DOCSLIB.ORG

IRMA Documentation Release 2.0.4

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
IRMA Documentation Release 2.0.4 IRMA Documentation Release 2.0.4 Quarkslab Jan 24, 2018 Contents 1 Introduction 3 1.1 Purpose..................................................3 1.2 File Analysis Process...........................................3 1.3 Infrastructure Overview.........................................4 1.4 Hardware requirements.........................................5 1.5 Supported Analyzers...........................................6 2 Automated Install 9 2.1 Requirements...............................................9 2.2 Ansible scripts..............................................9 2.3 Predefined Environments.........................................9 2.4 Using Debian repos........................................... 12 3 Manual Installation 13 3.1 Brain................................................... 13 3.2 Frontend................................................. 22 3.3 Probe................................................... 31 4 Database migration 41 4.1 Requirements............................................... 41 4.2 Content.................................................. 41 4.3 Usage................................................... 42 4.4 Tips and tricks.............................................. 44 5 To evolve IRMA 47 5.1 Adding a new probe........................................... 47 6 References 51 6.1 Disclaimer................................................ 51 6.2 License.................................................. 51 6.3 Apache License, version 2.0....................................... 51 6.4 Authors.................................................. 51 7 Frequently Asked Questions 53 7.1 Playing with tags............................................. 53 7.2 SSL settings............................................... 56 7.3 How to debug............................................... 57 i 7.4 How to migrate.............................................. 60 7.5 API documentation............................................ 61 7.6 Connect to a vagrant box through ssh.................................. 63 7.7 Enable SSL using OpenSSL in ansible scripts.............................. 63 7.8 Speed up your Vagrant VMs....................................... 64 8 Resources 65 9 Screenshots 67 9.1 Command Line Interface......................................... 67 9.2 Web Interface............................................... 68 ii IRMA Documentation, Release 2.0.4 IRMA is an asynchronous & customizable analysis system for suspicious files. This guide will explain how to set up IRMA, use it and customize it at will. Contents 1 IRMA Documentation, Release 2.0.4 2 Contents CHAPTER 1 Introduction This is an introductory chapter to IRMA. It recalls IRMA’s overall architecture, hardware required to run it and the recommended order for installing the IRMA’s components. 1.1 Purpose IRMA intends to be an open-source platform designed to help identifying and analyzing malicious files. However, today’s defense is not only about learning about a file, but it is also getting a fine overview of the incident you dealt with: where / when a malicious file has been seen, who submitted a hash, where a hash has been noticed, which anti-virus detects it, . An important value with IRMA comes from you keep control over where goes and who gets your data. Once you install IRMA on your network, your data stays on your network. Each submitted files is analyzed in various ways. For now, we focus our efforts on multiple anti-virus engines, but we are working on other “probes” (feel free to submit your own). 1.2 File Analysis Process 1. An analysis begins when a user uploads files to the Frontend. 2. Frontend checks for existing files and results in SQL. If needed, it stores the new files and calls asynchronously scan jobs on Brain. 3. Brain worker sends as much subtasks to Probe(s) as needed. 4. Probe workers process their jobs and send back results to Brain. 5. Brain sends results to Frontend. 