SunOS: Snoopy Dog

When performing network traffic sniffing, capturing or inspection, we all usually use the sniffer calls tcpdump(to me sniffer is not the correct term but lets ignore it here), Sun has developed their own sniffer which is called snoop. I think snoop is useful for people who run SunOS based servers when coming to network traffic debugging. Anyway I'm trying all these on nexenta OS that I have came across lately and hopefully this blog post is useful to myself if I need to perform reactive Network Security Monitoring Operation on SunOS in future.

Before I have done anything using snoop, I check out the man page -

shell>man snoop

If you can't find certain man page for the command you want to use, you can try this too -

shell>info snoop

Snoop also has primitive support for filter expression, it is pretty similar to bpf filtering while I don't really look into it much. Just like tcpdump -d, snoop has -C to print the code generated from the filter expression for either the kernel packet filter, or snoop's own filter. For example -

shell>sudo snoop -C ip
Kernel Filter:
0: PUSHWORD 6
1: PUSHLIT EQ
2: 129 (0x0081)
3: BRFL
4: 3 (0x0003)
5: LOAD_OFFSET
6: 2 (0x0002)
7: POP
8: PUSHWORD 6
9: PUSHLIT EQ
10: 8 (0x0008)

I don't really dig into it much to understand the code like I did for tcpdump -d here.

By default snoop will capture the whole packet unless you specify the snap length with -s(same like tcpdump), there's very good tip in using -s option which I would like to show here as it can be useful for tcpdump user too -

-s snaplen

Truncate each packet after snaplen bytes. Usually the whole packet
is captured. This option is useful if only certain packet header
information is required. The packet truncation is done within the
kernel giving better utilization of the streams packet buffer. This
means less chance of dropped packets due to buffer overflow during
periods of high traffic. It also saves disk space when capturing
large traces to a capture file. To capture only IP headers (no
options) use a snaplen of 34. For UDP use 42, and for TCP use 54.
You can capture RPC headers with a snaplen of 80 bytes. NFS headers
can be captured in 120 bytes.

That's really neat -

- Ethernet Header(14)+IP Header without option enabled(20) = 34

- Ethernet Header(14)+IP Header without option enabled(20)+UDP Header(8) = 42

- Ethernet Header(14)+IP Header without option enabled(20)+TCP Header without option enabled(20)=54

To make sure we are capturing the IP header without option enabled, we can also make use of the filter such as -

ip[0] & 0x0F = 5

Netstat -i output tells me I can log via my network interface ae0, here's what I do with snoop to log the network packets to file -

shell>sudo snoop -q -r -d ae0 -o testing.snp

By default it will print the packet count that been seen by your network interface so with -q as quiet mode it won't, you can also specify -D in case you want to monitor the count of packet dropped during capture period. This is extremely useful to make sure you don't miss any packet. The -r option just like -n in tcpdump to avoid address resolution. While the -o option is to output it to a file which is just like -w in tcpdump.

After logged to the file, I check the file format -

shell>file testing.snp
testing.snp: Snoop capture file - version 2 (Ethernet)

You can read it with -

shell>snoop -t a -r -i testing.snp
1 0.00000 172.16.47.133 -> 172.16.47.2 DNS C _nfsv4idmapdomain.localdomain. Internet TXT ?
2 0.06758 172.16.47.2 -> 172.16.47.133 DNS R Error: 3(Name Error)
3 0.00047 172.16.47.133 -> 172.16.47.2 DNS C _nfsv4idmapdomain. Internet TXT ?

I like -t a which prints the absolute time that is similar to tcpdump -tttt. The -i option is just like -r option in tcpdump in order to read the packet dump. You may notice the number of each packet that shown in the snoop output too, and you can jump to certain packet with -p option. For example -

shell>snoop -t a -r -p 2 -i testing.snp
2 11:44:3.12067 172.16.47.2 -> 172.16.47.133 DNS R Error: 3(Name Error)

Or you can specify the range such as to jump to the packets within 10-20 range, just specify -p 10,20 will do.

