How to Connect to your ECS Instances Securely?

Continue from the story of the previous blog posts - How to Secure Your ECS Instances with Alibaba Cloud Security Center and How to Remove Donald Trump Virus/Script from Linux? I would like to share one more feature that I mentioned I was lazy to implement which lead to give opportunity to the hacker to brute force attack my Linux root account.

If you are Alibaba Cloud, AWS or any other similar cloud service provider user, when you are trying to provision an ECS instance, you will be given the choice of setting up the logon credential with key pair or password like the following screen.

If you are lazy like me and set the logon credential with password, then you will face the risk of root account being brute force attack.

So, what if you already setup the server with password credential, then you can actually still able to make thing right now.

Generate Key Pair

First, you need to generate a key pair for your account which is used to connect to the server by opening the PuTTYgen software.

Hit the Generate button, then move your mouse around this area for it to generate random value:

Until you see the following screen, then enter the key comment as your username to differentiate the accounts. Then, the key passphrase will be the password that you need to key in while connecting to the server which actually does the decryption.

Save a copy of the private key, it is required to be imported to the Putty authorization profile later.

Configure PuTTY

Now, open PuTTY then enter the server IP address, then go to Connection menu -> SSH -> Auth, browse and select the saved private key.

Now, go back to the main screen, save the session.

When you connect to the server, you will be prompted to key in the passphrase that you had set earlier while generating private key in the PuTTYgen software.

Enable SSH Root Access With Key

Go to /etc/ssh path, then open text editor to edit the sshd_config file.

sudo vi /etc/ssh/sshd_config

Uncommet the PermitRootLogin and change the value from prohibit-password to without-password

Finally, restart the sshd service to make it take effect

service sshd restart

Now, you can try to login to the server with root password, it should not be accessible now.

Summary

After setting up the SSH authorization method to key pair, your root account is at least safe from brute force attack. For even tighter security, I would advice you to setup a Security Group in Alibaba Cloud to whitelist a range of IP addresses that suppose to be allowed to access the server only.

How To Secure Your Alibaba Cloud ECS Instances?

Today I would like to share with you about how to secure your Alibaba Cloud ECS instances. Recently, I had been going through a lot about security issues with my servers, hence writing this blog to keep a record of what security measurement that I had done.

If you are an Alibaba Cloud user, have you ever seen or use the feature of Security Center that you may find in the cloud dashboard? It is free to use, and not sure if you have received any email notification about the security threat or risk about your server that need action? The email subject usually are "Threat Detection Service Unhandled Vulnerabilities Weekly Report" or "Threat Detection Service Security Events Notification".

If you have received any of the email notification related to Threat Detection, I would advice you to login to your Alibaba Cloud Console and go to the Security Center to check out what had happened to your server.

Security Center basic edition is free to use but with limited feature. If your budget allow and host business critical public facing servers, I strongly recommend subscribe the protection service. You save the hassles from monitoring and attack prevention.

Notice the Urgent Vulnerabilities suggestion on top of the dashboard? You can simply click it to enter the detail page, and then scan all your servers to check if any of them prone to any of the suggested vulnerabilities.

After done the vulnerabilities scanning, go to the Alert section to check out what had happened to your servers. You may find the list of all the threat detection on your servers here.

If you had read my previous post about my servers were attacked and injected with crypto mining scripts call Donald and Trump, then now you can see all the attack trails are showing in the Security Center. If you encountered the similar problem with crypto mining software injection, you may want to checkout my previous post to learn how to remove them HERE.

The cron job details also had been tracked successfully.

You also can further trace who actually logged in to your server and injected the script. From there, it tells the crypto mining scripts were not simply injected out from no where. Someone actually obtained the correct password to access my server. The details reveal the IP and location of the attacker.

I have another server being attacked by ransomware. The server crypto wallet and SQL Server database had been encrypted. Luckily it was just a test server, there is no impact to me.

From the Security Center, I can see that the server was being accessed through normal RDP.

We also can see how and what the attacker done to my server, first he download a ransomware script from some website and then execute some powershell command to perform the encryption.

