Bittwiste - Revision

Talking about editing pcap files, I always have this problem where I want to change the IP address to another IP address, for example I want to change 1.2.3.4 to 192.168.48.21, I can do it easily if it is only fewer records or small pcap files with netdude. However I always have problem with this kind of Pcap files where IP 1.2.3.4 is in the source and destination IP field(bidirectional for example TCP connections), if I use netdude to change the IP address by highlighting the pcap records, all the source IP will be changed to the same as 1.2.3.4 which I don't want. In TCP connections, we usually have this kind of connections,

1.2.3.4 -> x.x.x.x
x.x.x.x -> 1.2.3.4
1.2.3.4 -> x.x.x.x

So if I use netdude, it will becomes -

192.168.48.21 -> x.x.x.x
192.168.48.21 -> 1.2.3.4
192.168.48.21 -> x.x.x.x

This is very inconvinient and I have to manually change either the source and destination IP. I feel that there's lack of tool that can do the thing I want and fortunately we have latest Bitwiste which able to do this type of thing.

Let's say now I have this Pcap file called TCP-Learning.pcap -

shell>tcpdump -nr TCP-Learning.pcap
reading from file TCP-Learning.pcap, link-type EN10MB (Ethernet)
17:19:46.623049 IP 222.64.79.60.3493 > 1.2.3.4.80: S 676482397:676482397(0) win 65535
17:19:46.623101 IP 1.2.3.4.80 > 222.64.79.60.3493: S 814542684:814542684(0) ack 676482398 win 5840
17:19:46.834035 IP 222.64.79.60.3493 > 1.2.3.4.80: . ack 1 win 65535
17:19:46.882274 IP 222.64.79.60.3493 > 1.2.3.4.80: P 1:313(312) ack 1 win 65535
17:19:46.882323 IP 1.2.3.4.80 > 222.64.79.60.3493: . ack 313 win 6432
17:19:46.883334 IP 1.2.3.4.80 > 222.64.79.60.3493: P 1:615(614) ack 313 win 6432
17:19:47.184978 IP 222.64.79.60.3493 > 1.2.3.4.80: . ack 615 win 64921
17:19:53.598808 IP 222.64.79.60.3493 > 1.2.3.4.80: P 313:625(312) ack 615 win 64921
17:19:53.599825 IP 1.2.3.4.80 > 222.64.79.60.3493: P 615:1229(614) ack 625 win 7504
17:19:53.927832 IP 222.64.79.60.3493 > 1.2.3.4.80: . ack 1229 win 64307
17:20:09.744646 IP 1.2.3.4.80 > 222.64.79.60.3493: F 1229:1229(0) ack 625 win 7504
17:20:09.946046 IP 222.64.79.60.3493 > 1.2.3.4.80: . ack 1230 win 64307
17:20:14.316555 IP 222.64.79.60.3493 > 1.2.3.4.80: R 625:625(0) ack 1230 win 0

Now I want to change 1.2.3.4 either in source or destination IP field to 192.168.48.21, what I can do is just one liner with bitwiste,

shell>./bittwiste -I ./TCP-Learning.pcap -O TCP-Learning-edited.pcap -T ip -s 1.2.3.4:192.168.48.21 -d 1.2.3.4:192.168.48.21

shell>tcpdump -nr TCP-Learning-edited.pcap
reading from file TCP-Learning.pcap, link-type EN10MB (Ethernet)
17:19:46.623049 IP 222.64.79.60.3493 > 192.168.48.21.80: S 676482397:676482397(0) win 65535
17:19:46.623101 IP 192.168.48.21.80 > 222.64.79.60.3493: S 814542684:814542684(0) ack 676482398 win 5840
17:19:46.834035 IP 222.64.79.60.3493 > 192.168.48.21.80: . ack 1 win 65535
17:19:46.882274 IP 222.64.79.60.3493 > 192.168.48.21.80: P 1:313(312) ack 1 win 65535
17:19:46.882323 IP 192.168.48.21.80 > 222.64.79.60.3493: . ack 313 win 6432
17:19:46.883334 IP 192.168.48.21.80 > 222.64.79.60.3493: P 1:615(614) ack 313 win 6432
17:19:47.184978 IP 222.64.79.60.3493 > 192.168.48.21.80: . ack 615 win 64921
17:19:53.598808 IP 222.64.79.60.3493 > 192.168.48.21.80: P 313:625(312) ack 615 win 64921
17:19:53.599825 IP 192.168.48.21.80 > 222.64.79.60.3493: P 615:1229(614) ack 625 win 7504
17:19:53.927832 IP 222.64.79.60.3493 > 192.168.48.21.80: . ack 1229 win 64307
17:20:09.744646 IP 192.168.48.21.80 > 222.64.79.60.3493: F 1229:1229(0) ack 625 win 7504
17:20:09.946046 IP 222.64.79.60.3493 > 192.168.48.21.80: . ack 1230 win 64307
17:20:14.316555 IP 222.64.79.60.3493 > 192.168.48.21.80: R 625:625(0) ack 1230 win 0

This is clean and neat, thanks to Addy(author of bittwist) who has added this feature for the ease of use. Feel free to download it at here and give it a try.

What a powerful pcap editing tool!!!!!

Enjoy (:])

Crime Detections

While watching news on TV yesterday night, I were surprised that our police enforcement don't have computer system that keeping track of criminal activities. With this kind of criteria, I'm wondering how our security is guaranteed in such a way, the criminal profiling is handled in very inefficient ways which is decentralized and by each branches in different locations.

And now only they come to realized that they need to have centralized management and start to build the database system, this can be considered as good new since it is never too late to do it while other countries have this kind of system ages ago.

I think with this kind of system, the correlations can be done and it is time saver as well since each branches doesn't have to take much times to query the records and profiles of criminals. The information sharing within each branches will help and all the police stations are now merged into empowered body even they are all separated physically.

They should be sharp in crime detections with this kind of deployment. By the way I'm wondering when the system will be completely built while the project is started on December of this year if I'm not mistaken.

Cheers :]

ModSec2Sguil Screenshots

I just hacked into Victorj's blog and stole his screenshot so that I can share it with everyone, I don't think he will know it since I can easily bypass his IDS. Enjoy the Mod_Security Logs in Sguil!!!!!

Oops, I just forgot he deployed NSM instead of IDS only, damn!!!!!

Enjoy :]

PgOSS Meetup - Continued

Thanks to surface for recording the talk in mp3 format so that we can share the PgOSS presentation with others. Here's the second presentation that done by Vicky -

http://mysurface.no-ip.org/download/02vick.mp3

And for anyone who stay around Pulau Penang, and you would like to join us in the next meetup, you can find the information @t

http://foss.org.my/projects/meetups/2006-09/pgoss/

By the way I'm looking for anyone who would like to share their OSS expereience and skills in the meetup, please email me and I would like to hear from you. My email is as the same as always geek00L[at]gmail.com.

Enjoy :]

PgOSS Meetup

This is the first official meetup for Penang Open Source Software Meetup, you can find the initial meetup announcement @t

http://my.opera.com/mysurface/blog/show.dml/484686

http://aizatto.com/blog/archives/180

The meetup is over, I know many of you are looking for me in the meetup since I'm one of organizer, however I were not be able to attend the meetup due to some personal issue, fortunately there are aizat and surface who are willing to help, aizat was down from Kuala Lumpur to Penang and I'm glad that he makes his way here :)

Anyway thanks to everyone that coming to the meetup, especially Dr. Dhanesh who has helped organizing the meetup.

I hope that we can organize the meetup again next month and looking forward to see everyone in the meetup if possible. For more information regarding the meetup, I think aizat and surface will blog the wrap-up.

This is not a hardcore OSS meetup, and PgOSS guys have captured the scene to share and you can download it via

http://mysurface.no-ip.org/download/01aizat.mp3

Have fun with OSS!!!!!

Cheers :]

P/S: For whoever think I'm coming, I'm cheating for good intention :P

Snort and ModSec2Sguil

I know I haven't been posting in my blog for quite sometimes, lots of things in my mind that I have to get it done. However for those who is snort lover, the snort 2.6.1 beta2 is already out for quite sometimes, and I just noticed it. Lots of decoders are added to solve the detection issue. I hope I can spare my time to test those preprocessors but this is not the case, maybe next month or when snort 2.6.1 releases.