You can also print summary line with -V option which summarizing the packet in human readable output -

shell>sudo snoop -t a -d ae0 -V
Using device ae0 (promiscuous mode)
________________________________
10:44:44.86678 nexenta -> 192.168.1.124 ETHER Type=0800 (IP), size=98 bytes10:44:44.86678 nexenta -> 192.168.1.124 IP D=192.168.1.124 S=172.16.47.133 LEN=84, ID=24675, TOS=0x0, TTL=255
10:44:44.86678 nexenta -> 192.168.1.124 ICMP Echo request (ID: 8040 Sequence number: 0)
________________________________
10:44:44.86682 192.168.1.124 -> nexenta ETHER Type=0800 (IP), size=98 bytes10:44:44.86682 192.168.1.124 -> nexenta IP D=172.16.47.133 S=192.168.1.124 LEN=84, ID=11586, TOS=0x0, TTL=128
10:44:44.86682 192.168.1.124 -> nexenta ICMP Echo reply (ID: 8040 Sequence number: 0)

If you want the packet to be printed in side by side hexadecimal and ascii output which is like -XX in tcpdump, you just need to specify -x 0 in snoop. Here's the example command you can use -

shell>snoop -x 0 -t a -r -i testing.snp
15 11:01:37.34663 172.16.47.133 -> 172.16.47.2 ICMP Destination unreachable (UDP port 34901 unreachable)

0: 0050 56f8 6c66 000c 2999 4f2b 0800 4500 .PV.lf..).O+..E.
16: 0070 8e9d 4000 ff01 3647 ac10 2f85 ac10 .p..@...6G../...
32: 2f02 0303 0c7b 0000 0000 4500 00af 2f13 /....{....E.../.
48: 0000 8011 5483 ac10 2f02 ac10 2f85 0035 ....T.../.../..5
64: 8855 009b 69cb fb53 8180 0001 0001 0002 .U..i..S........
80: 0002 0231 3202 3432 0237 3503 3230 3207 ...12.42.75.202.
96: 696e 2d61 6464 7204 6172 7061 0000 0c00 in-addr.arpa....
112: 01c0 0c00 0c00 0100 000b ff00 1807 ..............

If you want the output looks like the tshark which prints each protocol header in details, you can use -v, the example output for single packet is shown below -

shell>snoop -v -t a -r -i testing.snp
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 1 arrived at 11:01:25.14378
ETHER: Packet size = 98 bytes
ETHER: Destination = 0:50:56:f8:6c:66,
ETHER: Source = 0:c:29:99:4f:2b,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 84 bytes
IP: Identification = 36451
IP: Flags = 0x0
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 255 seconds/hops
IP: Protocol = 1 (ICMP)
IP: Header checksum = 5d58
IP: Source address = 172.16.47.133, 172.16.47.133
IP: Destination address = 202.75.42.12, 202.75.42.12
IP: No options
IP:
ICMP: ----- ICMP Header -----
ICMP:
ICMP: Type = 8 (Echo request)
ICMP: Code = 0 (ID: 8122 Sequence number: 0)
ICMP: Checksum = 3bf2
ICMP:

I think that's all for the snoopy dog, in fact this post is more about tcpdump vs snoop but I think both are great so no fight between them. If any of you have better knowledge in using snoop, please do share as I still considered myself as newbie in utilizing it practically.

Enjoy (;])

Regular Expressions: Another good resource

This is great reference for people who want to learn about regular expressions, feel free to check it out -

http://www.ilovejackdaniels.com/cheat-sheets/regular-expressions-cheat-sheet/

Thanks to Dave who has created the regex cheat sheet with straight forward explanation.

Cheers ;]

Packets -> Flows -> CSV -> Graph

Comma-Separated Values(CSV) file format is widely used and it can be easily parsed by lot of graphing tools. Here's the simple trick to generate CSV data from packet dump(pcap) with the used of upcoming argus 3 and the pipe.

Say I downloaded this slammer.pcap that available at wireshark sample capture wiki -

http://wiki.wireshark.org/SampleCaptures

shell>argus -w - -r slammer.pcap | \
ra -nnr - -c ',' -s saddr daddr dport - ip

213.76.212.22,65.165.167.86,1434

There's only one flow but you get the idea of how to generate the CSV ouput from packet dump(pcap). The next thing to do is to generate the graph, I won't show it here but you are free to use any application such as OpenOffice Spreadsheet, afterglow and etc for that purpose.

The good thing about argus is that it provides wide range of useful flow metrics so you can actually generate rich set of data for graphing purpose.

Enjoy (;])

Hub Seeker

Yeah I'm looking for ethernet hub, it is pretty hard to find network hub in Malaysia now and I know there are many companies just throw it away or put their old network hub in the store to collect dust because network switch is cheap and better and network hub is obsolete in their point of view.

This is not joking, if your company has unused network hubs lying around and produce no value at all, I would like to give them life in my research lab especially from local companies since shipment is really expensive.

If you feel that you can help me, drop me an email. Thanks!

Cheers ;]

InfoSec Technical Forum

CyberSecurity Malaysia(Previously known as MyCERT/NISER) will organize the event where you can find the detail at -

http://www.cybersecurity.org.my/infosec-my/itinenary.html

The topics sound interesting but I'm not too sured it is more business or technical oriented. As far as I know Malaysia used to have technical event but business oriented most of the time which I avoid to participate.

