What is Kali Linux?

In one of my recent post I explained and easy and safe way to set up your own Digital Forensics Lab and I mentioned a Linux based operating system by the name of Kali Linux. But what is it? and why would you use it in your virtual hacking lab?

Kali Linux is a Debian based operating system that uses the Gnome desktop environment, but unlike Ubuntu and Gnome Kali is packed full of usefully tools and applications for cyber security and digital forensics. Meaning that it is pretty much a one stop shop for just about any tools you could need, this makes things very convenient as you do not have to search around and download multiple applications they are already there in one place. It makes use of the Gnome menu system and groups all of the tools into named folders with the type of tool it is. This again means there is no hunting around when you have installed all of your tools.

There are a number off different use cases for a package such as Kali and the could be from a general curiosity to using it in industry as a professional. I personally use it along side my degree as is part of my course. But with it being free you can start using it when ever you want and with the many tutorial online it is really simple to get started and learn how to use it.

Because it uses the Gnome desktop it feels nice to use just like Ubuntu or Gnome, and it doesn’t feel like a tool your using. Granted a lot of people would be very unfamiliar with either of these Linux system but after a little bit it feels natural or like using any other graphical operating system. It also means that you could use it as a daily operating system if you were that way inclined. And don’t worry about requiring the latest computer hardware to run it because due to it being Linux based it doesn’t require all to much. Granted for certain task an application a little extra power wouldn’t go amiss but if you where to run it on 1 or 2 cores with 1 or 2 GB or ram it wouldn’t feel sluggish. And better yet you can run it live from a USB stick so you don’t even have to install it to benefit from it tools and features.

I tend to run it through a virtual machine, this is due to the safe lab that I mentioned before, and again it runs just like any other system within a VM. One benefit of doing this is that you can play around with the hardware the VM will supply it with. So if you have the hardware to spare you can build a beefy Kali System.

Tools Included in Kali

  • AirCrack
    • AirCrack is a WEP and WPA (Router Password) cracking tool, meaning that if you where preforming a penetration test on a company you may be able to gain access to there network through the WiFi.
  • Burp Suite
    • This package allows you to test the security of web applications, it does this by canning the application the searches for possible vulnerability. This is a very helpful tool for developers who wish to make there product as secrecy as possible.
  • Hydra
    • Hydra is a brute force password cracking application that on the surface looks limited and outdated. But in reality is a powerful tool allowing you to attack one or many users with either a single password or from a list of passwords.
  • John the Ripper
    • John the Ripper is another password cracking application that is command line based, although you can use a graphical version in the form of Jonny the ripper. It has been know for its speed at being able to crack passwords.
  • Maltego
    • This is one that you are very unlikely to have used or heard of and it is Maltego, this application is an effective relationship tracker that can work on social media platforms, Computer networks and websites. Once it scans the target location it produces a map using graphics making it clear and easy to understand.
  • Megasploit Framework
    • This is another application that works well for developers or system admin, Megasplot Framework runs simulated attacks on your network trying to find vulnerabilities. This allows you to patch or alter the vulnerability and make your system as secure as possible. And because it is all simulated there is no negative effects on the network its self.
  • Nmap
    • Is another command line application that has a graphical front end application as well this time its in the form of Zenamp. The purpose of this tool is to preform network discover scan and also security auditing.
  • Zed Attack Proxy
    • The Zed Atatck Proxy or ZAP is another penetration testing tool targeting web applications, It supports the Open Web Application Security Project or OWASP and is pack to the brim with functionality and features.
  • Sqlmap
    • Sqlmap is again a penetration testing tool but this time it is targeting SQL databases and looks for weakness in SQL injection, In some cases SQL injection can compromise an entire database. This could potentially leave the target in a whole heap of trouble.
  • Wireshark
    • Wireshark is a network protocol analyser, it boast some features such as being able to scan hundreds of protocols and preform offline analysis.

Other Similar Operating Systems

All of the above are aimed to provide a similar services to Kali Linux, and although I have limited hands on experience with each of them. I do know from others that they are good at what they do and that they should be considered as an alternative to Kali. Some of them are more tailored towards anonymity online while other are again forensics packages.