3 IRMA Documentation, Release 2.0.4 1.3 Infrastructure Overview A drawing is better than a lot of explanations (sometimes ;) 4 Chapter 1. Introduction IRMA Documentation, Release 2.0.4 1.4 Hardware requirements IRMA platform is divided in three major components: the Frontend, the Brain and one or multiple Probes. These three components can be installed on a unique host or on multiple hosts, according to the kind of probes you are using. The Frontend and the Brain must be installed on a GNU/Linux system1. We recommend to use a Debian Stable distribution which is supported and known to work. According to the kind of probes and their dependencies, each analyzers can be installed on a separate hosts or share 1 Theorically, it should be possible, with some efforts, to make IRMA work on Microsoft Windows systems as most of the components used for the platform are known to work or to have equivalents on these systems. 1.4. Hardware requirements 5 IRMA Documentation, Release 2.0.4 the same host as far as they do not interfere with each other2. So forth, only Debian Stable and Microsoft Windows 8 and 10 hosts have been tested. We can not give you any specific numbers. On one hand we managed to run the whole IRMA platform on a single machine by hosting it with multiple systems inside virtual machines: this setup gives fairly high throughput as long as it has reasonable IO (ideally, SSDs), and a good amount of memory (our setup was an i7 cpu with 16 GB ram on regular drives (at least 200 GB required), on the other hand, a lighter version of the system with the three parts together3 was successfully installed on a single virtual machine (1 GB of Ram and 4 virtual processors). For a large company, in theory, given a single high-memory machine, with 16+ cores, and SSDs, you could run IRMA platform and bear the workload load with reasonable response time. 1.5 Supported Analyzers We have mainly focused our efforts on multiple anti-virus engines but we are working on other kind of “probes”. We enumerate the analyzers that are bundled with IRMA probe application. Feel free to submit your own probes. 1.5.1 Antiviruses So far, we have instrumented the following antiviruses from their CLI: Probe Name Anti-Virus Name Platform ASquaredCmd Emsisoft Command Line Microsoft Windows CLI Avira Avira Microsoft Windows CLI AvastCoreSecurity Avast GNU/Linux CLI AVGAntiVirusFree AVG GNU/Linux CLI BitdefenderForUnices Bitdefender GNU/Linux CLI ClamAV ClamAV GNU/Linux CLI ComodoCAVL Comodo Antivirus for Linux GNU/Linux CLI DrWeb Dr.Web GNU/Linux CLI EsetNod32 Eset Nod32 Business Edition GNU/Linux CLI EScan eScan GNU/Linux CLI FProt F-Prot GNU/Linux CLI FSecure F-Secure GNU/Linux CLI GData G Data Antivirus Microsoft Windows CLI Kaspersky Kaspersky Internet Security Microsoft Windows CLI McAfeeVSCL McAfee VirusScan Command Line GNU/Linux - Microsoft Windows CLI Sophos Sophos GNU/Linux - Microsoft Windows CLI Symantec Symantec Endpoint Protection Microsoft Windows CLI VirusBlokAda VirusBlokAda GNU/Linux CLI Zoner Zoner Antivirus GNU/Linux CLI 1.5.2 External analysis platforms So far, we query the following external analysis platforms: 2 For instance, we managed to host several GNU/Linux anti-viruses on an unique probe by preventing it to launch daemons at startup. This is difficult for Microsoft systems on which it is not recommended to install multiple anti-viruses on a single host. 3 with a limited set of probes 6 Chapter 1. Introduction IRMA Documentation, Release 2.0.4 Probe Name Analysis Platform Description VirusTotal VirusTotal Report is searched using the sha256 of the file which is not sent 1.5.3 File database So far, we query the following file databases: Probe Database Description Name NSRL National Software Reference Li- collection of digital signatures of known, traceable software ap- brary plications 1.5.4 Metadata So far, we implemented the following analyzers: Probe Name Description StaticAnalyzer PE File analyzer adapted from Cuckoo Sandbox PEiD PE File packer analyzer Yara Checks if a file match yara rules 1.5. Supported Analyzers 7 IRMA Documentation, Release 2.0.4 8 Chapter 1. Introduction CHAPTER 2 Automated Install IRMA platform can be easily installed with a set of ansible roles and playbooks. It will help you to build, install or maintain different setups. 2.1 Requirements • Ansible 2.2.1.0; 2.2 Ansible scripts Get IRMA ansible scripts on github: $ git clone https://github.com/quarkslab/irma $ cd irma/ansible 2.3 Predefined Environments There are 2 different IRMA setups available. Dev/Testing will be installed in one or multiple virtual machines while production could be used to install IRMA on physical machines or virtual machines already setup: 2.3.1 Development environment This environment has been designed to help you to modify IRMA’s components and redeploy and test them. In this setup, everything is installed in a single virtual machine with sources rsync-ed between the host and the guest. 