In summary, whatever the hacker had done to the server cannot be undone. I do not blame the hacker, I blame myself for being careless. Also, the root cause investigation had been narrowed down to password access to the server to inject script and ransomware. Therefore, I suspect the strong password generator website that I usually use actually keep a copy of generated password in their database.

https://strongpasswordgenerator.com/
https://passwordsgenerator.net/

I strongly suggest anyone of you stop using the online random password generator. Prevention is very important. Lesson learned and I shall further strengthen the servers security and redesign my network architecture. In my new network architecture design, all the servers are locked down. In order to RDP or SSH access to the servers, I must connect to a proxy server first in order to access other servers. With this setup, proxy server become the only target to be attacked. Therefore, I only need to manage and monitor only one server.

Also, pay attention closely to the email alert sent by the Alibaba Cloud Security Center. When illegal logon activity happen, we need to take action immediately to investigate.

I also recommend you to subscribe the Security Center at least Advanced package. You may check out the package difference here. You can also click at this LINK to get a discount for the subscription.

How to Remove Donald Trump Virus/Script from Linux?

Today have been a bad day, at 3AM in the morning, received an email alert from Alibaba Cloud indicating successful brute force attacks to a few of my ECS servers. It was my mistake for not changing the server SSH default port, given the chance to the hacker to brute force attack my server access.

I discover what the hacker did to my ECS server is creating a cron job that constantly compile and generate 2 executable scripts call Donald and Trump. The scripts spike my server CPU to 100% and affecting my other application process being slow in performance.

How do I find the root if you ask me? Just run the top command and then press C, you will see the Donald script is running and eating the 100% CPU and also its source location. However, I spotted there is an unknown suspicious process actively running as well.

By deleting Donald and Trump executable scripts will not solve the problem. I discover that there is a cron job running to automatically compile and create both Donald and Trump scripts after a while.

So, I run the systemctl status command in order to further trace which and where actually started the process.

systemctl status <PID>

As you can see from the above screenshot, the culprits are:
/tmp/Donald
/usr/bin/ujwofa5

Also note that there is a cron job actually execute ujwofa5. Therefore, we need to remove all the executable scripts and cron job as well.

In order to trace the cron job, just run crontab -l command
For deleting the cron job, run crontab -r command
You may want to stop the cron job if you dont need it at all, just run service crond stop

Now, remove the Donald script and ujwofa5 by executing rm command. Then, kill both processes.

Now, you need to reboot the server in order to permanently remove the script to take effect. After server get back online, you can run top command again to monitor and see if the Donald or Trump script appear again. If everything goes normally, then the problem is considered solved.

It was lucky that Alibaba Cloud sent me email notification about suspicious login to my server actually triggered me to check what's wrong. Lesson learned that I should not being lazy even the server is not important, I should change the SSH default port.

For your knowledge how to change SSH default port, just login to the server again. Open up the SSH config file by executing command vi /etc/ssh/sshd_config

Modify the file by removing the # comment at the Port 22 row, then change the value 22 to your desire port number. Once done, save the file and then restart the SSH service by executing service sshd restart

Now, the server is resume back to normal. Let me know if this helpful, and note that the cron job script name is random and different from each server. You cannot assume your cron job script name is ujwofa5.

The Security of FiiiPay & FiiiPOS

On June 5th and 6th, me and my marketing team colleagues attended the Singapore Smart Nation Innovation / Innovfest Unbound event, setting up booth and pitch to promote our FiiiPOS and FiiiPay. We received a lot very useful feedback and comment about our product. The most frequently asked question is related to security which I would like to explain more in this post.

HTTPS

Firstly, the most common way to secure a communication channel is to use encryption. Our POS terminal and digital wallet communicate with our payment gateway API using SSL. It is to prevent user data from being leaked when users or merchants are connecting their devices to a public WiFi. You do not know there may be someone who is also connecting to the same WiFi network implanted some sniffing script to the router to monitor the network traffic. If the communication is not encrypted, the hacker can see the data flow between your POS terminal or digital wallet.

