. That's not enough if you want to follow the road to Cyber Security Success!!

I followed a 1-year training course in Milan, Italy (eForHum) and got Cisco CCNA certification. That is just an example of training that you need to follow to have a basic knowledge about ISO Layers, IPv4, IPv6, switching and routing protocols and finally Cisco CLI commands.

It has been useful in all my following working experiences, especially now working within a Telco company.

Another good training to follow is the one that brings you to get CompTIA Network+. You may find a good training course if you join Cybrary.it

Computer Languages

Knowing computer languages is possibly the hardest step to achieve in the "growing as an hacker" learning curve.

If you studied Linux, you should have come into Bash and you possibly had some scripting experiences with it. Anyhow, I would suggest you to learn it really well together with the regular expressions (which are used by tools such as grep, awk and sed).

Another language you should be able at least to "read" is Python. If you are going to do reverse engineering of malware, possibly you need to have a background in C/C++ as well.

Any Linux distro provide free environment and IDE to practice these languages. Again the best way to start is by following a basic/intermediate training with loads of Labs ... practice practice practice !!
As suggested by +Mike Barton a good understanding of the Assembly language is quote "very important and not only for reverse engineering but for very tight code".
Perhaps writing good code is something missing in this days!

Continuous Learning

To complete the post, I would like to suggest the beginner (and the expert as well) to keep studying! Learn how the "black hat" are doing their dirty activities by reading forums.

A good way to be always updated is by creating a Google Alerts, which is a Google tool to be able to have Google posting you with a periodicity you may specify, articles related to a selected topic.

The Security world is made of several "chapters" such as Physical Security, Network Security, System Security...

Every Security Expert should have a basic knowledge of all the topics and be expert on a few ! So you should study the training material related to some entry level Security certification such as CompTIA Security+ or Certified Ethical Hacker.

Conclusion

Continuous studying and practice practice practice!!

Don't do dummy things such as trying the available tools without authorization against Networks and Systems you don't own!!

Enjoy every moment of the study, share your knowledge and be always positive.