Anyway I might be going there to meet my friends.

Peace ;]

Ubuntu: msttcorefonts problem fixed

This is just for my own note as I have problem when installing msttcorefonts on Ubuntu Linux but anyway it is fixed, the problem is due to the wrong setting in the proxy where you can find under System -> Preferences -> Network Proxy. If you encounter the similar problem when installing other stuffs, this post may give a hint of how to fix it as well. I have been lazy to post this up but anyway here you got it -

I have encountered the problem below when installing msttcorefonts and I have tried various ways to fix(e.g. remove or fix with dpkg tool)but no luck, here's the error I got when I was trying to apt-get remove --purge msttcorefonts

Blablabla .....
dpkg: error processing msttcorefonts (--purge):
subprocess pre-removal script returned error exit status 1

These fonts were provided by Microsoft "in the interest of cross-
platform compatibility". This is no longer the case, but they are
still available from third parties.

You are free to download these fonts and use them for your own use,
but you may not redistribute them in modified form, including changes
to the file name or packaging format.

Error parsing proxy URL http://:8080/: Invalid host name.
Error parsing proxy URL http://:8080/: Invalid host name.
Error parsing proxy URL http://:8080/: Invalid host name.
Error parsing proxy URL http://:8080/: Invalid host name.
Error parsing proxy URL http://:8080/: Invalid host name.
Error parsing proxy URL http://:8080/: Invalid host name.
Error parsing proxy URL http://:8080/: Invalid host name.
Error parsing proxy URL http://:8080/: Invalid host name.
Error parsing proxy URL http://:8080/: Invalid host name.
Error parsing proxy URL http://:8080/: Invalid host name.
Error parsing proxy URL http://:8080/: Invalid host name.
Error parsing proxy URL http://:8080/: Invalid host name.
Error parsing proxy URL http://:8080/: Invalid host name.
andale32.exe: No such file or directory

All done, errors in processing 1 file(s)
dpkg: error while cleaning up:
subprocess post-installation script returned error exit status 1
Errors were encountered while processing:
msttcorefonts
E: Sub-process /usr/bin/dpkg returned an error code (1)

I tried to search the ubuntu forum but no luck, and finally I figured I can fix by commenting these two lines in /var/lib/dpkg/info/msttcorefonts.postinst -

# db_get msttcorefonts/http_proxy
# http_proxy=$RET

Now I can do

shell>sudo apt-get remove --purge msttcorefonts

Problem fixed. Now you need to get the setting of your proxy right or just remove it to use direct connection and reinstall msttcorefonts.

Cheers ;]

MyOSS November Meetup

After idle state, MyOSS Meetup is rebooted on 22th November again, me and chfl4gs_ will represent the HeX development team and give the talk about our Open Source Project titled "HeX liveCD Development & Showcase". More information about the meetup can be found here.

For your information, MyOSS Meetup is the local monthly FOSS event and feel free to join us!

Enjoy ;]

MyOSS: Basketball

Been long time I haven't played basketball, and now we are going to have basketball game on tomorrow which is November 15th, welcome all the myossers to join us! The detail of the event can be found in the link below -

http://foss.org.my/projects/recreation/basketball-november-2007

Enjoy ;]

This site is dead forever?

If you can't even protect the little site, how can you protect your people?

Big disappointment!

Peace ;]

HeX &

Yes I'm not familiar with silktools but I add it to the HeX liveCD, the reason is that silktools comes with very comprehensive documentation and I believe I might try it out someday, I know some of you may find silktools toolset missing in the HeX menu because I don't really use it practically and not too sured about the the placement of it in the menu.

Anyway I just figured some of the applications that bundled by silktools(such as rwptoflow) are broken due to the absent of lzo2 library, so I think we need to fix this.

On the other hand, thanks to the report from dakrone, chfl4gs_ has fixed the dual display devices problem in order to probe for X properly.

Couple of minor changes would be the font setting for sguil client is now predefined and you wouldn't get the ugly font any more, we have also set the mozilla firefox as default browser without interaction of users anymore. Thanks to Victorj for this.

We are not going to release anything yet, as we are still waiting for more bug reports, feel free to do so. By the way, if you have any opinion or suggestion for HeX liveCD development, you are welcomed as we are moving to HeX 2.0 development soon.

Anyway, I'm pretty glad for the progress of HeX so far and some other projects undergoing .....

