Malware, Solaris, Cisco, Firewall, Security Links and Resources
Malware Resources
Enterprise Adware Detection: Detecting Spyware Infections on a Corporate Network
Spyware and adware infections on corporate networks is a problem which is only increasing. This paper briefly describes
the role that Browser Helper Objects (BHOs) play in spyware and adware infections. It also announces a
new free (Open-Source)
remote malware scanner which scans a corporate network for spyware infections by
scanning remote registries for the presence of unauthorized BHOs.
It is the author's hope that by running this remote BHO scanner, spyware and adware installed
on a users' desktop may be identified early in the infection cycle, before the machine is completely infested with multiple types of malware and dozens of new registry entries and startup items.
By identfying malware that been installed on a corporate desktop, steps
can also be taken to prevent other machines from becoming infected as well.
Securing Solaris 8
with an emphasis on Solaris Packages, Software Groups, Metaclusters
Securing a Solaris Box
- Install Minimal OS:
- Patch the system:
- Harden the System:
- Run hardening tools such as Titan or YASSP, JASS Toolkit
or harden OS manually
-
Uninstall unnecessary packages

This article, written by us, examines the packages installed with the SUNWCreq "core" installation of Solaris, and contains a meta-analysis of which packages the experts suggest you remove on a server destined to be a firewall.
- Disable unneeded startup services, modify and add others:
An analysis of Solaris 8 Startup Files: This paper lists each Solaris startup file along with the package which installed it.
- Modify files in /etc (including /etc/default/*, most /etc/*.conf, /etc/system and others)
- Delete unneeded accounts and cron permissions
- Change network settings:
- and much more....
--Follow checklists such as--
- Install Sysadmin Tools:
-
Run Security Audit/Vulnerability Assessment Scans/Penetration Tests (or whatever buzzword you wish to use):
- Open Source:
nessus, nmap,
whisker, SAINT,
sara,
Boran's audit2.pl,
http://www.cisecurity.org/-Center for Internet Security,
WhiteHat Arsenal
- Scan from the outside (also tests your firewall, inform your firewall/IDT admin first!):
-
http://www.vulnerabilities.org/nessusfreehtml.html
Commercial Products:
Cisco Secure Scanner (netsonar), Retina, ISS
CyberCop Scanner
http://www.securityspace.com
- Establish system audit/profile:
- Run commands such as:
/usr/platform/sun4u/sbin/prtdiag -v
Displays system configuration and diagnostic information, and lists any failed Field Replaceable Units (FRU).
/usr/bin/showrev [-p] Displays revision information for the current hardware and software. When used with the -p option, displays installed patches.
/usr/sbin/prtconf Displays system configuration information.
/usr/sbin/psrinfo -v Displays CPU information, including clock speed.
Run System Profiling Software:Don't forget about disk information under the control of Disksuite or Veritas....
Run Network profile (goal is to should show as few listening ports as possible):
- Run the following commands(More Information):
netstat -an | grep LISTEN"
lsof -i | egrep 'COMMAND|LISTEN|Idle'
rpcinfo -p
- Run
This Script from sunsolve to show all active tcp connections
Monitor the System
Run Host-Based IDS:(Mentioned earlier, but it's important enough to repeat)
Stay Current
Cisco Router Resources:
Other Goodies:
- Network Intrusion Detection:
- Distributed Intrusion Detection:
- HoneyNets:
- Track down the intruders (or spammers):
- If this will be a fw1 server:
- IIS Headaches
- Unix Security (Tried on Red Hat, should work on most others):
Note: Some items are mentioned more than once because they fall into more than one category.
If you know of a resource that should be added to this list, please email us at mgmg_interactive12345@12345hotmail.com
(remove all numbers from email address).
If you find this page useful, please link to us and let us know about it!
MGMG Articles:
(C) Copyright 2002-2005 David Glosser
mgmg_interactive12345@12345hotmail.com (remove all numbers from email address).
Please read disclaimer.
About MGMG Interactive