Handling and Identifying SSL Handshake errors

SSL handshake errors can occur due to various reasons such as Self Signed certificate, unavailability of protocol or cipher suite requested by client or server, etc.  Recently I faced this issue where I was connecting to third party server using HttpClient library.  Here’s what I did to identify the cause:-

Firstly, I enabled the debug flag for SSL,handshake and failure on  javax.net packages.

-Djavax.net.debug=ssl,handshake,failure

On examining the logs, I could see that the third party site was expecting a cipher key of 256 bits and the only supported keys in my glassfish server were of 128 bits length.  As it happens,  this occurs because OOTB java 6, 7 or 8 support only 128 bit encryption keys. To enable 256 or higher bit key length , you need to download the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files which essentially contains two jars i.e US_export_policy.jar and local_policy.jar and place them in <JRE_HOME>/lib/security/ directory and restart the server to enable higher bit encryption keys.

The above step will enable  256 bit or higher bit encryption keys and will ensure that you do not face SSL Handshake errors due to key strength.

You can download the Policy files from the following links.

JCE Unlimited for java 6

JCE Unlimited for java 7

JCE Unlimited for java 8

Read More

PHLAK:Professional Hacker's Linux Assault Kit

PHLAK is a modular security distribution. It is a derivative of Morphix, created by Alex de Landgraaf. It can be used as a live cd by security professionals to perform security analysis, penetration testing, forensics, and security auditing on a system to check whether it has been compromised in terms of security.

The thing i like the most about it is that it provides one with enough security documentation to be able to help him become a security expert. It has a file cabinet full of security related documentation for your reading/educational purposes.

This distribution comes with the best security tools like hping2, proxychains, lczroex, ettercap, kismet, hunt, achilies, brutus,nmap,nessus, snort, the coronor’s toolkit, ethereal and many others.

It also has standard features like apache, mysql ,iptables, programming compilers etc that come with the linux distributions.

It is user-friendly as it includes two fast, light-weight window managers, XFCE4 (the default) and Fluxbox.

One thing that this distribution lacks is that it is 3.5 years old and new version is nowhere to be seen whereas other penetration testing systems like backtrack are new and under active development.

Note:It's security documentation the one you'll definitely want to have.

It can be downloaded from the following link:-







Following are some of the snapshots of this os:-

Read More

ddos attack/ping flooding: Explanation and Solution

what is a ddos attack/ping flooding attack ?

ddos attack or ping flooding attack is basically sending large and continuous ICMP (Internet control message protocol) echo packets to a target host and wait for the icmp reply message. Now what this does is, it floods the target host with large data segments and if ICMP service is not disabled by the target host then it will send the ICMP echo reply message (that's what an attacker wants to accomplish).

So if you want to try it out just use the following variation of the ping command:-

ping -t -l [buffer_size] "target_ipaddress"

The options:-

-t for repeated sending of icmp echo messages.

-l [buffer size] : the size of packet to be sent from[0 to 65500]

target_ipaddress : the host address you want to ping to

you can always stop the ping command like any other command by pressing ctrl+c (for windows) combination that kills the process.

For the attack to be more effective tell some of your friends a group of 10-20 people to join you and ping together an ip address.

For example:

ping -l 34567 -t 202.63.160.186

the output will be like the following image :-

The solution:-

If you are a server admin you would know about this issue and you would have probably solved this by now, but many counter strike or any other online game server admins don't know the cure for this.

Well the cure is very simple and for that you have to disable the icmp service for the wan interface of your modem/router. Now what this will do is, it will silently ignore the icmp echo request.

Follow these steps to disable the icmp service for the wan interface in the router/modem :-

• Open your web browser and type the address of the default gateway configuration page(by default it is http://192.168.1.1/index.html or http://192.168.1.1/main.html or 192.168.1.1) and then type in the user-name and password pair (by default are admin, admin or admin, password) .


• Now, first find the management section in the configuration page, then the access control configuration page and finally the services config page (don't worry if you cannot find the exact sequence the important thing is that you must be able to find the service configuration page)


• Uncheck the icmp service, save the changes and after saving the changes you might have to reboot the modem so reboot it. Now any ping request to your modem's wan interface will be warded off (and counter strike admins will be able to run their servers with no lag due to this attack) (Refer to the following snapshot of my modem page which is a beetel 220bx)

Note:If you have any issues do post your comments.