Enjoy (;])

OpenBSD 4.2: Sguil Setup

Just in case you haven't noticed, my friend nikns has actually updated the NSM wiki about the Sguil setup on OpenBSD 4.2, good job nikns as I will use the guide to build the virtual appliance, by the way I'm really looking forward to the upcoming of Sguil 0.7. Here's the link -

http://www.vorant.com/nsmwiki/Setup_a_Sguil_framework_using_ports_under_OpenBSD

Enjoy ;]

Ubuntu: Qemulator

Last time when I used qemu on FreeBSD, I used the gui frontend for qemu called qemu launcher, however it ends up that qemu launcher is not good enough in my point of view, and I have found another gui frontend for qemu in Ubuntu software repo which is called Qemulator. Let's check it out -

To whoever allergy to command line interface or don't know how to read man page, you can launch qemulator, configure everything you need in the graphical interface environment. After that, you can right click on any virtual machine you have setup in My Machines tab, and choose Show Commandline which looks exactly like the screenshot above. In order to tune the setting of each virtual machine, you can click on show settings button at down there.

Once you click on the show settings button, it contains many sub tabs for you to configure almost everything such as the boot options, emulated hardwares, networks and so forth. it shouldn't be hard to configure with all those options available and you just need to point and click.

Here you can see I click on User mode in the Network tab, and you can also change the Hostname if you want in the same tab.

In the Main tab, I choose cdrom as first boot options, because I plan to boot up my HeX liveCD for packetysis(Don't bother my own word). Now everything is setup, just click on the green button with arrow.

Here you go, the shiny HeX booting up in progress. Maybe I should change that demon to monkey someday.

Cheers ;]

Happy Deepavali

To all my friends especially those in #myoss and Mr. Saravanan, Happy Deepavali!

To find out what Deepavali is about, read this.

Enjoy ;]

NexentaOS: Gnu OpenSolaris

I'm not a big fan of Sun Solaris but I wouldn't mind to give it a try again after Solaris 9. Thanks to Sun for making OpenSolaris available(I know this is nothing new) and I chose to try out NexentaOS which you can find here -

http://www.gnusolaris.org/gswiki/Nexenta_OS

You are required to register before downloading the installation iso, and I quickly completed the registration and jumped to the download section, thanks to fast internet that I able to download it within 20 minutes.

Surprisingly it is pretty easy to get NexentaOS desktop installed, gnome appears to be the default desktop of choice. Interestingly NexentaOS is not using the standard Sun Solaris package management tools but Debian apt style for software management. You can find the apt repositories for NexentaOS at -

http://www.gnusolaris.org/gswiki/APTMirrors

Just add any of them to /etc/apt/sources.list and run the sudo apt-get update will do, debian/ubuntu users will find this familiar. Till now I haven't really look at the exciting features such as dtrace and zfs in NexentaOS while I have FreeBSD 7.0 Beta 1.5 installed for zfs testing, I'm looking forward to try them out when I have time.

Anyway here's the screenie of NexentaOS, it looks pretty ubuntu-ish -

Oops, I may need to try out the Solaris default sniffer too - the snoopy dog!

Cheers ;]

OpenBSD 4.2: ISO Ready

Don't confuse, I'm not distributing any unofficial OpenBSD iso, and I don't need to!

I used to create the OpenBSD iso myself because there's no official iso from OpenBSD team, you can find how I did it here. But with the arrival of OpenBSD 4.2, you no longer need to use mkisofs or mkhybrid to create the iso from the files that you download from any of OpenBSD download mirrors, I was stupid enough to download everything from here -

ftp://ftp.openbsd.org/pub/OpenBSD/4.2/i386

I couldn't find cdrom42.fs in this release so I can't create my own iso. In fact now what you actually need is the install42.iso, just burn it to the CD and you are ready to install OpenBSD 4.2.

It's time to install the fresh puffy!

Enjoy ;]

OpenBSD 4.2 Release

Yes, this is another big release of OpenBSD, kudos to the OpenBSD team again for making this happen, you can find the release information at -

http://openbsd.org/42.html

Side note: Maybe it should be time to create another sguil virtual appliance based on OpenBSD 4.2, let's see.

Enjoy ;]

Russ Toolsmith

Russ McRee has published the article "Auditing Network Activity Using Argus" for the toolsmith column in November ISSA journal, you will be able to grab the article at -

http://holisticinfosec.org/toolsmith/docs/november2007.pdf

Thanks for the acknowledgment from Russ, especially he has also mentioned about the HeX liveCD and the argus paper that I have written. On the other hand, he has also mentioned about NSM wiki which you shouldn't miss if you are NSM practitioner.

NSM is getting hot!!!!!

