Securing your Online World

Password Managers!

 One of the easiest way to get hacked, and it’s still one of the most popular methods is through weak and/or re-used passwords. You’ve probably heard this all before so I’m not going to rant on and on till you wander off and bury your head in the sand, I’m just going to tell you that you need to sort it! …… and show you how!

 Welcome to the world of Password Managers! The good, the not so good and the really not so good. There are a tonne of them out there so I’ll give a quick run down of a bunch, talk about my favourite: Roboform*, and why I use it, then send you off on your merry way to research and sign up to one of your choosing .... and then start using it! There is no real, good reason for you not to be using one.

 These are in no particular order, rank or favouritism. In fact, I’ll do them in alphabetical order to avoid any conflict:

1Password

Protect yourself, your family, or your global workforce with simple security, easy collaboration, and actionable insights. 1Password is a popular manager with very similar functionality to RoboForm although a little pricier. For business use you can generate logs which can be diverted to SIEM solutions. 

Having not used the service myself I've browsed their documentation, but it doesn't seem to have a built in authenticator - which is a massive requirement for me. Having an all in one solution makes for a much better user experience, without having to load up multiple apps. There doesn't seem to be an app for PC either which means for passwords on desktop apps you'll need to retrieve them from a browser.

You can check them out at: https://1password.com/

---

Bitdefender

Bitdefender Password Manager is a multi-platform service that helps you store and organize all your online passwords. It comes with the strongest known cryptographic algorithms, so your online credentials are safe and secure. Easily manage your logins with the help of a single master password.

This seems a very similar offering to most of the other managers, has a built in Password Generator, works on all browsers - but no actual PC app, and includes password leak alerts.

You can find out more at: Bitdefender Password Manager - Secure Password Generator

---

Bitwarden

Bitwarden is an Open Source password manager which is again browser based and includes mobile apps. Bitwarden does include and Authenticator in it's Premium account and at just $10 a year it's a pretty hard option to ignore. If you don't need the authenticator then they have a totally free account!

Check out Bitwarden here: Bitwarden Open Source Password Manager | Bitwarden

---

Dashlane

Built for individuals who want to secure and optimize their online lives. Dashlane makes it effortless for you to access your passwords, passkeys, payment information, and IDs anywhere you are, across any device. Dashlane incorporates a nice password generator which is very similar to the one I use with RoboForm and also checks the Dark Web for any breaches (but only on a paid plan!). There is a free plan for their basic Password manager and 3 further plan tiers at additional pricing which include extra features as the plan increases.

Find out more about Dashlane: Free Password Manger | Dashlane

---

Google

Google password manager is available on Google Chrome and Android devices. If all you use is Android / Google devices then this is probably the best option for you. However, if you use a PC / Mac, you'll need to be using the Chrome browser. Google also have their Authenticator app which works just fine but again, what ever device you're using you'll need access to your google account. Check your Google account for more info.

---

KeePass

KeePass is a free open source password manager, which helps you to manage your passwords in a secure way. You can store all your passwords in one database, which is locked with a master key. So you only have to remember one single master key to unlock the whole database. Database files are encrypted using the best and most secure encryption algorithms currently known (AES-256, ChaCha20 and Twofish).

KeePass is software based and is totally free, you can even have it just on a USB stick. It's probably a little more of an advanced option for the more IT proficient!

Check out KeePass here:  https://keepass.info/

---

Keeper

Never forget another password with Keeper Password Manager. Easily create and store your passwords in a secure personal password vault that you can access from any device. Keeper has 2 paid plans, has a Mobile App or is browser based. There's no mention of and Authenticator function with Keeper so at it's price point is a little on the expensive side.

Keeper can be found at: https://www.keepersecurity.com/

---

LastPass

We'll just leave this one for now. Multiple recent breaches make me want to stay away from this one until they improve their systems a bit!

---

Microsoft Edge

It looks like Microsoft has improved it’s password manager offering with the Wallet which includes a Health Check for your passwords. It can keep track of your Payment info, Passwords and personal info. Edge can also suggest passwords for you. 

The downside are: The Authenticator function for MFA is a separate standalone app. To have the password manager on all devices, you will need to install Edge Browser on them all and use that to surf the web using your stored passwords (all except on Chrome Books which don't support Edge). It’s good but not very efficient for me. TechRadar have a good write up on it here.