Read More

MAC address/Mac Spoofing

Changing of MAC/Physical address is salutary for following purposes:

1. If your Internet Service Provider (ISP) does mac binding with your id (Almost all do).
   So in case your old modem/router is no longer usable and If you want to use a new modem then it
   will result in authentication failure.


2. For "MAC Spoofing" : That is showing you have a different address to what you actually have.

The Steps are:

1.Telnet to your modem/router i.e

• Go to Command prompt and type telnet 192.168.1.1
  
• Enter your user name and press enter and then the password.

2. A menu will be displayed then type sh a # prompt appears .This lets you into the shell of your router/modem

3.Now to change your ethernet Interface's address you will have to first shut it down so for that
to happen you would have to connect through your usb interface .

4. To View what interfaces are available type ifconfig

5. Assuming that you want to change eth0 interface, type the following sequence of steps :

• ifconfig eth0 down

• ifconfig eth0 hw ether <your mac address>

For example: ifconfig eth0 hw ether 02:10:18:01:00:01

• ifconfig eth0 up

6. That should do it type Ifconfig eth0 to view the change to eth0 Interface.

Read More

Using Telnet for configuring modem/router and securing your router.

The following are the simple steps that show how you can use telnet to configure your router/modem or to connect to a remote host and how to secure your modem:-

For configuring your modem/router:-

• Open the Command prompt: start->run or (windows key+r), then type cmd
  


• Now type telnet "the ip address of your gateway or modem or router". for example : In case you are configuring the modem connected to your pc directly then by default the router/modem's ip is configured to have a private address of 192.168.1.1 , so the command in this case will be telnet 192.168.1.1
  


• Now fill in the username and press enter, then fill in the password and press enter. By default the username password pair is (admin, admin) or (admin, password) .


• Now the menu containing options for your modem will appear as shown in the following figure. Note: there is also a hidden unix based shell in your modem which can be used to configure and access more information about your modem
  
  
  

• Now you can pick any option, for example you can pick wan option and configure the wan connection and do other stuff like spoofing the mac address, the latter thing cannot be done if you access the modem through the browser because it won't provide access to such option.

Configuring the wan ppp connection:-

• After following the aforementioned steps choose the option that corresponds to wan, in my case it is option 3 so type 3 in the -> prompt.


• Then choose the configure option ( option 1).


• Assign a VPI (Virtual Path Identifier) as used by your isp (0 for airtel, 0 for mtnl).


• Assign a VCI (Virtual Circuit Identifier) as used by your isp (32 for mtnl) .


• Assign a wan id you should leave this field as such and press enter.


• Choose the category, our isp's generally use ubr ( some application use constant bit rate(cbr) )


• Choose the protocol pppoe(ppp over Ethernet) or bridge if it's a bridge connection.


• Choose the encapsulation LLC (logical link control) .


• Choose enabled state for the interface .


• Enter the service name, prefer to use the isp's name in the service name.


• Enter the ppp username provided to you by your isp, it is generally your phone number.


• Enter the ppp password provided to you by your isp.
  Note: You should password protect your modem, lest there is a simple hack that reveals your ppp password which can be used by even a novice cracker to use your account ( It still works on mtnl :-) ) [link] . Even if your isp account is attached to your modem's mac address then also spoofing can be done to crack and use your account. [link] . Below i mention a solution on how to password protect your modem and prevent such simple attacks.


• Leave the idle timeout field blank and choose authentication method as auto .


• Disable or enable the Internet group message protocol( IGMP) .


• Disable the QOS service.


• Disable the ppp ip address and then enter any name in pppoe service name.


• Then press enter, choose exit option and then choose save and reboot option this will lead to the activation of the new wan configuration
  

Securing your modem:

• Choose the passwords option after which a passwords menu will appear from which you should select the admin account.


• Enter the old password, by default it is either "admin" or "password".


• Enter the new admin password and confirm it. This step makes your modem more secure than before.
  

Read More