Review: Free DD-WRT network router firmware

Most network routers have fairly basic firmware that limits the hardware's full potential. You can change that.

In most situations, a network router's normal purpose is to facilitate in connecting computers together to form a network, either for internal use or for granting access to the World Wide Web. Admittedly, if you actually want to do anything interesting with the hardware, most routers have fairly basic firmware that limits the hardware's full potential. I know this first hand, as I picked up an ASUS RT-N12 router from a good friend of mine recently to replace my underwhelming Belkin branded one. Although ASUS hardware is mostly of high quality, the firmware felt rather raw and unpolished. With that in mind, I did some research online and found that custom router firmware was available and I decided to give it a try.

DD-WRT

Product Information

• Title: DD-WRT
• Company: NewMedia-NET GmbH
• Product URL: http://dd-wrt.com
• Price: Free

Eventually, I settled on DD-WRT, which is quite honestly one of the best router firmware packages I've ever used. For those who are unfamiliar with it, DD-WRT can be flashed on any compatible router in order to grant the user extra functionality, which hardware manufacturers seem reluctant to include in stock software. Once you flash your router, you probably won't want to go back. You quite literally get everything but the kitchen sink at your fingertips.

For an idea of what DD-WRT can do for you, I will highlight some of my favorite features included with the firmware.
If you wanted to set up an OpenVPN gateway for all systems that connect through the router, you can add your VPN cert and private key, flip a few switches to determine the encryption and tunnel type, and voila! Every computer that connects to the router will pass right into the VPN. No client end VPN software is necessary.
I also like how DD-WRT is extremely verbose on stats, showing you total inbound and outbound traffic to date, as well as router performance information, including free memory and CPU activity. Having access to this panel will give you insights into what kind of traffic you are dealing with and if you need additional hardware down the road.

An example of some of the available router stats

Finally, DD-WRT just seems to improve network performance by a decent margin. For instance, after switching the firmware from stock to custom, surfing web pages and downloads seemed a bit snappier than before. Not to mention, I could be more discriminatory of what protocols (i.e. Bittorrent) could do what it needed to do with the network to improve balance.

Installing takes some research

Now, when it comes to getting DD-WRT installed to the router, there really is no one-size-fits-all method, as hardware from different manufacturers is handled on a case by case basis. There are some routers that are unable to be flashed too, so if you are shopping around for a new router, it would be advisable to refer to the DD-WRT hardware compatibility database first before committing to a purchase.
Fortunately, for my router, installation was as simple as dropping into the firmware upgrade menu, selecting the custom-tailored ROM file for my hardware make and model, and then uploading it over the network. After a several minute upload process, followed by a mandatory router reboot, I was up and running in DD-WRT. In the unfortunate event of an endless reboot or other strange issue that might arise in the process of flashing, I also have the option to boot into the router's low-level recovery mode in order to roll back to the stock firmware and try again.
With all this interest surrounding router modifications, it goes without saying that flashing with un-official custom firmware could invalidate your warranty coverage and cause other problems. If this all sounds too risky, companies like Buffalo actually offer routers with DD-WRT firmware already flashed and ready to go with full warranty coverage. This way, you won't have to worry about accidentally bricking any hardware if you don't feel adventurous.
DD-WRT is available to everyone as freeware under the GNU GPLv2 license. So long as your router make, model, and revision are all listed, you should be good to go. One thing to note: if you have less than 8MB of flash storage space on your router, you won't be able to take advantage of every feature available. Therefore, you will need to choose the mini firmware "edition" that best suits your needs for the hardware.






Review: Free DD-WRT network router firmware - TechRepublic

Snort :: Home Page

Snort :: Home Page

Infographic: Finding the right security solution for the data center

This infographic from Cisco illustrates the issues that data centers face trying to deploy comprehensive security systems.

By Evelyn de Souza, Security Technology Group at Cisco

Today’s savvy information technology professional wants security tools and understands that protecting your organization is something that opens doors, rather than closes them. The right security solution can move businesses beyond buzzword bingo to a place where they can actually achieve these hoped-for efficiencies.
Many times as InfoSec professionals, it can be difficult to associate security investments with ROI. However, when it comes to data centers, the ROI associated with employing a comprehensive security solution goes well beyond hard numbers. The right security solution can result in avoiding higher costs and consequences stemming from potential data breaches – which are far more damaging in the long run than taking necessary preliminary precautions early.
This infographic from Cisco dives into problems that data centers face today, and how finding the right security solution can make all the difference.

Infographic: Finding the right security solution for the data center - TechRepublic

Breach Detection Systems take aim at targeted persistent attacks

You've just been told to get a Breach Detection System in place. Where do you start? How about a buyer's guide created by an independent test facility?