For Sguil Lovers, check out -

http://www.inliniac.net/blog/?p=43

Mod_Security Logs now can be managed and analyzed thru Sguil, thanks to Victorj who has written ModSec2Sguil. I hope it will be added as extra features for Sguil. This is good news for serious and heavy users of Mod_Security. You can have centralized center to perform analysis on Mod_Sec Logs now.

I will try my best to write more about NSM stuffs when I have time, currently I'm still testing OpenBSD PF layer 2 filtering stuffs and hopefully I can blog about it when I have time.

Cheers :]

HITB Conference 2006

Finally everything is over, I'm glad that the training class was going fine for the first time me and mel conducting it together.

For the Capture The Flags Hacking Competition. While it is not perfect, we all learnt something from the setup and improvement can be done in future, thanks to all the CTF Crews, speakers who submitted the daemons as well as the volunteers who doing the cabling job.

I don't have much time to get into any speaker's talk but Philippe Biondi, since I use Scapy a lot and his talk was really interesting including the tricks and tips on toying with IPv6.

Finally thanks to all the HITB members to make this conference successful.

Again, I'm glad to work with you guys - mel, takizo, rd, xwings, ditesh, adli, y0muds and some other cool guys. You all just r0x0r5!!!!!

Special thanks to mel for his clothes, takizo who offers me his place to stay while I'm homeless..... and his kindness for donating so much $$$$$ to NCC.

Cheers :]

Short Note

FreeBSD gtk theme for user is located at ~/.gtk-2.0 but the global one is at /usr/X11R6/share/themes. Change the theme as you wish or you can download those themes from whatever look - gnome-look, kde-look, and so forth.

By the way, for user who are not using gnome or kde, if you want to change your gtk setting, try

http://plasmasturm.org/code/gtk-chtheme/

Nice little tool indeed.

Anyway I will be heading to Kuala Lumpur for HackInTheBox Conference, geek party will be launched soon!!!!!

Enjoy :]

TCPstat: Detecting SYN DOS?

shell>tcpstat -i fxp0 -o "PPS\=%p\ TCP\=%T\n"
PPS=1505.20 TCP=6850
PPS=1642.80 TCP=7540
PPS=1492.60 TCP=7020
PPS=1565.20 TCP=7384
PPS=1500.00 TCP=6958
PPS=1649.80 TCP=7724
PPS=1622.80 TCP=7505
PPS=1653.20 TCP=7658
PPS=1791.40 TCP=8443

shell>tcpstat -i fxp0 -o "PPS\=%p\ TCP-SYN\=%T\n" -f "tcp[13]=2"
PPS=42.40 TCP-SYN=212
PPS=44.00 TCP-SYN=220
PPS=40.40 TCP-SYN=202
PPS=38.20 TCP-SYN=191
PPS=42.00 TCP-SYN=210
PPS=38.60 TCP-SYN=193
PPS=49.60 TCP-SYN=248
PPS=38.80 TCP-SYN=194
PPS=34.80 TCP-SYN=174

I'm running them in parallel, with ratio you can easily detect SYN DOS. Just mindless idea here :P

Happy monitoring (:])

TCPstat - Report your NIC statistic

Just come across this network interface statistic reporting tool, while most of the tools just offer links accounting, this tools can do protocol breakdown on the fly. The default mode of tcpstat reports

shell>tcpstat -i fxp0
Time:1157911172 n=7049 avg=607.08 stddev=659.37 bps=6846924.80
Time:1157911177 n=6614 avg=632.79 stddev=668.06 bps=6696438.40
Time:1157911182 n=7242 avg=648.16 stddev=677.81 bps=7510414.40
Time:1157911187 n=6533 avg=555.01 stddev=651.15 bps=5801387.20
Time:1157911192 n=1417 avg=588.38 stddev=659.08 bps=1333964.80

You can tweak the output format to display per protocol basis,

shell>tcpstat -i fxp0 -o "TotalPackets\=%n\ ARP\=%A\ IP\=%I\ ICMP\=%C\ TCP\=%T\ UDP\=%U\n"
TotalPackets=6482 ARP=10 IP=6466 ICMP=37 TCP=5858 UDP=570
TotalPackets=5423 ARP=13 IP=5406 ICMP=33 TCP=4710 UDP=662
TotalPackets=6288 ARP=18 IP=6261 ICMP=36 TCP=5462 UDP=762
TotalPackets=6271 ARP=11 IP=6256 ICMP=37 TCP=5451 UDP=767
TotalPackets=6466 ARP=12 IP=6449 ICMP=34 TCP=5669 UDP=744
TotalPackets=6909 ARP=6 IP=6898 ICMP=42 TCP=6197 UDP=658
TotalPackets=6530 ARP=13 IP=6512 ICMP=43 TCP=5824 UDP=644
TotalPackets=6629 ARP=7 IP=6617 ICMP=42 TCP=5805 UDP=769
TotalPackets=7382 ARP=8 IP=7367 ICMP=44 TCP=6448 UDP=874
TotalPackets=5904 ARP=9 IP=5891 ICMP=42 TCP=5128 UDP=720
TotalPackets=5991 ARP=8 IP=5977 ICMP=35 TCP=5140 UDP=801
TotalPackets=5959 ARP=10 IP=5945 ICMP=41 TCP=5195 UDP=708
TotalPackets=5439 ARP=8 IP=5425 ICMP=34 TCP=4880 UDP=510

By the way, this tools support BPF expression filtering, neat!

Enjoy ;]

TCPdstat Graphing & P0f 2 New Release

Just have some interesting read on graphing network statistic using tcpdstat. I think sometimes visualization helps in traffics analysis. Check it out @

http://ilopez.com/?postid=166

By the way for people who hasn't noticed, P0f-2.0.8 is out, the tool is re-written and better now however one have to relearn P0f signatures writing since it is completely different now. Check out all the interesting features here -

http://lcamtuf.coredump.cx/p0f/README

Cheers :]

! Computer

Having sticking with computer too much, I come to realize I need sports. Apparently it is not healthy to sit in front of computers without experience other activities. Today I decide to do swimming, and yes I decide to do it maybe twice a week because it is refreshing me, especially now I'm kind of braindead. Sport is helping, especially when you are stucked with computer too much.

By the way I may buy basketball as well, been a while I haven't played basketball and I need the sound - sop!

Let's kick ass without computing, cheers!!!!!

OpenBSD 4.0 BPF

I read this in OpenBSD Current(4.0) Daily changelog .....

- Allow bpf(4) to ignore packets based on their direction.

I tag this down so that I will test it out when OpenBSD 4.0 is ready. Sound like a feature to analyzt.

Cheers :]

The Art Of Network Stegno Detection

Dealing with network covert channel, it would be seriously hard to detect by using purely signature based detection methodologies, you will come to realize that when you can't fingerprint it, you'll have to characterize it. What I mean by characterize is "To be a distinctive trait or mark of; distinguish"(definition from thefreedictionary.com). To be even clear about how it can be done, think behavioural and statistical analysis. I'm coming to this conclusion when I have almost finished reading the papers in the link below -

http://www.gray-world.net/papers.shtml

I most properly agree that covert channel detection can occur by luck when you are monitoring large network. But in small and medium network, you will have higher chance of detecting covert channel if you are implemeting the following -

- Tighten Network Access Control

- Client & Server Services Profiling

- Network Traffic Profiling

Most of the covert channels will try to act as normal legitimate traffics, or it will be more of protocol over protocol tunneling. It doesn't break the protocol, however it will introduce different behaviour in the protocol, the most obvious will be long and continuatious traffic of http, odd sequence numbers usage and so forth. Keep in mind that the attribute of protocol fields may change and the connection states as well.

Tightening network access control can prevent network noise, we are not using network access control to block against covert channel(as you can never block this type of stealthy connections that looks like legitimate one). Client service profiling is defined as what kind of services are allowed to be used by client such as http, https, pop3 and all(outgoing). Server service profiling should be the services that are accessible to the world(incoming). Depends on your network environment, services profiling is a must to identify covert channel because the covert channel will mostly carry over the legitimate services(as I said it bypasses network access control). The network traffic profiling will be the protocol break down and each protocol usages, this is mostly done by using flow/session data collectors, it will generate the statistic of the network flows that allowing you to identify the weird connections by protocols, this is the lead to analysis of covert channels.

