Security Resources: Solaris, Cisco, Firewall, Anti-Malware Resources
Malware Resources
New Resource: Using Static Routes to Block Malware and Spyware
Blocking IP networks associated with spyware and malware through the use of "null routes" have traditionally been limited to corporations with network administrators. This new draft
describes an additional tool for a home or small business in the fight against spyware, a script which will "null route" IP networks on the local machine.
Centralized Spyware Detection: Detecting Malware Infections in a Corporate Environment
Malware infections on corporate networks is increasing. This paper briefly describes the role CLSIDs and Browser Helper Objects (BHOs) play in malware infections. It also announces a new
Open-Source anti-malware scanner which scans a corporate network for malware infections by
scanning remote registries for the presence of unauthorized Browser Helper Objects (BHOs).
It is this author's hope this remote spyware scanner will identify malware and adware installed
on a users' desktop (detected by the presence of an unauthorized BHO) early in the infection cycle, before the machine is completely infested with malware "crud".
By identifying which malware has been installed despite corporate
anti-malware measures taken at the firewall, router, URL-blocking proxies, and desktop, steps
can also be taken to prevent other machines from becoming infected as well.
Securing Solaris 8
With an Emphasis on Solaris Packages, Metaclusters, Software Groups
Hardening a Solaris System
- Install Minimal OS:
- Patch the system:
- Harden the System:
- Run hardening tools such as Titan or YASSP, JASS Toolkit
or harden OS manually. (Also examine Papillon)
-
Uninstall unnecessary packages
This document, written by us, examines the packages installed with the SUNWCreq "core" installation of Solaris, and contains a meta-analysis of which packages the experts suggest you remove.
- Disable unneeded startup services:

Even if you performed a minimal Solaris install, there are a bunch of startup files which need to be disabled as part of your hardening routine. This paper lists each Solaris startup file, its associated package, along with checklists and scripts to delete (and modify/add) startup files designed to increase system security.
- Modify files in /etc (including /etc/default/*,/etc/inetd.conf and other /etc/*.conf files, /etc/system and others)
- Delete unneeded accounts and cron permissions
- Change network settings:
- and much more....
--Follow checklists such as--
- Install Sysadmin Tools:
- Packet filtering software: ipfilter or
Sunscreen Light (Also: Sunscreen How-To)
- Host-based Intrusion Detection software:
-
Other Tools and Resources:
lsof,
top ,
ntop- Maybe your network is 70% appletalk and ipx....
sudo ,
tcpwrappers,(If you must run telnet),
wuftp(If you must run ftp)
logcheck(offline?)
or swatch,
sps,
webmin,
wget,
SE Toolkit,
openssh (also http://www.unixguide.net/sun/ssh_installation.shtml)
-
Visit
BigAdmin and sunfreeware
http://www.cert.org/tech_tips/security_tools.html- CERT Coordination Center's
List of Security Tools
http://www.insecure.org/tools.html- insecure.org's top 75 security tools
-
Run Security Audit/Vulnerability Assessment Scans/Penetration Tests (or whatever buzzword you wish to use):
- Open Source:
- Scan from the outside (also tests your firewall, inform your firewall/IDT admin first!):
- Install your third party software
- Establish system audit/profile:
- Run commands such as:
/usr/platform/sun4u/sbin/prtdiag -v
Displays system configuration and diagnostic information, and lists any failed Field Replaceable Units (FRU).
/usr/bin/showrev [-p] Displays revision information for the current hardware and software. When used with the -p option, displays installed patches.
/usr/sbin/prtconf Displays system configuration information.
/usr/sbin/psrinfo -v Displays CPU information, including clock speed.
Run System Documentation (System Profiling):Don't forget about disk information under the control of Disksuite or Veritas....
Run Network profile (goal is to should show as few listening ports as possible):
- Run the following commands(More Information):
netstat -an | grep LISTEN"
lsof -i | egrep 'COMMAND|LISTEN|Idle'
rpcinfo -p
- Run
This Script from sunsolve to show all active tcp connections
Monitor the System
Run Host-Based IDS:(Mentioned earlier, but it's important enough to repeat)
Stay Current
Cisco Resources
Other System Admin Tools:
- Network Intrusion Detection:
- Distributed Intrusion Detection:
- HoneyNets:
- Track down the intruders (or spammers):
- If this will be a fw1 server:
- IIS Headaches
- Securing a Linux System (Tried on Red Hat, should work on others):
- Misc Goodies
Note: Some items are mentioned more than once because they fall into more than one category.
If you know of a resource that should be added to this list, please email us at mgmg_interactive12345@12345hotmail.com
(remove all numbers from email address).
If you find this page useful, please link to us and let us know about it!
MGMG Articles:
- http://www.mgmg-interactive.com/
Solaris, Cisco, Firewall, Security Resources
- http://www.mgmg-interactive.com/packages1.html
An introduction to Solaris OS Installation options: Solaris Packages, Clusters, Software Groups
- http://www.mgmg-interactive.com/packages2.html
A meta-analysis of the extra Solaris packages that several experts suggest you should install above and beyond your OS Core Install. These packages will increase your systems's logging and auditing, and aid in your other system administration tasks.
- http://www.mgmg-interactive.com/packages3.html
An examination the packages installed with the Solaris SUNWCreq "end user" installation, and a meta-analysis of which packages the experts suggest you remove as part of the minimalization process in order to enhance system security.
http://www.mgmg-interactive.com/solaris_startup_files.html
An analysis of Solaris 8 startup files: Even if you performed a minimal Solaris install, there are a bunch of startup files which need to be disabled as part of your hardening routine. This paper lists each Solaris startup file along with its associated package, as well as checklists and scripts to delete (and modify/add) startup files designed to increase system security.
-
http://www.mgmg-interactive.com/malware.html
This paper describes the role that Browser Helper Objects (BHOs) play in malware infections and briefly outlines corporate anti-malware options. It also announces a new free
enterprise malware scanner, which scans a corporate network for spyware infections by
scanning remote registries for the presence of unauthorized Browser Helper Objects (BHOs).
(C) Copyright 2002-2007 David Glosser
mgmg_interactive12345@12345hotmail.com (remove all numbers from email address).
Please read disclaimer.
Last updated Sep 2007