Cheers ;]

HeX: Virtual Appliances Offering

In order to make sure HeX is in good shape, we have actually tested it on various applications that offering virtualization technology. Here are the lists, the screenies speak for themselves -

HeX on VMware Player

HeX on VMware Fusion

HeX on Parallels

HeX on Qemu

HeX on VirtualBox

We are proud to release HeX virtual appliance for different flavors of virtualization softwares. Most people prefer to try or test the stuffs before real deployment, and I think by offering different types of HeX virtual appliance(VMware, VirtualBox, Qemu, Parallels), people can easily load them to their preferred application. This virtual appliance is based on HeX 1.0.1 with the default installation set(sudo installer). We have tested it on all of them and it boots from zero to fluxbox fully loaded in less than a minute with 256MB of RAM. All of the virtual appliances can be found at -

- http://bsd.ipv6.la/hex-images

For direct download, just click here will do -

- HeX VMware Virtual Appliance
- MD5 Hash
- SHA256 Hash

- HeX VirtualBox Virtual Appliance
- MD5 Hash
- SHA256 Hash

- HeX Qemu Virtual Appliance
- MD5 Hash
- SHA256 Hash

- HeX Parallels Virtual Appliance
- MD5 Hash
- SHA256 Hash

Enjoy (;])

HeX 1.0.1 Release

Yes, we thought we could have stopped the development of HeX after 1.0R but we were wrong, we have encountered the boot issue with HeX on certain hardware and also on vmware when mounting the CD. Me and chfl4gs_ have tried to track down the problem and it seems that the problem is caused by the data that need to be copied from CD to memory in order to mount it using mfs( the /var which is about 32Mb). This IO process has caused the liveCD can't boot properly in certain machines and finally we find the workaround.

Another problem that we have encountered is the msfweb not loading properly, and after trying out the ntop and darkstat, we figure even if we enable java script in the firefox browser, it still didn't seem to show the graph in the browser and we tried to delete ~/.mozill/firefox and use the global configuration for firefox instead. With that we solved msfweb problem too(in fact it is caused by browser oddness).

With all the problems solved now, we are shamelessly releasing HeX 1.0.1 which is more shiny as the boot up performance is much improved and most of the hardcore issue which we can't fix is most properly gone now. Please try out the new release and as usual if you have problem, make use of the HeX trac, mailing list or even join the IRC freenode rawpacket channel will do. Anyway here's the download links -

- HeX 1.0.1 Release ISO

- HeX 1.0.1 Release MD5

- HeX 1.0.1 Release SHA256

Enjoy (;])

HeX: Trac & Wiki

Thanks to spoonfork and now we have the trac and wiki -

https://trac.security.org.my/hex/wiki

With that we can manage the HeX project efficiently and if you have any tips or tricks that want to share, just let me know and I will put it into the wiki. For the bugs management, use trac.

Users need to register in order to do bug report, sorry for the hassle but we are not spam lovers.

Peace ;]

HeX: Using Darkstat & Ntop

If you are using HeX, you can track your network statistic easily with the use of both darkstat and ntop, and here I will show you the simple way of doing it. Both darkstat and ntop are accessible through the right click menu -> NSM-Toolkit -> Session -> Darkstat or Ntop.

It is pretty straighforward to get darkstat to run -

shell>sudo darkstat -i lnc0 -b 127.0.0.1 -p 5555

To run ntop -

Set the admin password so that you can access to the web interface -

shell>sudo ntop -u nobody --set-admin-password=whatever

shell>sudo chmod 777 /var/db/ntop

In order to make it start on boot, I add this part to the file - /etc/rc.conf

ntop_enable="YES"
ntop_flags="-i lnc0 -w 127.0.0.1:3000 -d --use-syslog=daemon"

Then I start it -

shell>/usr/local/etc/rc.d/ntop start

Now you can access the web gui by typing this in your browser -

Darkstat
http://127.0.0.1:5555

Ntop
http://127.0.0.1:3000

If you are opening this via localhost, you may figure firefox browser won't be displaying the graphs properly even you have java script enabled in the browser, here's simple trick to fix it, just do -

shell>rm -rf ~/.mozilla/firefox

Restart your firefox and you are done.

Some screenies below -

I will continue to write the tips and tricks for the HeX liveCD, if you find any network security monitoring tools that listed in the menu you want to use but don't know how, feel free to email me and I will post the write up. In fact I'm thinking of doing screencast tutorial, let me know what do you guys think about that?

Enjoy (;])

HeX liveCD: 1.0 Release

After six months of heavy developments, HeX development team is proud to present you the first and foremost Network Security Monitoring & Network Based Forensics Centric liveCD - HeX version 1.0 Release.