There's a little tool to demonstrate statistical covert channel detection which is called tcpstatflow written by fryxar, you can download it here -

http://www.geocities.com/fryxar/

While I don't get it to compiled on FreeBSD, I have luck with Ubuntu. Here's what I have done

geek00l@hell:~/Desktop/Covert-Tools$ cd tcpstatflow/
geek00l@hell:~/Desktop/Covert-Tools/tcpstatflow$ make

geek00l@hell:~/Desktop/Covert-Tools/tcpstatflow$ ls
datalink.c datalink.o flow.c flow.o main.c main.o Makefile README tcpflow.h tcpip.c tcpip.o tcpstatflow util.c util.o

geek00l@hell:~/Desktop/Covert-Tools/tcpstatflow$ ./tcpstatflow

./tcpstatflow[29633]: no suitable device found

geek00l@hell:~/Desktop/Covert-Tools/tcpstatflow$ ./tcpstatflow -h

./tcpstatflow version 1.1 by Fryxar (thanks Jeremy Elson!)

usage: ./tcpstatflow [-hpvD] [-d debug_level] [-f tcptimeout]
[-i iface] [-t statistics_time] [-x bytes_threshold]
[-y time_threshold] [-z packets_threshold] [expression]

-d: debug level; default is 1
-D: start as daemon (log to syslog)
-h: print this help message
-i: network interface to listen
(type "ifconfig -a" for a list of interfaces)
-f: TCP timeout in seconds; default is 7200
-p: don't use promiscuous mode
-v: verbose operation equivalent to -d 10
-t: statistics time; default is 3600, use 0 to disable
-x: cummulative bytes in both senses threshold to report an alarm; default is 50000
-y: duration (in seconds) threshold to report an alarm; default is 86400
-z: cummulative packets in both senses threshold to report an alarm; default is 1000000
expression: tcpdump-like filtering expression

Running my own simple but fast ssh sock proxy channel(Dynamic port forwarding)

geek00l@hell:~/Desktop/Covert-Tools/hcovert-0.5$ ssh -ND 5555 root@1.2.3.4 -p 2222

On the other hand, I also run corkscrew which allowing tunneling ssh through http proxy that I have setup at 1.2.3.4 port 8080. You can install corkscrew by using apt-get on Ubuntu and pkg_add on FreeBSD.

Now I have run the sock proxy and ssh over http proxy, I also connect my browser and other applications to use the sock proxy as well as scp through the http proxy.

Here's the result of my tcpstatflow,

geek00l@hell:~/Desktop/Covert-Tools/tcpstatflow$ sudo ./tcpstatflow -i eth0

Password:
./tcpstatflow[29651]: listening on eth0
Potencial tunnel = 10.0.0.10:2302->1.2.3.4:2222: packets rx=1860 tx=1135, bytes rx=1808079 tx=50182, seconds=234
Stats= mallocs: 9, cleans: 8, reuses: 0, flows: 1, Packets: 4219 drops: 707 (16%)
Potencial tunnel = 10.0.0.10:2496->1.2.3.4:8080: packets rx=3425 tx=4741, bytes rx=50023 tx=5204157, seconds=228

That's pretty neat, but I'm running tcpstatflow in default mode, you can tweak the threshold when coming to detect different kind of covert channels, while you may think that icmp covert channel can bypass this tool, it may be true since this is only for tcp connection, but I believe that icmp covert channel can be restricted with your network access control(Only allow icmp ping echo and reply) and the detection of icmp covert channel can be done via its bytes transfer per flow easily when you have your flow collector in place.

You may check out one of sguil aliance - Victorj, using his mysql-fu, to detect icmp tunnel via Sguil

http://www.inliniac.net/blog/?p=24

http://www.inliniac.net/blog/?p=27

I have mentioned that monitoring large network can be very headache for covert channel detection, but guess what? Try ourmon!

Now you know why NSM emphasizes on statistical data as well!!!!!

Enjoy (:])

Ubuntu - Where is my traceroute?

I have the internet problem where I need to figure out, while my laptop is busy on something else, I was thinking of using my ubuntu box that I just upgraded to Dapper Drake to trace the network issue. I may need to clarify that while I had been long time user of ubuntu linux, I'm a serious noob on it where I only used it for movie and music(Entertainment Desktop). Let's see what I can do when I need to traceroute -

Command not found? I hope my typo is wrong but this is not the case, after talking to some folks, they told me that Ubuntu is meant for Desktop users where it doesn't need network debugging tools. Okay fine, let's notice what I have executed in the screenshot - traceroute6

Oh yeah, desktop users surely know how to configure IPv6, or else why traceroute6 is included while traceroute is not there. Now I even wondering what it is like when coming to user friendly(Even windows users know how to use tracert).

Ubuntu, another lovely linux desktop, sigh!

Peace :]

Internet Freedom: Unleashed

Interesting read though ->

http://zensur.freerk.com/

My shortest post (:p)

~Enjoy~

Proxy - Your Guardian

Proxy can serve as double edged sword, while it can mask one's track by hopping through multiple proxies(stepping stone), it can be a very effective defensive|preventive perimeter. Most of people know the infamous Squid, which can run as either transparent proxy or reverse proxy. Squid definitely is a powerful tool, however sometimes we would like to have alternative, here are the other good alternatives -

- Apache(Forward & Reverse Proxy)

- Pound(Reverse Proxy)

- Delegate(Application Proxy)

I'm looking at pound and delegate, thanks to Chflags who recommends me to take a look at it. Delegate seems to be very interesting when comes to proxying application protocol as well, and it has whole lot of features that I need to try.

While network security monitoring requires visibilities of network, pound can be used as ssl terminator, decrypting the ssl connection and send it back to the backend web server.

Other nifty proxy application that can be used will be Privoxy, privoxy can be used to mangle the traffics, hence it can used to protect your browser bug. While reverse proxy serve as server side protection layer by applying sanitizer and filtering, transparent proxy will be more of protection layer for client side. It may sound like security through obscurity, but it is the fastest way to defense against outbreak period since applying filtering rules in proxy can be done in short time.

On the other hand, remember proxy is fast - with caching enabled.

Cheers :]

Nice Kit - Overload

While I was in Kuala Lumpur last week, I have bought a laptop backpack. While looking for targus backpack, I found High Sierra. Thanks to Mel for bringing me to the shop located at Curve. It is worth the time and price that I have paid to look for the backpack that I would like to carry everywhere, here's the description and look of the backpack,

http://www.highsierrasport.com/ItemDetail.jsp?itemNum=54602

I have black one which matches my laptop color. It has name - Overload !!!!! Remind me of StartCraft.

Side note: Since I don't want to write another blog post, lazy me just include this url as linux/bsd laptop installation guide especially for IBM thinkpad. Thanks to gutizz for good reference.

http://tuxmobil.org/ibm.html

Enjoy :]

FreeBSD TightVNC

For the HITB2006 training, since Wireshark(Ethereal), netdude and some others tools need demonstration, I'm considering of letting users to access to FreeBSD VMware image remotely, while ssh is a shiny choice for CLI, I think most prolly access is needed for GUI applications as well, I remember I used to use VNC on windows and digging in the FreeBSD port, I found tightvnc. Installing tightvnc is in a glance, just pkg_add will do. After installation done, you may find vnc related application under /usr/X11R6/bin,

shell>ls -la vnc*
-r-xr-xr-x 1 root wheel 3948 Mar 17 05:49 vncconnect
-r-xr-xr-x 1 root wheel 12284 Mar 17 05:49 vncpasswd
-r-xr-xr-x 1 root wheel 15226 Mar 17 05:29 vncserver
-r-xr-xr-x 1 root wheel 81476 Mar 17 05:49 vncviewer