9 IRMA Documentation, Release 2.0.4 Requirements • Vagrant 1.8 or higher has to be installed • As the installation work only for Virtualbox, you will need to install it • Rsync to synchronize directories from host to VMs • Read the Ansible introduction Run Vagrant and create your VMs To initialize and provision the Virtualbox VM. $ cd <IRMA_SRC_DIR>/ansible $ VM_ENV=your_environment_name vagrant up The template will be downloaded automatically and configured using environments/dev.yml file. Note: Optionally, if you want to use your own environment, create it in environments directory and run: $ VM_ENV=your_environment_name vagrant up Configure your .ini files Note: You can bypass this step, as this
Load more

Recommended publications
  • DEFINICIÓN Un Antivirus
    ANTIVIRUS DEFINICIÓN Un antivirus es un programa de computadora cuyo propósito es combatir y erradicar los virus informáticos. Para que el antivirus sea productivo y efectivo hay que configurarlo cuidadosamente de tal forma que aprovechemos todas las cualidades que ellos poseen. Hay que saber cuales son sus fortalezas y debilidades y tenerlas en cuenta a la hora de enfrentar a los virus. Un antivirus es una solución para minimizar los riesgos y nunca será una solución definitiva, lo principal es mantenerlo actualizado. Para mantener el sistema estable y seguro el antivirus debe estar siempre actualizado, tomando siempre medidas preventivas y correctivas y estar constantemente leyendo sobre los virus y nuevas tecnologías. ¿CÓMO FUNCIONA? Básicamente, un antivirus compara el código de cada archivo con una base de datos de los códigos (también conocidos como firmas o vacunas) de los virus conocidos, por lo que es importante actualizarla periódicamente a fin de evitar que un virus nuevo no sea detectado. También se les ha agregado funciones avanzadas, como la búsqueda de comportamientos típicos de virus (técnica conocida como Heurística) o la verificación contra virus en redes de computadores. Normalmente un antivirus tiene un componente que se carga en memoria y permanece en ella para verificar todos los archivos abiertos, creados, modificados y ejecutados en tiempo real. Es muy común que tengan componentes que revisen los adjuntos de los correos electrónicos salientes y entrantes, así como los scripts y programas que pueden ejecutarse en un navegador web (ActiveX, Java, JavaScript). ALGUNOS ANTIVIRUS 1 CLAM ANTIVIRUS Comodo AntiVirus FProt Antivirus FSecure AntiVirus ZoneAlarm Antivirus ANTIVIRUS HEURISTICOS Los heurísticos analizan el código de cada archivo con métodos genéricos y detectan virus nuevos que todavía no se han incluido en la base de datos de virus del programa antivirus.
    [Show full text]
  • Clam Antivirus: Open-Source Virus Protection
    Clam Antivirus: Open-Source Virus protection Michaël Van Canneyt March 16, 2014 Abstract Protecting your precious PC against email and other viruses doesn’t have to cost a lot of money: Clam Antivrus is an open source virus scanner which can be installed on Unix machines (suitable for integration in mail server’s MTAs) but which also has a Windows version for those that are not fortunate enough have a Unix at hand. Introducing Clam Antivirus Clam Antivirus is an open-source implementation of a virus scanner which does 1 thing only: it scans a file for known viruses. The virus scanner consists of 2 parts: One is the actual scanner, clamscan: It scans a file to see whether it is infected with a known virus. It reports on the found viruses. The known viruses are kept in a database file. The second part (freshclam) serves to keep this database up-to-date: new viruses are born every day, and existing viruses mutate to more dangerous forms regularly, it is therefore of the utmost importance to keep the database with virus definitions up-to-date. The freshclam program should be run on a regular basis, for instance in a cron job on Unix. The Unix version features also a client/server model: The scanner runs as a daemon. The clamscan program then sends the file to be scanned to the daemon, for inpection. This reduces startup time and system load, which is quite important on servers than run a heavy- load MTA service. On Windows, a small GUI frontend exists which allows to perform and schedule scans, and to perform and schedule the virus database update.
