Threat Modeling and Risk Management Linux

Since this book is about building secure Linux Internet servers from the ground up, you’re probably expecting system-hardening procedures, guidelines for configuring applications securely, and other very specific and low-level information. And indeed, subsequent chapters contain a great deal of this.
But what, really, are we hardening against? The answer to that question is different from system to system and network to network, and in all cases, it changes over time. It’s also more complicated than most people realize. In short, threat analysis is a moving target.
Far from a reason to avoid the question altogether, this means that threat modeling is an absolutely essential first step (a recurring step, actually) in securing a system or a network. Most people acknowledge that a sufficiently skilled and determined attacker[1] can compromise almost any system, even if you’ve carefully considered and planned against likely attack-vectors. It therefore follows that if you don’t plan against even the most plausible and likely threats to a given system’s security, that system will be particularly vulnerable.
[1] As an abstraction, the "sufficiently determined attacker" (someone theoretically able to
compromise any system on any network, outrun bullets, etc.) has a special place in the
imaginations and nightmares of security professionals. On the one hand, in practice such people
are rare: just like "physical world" criminals, many if not most people who risk the legal and social
consequences of committing electronic crimes are stupid and predictable. The most likely
attackers therefore tend to be relatively easy to keep out. On the other hand, if you are targeted
by a skilled and highly motivated attacker, especially one with "insider" knowledge or access,
your only hope is to have considered the worst and not just the most likely threats.
This chapter offers some simple methods for threat modeling and risk management, with real-life examples of many common threats and their consequences. The techniques covered should give enough detail about evaluating security risks to lend context, focus, and the proper air of urgency to the tools and techniques the rest of the book covers. At the very least, I hope it will help you to think about network security threats in a logical and organized way.

Change Text on XP Start Button XP Trick

Step 1 - Modify Explorer.exe File

In order to make the changes, the file explorer.exe located at C:\Windows needs to be edited. Since explorer.exe is a binary file it requires a special editor. For purposes of this article I have used Resource Hacker. Resource HackerTM is a freeware utility to view, modify, rename, add, delete and extract resources in 32bit Windows executables and resource files (*.res). It incorporates an internal resource script compiler and decompiler and works on Microsoft Windows 95/98/ME, Windows NT, Windows 2000 and Windows XP operating systems.

get this from h**p://delphi.icm.edu.pl/ftp/tools/ResHack.zip

The first step is to make a backup copy of the file explorer.exe located at C:\Windows\explorer. Place it in a folder somewhere on your hard drive where it will be safe. Start Resource Hacker and open explorer.exe located at C:\Windows\explorer.exe.

The category we are going to be using is "String Table". Expand it by clicking the plus sign then navigate down to and expand string 37 followed by highlighting 1033. If you are using the Classic Layout rather than the XP Layout, use number 38. The right hand pane will display the stringtable. We’re going to modify item 578, currently showing the word “start” just as it displays on the current Start button.

There is no magic here. Just double click on the word “start” so that it’s highlighted, making sure the quotation marks are not part of the highlight. They need to remain in place, surrounding the new text that you’ll type. Go ahead and type your new entry. In my case I used Click Me!

You’ll notice that after the new text string has been entered the Compile Script button that was grayed out is now active. I won’t get into what’s involved in compiling a script, but suffice it to say it’s going to make this exercise worthwhile. Click Compile Script and then save the altered file using the Save As command on the File Menu. Do not use the Save command – Make sure to use the Save As command and choose a name for the file. Save the newly named file to C:\Windows.


Step 2 – Modify the Registry

!!!make a backup of your registry before making changes!!!

Now that the modified explorer.exe has been created it’s necessary to modify the registry so the file will be recognized when the user logs on to the system. If you don’t know how to access the registry I’m not sure this article is for you, but just in case it’s a temporary memory lapse, go to Start (soon to be something else) Run and type regedit in the Open field. Navigate to:

HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows NT\ CurrentVersion\ Winlogon

In the right pane, double click the "Shell" entry to open the Edit String dialog box. In Value data: line, enter the name that was used to save the modified explorer.exe file. Click OK.

Close Registry Editor and either log off the system and log back in, or reboot the entire system if that’s your preference. If all went as planned you should see your new Start button with the revised text.[/b]

Single Users vs. Multiusers vs. Network Users

Single Users vs. Multiusers vs. Network Users
Windows was designed according to the “one computer, one desk, one user” vision ofMicrosoft’s
cofounder Bill Gates. For the sake of discussion, I’ll call this philosophy single-user. In this
arrangement, two people cannot work in parallel running (for example) Microsoft Word on the
same machine at the same time. Using Terminal Services in Windows 2000 or Windows XP
allows remote use of one computer from another but is still bound by the single-user paradigm.
The Windows .NET Server products, which are unfinished as of this writing, continue to add
terminal features to enable more than one user to access the server simultaneously.
Linux borrows its philosophy from UNIX. When UNIX was originally developed at Bell
Labs in the early 1970s, it ran on a PDP-7 computer that needed to be shared by an entire
department. It required a design that allowed multiple users to log in to the central machine at
the same time. Various people could edit documents, compile programs, and do other work
at the exact same time. The operating system on the central machine took care of the “sharing”
details, so that each user seemed to have an individual system. This multiuser tradition
continues through today, on other UNIXs as well. And since Linux’s birth in the early 1990s,
it has supported the multiuser arrangement.

Today, the most common implementation of a multiuser setup is to support servers—
systems dedicated to running large programs for use by many clients. Each member of a
department can have a smaller workstation on the desktop, with enough power for day-to-day
work. When they need to do something requiring significantly more CPU power or memory,
they can run the operation on the server.
Linux, Windows 2000, and Windows .NET Server are all capable of providing services
such as databases over the network. Users of this arrangement can be called network users,
since they are never actually logged in to the server but rather send requests to the server. The server does the work and then sends the results back to the user via the network. The catch in this case is that an application must be specifically written to perform such server/client duties. Under Linux, a user can run any program allowed by the system administrator on the server without having to redesign that program. Most users find the ability to run arbitrary programs on other machines to be of significant benefit.