Ubuntu is an incredibly popular
operating system for hackers and Linux
users alike today we'll look into how we
can harden it for accessing the Internet
and exposing the minimum amount of
attack surface on this episode of cyber
weapons lab
[Music]
[Applause]
[Music]
after setting up a bun to securely in
our previous guide we have a system
that's minimal lean and has an encrypted
hard drive so that it's mostly resistant
to things like physical attacks the next
step comes when we want to actually join
a network which means we're going to be
up against all sorts of attacks and
threats which might start with a little
bit of recon by scanning our device now
the best way to reduce our tax surface
is to make sure that to someone scanning
our device it looks like something it's
not or something that's really
unattractive so that we're not getting
anyone who's trying to break into our
machine because we're not really giving
them enough information to decide to
attack it in the first place now of
course that could mean something like
spoofing your MAC address but today
we'll also get into things like
restricting firewall of applications
from being able to actually access the
internet so that we can tell what's
accessing the Internet and then set
firewall rules to restrict anything that
we don't like now we'll go into a couple
other steps and if you get confused you
can also check out the awesome article
written by Tokyo neon which is linked in
the description once you have your
Ubuntu set up and ready to go we can
start setting this up but I will warn
you we will get into some Network
restrictions that can cut off your
access to the Internet so you might want
to make sure that you have the article
loaded up if you're going to be
following this guide because if it goes
a little bit too far and cuts you off
from the internet it might be a little
bit frustrating to find try to find the
instructions retroactively Lee now I'm
going to go ahead and power up my
virtual machine however while I do so
I'm gonna show you Tokyo neons if it
lets me there we go
I'm gonna go ahead and show you Tokyo
neons Twitter and I highly recommend you
follow him because he has all kinds of
great guides and this is just one in a
larger series of amazing guides on how
to keep yourself safe while using a
really fun and easy to use system now
move on to is a great way to get started
and we're going to be following this
guide today so if you want to follow
along you can check out the null byte
article in the description and follow
Tokyo neon on Twitter because all of us
pads are great and I think you'll find
them very useful now to get started
we're
going to open up our Ubuntu system that
we created in the last guide and again
this can either be a virtual machine or
this can be a dual booted system it's
really entirely up to you for me I'm
running a virtual device so I'm going to
go ahead and connect both Ethernet and a
Wi-Fi adapter but uh looks like one of
them didn't take but hopefully the
second one does all right so the first
step of what we're gonna do is go into
the Wi-Fi settings and what you'll
notice is there's actually the ability
to add a cloned MAC address now if
somebody is scanning a network and
they're trying to figure out if you have
a certain kind of device they're gonna
have the MAC address to rely on because
the Mac characters address is derived
basically from whoever manufactures your
computer or your wireless card so if
somebody is looking for a Lenovo laptop
or a particular kind of chipset because
they have an exploit for it or if they
want to know if you're like an apple
device and it's really easy to do so if
you are scanning for MAC addresses and
managed to match them to a particular
manufacturer now here you can see I have
this particular MAC address for our
actual MAC address which would lead back
to probably a virtual machine but
because I want to hide that information
I want to use this clone MAC address of
a a BBC CDD EDD so I'm going to go ahead
and click apply
and then this should apply our spoofed
MAC address to the system so that if
anybody is trying to search for us on
the network we're going to look like a
very very confusing device now if we go
ahead and open a terminal window
and let me see if I can make this little
bigger there we go okay I'm gonna open
up a terminal window and in order to go
ahead and check this out I'm going to
type nets at tack NTP well oops
whoa okay and as you can see we don't
have it so the first step to actually
run this tool is to follow the advice
here and run a PP install net tools oh I
got this to do it so net tools has a
whole bunch of different things and if
you're ever running ifconfig and notice
that it just doesn't work net tools as a
package in which it is contains so if
you just did install that then it will
generally have all the Kelty Linux tools
that you know and love such as I have
config and apparently the one I just
tried to type which is net stat tack NT
pul there we go
okay so now we have some more
information we can see a little bit more
about the services that are open on our
device and this gives us an indication
of if we have any particular risk
factors for something interacting with
our machine that we don't want to happen
now we can do a couple things to prevent
somebody from maybe starting to mess
with these services that are open but
once we're aware of them that's kind of
the first step to being able to remove
anything that we don't want interacting
with our actual system now again if
you're not using a printer over the
network there's probably no reason to be
constantly listening for that sort of
thing or to give somebody information
about your computer if they're if they
happen to be scanning for printer
protocols and be like oh this is an