    [Show full text]
  • Linux Security Review 2015
    Linux Security Review 2015 www.av-comparatives.org AV-Comparatives Linux Security Review Language: English May 2015 Last revision: 26 th May 2015 www.av-comparatives.org -1- Linux Security Review 2015 www.av-comparatives.org Contents Introduction ....................................................................................................................... 3 Reviewed products ............................................................................................................... 4 Malware for Linux systems ..................................................................................................... 5 Linux security advice ............................................................................................................ 6 Items covered in the review .................................................................................................. 7 Avast File Server Security ...................................................................................................... 8 AVG Free Edition for Linux.................................................................................................... 11 Bitdefender Antivirus Scanner for Unices ................................................................................ 13 Clam Antivirus for Linux ....................................................................................................... 17 Comodo Antivirus for Linux .................................................................................................. 20 Dr.Web Anti-virus for
    [Show full text]
  • Characterizing Antivirus Workload Execution
    Characterizing Antivirus Workload Execution Derek Uluski, Micha Moffie and David Kaeli Computer Architecture Research Laboratory Northeastern University Boston, MA {duluski,mmoffie,kaeli}@ece.neu.edu Abstract head is introduced if we enable anti-virus scan- ning. Many users are unhappy with the per- Despite the pervasive use of anti-virus (AV) formance penalty they must pay for security. software, there has not been a systematic The amount of overhead introduced can be study of the characteristics of the execution of so significant that many users will defer virus this workload. In this paper we present a char- scanning or totally disable their anti-virus soft- acterization of four commonly used anti-virus ware. Then their system will be vulnerable to software packages. Using the Virtutech Simics viruses. Thus, it is important to address the toolset, we profile the behavior of four popu- performance overhead associated with anti- lar anti-virus packages as run on an Intel Pen- virus software execution. tiumIV platform running Microsoft Windows- Most anti-virus software packages employ a XP. range of scanning techniques to decide whether In our study, we focus on the overhead in- or not a given file is infected. More complex troduced by the anti-virus software during on- techniques also exist such as: sandboxing, dig- access execution. The overhead associated ital watermarking, and heuristic-based tech- with anti-virus execution can dominate overall niques [11]. performance. The AV-Test group has already There are two main usage models when run- reported that this overhead can range from 23- ning anti-virus software, 1) on-demand,and2) 129% on live systems running on-access exper- 1 on-access.
    [Show full text]
  • Anti-Virus Outbreak Response Testing and Impact
    Insecurity in Security Software Maik Morgenstern Andreas Marx AV-Test GmbH http://www.av-test.org Virus Bulletin 2005 Conference presentation about “Insecurity in Security Software” Copyright © 2005 AV-Test GmbH, Klewitzstr. 6, D-39112 Magdeburg, Germany Phone: +49 391 6075460, Fax: +49 391 6075469, http://www.av-test.org Table of content z The paradox z Types of security software z Comparison of CVE advisories z Examples of bugs and security vulnerabilities z Why bugs occur z Vulnerability lifecycle z What to do? (for users and developers) z Trustworthy computing security development lifecycle The paradox z All software products contain security vulnerabilities (and other bugs) z AV software is widely deployed to protect companies, organizations and home users z Every week, security flaws are discovered in different AV products z The paradox: Security software is meant to secure the system, but nowadays it introduces new security holes. Types of security software z Two different groups of security software: – Home and business user software (widely used) z Firewalls z IPSec products z IDS/IPS z AV software… – Tools used by researchers (small deployment) z IDA Pro z OllyDbg z Softice… CVE advisories for vendor products (2001 quarterly average = 100, Source: © The Yankee Group) z Microsoft / Security vendors / All vendors Bugs leading to security vulnerabilities z A couple of examples from recent months (advisory titles): – ISS and the Witty Worm – Trend Micro VSAPI ARJ parsing – McAfee Virus Library – Symantec Multiple Products UPX Parsing Engine Heap Overflow – Computer Associates Vet Antivirus Library Remote Heap Overflow – Kaspersky AntiVirus "klif.sys" Privilege Escalation Vulnerability – OllyDbg "INT3 AT" Format String Vulnerability – DataRescue IDA Pro Dynamic Link Library Format String Vulnerability – Clam AntiVirus ClamAV Cabinet File Handling DoS Vulnerability Bugs vs.