You will run the vncserver at the first time, and it will ask you to assign remote access password, then it will ask to assign for view only password. Once assigning the password, you can start running vnc server by execute

shell>vncserver

I have the problem at the first time and I figure out it searches for ~/.Xresources, hence I just create a blank file called .Xresources will do. To run vncserver with geometry,

shell>vncserver -geometry 1024x768

shell>ps auxww | grep vnc
root 1239 0.0 12.1 12228 10848 p1 I 10:10AM 0:35.05 Xvnc :4 -desktop X -httpd /usr/X11R6/share/tightvnc/classes -auth /root/.Xauthority -geometry 1024x768 -depth 24 -rfbwait 120000 -rfbauth /root/.vnc/passwd -rfbport 5904

shell>netstat -an | grep 5904
tcp4 0 0 *.5904 *.* LISTEN

We have verified that vnc server has launched on port 5904 successfully. Now we can just run the vnc client from the other host. Since my vnc server runs on 192.168.0.6, I just need to run

shell>vncconnect 192.168.0.6::5904

After type in the password, there it goes ----->

However the traffics between the vnc server and client is not encrypted, hence I'm thinking of getting it to work with ssh tunnel. As usual I used to read man page before anything, and I found -via gateway option in tightvnc. Maybe that's what I need, just run

[root@trinity ~]# vncviewer -via 192.168.0.6 192.168.0.6::5904
Password:
VNC server supports protocol version 3.3 (viewer 3.3)
Password:
VNC authentication succeeded
Desktop name "root's X desktop (hitb:4)"
Connected to VNC server, using protocol version 3.3
VNC server default format:
32 bits per pixel.
Least significant byte first in each pixel.
True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Using default colormap which is TrueColor. Pixel format:
16 bits per pixel.
Least significant byte first in each pixel.
True colour: max red 31 green 63 blue 31, shift red 11 green 5 blue 0
Tunneling active: preferring tight encoding

That's cool, I would seriously agree that tightvnc is nifty tool to setup secure remote access especially when there's a need to grant access for GUI.

Cheers :)

Does .gov.my take security as concern?

We have Mycert, Gcert and all kind of Certs, that for sure indicating Malaysia Boleh! However I would like to ask again - Does Malaysia Government takes Internetwork Security as its one of primary concern?

I don't have to mention any, but after working in network security field for quite sometimes, I figure out our Government generally not taking this virtual world for real.

- Government Internetwork is considered decentralised, they are not actually fully managed and monitored. Outsourcing is seriously bad idea for the network that contains critical data, unless you find a promising and respectable vendor.

- This is a joke, while I found it amusing, however hackers found it as easy target. There are many .gov.my sites are built upon Content Management System. It is fine to deploy CMS but without proper patching and update management, it can be a total screw up.

- No strong policy enforcement - Yes, you can install anything on your laptop and bring it to work even you are working for .gov.my, on the other hand, you can't count how many rookits & viruses reside in .gov.my network happily.

- No human education - Inpersonating is good way to gain access to .gov.my, it works all the while since no one is educated about cyber threats even for those who working closely with .gov.my.

- Faulty implementation & deployment - No DMZ, no network screening and strong network control. What can I say about this? If you don't build defensible network, blame yourself for intrusions and extrusions.

I'm not representing any party, while I'm not ranting(I don't think I'm), I'm just trying to figure out and criticize on what I see as unnecessary. Pointing out the weakness can lead to correctness. I'm not who working for government, however I'm just here pointing out all the risks that we have encountered.

While our country is on the way to establish Multimedia Super Corridor(MSC), surprisingly Security is not putting into main concern. Do they need to re-think about it?

Electronic Government, I hope this is not a joke.

Peace :]

Network Security Monitoring - The Big Screen

Yes, I know you would love to monitor the network security with eyes wide open!!!!!

~Sguil In Action~

Enjoy :]

Network Security Toolkits

Got Sguil?

NST - One of the interesting LiveCD that contains fruitful Open Source Network Security Applications finally got Sguil, while I consider this is late coming but I'm still glad to see it in. You can check out the details here -

http://nst.sourceforge.net/nst/docs/scripts/nstsguil.html

Sguil becomes more and more popular these days, Network Security Monitoring is what we need!!!!!

Enjoy :)

HITB 2006 Training

Just in case you don't notice, me and mel will be conducting a workshop - Structured Network Threat Analysis & Forensic @ HackInTheBoxConf 2006. You can check out the detail here -

http://conference.hackinthebox.org/hitbsecconf2006kl/?page_id=89

If you are interested in mastering packet analysis, especially with Open Source Tools. We will demonstrate how you can detect and understand different level of network attacks - From fingerprinting phase to serious intrusions. Don't miss it!

Cheers :]

P/S: I'm very busy lately and having no time to blog much, stay tuned!

Create BPF device

Sometimes you need more than one bpf interface to run your network monitoring application, especially if you are using creative IDS like Bro-IDS and snort or some other tools such as trafshow and so forth, thus you need to have multiple bpf interfaces, while you may run into problem where bpf interface not exists or permission denied, you can create the bpf interface manually before running those kind of applications. Login as root and run -

shell>cd /dev; mknod bpf5 c 0 0

Now you will find bpf5 is created under /dev directory, changing the permission to 744 will most properly lead you to run the network monitoring application successfully without problem.

By the way this is applied to FreeBSD and OpenBSD.

Peace :]

OpenBSD Application Port/Package Tracking

While using FreeBSD, I used to look for new packages/ports by refering to www.freshports.org, that makes life whole lot more easier to track the applications I'm using and I want to use in future maybe. Now, you will have the similar thing in OpenBSD, check out -

http://ports.openbsd.nu/

I think many people may find it useful, it would be better to add the new ports request and status as well. But I see this as very good kickstart for port tracking and maybe it can be improved from time to time. Thanks to OpenBSD.nu in cooperation with NetBSD.se to create OpenBSD packages/ports frontend.

Cheers :)

Testing Firewall Rules

And yet you are using PF and want to test your firewall rules remotely but afraid of locking yourself out of box, you can actually do this. Create a pf config file name /etc/pf-open.conf, and with the open all rulesets,

pass all

Then you have the PF configuration file calls /etc/pf-server.conf that you want to test which having heavy filter rules, now to test it. Run

shell>pfctl -f /etc/pf-server.conf; sleep 90; pfctl -f /etc/pf-open.conf

The filter rules will be applied and it will change to the pass all rules over 90 seconds. With this you can relogin to the box remotely after 90 seconds in case you accidentally lock out of the box or you internet got screwed.

I found this tip from here, apparently this is very useful.

The safer way is putting the commands above into the shell script and run that script instead in case you get terminated and the terminal closed before 90 seconds causing the pfctl -f /etc/pf-open.conf not getting executed.

Enjoy :]

Penang Open Source Community

Since there are many times I have been thinking of activating the Open Source Community in Penang State, Malaysia especially some of folks in MyOSS been asking about it as well. I would like to give it a kick, however it ain't enough with my sole efforts, I need helping hands and apparently surface is the right guy to help me out on this. If you are the guy who like to tinker with open source, or newcomers that would like to learn up one or two things about the open source thingy, feel free to send me email or ping me at freenode myoss channel. We would like to see more and more members that joining the community.

Currently we are looking for a place to organize the meetup, and apparently USM is the right place with young and energitic souls. However we also would like to see anybody who already have been using Open Source in the Industry to share thier experience or perhaps presenting topics regarding Open Source stuffs.

It's never been too late, I think with the Community based structure, we can push the OSS awareness to the next level.

Feel free to join us. Cheers :)

Passive Tap in Actions

Nikns has his own web page on creating passive network tap in actions. It seems interesting, however it is seriously hard to find all the kits needed to build the network tap in Malaysia. I will need to dig a bit and look around if any company selling those kits. If you have any idea where can get those kits, please do let me know.

Check it out here, Nikns rox!

http://openbsd.secure.lv/tap/

Enjoy (;])

Good Time in KL

Back from Kuala Lumpur, I might say it was good trip, having chance to stay at the infamous Paul Ooi's place, I was given a room and free internet access as well. I also enjoyed the good foods there as well. Thanks to Paul for everything and I'm glad to have friend like you.