---

NordPass

All of your passwords, credit cards, and personal info in a single secure place. Never forget another password again. Create strong and unique passwords, securely store them in a single place, and autofill them with just a few clicks. Nordpass includes the usual password generator and breach alerts (int he paid plan). The have a free plan for the basic manager, a premium and family option which include all the available features. Again, there's no authenticator component with Nordpass. Discounts may be available if you have their VPN service!

Check out Nordpass here: Securely Store, Manage & Autofill Passwords | NordPass

---

Norton

Norton's offering is a cloud based password manager with browser extensions available and apps for Android and iOS. It appears to be free but is only available on Android and iOS devices with Fingerprint Authentication or Touch ID/Face ID activated. If you already have a Norton account and want a basic password manager then this seems like a great option.

---

Passbolt

Passbolt is another Open Source manager more aimed at business users. Passbolt can be downloaded and installed on a server, VM or Docker instance and again more for the IT proficient audience. They do have a free offering which is fairly feature rich but it does require configuration to get it up and running.

Find out more about Passbolt here: Passbolt: The Open Source Password Manager For Teams

---

RoboForm

RoboForm is utilised via a Browser Extension compatible with many browsers or via an app, be it Windows, Mac, iOS, Android, Linux or Chromebook. It can keep track of all of your usernames and passwords, personal info, payment info. RoboForm securely scans for weak, duplicate, or compromised passwords and alerts you if any are found in documented breaches.

It also has a built in Password Generator and Authenticator making it and all in one solution. You can log in with a single click into almost any account or app on any webpage, browser or device and will sync your data across all your devices. Having the built in Authenticator is a massive bonus for the price, which means that when RoboForm enters the Username and Password, as soon as the website requests a TOTP (Time Based One Time Passcode) RoboForm is ready to respond with it immediately.

I use RoboForm Password Manager everyday on all of my devices and love it; I think you would too!

As a first time user,when you purchase a RoboForm Everywhere subscription using my referral link, you'll receive and additional 6 months for Free!

Purchase and learn more about RoboForm Everywhere click here*.

---

Conclusion

All that's left now is for you to pick one, sign up and start using it!

Thanks for reading,

Rich.

If you find any incorrect or missing details that you feel need correcting, then please feel free to drop me a comment and I'll get them fixed asap.

*These links are affiliate links, should you click and sign up via this link I will receive a small extension to my plan which helps me keep the costs down in creating content, and I thank you for it.

The Richinthecloud YouTube Channel

 The blog has been a little quite recently as I've been focusing on some training and the creation of my new YouYube channel - https://www.youtube.com/@richinthecloud/. People ingest information in different ways, some prefer reading so the blog is an excellent choice. However, some prefer a more visual style - watching video's, so the YouTube channel seemed a perfectly natural opportunity to reach the more visually inclined. 

The channel is also a great way for me to really get my point across and get into the nitty gritty of subjects which would otherwise result in a short novel. The channel will mirror the blog content but dive deeper into details with near real time walkthroughs and additional thoughts. What I'm creating is raw, down to earth and shot with one take, so there's no post editing - you get to see all the mistakes that I can make and any errors/pitfalls that can pop up along the way. Hopefully this provides a more real world experience for the people curious about IT and Cyber along with those looking to start learning or break into the field of Cyber Security.

Watch the welcome video here and whilst you're there, why not subscribe so you're kept up to date with the latest releases and content. I'd love to have you along to keep me company!

Thanks for reading,

Rich.

Running your first Nessus Scan

If you've just installed Nessus Essentials and are now sat wondering what next, to give you a quick idea, we'll do a first scan to show you how it works. If you've not yet installed Nessus but want to, check out my last post on "Installing Nessus Essentials on Kali Linux". Lets get scanning...

Following on from where we left off or from opening Nessus, if you're not on the screen below, click "My Scans" from the left hand menu and then "New Scan" on the top right of the page to bring you to our stating point:

Click the "Basic Network Scan" button. In the Name field, you can give the scan a name to identify it (useful if you configure a scan that you want to run again in the future), I'll call mine Test, you can give it a description where you can details the reason for the scan or the configuration used but I'm leaving mine blank. The Targets field is where you need to put your IP addresses for the scan, I'm just going to use the loopback address to scan the local machine (you could also create a file of IP addresses and upload that to save typing them all in). I'm not going to go through the rest of the options as they're not required for a quick scan but you can explore them at your own leisure.