    [Show full text]
  • Clam Antivirus 0.100.2 User Manual Contents 1
    Clam AntiVirus 0.100.2 User Manual Contents 1 Contents ClamAV User Manual, 87d 88d 89d c 2018 Cisco Systems, Inc. Authors: Tomasz Kojm This document is distributed under the terms of the GNU General Public License v2. Clam AntiVirus is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. ClamAV and Clam AntiVirus are trademarks of Cisco Systems, Inc. 1 Introduction 2 1 Introduction Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX, designed espe- cially for e-mail scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. The core of the package is an anti-virus engine available in a form of shared library. 1.1 Features • Licensed under the GNU General Public License, Version 2 • POSIX compliant, portable • Fast scanning • Supports on-access scanning (Linux only) • Detects over 1 million viruses,
    [Show full text]
  • An Innovative Custom Cyber Security Solution for Protecting Enterprises and Corporates’ Assets
    An Innovative Custom Cyber Security Solution for Protecting Enterprises and Corporates’ Assets Karim Ouazzane*, Markson Aigbodi, Daniel Mitchell, Vassil Vassilev School of Computing, London Metropolitan University E-mail: [email protected], [email protected], [email protected], [email protected] Jun Li Department of Oncology, University of Oxford E-mail: [email protected] Abstract Anti-virus software has been the main defense against malicious application and will remain so in the future. However the strength of an anti-virus product will depend on having an updated virus signature and the heuristic engine to detect future and unknown virus. The time gap between an exploit appearing on the internet and the user receiving an update for their anti-virus signature database on their machine is very crucial. Having a diverse multi-Engine anti-virus scanner in the infrastructure with the capability for custom signature definition as part of a defence in-depth strategy will help to close that gap. This paper presents a technique of deploying more than one anti-virus solution at different layers and using custom anti-virus signature which is deployed in a custom proxy solution as part of a defence in-depth strategy. Keywords: Anti-virus, ClamAV, Malware, defence in-depth, Portable Executable (PE), Cyber security. Introduction Malicious applications like virus, worm, Trojan, Spamming and phishing tools can infect and destroy information in a user’s computer through means that the user utilizes in communicating on the internet. Email, File attachment, web surfing or file transfer on the internet either with a desktop or a smart phone are just a few of the many ways that potential harmful applications called Malware (Norton, 2012) can be introduced into the network.