- Big Shout to chfl4gs_, thanks for everything
- Shout to pauls, thanks for all the ports
- Shout to guti, our web master
- Shout to vickz, our graphic designer
- Shout to tenner, thanks for your Fluxbox styles
- Shout to enhancer, mirror mirror on the net
- Shout to hol, thanks for the writeup editing
- Shout to spoonfork, thanks for your input
- Shout to whoever uses it and the feedbacks/suggestions

Great works to all the members in the team and thanks for the feedbacks. Inline with the 1.0 Release, we have also printed total 50 copies of CD labels(15 peace monkey and 35 fierce monkey) to be distributed. Here are the samples -

We will stop the development of HeX after 1.0 release, and only release bug fix version if any major bug found. We need some rest now, the next development cycle will be started again after FreeBSD 7.0 Released. We are currently planning for next project which will be announced soon.

For more details, check out its own page here -

http://www.rawpacket.org/projects/hex-livecd/version-10-release

May the force be with you!

Enjoy (;])

PADS: Call For Testing

If you are using PADS, we would like to have you testing for 2 patches which are available at sourceforge, my friend David Bianco has been running PADS with his own patches which fixed the daemon mode bugs and added vlan support. You can find the patches under his InstantNSM project here -

http://instantnsm.cvs.sourceforge.net/instantnsm/instantnsm/instantnsm/patches/

On the other hand, David has also added vlan support for tcpflow. If any of you are interested, feel free to test it out and send the feed back to me.

Thanks.

Peace ;]

Happy Festival & Holidays

To my muslim friends, Selamat Hari Raya Aidilfitri.

To my non-muslim friends, Selamat Bercuti.

Check out the wiki if you don't know what I mean.

Enjoy ;]

PADS: About Signatures Writing

I have written short write-up at security.org.my about how to write PADS signatures from the scratch, it's nothing to do with the regex matching but more to obtaining the correct data you need in order to proceed.

Lets go ->

http://security.org.my/index.php?/archives/PADS-Efficient-Signature-Writing.html

Enjoy ;]

HeX liveCD: Packet Trace File Conversion

I have spent some times to analyze the packet trace files which are freely available in Wireshark wiki and packet-level.com using HeX liveCD. While I'm having great fun with the packet traces, I encounter this -

shell>tshark -nr tcpshake.cap
1 0.000000 130.57.20.10 -> 130.57.20.1 TCP 1026 > 524 [SYN] Seq=0 Len=0 MSS=1460
2 0.004942 130.57.20.1 -> 130.57.20.10 TCP 524 > 1026 [SYN, ACK] Seq=0 Ack=1 Win=32768 Len=0 MSS=1460
3 0.005894 130.57.20.10 -> 130.57.20.1 TCP 1026 > 524 [ACK] Seq=1 Ack=1 Win=8760 Len=0

I want to compare the output of tshark and tcpdump, then I run -

shell>tcpdump -ttttnnr tcpshake.cap
tcpdump: bad dump file format

Fine, lets check what it is -

shell>file tcpshake.cap
tcpshake.cap: NetXRay capture file - version 002.001 (Ethernet)

It seems Wireshark suite supports NetXRay file format,

shell>man wireshak
Output truncated .....
Wireshark can read / import the following file formats:
* Cinco Networks NetXRay captures
Output truncated .....

Maybe I can convert it using editcap? Right click to launch the HeX main menu -> Pcap-Editor -> Editcap, to convert it from NetXRay capture format to libpcap format, I run -

shell>editcap -F libpcap tcpshake.cap tcpshake.pcap

shell>tcpdump -ttttnnr tcpshake.pcap
reading from file tcpshake.pcap, link-type EN10MB (Ethernet)
1999-11-08 06:31:23.090125 IP 130.57.20.10.1026 > 130.57.20.1.524: S 12952:12952(0) win 8192
1999-11-08 06:31:23.095067 IP 130.57.20.1.524 > 130.57.20.10.1026: S 2744080:2744080(0) ack 12953 win 32768
1999-11-08 06:31:23.096019 IP 130.57.20.10.1026 > 130.57.20.1.524: . ack 1 win 8760

That's great.

I figured that if you prefer gui, you can use the freeware which support more different capture formats - ProConvert. With wine, I have successfully installed in on Ubuntu 7.04. And here's the screenshot -

I try to compare both files that converted from different tools with diff command and they seems to have no differences, including both have same file size as well.

shell>ls -la tcpshake_cap.dmp tcpshake.pcap
-rw-r--r-- 1 geek00l geek00l 252 2007-10-10 14:41 tcpshake_cap.dmp
-rw-r--r-- 1 geek00l geek00l 252 2007-10-10 15:00 tcpshake.pcap

I haven't tried wine on HeX(FreeBSD), maybe it's about time to do it too.