Anyway I can't wait for the next trip to Kuala Lumpur again especially for Hack In the Box events, and I think at that moment Paul already moved to the New Place :P

Peace :]

Home Made Network Tap

Commercial Network Tap tends to be expensive, thus I'm always looking for alternative way to build my own Network Tap device. This is more suitable for home network environment since it is cheap to build. If you are interested in how to build one so that you can learn more about network traffic monitoring, check out this writing -

http://www.altsec.info/passive-network-tap.html

http://www.sun.com/bigadmin/content/submitted/passive_ethernet_tap.html

Feel free to build one!!!!!

Enjoy ;]

Fosscar Presentation Slides

Finally I have done with Fosscar presentation, I'm glad to meet mel, jayakumar, angch and all the folks like xwings, ditesh, and so forth. As I promised, I had already uploaded the presentation slides up and you can download via -

http://www.dissectible.org/anonymous/Misc/Fosscar-2006.pdf

By the way, Malaysia seriously needs more and more conferences of this kind.

Cheers :]

OpenBSD Sguil Client Ports

I haven't been blogging for quite sometimes, and I think I should blog about this. Nikns has created OpenBSD Sguil Client Ports, what I mean is that he created all the ports for libraries that needed to get Sguil Client works. If you happenned to run Sguil on OpenBSD, please do try out and send report to OpenBSD Ports Mailing List. He will most properly appreciate that. Thanks.

You can download those ports via

http://secure.lv/~nikns/stuff/ports/

Cheers :]

Wireshark-0.99.2 Released

For people who haven't noticed, wireshark is silently released. I think most of people should already know the core developer leaved the company and joining other force. The wireshark 0.99.2 is released, it is same old ethereal but with different name, bug fixes and improvements, check out the site.


Beware of shark .....

Cheers :]

Tcptrack - Monitoring on the fly

I haven't been writing anything regarding NSM tools recently, and yes I'm actually writing and editing my handbook indeed. Here's another interesting tool to monitor and track what is happenning in your network.

While tools like iftop, bwm-ng can provide you the clear view of your network interface statistic, tcptrack takes it further by allowing you to monitor the network by specifying bpf like filter. It can provide quick view when you suspect that your network is being hacked or having malicious events running. The only weak point about tcptrack as is name implied, it doesn't track icmp and udp based connection, thus you can't get overview of the whole network activities that happening in the network. I install tcptrack via FreeBSD port/package since it is the easiest way to get it install, and I just need to run,

shell>tcptrack -i fxp0 -r 10

It will start to sniff on fxp0 interface and with -r 10, it will refresh the screen so that close connection won't be shown anymore as it is meaningless. You may notice that it shows total connection at the footer. You can pause it and sort it with p and s key.

If you just want to navigate the connection that belonged to 10.0.0.1 alone, you can run -

shell>tcptrack -i fxp0 -r 10 src or dst 10.0.0.1

You can also checking whether your server - 192.168.0.100 is connecting to non-legitimate smtp server by specifying -

shell>tcptrack -i fxp0 -r 10 src 192.168.0.100 \
and dst port 25

While you are suspecting your network is infected by worms such as sasser, korgo that will launch outbound connections to port 445 that exploiting lsass. You can actually run this command to check on the outbound traffics from your network, for example let's say your network is 192.168.5.0/24. Just run -

shell>tcptrack -i fxp0 -r 10 src net 192.168.5 and dst port 445

Screenshot below shows the output -

Interesting huh, let's have fun with tcptrack.

Peace (:])

Interesting Network Adapter

I just found this cool intel network card, while reading its spec of which it is actually based on Endace encap, I would like to know anybody have experience with this card - Intel Pro/1000mt Server adapter. It seems to be great network adapter to use for network security monitoring purpose as we all know Endace is a vendor that providing hardware which plays well with Open Source Tools. Here's the infos of the network adapter -

http://www.endace.com/enCap.html#

http://www.intel.com/network/connectivity/products/pro1000mt_server_adapter.htm

I plan to get this adapter and install it on FreeBSD box. Please do share your experience if you have one, it would be glad to hear from you.

Cheers :]

Bridge or Trunk?

When I had been asked whether to use either trunk interface or bridge interface when connecting OpenBSD box to the network tap with RX/TX separated, I suggest trunk. The main reason is that bridge interface that you created is not doing network bonding, which means that it doesn't actually aggregate the network traffics that flowing into both network interfaces that been added to bridge interface. On the other hand, trunk interface creates a single channel for the network interfaces that bound to it. The advantage of this feature that lacking in bridge interface makes whole lots of differences. While trunk can survive in heavy load since it uses roundrobin mechanism by default to process the packets where you can share the load between network interfaces that binded to trunk interface, bridge won't do so. If one of the network interface in heavy loaded traffcs, it may cause packet loss since bridge doesn't create single channel to load the network traffics across multiple network interfaces. This is total failure because it will make deployment of IDS useless at all. I have blogged about it previously in case you didn't notice, here's the link. You may need to check out the screenshot below where I run vmstat ifstat command to understand how trunk interface works comparing to bridge.

I only show the screenshot of trunk interface, the bridge interface shows the common result where each separated network interface has its own load based on the packets it intercepted.

Peace (;])

Gmail Lover

I always like the small utility that works well for me, I have used this little utility calls gmail-notify now to track the incoming google mail automatically. If you are on FreeBSD, just pkg_add will do. Then create a file call .notifier.conf under your user directory, the content should be almost similar to -

[options]
lang = English
voffset = 0
gmailusername = geek00L
checkinterval = 20000
gmailpassword = 123456
browserpath = opera-devel
popuptimespan = 5000
hoffset = 0
actionpath = play
animationdelay = 15

You may tweak your browserpath, mine is opera-devel since I'm using opera, go with what you like. To run it manually,

shell>/usr/local/bin/gmail-notifier

Nichy little util indeed .....

Cheers :)

)))Irresistable(((

Yeah I know I have been very busy lately, but I can't resist myself to post this sceenshot .....

F34R me

Have fun :p

FreeBSD Based Projects

I like the projects that built on top of FreeBSD, I have found two that actually grab my attention, the first one is Frenzy, the FreeBSD Based System Admin Live CD, it uses Fluxbox as main Window Manager and including tons of useful tools for Sysadmin, I will give it a try once I finish downloading it.

Another project is FreeNAS, FreeNAS is the answer to Network Attached Storage System. While many companies sell expensive NAS solution, you can actually do the same thing by using FreeNAS which is much more cost effective especially for home users who can't afford. I had already installed and get it up and running within minutes, the web base configuration that based on m0n0wall is very clean.

I suggest you take a look at it, for the fun of it -

http://frenzy.org.ua/en/

http://www.freenas.org/

Till next time .....

Cheers :]

FreeBSD - Qemu with Multiple NICs

Previously I have setup qemu for testing by using the quick how-to at the taosecurity blog here. Everything is going well and I'm pretty satisfied to run qemu for my pre-deployment testing. However the setup won't allow me to connect to the Virtual Machine remotely by using localhost, which means that I can only interact with qemu VM by login to another machine and connect back to qemu VM. This is not a big problem anyway but it kills my need of running everything with my standalone notebook only.

After going through the man page of if_bridge, I decided to create bridge interface using it instead of the one mentioned in bridge man page. Both are different and you can read it anyway by just run man if_bridge and man bridge. With that I have successfully connect to qemu VM with localhost. All I need is just run my VM with the command,

shell>qemu -boot c -hda /nsm/i-VMimages/NSM.img \
-net nic -net tap

Then create the bridge interface and adding the physical interface - bge0 and the pseudo interface - tap0 to the bridge interface.

shell>ifconfig bridge0 create

shell>ifconfig bridge0 addm bge0 addm tap0

You need to assign the IP to the bridge interface if you want to have the VM connecting to internet, and don't forget to delete the ip configuration of the bge0 interface.

shell>ifconfig bridge0 inet 192.168.0.199 \
netmask 255.255.255.0 up

shell>ifconfig bge0 inet delete

Now you may have the VM in the same LAN is the bridge interface, just configure your network interface in the VM to be something within range 192.168.0./24 will do. The NIC variable in my OpenBSD VM is ne3, just run ifconfig utility to configure the IP address will do.