Ubuntu printer protocol listening on
this port so let's type in system
CTL disabled cups browsed we'll need to
type in our password and it hates it let
me see you try sudo there we go now we
should be able to cut down on the number
of things that are listing on various
ports and this will greatly prevent
anybody from being able to learn about
our system so that we're not actually
having to worry about enumeration on our
device that could lead to somebody
sending an Ubuntu exploit our way or
maybe a printer protocol exploit our way
now the next thing we're gonna do uh I
was just thinking ahead on my system
might be a little complicated because
I'm actually using an Apple device but
we're going to disable the daemon that
basically allows us to communicate with
Apple protocols and again if you're
going to be using your abun to with
Apple devices this might be something
that you want to leave enabled but for
Security's sake if we want to really
lock down our system we can type sudo
systemctl disable AV aah I - daemon
there we go so now we might not be able
to communicate with Apple devices
anymore but the nice thing is that we
can actually use a firewall to protect
ourselves from any further let's say a
nefarious connection that's coming out
of our box or one that's trying to come
in so we've made a couple trade-offs
this is starting to get again a little
bit hardcore for people who might be
interacting with a bunch of devices all
the time and not worried as much
security but if you are focused on
security then these steps do give you
the ability to scale them forwards and
back depending on your level of comfort
so let's go ahead and use a firewall to
actually start taking charge of what's
going on with our system and we're going
to start to be pretty heavy-handed so
let's do suit
you f/w enable okay so the firewall is
active and enabled on system startup so
this is basically this is called the
uncomplicated firewall it's designed for
us to be able to enter in a couple
really really easy commands and
basically be able to do some pretty
serious stuff when it comes to
monitoring and selectively allowing or
denying connections so let's start out
by doing sudo ufw defaults when you're
to this default deny forward well I will
start with incoming ok so now our
incoming policy for incoming connections
is to deny them let's go ahead and deny
forwarding and let's uh while we're at
it also deny outgoing and there you go
the perfect computer nothing in nothing
out it's lockdown you're done just
kidding ok if you ever want to connect
to the internet again we do have some
steps that we actually need to do so one
thing we can do is type ifconfig pack a
and that should give us information
about our wireless interfaces or our
interfaces in general Ethernet or
Wireless here you can see information
about our wireless card so in order to
use the next commands we're going to
need to know the name of our wireless
network adapter and as you can see it's
really long so that's great so I'm going
to switch over to the article here and
the actual commands we're going to be
using are a little bit long so I'm gonna
see if I can use in my virtual machine
the shared clipboard bi-directional and
hopefully I'll be able to copy these
over although if not I won't be
surprised so this is the command we're
going to need to copy it is sudo
uncomplicated firewall I'll
allow out on our interface name and
we're going to go ahead and change in a
second our DNS to the CloudFlare DNS of
1 1 1 1 so the rest of this will
basically just allow our exceptions for
DNS queries and I'm gonna go ahead and
copy this and I really hope it comes out
in our bun 2 virtual machine let's see
if it does and of course it doesn't that
is the worst all right well I get to
write this whole thing out
just like you it's gonna be fun alright
let's do this okay sudo ok I can't see
it that way and the best part is if I
wanted to open this on a in a browser
and do it here
I just disallowed all network
connections so there's no way it would
work so we got to do this
alright sudo ufw allow out on this
horribly long network adapter where is
it
there we go alright so we'll copy this
drop that in so then we've created our
exception for the network adapter let's
keep this going to 101 1 1 frodo UDP
port 53 comments
and this is going off the side and of
course this is just a comment I can see
that but I'm gonna do it anyway so I
remember what this is for all right
let's run this and see what happens so
we're going to try to create this
firewall rule that allows us to make DNS
queries which will be very helpful if we
want to go anywhere on the Internet
ok it worked so now we can copy a lot of
this over all the first part is gonna be
the same we are going to change part of
it to any so we're gonna say rather than
just this one DNS resolver any IP
address we're going to say it's a TCP
connection instead of UDP we're gonna
say port 80 and this is for HTTP
all right and the last one I'm gonna
expand this again because now I don't
have to copy this anymore yeah it's very
long alright so we'll run that and the
last one is port 443 and that is going
to be for HTTPS awesome all right so now
stuff is still not going to work
basically the default DNS is going to be
set we're gonna have to go ahead and go
in and set it ourselves if we actually
want this to work now we'll go back to
the Wi-Fi settings and in the same menu
that we were in before we can click
through until we see there we go DNS so
let's go ahead and type 1 1 1 1 hit
apply and that should be everything we
need to get everything working on our
outbound and inbound outbound
connections through our DNS exception
that we just set up so basically what
we've done now is by default locked
pretty much everything down but we've