    [Show full text]
  • Antivirus Software Anti Virus
    ANTIVIRUS SOFTWARE ANTI VIRUS Antivirus (or anti-virus) software is used to prevent, detect, and remove malware, including computer viruses, worms, and Trojan horses. Such programs may also prevent and remove adware, spyware, and other forms of malware 6/20/2012 TechReg-WelkinRaja HISTORY OF ANTIVIRUS Most of the computer viruses that were written in the early and mid '80s were limited to self-reproduction and had no specific damage routine built into the code (research viruses) The first publicly documented removal of a computer virus in the wild was performed by Bernd Fix in 1987. Fred Cohen, who published one of the first academic papers on computer viruses in 1984, started to develop strategies for antivirus software in 1988 that were picked up and continued by later antivirus software developers. 6/20/2012 TechReg-WelkinRaja IDENTIFICATION METHODS There are several methods which antivirus software can use to identify malware. Signature based detection Heuristic-based detection 6/20/2012 TechReg-WelkinRaja SIGNATURE BASED DETECTION Signature based detection is the most common method. To identify viruses and other malware, antivirus software compares the contents of a file to a dictionary of virus signatures. This can be very effective, but cannot defend against malware unless samples have already been obtained and signatures created. Because of this, signature-based approaches are not effective against new, unknown viruses. Because new viruses are being created each day, the signature-based detection approach requires frequent
    [Show full text]
  • Clam Antivirus 0.88.2 User Manual Contents 1
    Clam AntiVirus 0.88.2 User Manual Contents 1 Contents 1 Introduction 6 1.1 Features.................................. 6 1.2 Mailinglists................................ 7 1.3 Virussubmitting.............................. 7 2 Base package 7 2.1 Supportedplatforms............................ 7 2.2 Binarypackages.............................. 8 2.3 Dailybuiltsnapshots ........................... 10 3 Installation 11 3.1 Requirements ............................... 11 3.2 Installingonashellaccount . 11 3.3 Addingnewsystemuserandgroup. 12 3.4 Compilationofbasepackage . 12 3.5 Compilationwithclamav-milterenabled . .... 12 4 Configuration 13 4.1 clamd ................................... 13 4.1.1 On-accessscanning. 13 4.2 clamav-milter ............................... 14 4.3 Testing................................... 14 4.4 Settingupauto-updating . 15 4.5 Closestmirrors .............................. 16 5 Usage 16 5.1 Clamdaemon ............................... 16 5.2 Clamdscan ................................ 17 5.3 Clamuko.................................. 17 5.4 Outputformat............................... 18 5.4.1 clamscan ............................. 18 5.4.2 clamd............................... 19 6 LibClamAV 20 6.1 Licence .................................. 20 6.2 Features.................................. 20 6.2.1 Archivesandcompressedfiles . 20 6.2.2 Mailfiles ............................. 21 Contents 2 6.3 API .................................... 21 6.3.1 Headerfile ............................ 21 6.3.2 Databaseloading . .. .. .. .. .. .
    [Show full text]
  • 2. Malware 3. ແນະນຳ Antivirus Software 4. Some of Information
    ຢຊ ຸເກະ ຄຕິ ະມຣຸ ະ Yusuke Kitamura 1. “Information security” ແມ່ ນຫງັ ຄ? 2. Malware 3. ແນະ ນຳ Antivirus software 4. Some of information attack 5. ກຳນຉ້ ຬຄລະວັ ຄຫນ້ ຬງຫ ່ນຄ “Information security” ຅ືກໃຫ້ຉວາມຫມາຆກາຊຮັກສາຄ ໍ່ ມາ3ຂອງຂໍ່າວສາຊໂ຃ຆISO/IEC27000 series. Confidentiality: Only person who has been allowed access to information can access information Integrity: To secure the state where information is not destroyed, altered or eliminated Availability: To be able to run system to continue ->ISMS(Information Security Management System) Malware is malicious code or software created with the intention of illegal and harmful operation. Computer virus: Program that spreads by infecting other files and act wrong Trojan horse: Gives a hacker remote access to a targeted computer system Worm: standalone malware program that replicates itself in order to spread to other computers Spyware: Software that collects user information and automatically sends it to information collector If you use USB, which is effective way against malware infection? 1. Connected through a USB hub, not a socket of main body. 2. Insert the USB while holding down SHIFT key. 3. Format USB before store data. ຃ຳຉຬບ:2!! 1. Connected through a USB hub, not a socket of main body. 2. Insert the USB while holding down SHIFT key. 3. Format USB before store data. E-mail Internet USB P2P software(Share, Winny) Short-cut virus Virus infect Degital camera (SD card) Flashback (infect MacOS) Macro virus (word, excel file) ເສງ຃່ ຳ Software Trend Micro Norton AntiVirus McAfee ESET NOD32 Kaspersky Anti-Virus ໃຫ້ ລ້ ຳ Software (ຈຽວໃຆ້ ສ່ ວນຉົ ວ) Avast! antivirus Avira Antivirus AVG Anti-Virus ໃຫ້ ລ້ ຳ Software(ໃຆ້ ວຽກໄຈ້ ) COMODO Internet Security Clam Antivirus Microsoft Security Essential Wiretapping: To use illegally obtain personal information, such as password.