Remember I have told that I'm creating the sguil qemu image, currently it is in the progress and I named it as NSM.img(OpenBSD VM), this is working properly with single NIC. I can ping each other and interact with VM perfectly fine.

But is this what I want? I remember I used to create multiple NICs in my VMware, I crawled the qemu man page and found that I can actually create multiple NICs by running,

shell>qemu -boot c -hda /nsm/i-VMimages/NSM.img \
-net nic -net tap -net nic -net tap

Once the VM is started, I found ne3 and ne4 network interfaces in my VM, I thought that everything is going as expected, I add IP address 192.168.0.123 to ne3 and 192.168.0.124 to ne4, then I start to ping 192.168.0.123, now havocs started where I have tons of DUPLICATE ping packets. If this is the case that would be bad since I can't setup my VM with multiple NICs.

Since I'm not a give up type, I crawled against the qemu manual page. I found that I can actually create the NICs with different vlan setting. Thus I might give it a try, I run the commands,

shell>qemu -boot c -hda /nsm/i-VMimages/NSM.img \
-net nic -net tap,vlan=0,ifname=0 \
-net nic -net tap,vlan=1,ifname=1

Without making any assumption that it works, I start to ping 192.168.0.123, and this time everything goes fine and I don't see any problem, this is what I really want and I got it running this time. Now I can start tinkering with my NSM setup on qemu image. With the correct configuration of gateway and dns server, both my localhost and VM can connect to the internet. Check the screenshots below and look at the interface configuration and the ping result of my VM to localhost and internet, it just works!!!!!

My network interface configuration

VM pinging localhost and internet

If you don't want to use qemu anymore, and would like to delete the pseudo interfacessuch as tap and bridge interface, normally you don't have to do the ifconfig NIC destroy, you are better of doing this - unload the pseudo interfaces module,

shell>kldstat
Id Refs Address Size Name
1 19 0xc0400000 6a29c0 kernel
2 1 0xc0aa3000 5f60 snd_ich.ko
3 2 0xc0aa9000 22b88 sound.ko
4 1 0xc0acc000 58554 acpi.ko
5 1 0xc4ebd000 9000 if_iwi.ko
6 1 0xc4fe1000 16000 linux.ko
7 1 0xc5267000 5000 i915.ko
8 1 0xc526c000 e000 drm.ko
10 1 0xc5a69000 4000 if_tap.ko
11 1 0xc5a41000 8000 if_bridge.ko

shell>kldunload if_tap

shell>kldunload if_bridge

That's the right way of deleting pseudo interface instead of using ifconfig. On the other hand, I have found the mail thread where people are asking of problem when creating tap interface. Normally you just need to do this to avoid the unwanted error.

shell>kldload if_tap

shell>cat /dev/null > /dev/tap0

I just point out here in case this helps when people googling for answer :P

Though it is not as user friendly as VMware, I will still stick with qemu for the time being. I think the more I use qemu, the more I can do with it in practical environment.

Note: I will add this write-up to my handbook, for the section - Building cheapest testing lab environment.

Peace :]

FTP Commands & Codes

If I recall myself correctly, I did mentioned in my previous blog posts regarding the important of understanding http commands & codes, while I think it is pretty useful when analyzt need to perform analysis on http session, the same thing happens to ftp as well. One should at least know partial well known ftp commands such as RETR, STOR and codes like 226 or 250.

Normally you won't see much benefit until you get your hand dirty with ftp session, by looking at the ftp code you may know whether file is successfully uploaded or downloaded, here are two quick and straight forward urls that explaining about ftp commands and codes very well -

http://www.ftpplanet.com/ftpresources/ftp_codes.htm

http://www.nsftools.com/tips/RawFTP.htm

Or if you never feel enough of reading quick guides and would like to know more inner working of FTP, RFC is recommended as always -

http://www.faqs.org/rfcs/rfc959.html

I'm more to RFC guy, apparently not everyone like RFC due to the lenghty contents.

~ RFC is just ROX ~

Another Pcap File Editor - Bittwiste

If you feel that l33tness is important and you would like to do stuffs in CLI instead of GUI, no problem!!!!! Instead of using netdude, you can actually use bittwiste. What is bittwiste, it is a command line based pcap file editor that bundled with bit-twist(Libpcap-based Ethernet packet generator).

For more information, you can check out more info at it's main site, I pretty like the bittwiste reference sheet that located at

http://bittwist.sourceforge.net/doc/bittwiste_options_s.jpg

To change the destination address to 10.0.0.2, you can just run

shell>bittwiste -I /nsm/pcap/testing.pcap \
-O /nsm/pcap/testing1.pcap -T ip -d 10.0.0.2

To confirm that I have edited it correctly, I run tcpdump to check the output,

shell>tcpdump -qeXXttttnr /nsm/pcap/testing1.pcap -c 8

Bittwiste will automatically fix the checksum value as well, it is very quick and neat tool to modify pcap file indeed. Credit goes to Addy who create this interesting tool.

Peace :]

Pcap file editing with Netdude

Now you got cool pcap file that captured from the wire and would like to edit it to replay the traffics against your server, thus you need to change the destination IP address. Since there are so many packets and you want to change the destination IP address at one time, here's little tricks that you can do with netdude.

For example you can just load the pcap file into netdude, in my situation the destination IP is 172.16.0.99, then I need to change it to 10.0.0.1, thus I just need to go to Edit -> Select All or you can just right click in the pane and Select All, then click on the IPv4 tab below, choose the Dst.addr field and you can change the value from 172.16.0.99 to 10.0.0.1, once you have changed it, you may have almost the same thing like the screenshot below.

Since you have made changes to the IP header, the checksum value will be wrong and need to be recalculated, you can just correct it by click on Plugins -> Checksum Fixer.

The checksum value is corrected and you can save it by now and ready to replay the traffics with it.

Cheers :]

Bro-IDS - Signature Matching

Lately I have deployed a testing box on 30Mbps link by using Bro-IDS, apparently it is a small monster when running with default setting. Today I started to turn on the signatures matching engine. Guess what !!!!! The small monster starts to become hulk, let's see how it goes -

PID USERNAME THR PRI NICE SIZE RES STATE TIME WCPU COMMAND
546 bro 1 -58 0 166M 164M bpf 80:40 81.42% bro

It seems that it is not a good idea to turn the signature matching engine on since it consumes too much processing power, I would rather having snort instance running for signatures matching and bro running as protocol analyzer indeed. Anyway it's up to you.

F34R teh Hulk!!!!!

Peace :]

Network Trace Files - Share it!???

I think people who work in Network Security should have chance to learn, and study the packet dump files, usually if we are following the Open Source Standard, libpcap is considered the most common format that widely been used everywhere including commercial companies.

However not much people want to share the network trace files, the critical and sensitive information yields many people stop doing that. I'm still looking forward to OpenPacket that soon will be launched, though I don't know when since Rich is busy with his stuffs. OpenPacket will serve a central repository for interesting network trace files. If you want to learn about protocol by studying the headers and payloads, you can check it out at,

http://wiki.wireshark.org/SampleCaptures

http://www.icir.org/enterprise-tracing/download.html

While you may wonder how you can share your network trace files, there are tools available to help you anonymizing the packet headers, I won't be showing how it can be done here but you can learn by reading the man page, or maybe waiting for my handbook that still in process. Here are the tools,

ipsumdump - http://www.cs.ucla.edu/~kohler/ipsumdump/

tcpdpriv - http://ita.ee.lbl.gov/html/contrib/tcpdpriv.html

tcpmkpub - http://www.icir.org/enterprise-tracing/tcpmkpub.html

There maybe other tools like netdude where it can edit network trace files on the fly. With those tools you can remove or modify the confidential data in the network trace files and share to the world.

P/S: For people wonder what I'm doing lately since not much updates in the blog, I'm still writing technical materials for the handbook that I plan to release after HITB conference.

Cheers :]

Aget - Flashget?