I’ve been asked how to prevent illicit network penetration enough times to realize an esoteric discussion of the recent advances in intrusion detection and firewall protection is not what’s needed. What is needed is a clear picture of available preventative measures, and which of the preventative measures work as advertised.
Getting up to speed, for me, means paying attention to a certain independent test lab. For the past two years, the people at NSS Labs have been testing how well Breach Detection Systems deal with Targeted Persistent Attacks.

Different terminology

It’s entirely understandable if Targeted Persistent Attacks (TPA) and Breach Detection Systems (BDS) are unfamiliar, or appear to be incorrect acronyms. To get that sorted out, I talked to John Pirc, Research Vice President at NSS Labs and published author. Starting with Targeted Persistent Attacks, I asked John why NSS Labs didn’t use Advanced Persistent Threats (APT) like everyone else. “The truth of the matter is that an APT is sometimes made up of known exploits / vulnerabilities that are not that Advanced; so the term APT doesn't define the action correctly. TPA highlights that the actor is going after a specific target such as company X or an entire industry sector like financial services, and will be persistent in attacking the target”
John also mentioned there was a detailed examination of APT versus TPA in this blog. Next, I asked John why NSS Labs prefers to use Breach Detection System instead of Next Generation Intrusion Prevention System and Next Generation Firewall:
“The BDS, NGIPS, and NGFW products are similar in that all three can contain signatures and heuristics for identifying malware. However, a BDS separates itself from the pack with its ability to analyze the patterns of network traffic, identify malicious domains, and model the behavior/impact of files that are being downloaded and executed on an attack surface.
In some cases, BDS vendors are able to detect zero-day malware at various stages of propagation, and provide remediation. The ability to identify still-unnamed malware on your network is almost like having your own zero-day research team on site.”
BDS technology having proactive capabilities plus remediation is significant. I asked John how that was accomplished:
“What separates BDS from IDS/IPS is detecting unknown malware. Breach Detection Systems, unlike IDS/IPS, have the ability to model malware behavior through emulation and sandboxing or a combination of both. This places BDS at a distinct advantage over IDS/IPS; as they can identify the presence of dropped files, analyze them, determine if they are known bad or unknown bad, and monitor for command and control callbacks.”
Now that we’re on the same page, I’d like to look at how NSS Labs goes about testing Breach Detection Systems.

BDS testing

To start, this excerpt from the BDS Test Methodology paper describes what the testers will be looking for:

• Centralized management of multiple devices.
• Breach detection capabilities using one or more of the following methods:
• Malware identification (signatures, heuristics, or both).
• Network traffic analysis (flow monitoring, content analysis, or both).
• Sandboxing that allows for modeling internal systems (workstations and servers).
• Browser emulation.
• Domain reputation to identify malicious domains.
• Response mechanisms (for example, alerting, session termination).
• Reporting.

The remaining 18 pages of the test methodology report go into intimate detail explaining how the engineers at NSS Labs determine whether a BDS device meets expectations or not.

Test results

At the beginning of this article, I mentioned my reliance on NSS Labs to get a clear picture of this complex technology. To get that clarity, besides reading how NSS Labs tests BDS, I also read their annual Breach Detection Systems Buyer's Guide. The 14-page report is chock-full of analysis and recommendations. For example, here are some overall conclusions of the systems tested this year:

• A BDS is able to detect threats by using a network appliance or stand-alone endpoint, or by using a combination of both.
• A BDS can identify pre-existing breaches as well as malware that is introduced to the system through side channels.
• A BDS that is unable to identify side-channel attacks or command and control traffic from infected machines is little more than a network AV device.
• While high-end network core switches will be capable of supporting most BDS requirements, NSS engineers have noted port-spanning issues with many workgroups switches.

Next NSS Labs offered the following advice for those thinking about purchasing a BDS: “Enterprises looking to deploy a BDS should understand that there are differences in the maturity, technology, and scalability of the solutions that are offered by different vendors.”
Both the paper on BDS test methodology, and the BDS buyer’s guide provide an abundance of information, affording IT pros the opportunity to get familiar with Breach Detection Systems.
Here’s a list of vendors that are offering BDS products.

• Check Point
• Damballa
• Fortinet
• McAfee
• Palto Alto networks
• Sourcefire
• Trend Micro

John mentioned that not all of the above vendors have submitted systems for testing as of this post, and to contact NSS Labs to see if there is a test report on a system you are considering.

Final thoughts

With something as complex as Breach Detection Systems, I’m glad there is such a thing as a buyer’s guide. I’d be nervous having to base a decision on one vendor’s market-speak versus another’s.