only allowed our wireless network
adapter to go out on port 80 in port 443
now of course this can get very very
restrictive if you are having a hard
time with this or you find that it's
just not working at all you can always
type sudo ufw default allow outgoing
so okay that will go ahead and make
these rules a little bit less
restrictive but of course you're going
to want to actually check to see if
there's anything that is trying to get
out or if you have a particular program
that is just failing you might want to
know why it's doing so by exploring with
the log so you can go ahead and type
tale tack F slash Fair slash log slash
ufw dot log and you should be able to
see various things were blocked various
things that were allowed and kind of
like what's going on in terms of whether
or not there's a device it's not a
device a whether or not there's a
service that's persistently trying to
connect to a certain IP address now if
you find something that is persistently
trying to connect back to an IP address
you don't recognize or if the that IP
address looks suspicious
you should definitely maybe have cause
for concern that your computer has been
compromised and this is a great way that
you could catch something that somebody
else might not notice after all most
malware actually requires a
command-and-control server in order to
operate so if you're able to detect that
sort of behavior it could be a first
warning sign that your computer has been
breached now if you run into a program
that is broken or something like that
you can always fix it with some with a
command that goes like sudo ufw allow
out on and then our hideously long
wireless network adapter name from let's
say this IP address to this IP address
and that could be you know some program
that we're trying to run that's just
coops that's just getting stuck and
cannot can't communicate with the
resource that it needs well also right
Pete let's see
PR OTO TCP ports and it looks like this
was trying to connect to well it doesn't
matter let's just sit say nine nine nine
nine and of course it helps to use au
instead of a W there we go so you can go
ahead and type man UF W if you want to
see more information about how to set
these rules but basically if you want to
start getting more customized or strict
with the way that your computer actually
handles these sorts of connections you
can set your own rules to prevent
command and control servers you can lock
down individual processes it really is
as complicated or as simple as you want
to make it and I highly recommend you
look into this if you want to take a
more hands-on approach to your device
being able to lock down its connections
now hopefully let's see I should be able
to access the internet after making some
exceptions and I'm gonna try to do this
on my network and then show you guys one
of my favorite tools let's see if it
works yeah alright success we have
successfully created firewall exceptions
so the last step is to use a VPN of some
sort now VPNs are a really good way to
prevent local sniffing so even if
somebody gets the IP are the password to
the network that you're on and starts
sniffing the traffic they still won't be
able to detect what you're doing and
that goes for your internet service
provider as well basically all anyone
will see is a bunch of encrypted garbage
because your service your connection is
actually being piped over to a different
endpoint and you can choose to do that
pretty much anywhere in the world now
mul vad is my VPN of choice and I really
like it because it's a fast way of just
hiding your connection and they also you
can just mail them a check full cache if
you want to as a method of payment they
accept Bitcoin and a bunch of other
stuff
although I know there's a lot of people
that like private Internet access Pia
and there's a lot of other good VPNs out
there as well I recommend you to do your
own research but for beginners I think
Pia is a really great service and for
people who want to just mail in an
envelope full of cash mole VAT is a
really cool and interesting service that
I encourage you guys to check out so
that is how you can lock down your bun
to computer it's also how you can
protect your local connection on pretty
much any computer with a service that
offers a VPN connection that you like
and trust because the most important
thing to remember is that while a VPN
connection may be secure it always comes
down to whether or not you trust the
service that's running it so services
like proton VPN are also known for being
secure and people trust them but the
mole bad service and then Pia are both
perfectly trustworthy as well in my view
I would recommend you do your own
research the steps we've taken on your
Ubuntu device today will minimize its
attack surface when it's connected to a
network but don't take that to mean that
the network security is perfect or that
we've solved any number of problems that
can come along from doing something like
opening a malicious application now in
the next guide will actually take on
sandboxing applications and restricting
them from doing things that might be
malicious but today we've taken care of
things like anonymizing our box making
sure that we take care of any services
we're not using and all in all taking a
look at the attack surfaces we can
remove without stripping away too much
function now if any of this went too far
you can also check out the null byte
article in the description to maybe walk
back that firewall description if you
can manage to get to the internet after
you set it up that's all we have for
this episode of cyber weapons lab make
sure to LIKE comment and subscribe and
if you have any ideas for future
episodes send me a message on Twitter
because they'd love to hear from you
we'll see you next time