Enjoy (;])

Finally ..... Fluxbox 1.0 Stable Release

After marathon type of development, finally Fluxbox reaches the great milestone - 1.0 Stable Release. While I'm not involving in Fluxbox development, I'm quite a long time user of it and even our HeX liveCD uses it as our default Window Manager for its simplicity and clean style. You can find the latest changelog here.

If you are new to Fluxbox, no worry as Fluxbox community has setup very useful wiki for you.

Anyway, greeting to Fluxbox development team!!!!!

RealTime Log Visualization

Visualization is getting popular these days, I came across this site -

http://www.fudgie.org/

This is much easy to read/watch .....

Enjoy ;]

PADS: The Future

As PADS is now integrated to Sguil, I would assume the usage of it might be increasing. PADS is known to passively identify the network assets running on your network and further assisting in network assets profiling. However the main developer(Matt Shelton) of PADS is no longer actively maintaining it. Together with David Bianco, we have taken the initiative to maintain the PADS but this is more to NSM community efforts instead of doing it solely. If you are using PADS, feel free to do the following -

- bug report

- send us patches

- test our patches

- contribute PADS signatures

Matt Shelton has delegated us the admin access to PADS source tree, however we will take careful step to further testing all the patches and signatures before committing to it.

Cheers ;]

Hub, Span or Tap

I must say I enjoy reading this because it is well explained, you should read this if you are currently involved in network security monitoring implementation and deployment stage -

http://www.lovemytool.com/blog/2007/08/span-ports-or-t.html

http://www.lovemytool.com/blog/2007/09/aggregation-tap.html

I enjoy reading other posts as well since I can learn about some commercial products that I haven't used before. Progressive learning is always good .....

Peace ;]

HeX liveCD: The Graphic Designer

We have assigned Vickson as our main graphic designer because we all like his sense of art and ability to craft. It's been quite sometimes he has setup his own blog that discussing about art and design which I think it's worth mentioning, check out the link -

http://vickz.com

Hereby I would like to thank for his contribution to the HeX liveCD. We all appreciate it!

Cheers ;]

The light & easy

Today is Sunday, and lets share something that is light and easy. Here's the list of softwares I use lately on my Ubuntu desktop -

- Pcmanfm

- Tracker

- Deluge

- Miro

Pcmanfm is another nifty file manager, tracker is great indexing and searching tool, deluge is better than any other bit torrent clients out there, miro is your wanted video player. No sneak peaks here because you can find them in their respected site.

Enjoy ;]

Bro - Tips & Tricks

I figured simple way to find all the tips and tricks about Bro-Nids that written by me and spoonfork. Check them out here -

- My blog

- Malaysia Network Security Blog

Other than us, you would be able to find all the good things in the bro wiki.

Enjoy ;]

Digital Forensics Research Workshop

I'm always interested about digital forensics technology, while I'm not really into that field. I just learn about this site when googling around, and it's good to share with everyone -

http://www.dfrws.org/index.shtml

From the site -

DFRWS is dedicated to the sharing of knowledge and ideas about digital forensics research.

This is what we really need, the knowledge sharing!

HeXtra Changes

Along with the upcoming release of HeX liveCD, there will be couple of changes in HeXtra. Thanks to Paulh as most of the tools that packaged in HeXtra 1.0 Beta are already ported to FreeBSD port system. Therefore we will only distribute HeXtra 1.0R with the following -

- latest sguil client in cvs

- snort configuration files and signatures

- latest argus 3

I have received few requests about the adding of honeysnap to the HeX liveCD. If any of you would like to port it to FreeBSD for the sake of HeX, please feel free to contact me.

Sguil: Minor DB Issue

I remember I have this problem previously and it forces me to create the sguil sensor name without "-" instead to resolve it. And I haven't taken note of this but today when I read this information at Knoppix-NSM faq, they have clear answer so I think it's good to take note of it, from the link -

http://www.securixlive.com/knoppix-nsm/faq.php

Sensor is running but no data in sguil console?

If you have used the - (minus/dash) character in your sensor name than this could be the cause. When a new sensor is created new tables, based on the sensor name, are also created for storring data. MySQL does not allow you access to tables that has the - character in the name. Change the sensor name and this should fix the problem.

It's minor issue, seriously. But it can crack your head to figure it out sometimes.

Peace ;]

HeX liveCD: Pre 1.0R

Nothing much happens, but we are making progress bit by bit. We are currently testing the private version of HeX to make sure everything in HeX working properly.

As for today, we decide to release the last build of HeX before the major version 1.0 Release. Feel free to join our mailing list as the initial announcement is there.