    [Show full text]
  • Wazuh Ruleset
    [email protected] https://wazuh.com Wazuh Ruleset Rule Description Source Updated by Wazuh apache Apache is the world's most used web server software. Out of the box ✔ AppArmor is a Linux kernel security module that allows the system administrator to restrict programs's capabilities with per -program apparmor Out of the box ✔ profiles. arpwatch ARPWatch is a computer software tool for monitoring Address Resolution Protocol traffic on a computer network. Out of the box ✔ asterisk Asterisk is a software implementation of a telephone private branch exchange (PBX). Out of the box ✔ attack_rules.xml Signatures of different attacks detected by Wazuh Out of the box ✔ cimserver Compaq Insight Manager Server Out of the box ✔ cisco-ios Cisco IOS is a software used on most Cisco Systems routers and current Cisco network switches. Out of the box ✔ Clam AntiVirus (ClamAV) is a free and open-source, cross-platform antivirus software tool-kit able to detect many types of malicious clam_av software. Out of the box ✔ courier IMAP/POP3 server Out of the box ✔ dovecot Dovecot is an open-source IMAP and POP3 server for Linux/UNIX-like systems, written primarily with security in mind. Out of the box ✔ Dropbear is a software package that provides a Secure Shell-compatible server and client. It is designed as a replacement for standard dropbear OpenSSH for environments with low memory and processor resources, such as embedded systems. Out of the box ✔ FirewallD provides a dynamically managed firewall with support for network/firewall zones to define the trust level of networ k firewalld connections or interfaces.
    [Show full text]
  • Apoc@Lypse: the End of Antivirus
    Apoc@lypse: The End of Antivirus Rodrigo Ruiz Rogério Winter Kil Park Fernando Amatte i We are grateful to pixabay.com and Isabela Ganzert Ruiz for the images. We are grateful to CreateSpace. iii Technical Revision Kil Park Rogério Winter Rodrigo Ruiz Fernando Amatte Organization and Research Rodrigo Ruiz Codes Rodrigo Ruiz designed all codes in this book. Fernando Amatte created code to accelerate the development of bacterium packer system. Chapters by Author Rodrigo Ruiz wrote chapters 6, 7 8, 9, and 10, coauthored by Rogério Winter. Kil Park wrote chapters 2, 3, and 4. Rogério Winter wrote the Introduction and chapters 1, 11, and 12, coauthored by Rodrigo Ruiz. Fernando Amatte wrote chapter 5. Translation to English Rogério Winter Copyright © 2015 by Victoria Ganzert All the rights reserved. No part of the book may be reproduced in any form, by photostat, microfilm, xerography, or any other means, or incorporated into any information retrieval system, electronic or mechanical, without the written permission of the copyright owner. ISBN: 1514863677 ISBN-13: 978-1514863671 Library of Congress Control Number: 2015912081 LCCN Imprint Name: CreateSpace Independent Publishing Platform, North Charleston, SC 5 6 DEDICATION Rodrigo Ruiz To Victoria and Isabela, who are my reasons for living. Rogério Winter To Viviane and Henrique for the love, support, and dedication in the cheerful moments and in the most difficult moments of our lives. I love you two. To my parents, Ewaldo and Ana Maria, for their dedication, education, and support. Kil Park To my parents, for every single thing that is important in my life.
    [Show full text]