There's no open source flashget but there's a relatively good and fast http downloader which using multi threads to retrieve files from http server, though it is kinda old tool but I like it for the fact that it offers fast and consistent download speed, let's check out Aget. You may find the main site of aget at

http://www.enderunix.org/aget/

I run aget with the recommended -n 20 threads and use -f to force the usage of 20 threads, there it goes ----->>>>>

With my crap ISP home link, I can get roughly of 83Kb/s. This is not bad at all for my situation. The only thing that aget lacking would be support for ftp, however since aget is no longer in active development, I doubt that it will be updated with that functionability, you can use wget for that purpose as alternative.

Cheers :]

Netflow - One Useful Link

While digging the information regarding Netflow, I found a very good reference and useful link, I think I will read over it in details before jumping to other resources I found because this seems to be better and complete with the RFC reference as well.

http://netflow.caligare.com/

At the same time, I'm trying to learn about protocol tunnelling which I seldom get in touch with that used to evade IPS/IDS most of the time.

Cheers :)

Fluxbox 1.0 RC

Version jumping again from the project after Wireshark(ethereal), Fluxbox goes 1.0 RC after 0.9.15, here we see another open source project grows to be mature. Check it out at www.fluxbox.org.

Again I haven't been doing much blogging, real life sucks me out of it. I have been doing a lot of researches and studies on how one can use generic flow analysis to detect anomaly or malicious network activities.

Fosscar is around, for people who don't know about it, you may check it out at www.fosscar.com. Me and other OSS folks will be speaking and running workshops in the event. Hopefully I get a chance to have beer with them again.

Have fun :)

FreeBSD - IDS Sensor Tweaking

IDS used to suffer in high speed network where it need to sustain the heavy load traffics while detecting malicious traffic. Relying solely to the IDS software seems not to be a right idea, hence OS tweaking is supposed to be done in order to build a perfect Intrusion Detection System with commodity hardware, of course gigabit network card is preferred with lots of RAM. Here's my current testing configuration and I hope this is helpful to certain people who want to run IDS with comodity hardware and using either Bro-IDS or Snort. The OS I'm running is FreeBSD, you may find similar tweaking with Linux.

I added this to kernel config file in order to enable device polling,

options DEVICE_POLLING
options HZ=1000

After recompile the kernel and install it, I added those values below to the /etc/sysctl.conf

net.bpf.maxbufsize=8388608
net.bpf.bufsize=4194304
net.inet.tcp.sendspace=65536
net.inet.tcp.recvspace=65536
net.inet.tcp.rfc1323=1

Then I added this configuration to /etc/rc.conf for the network interface that used to capture network traffic and running IDS as well.

ifconfig_fxp1="polling promisc up"

I suggest if you are running IDS with commodity hardwares, you may need two network interface, one will be the management interface with access control enabled and another one just run as IDS interface, the configuration above applies to the IDS interface where IP is not needed and no other traffics inteference except the traffic you want to capture.

I'm currently testing how well this experimental IDS box in heavy load traffic, I run snort in sniffer mode,

shell>snort -i fxp1 -D

My snort PID is 738, since I have bpfstat installed, I try to run -

shell>bpfstat -i 3 -I fxp1 -p 738

You can view the result in the screenshot, 0 drop rate .....

If you happenned to know the better tweaking of OS or you are actually performing tweaking for your IDS box in different kind of OS as well, please do feedback or comment. I would like to learn more ways of building IDS boxen with commodity hardware.

Cheers (:])

FreeBSD - Google Earth

Since my friend told me the availabilities of Google Earth on Linux Platform with it's beta v4 release, I just browse to take a look there - http://earth.google.com/index.html, I downloaded the Linux version and think that it maybe fun to try to install it on FreeBSD, and with Linux ABI supports enabled, I then just go to directory that I have google earth downloaded and run sh ./GoogleEarthLinux.bin, the installation works flawlessly and you may check out the screenshots below.

Configure and Install .....

Installation Done ..... :)

Running Google Earth at the first time .....

Check out where I'm now .....

I'm kinda happy with Google Earth on FreeBSD, though it maybe slow because of soft emulation. Enjoy .....

Cheers :]

FreeBSD last.fm

I know you like radio station with cool musics don't you, and last.fm might be one of the popular fm these days, in fact last.fm been very Open Source Oriented, you can even download the player for various OS including Linux and FreeBSD, I have just downloaded the FreeBSD version and try installing it, tada!!!! It goes perfectly and I can now have fun with last.rm. Remember to register in last.fm.

Downloading it .....

Install with pkg_add after downloading it and start playing with last.fm.

That's all, folks.

Cheers :)

Session Data - Useful Links

I have been doing a lot of reading on netflow and session data collections and methodologies, and since I'm now moving to more systematic learning method, I always collect all the useful links and documentations before reading it in one shoot, there may be information overflows but I think that's more easy to make comparisons when reading and intepret. Since I find them useful, I might share the links as well, here you have it -

http://www.cs.dal.ca/~mchugh/netanalysis/slides/01-Introduction-2up.pdf

http://www.dynamicnetworks.us/netflow/index.html
http://www.networkuptime.com/tools/netflow/
http://www.hcs.ufl.edu/~park/tracearchive.html
http://events.ccc.de/congress/2005/fahrplan/attachments/560-Paper_IntrusionDetectionSystems.pdf

http://users.pandora.be/jurgen.kobierczynski/jkflow/eindwerk.pdf

www.educause.edu/ir/library/powerpoint/MWR0574A.pps

www.cert.org/flocon/2005/presentations/Trammell-Translator-FloCon2005.pdf

http://www.acsac.org/2005/case/wed-1030-yurcik-paper.pdf

http://cansecwest.com/core03/jhaile-cansec03.ppt


You can subscribe Argus Mail List at

https://lists.andrew.cmu.edu/mailman/listinfo/argus-info

Most of the links are presentation type so it should not take too much times to read. Hopefully you enjoy reading them.

Peace :]

Desktop Tips - icon

Again this is small tips for desktop users, if you happenned to have lovely icons that not available in your Open Source OS, you can actually convert it with the small util which is called iconconvert, just grab it via port/package will do,

shell>pkg_add -vr iconconvert

And if you have file with png format and you want to convert it to xpm which is loadable via fluxbox, you can use the small script that written by tenner via,

http://tenr.de/files/png2xpm.sh

There you will have tons of icons that you can use now.

Cheers :)

Xtra for ThinkPad X series Fluxbox users

If you are happenned to have Thinkpad X series and you are Fluxbox user, this is for you. I have few keys mapping work perfectly, here's how my configuration.

Here's my ~/.Xmodmap

keycode 92 = F13
keycode 111 = SunPrint_Screen
keycode 233 = XF86Forward
keycode 234 = XF86Back

Here's the keys file under ~/.fluxbox

Mod1 l :ExecCommand xlock -mode matrix -geometry 1x1 -enablesaver

None XF86Forward :NextWorkspace
None XF86Back :PrevWorkspace
None Print :ExecCommand scrot '%Y%m%d%R_$wx$h_scrot.png' -e 'mv $n ~/i-Screenshots/'

You can now jump to previous/next workspace with the mail forward and mail backwad key, and the printscreen will work too after you install scrot via package. Alternate + L will lock the machine if you install xlockmore.

Remember to add xmodmap ~/.Xmodmap at ~/.fluxbox/startup, this is important to get the key mapping works.

And guess WHAT?!!! Lenovo now turns their head again, check out the link below -

http://www.desktoplinux.com/news/NS5301096581.html

Again, we cheers :]

FreeBSD - Fluxbox + Gdm

I have been in Freenode #fluxbox channel for a while, it seems that many people are asking the same question regarding how to setup fluxbox on FreeBSD, previously I have written how to setup Fluxbox + Gdm in OpenBSD and I think I should write this one for FreeBSD. I will discard the X configuration part because it is similar to the previous OpenBSD Fluxbox post. Here's the quickies -

Installing fluxbox-devel and gdm, remember don't install the old fluxbox, many FreeBSD used to install the old stable version which is not actually stable compare to the recent devel version.

shell>pkg_add -vr fluxbox-devel gdm

Configure it to load through gdm,

shell>cd /usr/X11R6/share/gnome/xsessions

shell>touch Fluxbox.desktop

Adding the lines below to Fluxbox.desktop,

[Desktop Entry]
Encoding=UTF-8
Name=Fluxbox
Exec=/usr/X11R6/bin/startfluxbox
Icon=
Type=Application

Configuring ~/.xsession

Add this line,

exec startfluxbox

To add it into gdm session alternative,

shell>echo "exec /usr/X11R6/etc/gdm/Xsession \
/usr/X11R6/bin/startfluxbox" >> /usr/X11R6/etc/gdm/Xsession

Now you can find that you have fluxbox as alternative in your gdm menu when you login, just choose it if you want Gdm to lauch Fluxbox after login.