Image via contextis.com

Therefore, we strongly encourage our merchant who is using our FiiiPOS terminal not to connect to a public free WiFi hotspot, but putting up a SIM card into the POS terminal to use own network instead.

DNSSEC

All our public domain are protected with Domain Name System Security Extension (DNSSEC). It is a mechanism to prevent hackers from hijacking the DNS and faking the response data to the user, which is known as man-in-the-middle attacks.

Image credit to Michael Earls

Firewall & DMZ

FiiiPay and FiiiPOS servers are secured with perimeter network (known as Demilitarized Zone - DMZ). All the servers are protected with firewall rules that locked down most of the network port access. The common default ports are being changed to random port to prevent hackers from using brute force attack to guess remote access password.

The web and API servers are separated from the database servers where by the public access servers sit in the DMZ but the database server sit in the trusted zone or local area network which restricted to be accessed by the dedicated servers and IP addresses only.

The Vault

With the firewall setup above, all our cryptocurrency nodes are being protected and the nodes access are being restricted. We call it the vault as it can only be accessed by the approved staffs. The servers password are changed frequently and it is strongly type password. The cryptocurrency private key are backed up regularly.

Full Disk Encryption

All the servers storage such as hard disks and solid state disks are all fully encrypted. The servers are setup in a remote data center managed by the service provider. The servers contain the very valuable cryptocurrency private keys. In order to prevent the system engineer in the data center access to the server disks, the disks are fully encrypted. So that, it could prevent the system engineer from trying to unplug the disk and put it into another server or computer to attempt to obtain the private key.

Mobile Application Digital Signature

All the FiiiPay and FiiiPOS application are digitally signed and published to the application store. FiiiPOS application can only be installed to the POS terminal. Hacker cannot install any malware, script, key logger or applet to the POS terminal physically or remotely. So the chances of Spectre and Meltdown exploit is very low and near impossible.

Two Factor Authentication (2FA)

FiiiPay & FiiiPOS provide optional feature for the users and merchants to enable which is the two factor authentication. By default, SMS authentication is enabled. When user or merchant attempt to withdraw cryptocurrency out from the digital wallet, they need to provide the OTP from the received SMS.

We also provide optional Google Authenticator and email authentication option for 2FA in order to reduce the risk of user crypto being stolen by the hacker who has cracked the user password and gained access to the user account.

Artificial Intelligent

FiiiFinance will be equipped with machine learning capability to review all the crypto withdrawal request submitted by the FiiiPay and FiiiPOS users. It collect all the withdrawal timestamp, IP address, geolocation, device ID, operating system, withdrawal amount, crypto type, etc data. Based on the user app usage behavior, pattern and the withdrawal request history, it can raise alert to the finance team and put the withdrawal transaction on hold for human review when it detect unusual activity for a particular account. This security measurement can ensure the lower risk of the crypto to be stolen by the hacker who has gained access to a FiiiPay/FiiiPOS user account.

Payment Code Algorithm

The QR code, Bluetooth and NFC payment mechanism actually rely on HMAC (hash-based message authentication code) to generate the unique OTP which is impossible forge and brute force attack. The generated payment code is always unique to different account at different time and it will be valid for a short period of time.

Summary

Our system architecture are setup in enterprise standard. Our customer digital asset and data are the utmost important, hence we are very serious and invest heavily on system and network security. Cyber security is always the hot topic in blockchain world as we occasionally read the news about X exchange platform had been hacked and lost X million of USD worth of cryptocurrency. We ensure this tragedy will not happen in our platform.

If you are a cyber security expert or ethical hacker, please drop me a message by connecting to me at LinkedIn. We are planning for a hackathon event for our product to look for security exploit.

iOS - AppStore
Android - PlayStore

If you are interested in our multi-cryptocurrency POS machine - FiiiPOS, please drop me an email at sylvester.lee@fiiipay.com

If you are interested in our project, please visit our website at https://fiii.io

Facebook - https://www.facebook.com/fiiipay/
Telegram - https://t.me/fiiicoin