Breach Detection Systems take aim at targeted persistent attacks - TechRepublic

New strain of ransomware evades detection by AV apps

Learn about a new type of ransomware that has the potential to snare many victims - and it's not even malware.

Since you’re here at TechRepublic’s website, I’m betting you are familiar with ransomware, and how to avoid being conned by it. The trouble is there are millions of people who aren’t. That alone ensures ransomware will continue to cull people of their hard-earned money. To make matters worse, there’s a new version winding its way through the Internet. And, those in the know predict what’s being called HTML ransomware will be more successful than previous versions.

HTML ransomware

I first learned about HTML ransomware from Jerome Segura, Senior Security Researcher at Malwarebytes, and his blog post, "FBI Ransomware Now Targeting Apple’s Mac OS X Users." Initially, I was suspicious; OS X is not vulnerable in the same way Windows operating systems are, so what’s up?
As I continued reading, I learned the only requirements for HTML ransomware to work are JavaScript must be enabled, and the victim’s web browser incorporates the “Recover browser session after a crash” feature, which is part and parcel to all major web browsers -- including Chrome, Firefox, Internet Explorer, and Safari.
Here’s what HTML ransomware has going for it:

• Does not require installation.

• Disabling JavaScript breaks many popular websites; so people aren’t willing to turn off JavaScript, something the bad guys are relying on.
• AV applications, even with current malware signature sets, are of no use against HTML ransomware.

How it works

One way the scam starts is when an unlucky person selects a search result with a falsified link. Instead of the expected web page being presented, the victim’s web browser loads something similar to the following slide (courtesy of Jerome Seguro and Malwarebytes). 

 

Again, you aren’t fooled, but perhaps less computer-savvy friends and relatives might be.
While the victim is coming to grips with the above screen, associated JavaScript code is loading copies of the same screen (150 typically) onto the browser. By creating a 150 iFrame loop, HTML ransomware gives the impression the computer is locked up. Ironically, if the victim is determined, leaving the web page, and revisiting it 150 times will remove the problem.
I doubt I’d even consider reloading the web browser that many times; my inclination would be to reboot the computer, but that doesn’t help either because HTML ransomware taps into the “Recover browser session after a crash” feature I mentioned earlier, bringing the same FBI screen back up.

It’s not malware

Something else that makes HTML ransomware unique: by most definitions, it’s not malware. It is a snippet of JavaScript code readily available on the Internet that digital extortionists use to fool victims by controlling what is visible in the browser window. No other computer function is affected, at least as of this writing, but Jerome mentioned the potential is there, especially for Windows-based computers.
It not being malware is why HTML ransomware is a great idea for the bad guys: simple to set up, easy to move to different domain names, and no concerns on how to install code onto computers. To see if bad guys agreed, I asked Jerome how many instances of HTML ransomware he has seen?
“This ransomware is quite active; bad guys are registering new domain names several times per day. While it is not malicious (as opposed to ransomware that infects your PC), it’s still scaring people.”

How to tell if it’s HTML ransomware

Web browsers lock up for all sorts of reasons, so I asked Jerome how we would know for sure, if HTML ransomware caused the lockup:
“The browser being locked may not be ransomware in all cases. I can think of many sites that use annoying JavaScripts to keep the user on the page (pop-ups that ask ‘are you sure you want to leave this page?’). HTML ransomware is characterized by the following:

• Warning from the police
• Fee to be paid using a voucher
• Computer or browser locked

"If those three elements are in place, it’s HTML ransomware.”

How to get rid of HTML ransomware

Jerome did a thorough job of explaining how to remove HTML ransomware from Safari in his blog post, but missed explaining what those using other operating systems should do. I asked him what others should do:
“I recommend ending the web-browser process(es) after first having disabled JavaScript. Simply killing the web-browser process will recover the ransomware page and put you right back where you started.”
There is a possibility you may not have to worry about HTML ransomware if your antimalware provider is on top of the situation like Malwarebytes. Jerome explains:
“Malwarebytes has a large database of malicious sites that we constantly update. Our PRO users are protected against malicious websites as they pop up. This is due to our ability to blacklist entire IP ranges since we know they are only used for criminal purposes; any new website registered on those will be automatically blocked.”

Final thoughts

At first, I felt that HTML ransomware was not a big deal. But, it did not take long for me to realize darn near everything we do computer-wise involves the web browser. And, if the web browser appears to be locked up, it will seem like a huge deal.
Since this attack is easy to fix, it would be a shame to have those who do not understand what’s going on even for a second consider paying the ransom. So, please, let’s get the word out on HTML ransomware.
Once again, I owe a debt of gratitude to Rebecca Kline and Jerome Segura of Malwarebytes for helping me sort through the intricacies of HTML ransomware.

New strain of ransomware evades detection by AV apps - TechRepublic