- Go Fluxy -

Cheers (:])

Bro-IDS - The learning process

Since I want to have more tools to provide valuable alert data for clues when accessing network traffic, I have installed bro-ids on my FreeBSD workstation. It is installed fine on FreeBSD, however when I try to run bro against pcap file, I get an error where bro.init not found, bro.init file is in policy directory and running bro in that directory works, so that must be path issue and it can actually be resolved easily by adding the following lines to your .bash_profile if you are using bash shell.

BROHOME=/usr/local/stow/bro-1.1
BROPATH=/usr/local/stow/bro-1.1/policy:/usr/local/stow/bro-1.1/site

export BROHOME BROPATH

That's it and now bro runs perfectly fine.

$BROHOME is your default Bro home directory and for your local config tweaking, you need to check for site directory under $BROHOME. Bro disables it's signatures detection capability by default, to turn it on, you just need to load the line below to the file - local.site.bro or one with your host.domain.bro,

@load brolite-sigs

Then restart Bro with the command /usr/local/etc/bro.rc checkpoint. In snort, those protocol decoders are defined as preprocessor, however in bro, it is called analyzer. Those analyzers are mainly the policy scripts that under $BROHOME/policy. You can write your own analyzer if you need one, that's pretty similar where you can write your own preprocessor for snort, especially version 2.6 now that you no longer need to patch snort to get unofficial/external preprocessors. You have dynamic preprocessor loading capability in snort 2.6!

I try to correlate the similarities of bro and snort so that I can take bro easily in my learning process, though Bro is developed for research purpose, it can be very powerful when comes to provide alert data. And those documentation and manual are comes with the source tarball when you downloaded Bro, so I read through the documentation and there are few chapters that pretty interesting such as Bulk Traces & Off-Line Analysis. Those mentioning how to analyse pcap file and using Bro to extract the packet payloads. I still feel adventureous with trying more stuffs with Bro and maybe getting a sensor running Bro to see how it goes.

That's all for Bro now, peace :]

Sguil Client - Quick && Easy

I remember I have problem installing Sguil Client on FreeBSD previously that push me to use source installation for one of the tcl libraries, however in FreeBSD 6.1, this is no more case, it is even rather easy to get sguil client works compared to other OS now. The steps are, should be the step is

shell>pkg_add -vr tcl tk tcllib tclX itcl itk iwidgets

Now just download sguil client from source forge, untar and run

shell>wish8.4 ./sguil.tk

Here's the screenshot,


By the way I'm now updating my snort to 2.6, hopefully I can play with it later.

Cheers :]

Multipurposes post :]

I have been out of posting due to some serious matters, anyway I think I should be writing some stuffs to keep me going. First of all, I'm pretty satisfied and happy that I have reached 200 blog posts where I never think of writing so much. Thanks for the comments and feedbacks along.

Few things I want to blog about are I will no longer be supporter of IBM ThinkPad after Lenovo bought over it's brand name, the bad design and idea that put the Thinkpad to the dead, what can I say, Lnv you sux big time - check the link below.

http://hardware.slashdot.org/article.pl?sid=06/06/04/0415221

I guess my main choices would be either Toshiba or HP now, seriously Lnv is a real ass hole. Bye beloved IBM ThinkPad. For people who haven't have chance to look at the new Z series, the design is utterly ugly.

I have fun playing with Bro-IDS under FreeBSD, it is installed fine on FreeBSD 6.1R, here's are the note when I install it. You need to install the package below first

shell>pkg_add -vr p5-Config-General adns

Then just run the usual configure, make and make install, since I'm not integrating bro as the tool to provide alert data, I prefer it to be on /nsm for management wise, so that's what I do, again I use stow for source installation management. I untar the bro-1.1 and start my installation process with

shell>mkdir /nsm/stow

shell>./configure --prefix=/nsm/stow/bro-1.1

shell>make && make install

shell>make install-brolite

It will ask you a series of questions for configuration settings.

shell>cd /nsm/stow && stow bro-1.1

Installation are done now and you can start bro with

[root@trinity /nsm/stow]# /nsm/stow/bro-1.1/etc/bro.rc --start
bro.rc: Running as non-root user bro
bro.rc: Starting ..........bro.rc: Failed to start Bro
/usr/local/stow/bro-1.1/bin/bro: problem with interface bge0 - pcap_open_live: (no devices found) /dev/bpf0: Permission denied
... FAILED

Since I get permission denied, I change the permission setting of bpf0

[root@trinity /nsm/stow]# ls -la /dev/bpf0
crw------- 1 root wheel 0, 115 Jun 6 07:28 /dev/bpf0
[root@trinity /nsm/stow]# chmod 604 /dev/bpf0
[root@trinity /nsm/stow]# /nsm/stow/bro-1.1/etc/bro.rc --start
bro.rc: Running as non-root user bro
bro.rc: Starting ............. SUCCESS

To check if it is running,

[root@trinity /nsm/stow]# ps auxww | grep bro
bro 17459 0.0 0.1 1760 1104 p3 I 10:29AM 0:00.03 /bin/sh /usr/local/stow/bro-1.1/etc/bro.rc --start
bro 17464 0.0 1.1 12716 11512 p3 R 10:29AM 0:04.76 /usr/local/stow/bro-1.1/bin/bro -W -i bge0 trinity.dissectible.org.bro
bro 17510 0.0 0.1 1760 1104 p3 I 10:29AM 0:00.00 /bin/sh /usr/local/stow/bro-1.1/etc/bro.rc --start
bro 17512 0.0 0.5 6836 5584 p3 S 10:29AM 0:00.12 /usr/local/stow/bro-1.1/bin/bro -W -i bge0 trinity.dissectible.org.bro print-filter.bro

Check if it adds the cron entry correctly,

[root@trinity /nsm/stow]# crontab -e
BROHOME=/nsm/stow/bro-1.1
# checkpoint Bro once a week
0 0 * * 1 /nsm/stow/bro-1.1/etc/bro.rc --checkpoint
10 00 * * * ( nice -n 19 /nsm/stow/bro-1.1/scripts/site-report.pl )
10 3 * * * (/nsm/stow/bro-1.1/scripts/mail_reports.sh /usr/local/stow/bro-1.1
/etc/bro.cfg)
0 3 * * * (/nsm/stow/bro-1.1/scripts/bro_log_compress.sh)
# If you are process logs on a front end host, add this:
#10 3 * * * (/nsm/stow/bro-1.1/scripts/push_logs.sh FrontendHost)

Bro suggests tweaking bpf buffer size and its max value, I tweak it manually, I'm thinking of testing this sysctl settings for my sguil sensor as well and guess it should be applicable.

shell>sysctl net.bpf.maxbufsize=8388608

shell>sysctl net.bpf.bufsize=4194304

To uninstall it cleanly, again we will make use of stow,

shell>cd /nsm/stow && stow -D bro-1.1

Go to the bro source directory and run

shell>make uninstall

shell>rm -rf /nsm/stow/bro-1.1

shell>make distclean

Now everything back to the previous state where you haven't installed bro-ids. Since bro-1.1 is installed cleanly, I supposed it should be easy to make into port/package, the FreeBSD package which is version which is version 0.8 is kinda dated, may need to email the porter for updates.

For sleuthkit on FreeBSD, you need to install the package below or else mactime won't work,

shell>pkg_add -vr p5-Date-Manip

Autopsy is not working when install via package, as it can't find Main.pm. Thus I install using port and it works now.

shell>cd /usr/ports/sysutils/autopsy && make && make install

Now what?!!! Of course snort, snort-2.6 Final is released, you may find out all interesting features and updates in the link below, go go snorting .....

http://www.snort.org/pub-bin/snortnews.cgi#445

Hopefully I can make to 300 blog posts !

Cheers (:])