Click Save. Now you have a Scan saved to My Scans that you can find, run and rerun as required. 

To kick off the scan, click the little Play icon (or the launch button as it's called) to the right (the X will delete the saved scan!) and you'll see the Update icon, the Play button turns to a Pause button and the last scanned field gets updated. Sit back and wait for the scan to complete.

Once complete, the update icon turns to a tick. Click on the scan to see the results:

The top bar shows 3 tabs. Hosts shows the Hosts scanned and an overview of the scan results. The Vulnerabilities tab, well, shows the vulnerabilities. In my case 42 of them (eek). 

When you click on the tab, you get the full list and you can click on each to get a detailed view of the vulnerability description with CVE links:

You may also get a solution to mitigate the vulnerability (now would be the time to go fix it!):

And that's the basic power of Nessus Essentials. This has been a quick tutorial to get a first scan in the bag. There are many more options, settings and scan types that you can run and I'd encourage you to explore. You can find out more info from the Nessus documentation page at Nessus Documentation | Tenable™ or from their community pages at Home (tenable.com) 

I hope you enjoyed this quick walkthrough of running your first scan, thanks for reading.

Rich.

Credits:

Kali Linux | Penetration Testing and Ethical Hacking Linux Distribution

Download Tenable Nessus Vulnerability Assessment | Tenable®

 

Installing Nessus Essentials on Kali Linux

Nessus is a powerful attack surface vulnerability scanner from Tenable. Download Tenable Nessus Vulnerability Assessment | Tenable®. 

I've seen a few walkthroughs for Nessus Essentials and this is another one, but when I came to install it, I found that with the updates to Nessus, a lot of the screen shots were out of date so I thought I'd do a more recent walkthrough. I'm installing Nessus on a Kali Linux VM running in VMWare Workstation 17 Player (I'll do another write up for that install). I've now created a YouTube walkthrough which you can follow along with and see the install in a live demo here.

Open Firefox and browse to https://www.tenable.com/downloads/nessus - to download Nessus.

Select Version and OS platform (normally picked up be default) and click the Download button:

Accept the Licence Agreement to (feel free to read it all at your leisure):

Once downloaded, open a terminal, sudo su to switch to root (if not already), cd into Downloads folder cd Downloads/ and start typing the following command dpkg -i nessus then hit Tab to auto complete the file path (if it doesn’t auto complete, replace nessus with the full file name) and hit enter:

Once installed run /bin/systemctl start nessusd.service to start the Nessus service:

Then go back to Firefox and browse to https://kali:8834 - You will need to click “Advanced…”, scroll down and then click “Accept the Risk and Continue” as Nessus is using a self signed Certificate that cannot be verified (which is ok as it’s an internal system) to reach the Welcome page:

Click the Continue button and then select “Register for Nessus Essentials” and continue:

You will need to enter your details, this will provide a one time activation code (which cannot be used again so I’ve found that some non genuine details will work fine for me here as I already have a working version in my home lab which I registered with my real details. This install will be torn down with the lab I've created just for a specific course), then click Register:

Then click continue on the next screen:

Create a user name and password - this will be for you to log into Nessus so make sure you write down or remember these details! Then hit “Submit”:

Nessus will then download it’s required plugins, this could take a few minutes:

After a short wait, Nessus will open and start compiling the plugins:

Wait for the plugins to compile, indicated by this spinning update icon. This bit will take many minutes, now’s the time to grab a fresh brew, some lunch, walk the dog … you get the idea. Once it’s gone you’re good to go:

You’re taken to the My Scans page by default where you can explore or run your first scan:

Click the New Scan button in the top right of the screen and you'll be taken to the Scan Templates page. Here you'll see the extent of what Nessus can deliver. As this is the free version of Nessus, some of the templates won't be available, requiring a paid licence to run. In this free version we can scan up to 16 private IP addresses in one go. 

For the installation stage, we're now done - congratulations you now have a functioning vulnerability scanner for your lab, home network or small business.

I hope you've enjoyed this walkthrough of Installing Nessus Essentials on Kali Linux, in the next post I'll do a quick walkthrough of "Running your first Nessus Scan". I've not added it here as this post is long enough as it is!

Thanks for reading.

Rich.

Credits:

Kali Linux | Penetration Testing and Ethical Hacking Linux Distribution

Download Tenable Nessus Vulnerability Assessment | Tenable®

YouTube Video Link: Installing Nessus on Kali