 

 

 

 

NSA GitHub – Are they really being transparent

Earlier this week it came to light that the NSA (National Security Agency) had created a GitHub account, and realises some programs on the platform.  This bring up a number of questions, firstly are they really trying to be that transparent or is it a novel way to try and win back the trust of the public.
Thankfully the source code for all of the application is available so it is possible to see what is going on within them, as a major concern of mine would be the potential back doors or snooping application like this could do to e user if they where not able to actually see what was going on…

But this does still beg the question as to why they have realised it, now it is not uncommon for application and other such items to trickle down the pipe line to the more “consumer” market eventually but after the vault 7 leaks a few month ago it is possible to see that they have so many more application with much more malicious uses than the few that eye have realised for the public. So there is the potential they they have realsed stuff that is out dated to them or that they don’t feel will be to compromising to all if their activitys.

CIA Hacking: Apple

There has recently been a lot of ‘Data Dumped’ regarding the CIA having hacking tools that target vulnerability in Apple devices. In an article posted by the BBC it suggest that the CIA have been hacking into devices from some of the biggest manufactures and tech companies such as Apple, Samsung and Microsoft.

This all came to light after Wikileaks release a huge amount of documentation that talks about and explains the CIA’s hacking tools.  Wikileaks states that there is an entire division within the CIA that is targeting mobile devices. This is allegedly the CIA’s Mobile development Branch. This branch has reportedly been developing malware to target Apple iPhone and iPads, it then goes onto state how the CIA has a number of local and remote “zero days” exploits that it has either developed its self or has received from another cyber security agency such as GCHQ. There is also speculation that they have purchased some of these exploits from a private companies and contracts that focus on finding vulnerability or zero day faults and then selling them for a profit.

In my opinion the fact that the CIA has been hording vulnerability on devices such as iPhones and iPads doesn’t come as a surprise, if you look back to the ‘San Bernardino‘ case from last year in which apple refused to give up the password to a phone that was connected to that case. This was huge news at the time because apple told the FBI it would not help them, and a lot of companies jumped on the band wagon and supported apple. But eventually a Israeli company sold the FBI and application that would allow them to gain access to the device. So people shouldn’t be surprised when this sort of things happens, my argument would be if a private company can develop tools to compromise an iPhone then the US Government and all of its many resources will be able to achieve the same thing. Granted the iPhone password cracking is slightly different to potential monitoring and recording on a mass scale, but even if there where to have recorded all of the convocations and retrieved as much data as they possibly could from all of the devices they infected. You have to consider the fact that around 15% of the population use IOS devices that would be an extreme amount of data to processes. I would also speculate that 99% of people would have nothing to worry about because unless you were targeted directly then you would just be a possible compromised device and nothing more to the CIA.

If this all interest you i would suggest you read into it more on the Wikileaks site its self. They are  calling this data dump ‘Vault 7‘ so feel free to browse that at your own leisure but there are thousand of pages and documents in this dump.

Google Cracks SHA-1

A couple of weeks ago a report by Google came out stating they had managed to crack the SHA-1 (Secure Hash Algorithm 1) This Hash function was original developed by the NSA in 1993. And it is still used by a lot of websites today, although there are much newer versions that offers a lot more security as the maths and computing power to crack it is even greater it has not been as widely adopted.

These issue with the Hash Collision is that the idea behind SHA-1 was essentially each file would be given a unique header and in 1993 when this was first developed the for-site that there could potentially be a collision would have seemed impossible due to the amount of computing power required to even entertain this and the fact that PC and computer use was no where near as common as it is today. But although Google has managed to force a collision between 2 items having the same SHA-1 hash it did however take them 2 year with support from the university of Amsterdam. Combine the resources and computing power both a university and Google have and given it took them 2 years to achieve this means as an out-and-out security vulnerability it is not all that feasible that a hacker would be able to force a collision and potentially cause damage.

GoogleCollisionCrackImae
Source: Google Security Blog

Another reason this isn’t to much of a concern to the integrity of cyber security in my option is that SHA-2 is readily available, and already deployed meaning that even if the collision is able to be simulated again in much less time there is a very accessible upgrade path that will offer much greater security and also not lead to a time between SHA-1 is vulnerable and SHA-2 is being developed.

The Creator of both Linux and Git was warned about the possible vulnerability with SHA-1 in 2005 and proceed to continue using it for Git. This is because he felt it would be far to expensive and Git has layered security meaning that one layer might be compromised but that isn’t the end game.

In my opinion although it has been cracked in an experimental setting it would not be as accessable to do for malicious purposes unless it was a state sponsored attack because the resources and time required are not anywhere close to where hackers would feel it a useful tool. And furthermore companies such as Google and Microsoft already use SHA-256 so your average joe who uses YouTube and Gmail will have nothing to worry about in regards to their online privacy and security.

 

If you enjoyed that check out some other posts below

McAfee Cyber Threat Predictions 2017

Paid vs Free Anti-Virus Software