Here's the announcement from chfl4gs -

geek00L and I are proud to present latest build of Hex for group peer review. My apology for not making this post possible earlier and circulation of versions of Hex for wouldn't be merely between two of us.

Here you can grab the iso for testing.

http://bsd.ipv6.la/hex-i386-1.0RC2-20071002.iso
http://bsd.ipv6.la/hex-i386-1.0RC2-20071002.iso.md5

http://bsd.ipv6.la/hex-i386-1.0RC2-20071002.iso.sha256

Some of the known issue i.e. msfweb shows "Application Error" without error : RubyOnRails related memory handling issue. msfweb runs fine if you allocate more memory. 256MB on qemu is not sufficient for msfweb.

This version is a major bug fix release and we planned to go for 1.0-R if everything else is stable and functional. As usual, feedback, both good and bad, are most welcome. Please post to this group if you have any questions/bug reports/fix to share.

Thank You.

Yes, most of the bugs that we have found and reported are fixed, and we even tested all the Network Security Monitoring based tools and it goes well.

One of the script I have added is NBF-Offline.sh where you can find under ~/rp-NSM directory, it is Network Based Forensics automation script to assist analyzt to perform network data carving. Most of the stuffs in HeXtra are already merged to it as well, except the argus 3 and NSM-Offline.sh, which we have thought of adding to the 1.0R.

In order to summarize the Objective of our liveCD, we are actually trying to develop the first and foremost Network Security Monitoring & Network Based Forensics Centric liveCD. Therefore we welcome all the practitioners to try it out!!!!!

Enjoy ;]

HeX: Full Screen Terminal

For HeX liveCD, our virtual terminal of choice is mrxvt, we use version 0.5.3 which is the latest unstable branch and it works very well.

I know some of you prefer to have Full Screen CLI especially to those who allergy to GUI, here's the simple tip, you can either click on the fluxbox menu->System->Run or type in the terminal -

shell>mrxvt +sb -name FullScreen

Here's the screenshot -

It will launch the full screen terminal, and the font size also becomes bigger in this case. However if you prefer to have small font size while having full screen terminal, you can run -

shell>mrxvt +sb

Then follow by pressing Control+Shift+f keys will do. Here's the screenshot -


Nice little trick but it does what you want.

Peace ;]

Network Protocols & Passive Analysis

It's weekend day and I should find way to relax but I have to admit I'm network protocol addict. Today I have read about the links below and would like to share -

- http://sd.wareonearth.com/~phil/net/overhead/

- http://www.hypothetic.org/docs/msn/index.php

- http://www.securityfocus.com/infocus/1894/1

No comment about the protocol overhead and msn protocol topic but I might say I learn something new and save my time of digging them myself. Well documented stuffs always cool. However for the third link which topic is Passive Network Analysis and the date is 2007-09-28, introducing ethereal is bad especially the writing itself is more to introductory and you have wide range of audience(securityfocus is high profile) unless if we flash back to April 24, 2006. In fact, the wireshark is NOW. Other than that, Stephen Barish has done a great job in explaining the basic and the use of Passive Network Analysis.

Passive Network Analysis is another form of intelligence gathering technique in forming defensive strategy which you should look up.

Cheers ;]

OpenPacket: Emphasizing Practical Knowledge

One of the objective that raWPacket group creating the HeX liveCD is to develop the platform for network security analyzt to analyze the network data(pcap), and it can be great learning tool too if you want to learn about networking or enhance your analysis skill.

In most of the time, I have heard from people that they don't have live network to learn about networking or network security especially students, therefore their practical knowledge usually come after they started working in the field.

Thanks to Richard who taking initiative to launch OpenPacket, it is still in alpha stage but we hope to see it goes live soon. To follow up the progress and development of OpenPacket, stay tune with its blog.

So what is this OpenPacket all about?

OpenPacket.org is a Web site whose mission is to provide a centralized repository of network traffic traces for researchers, analysts, and other members of the digital security community.

I would like to add on that the network traffic traces or sample can be equally useful for education community too, students can download the data and start to learn about them practically instead of reading the unintuitive networking book line by line without real understanding. And it can be very handy and productive if they are using HeX liveCD.

What should you do now? Join the OpenPacket mailing list, share your network traces and be part of community. Your participation are always welcomed.

Before some of you may remind me, another useful website to obtain network data is at -

http://wiki.wireshark.org/SampleCaptures

Enjoy ;]

Fl0p: Decoding the Evil Genius Mindset

People who come from Unix background always have the real guts, and I bet you know what is RTFM all about. In fact it is Read The Fun Manual when you don't know how to use the commands or understand the technical section, sounds polite isn't it ;P

Thanks to one of my great friend who has observed the Fun thing about fl0p which created by one of the man who I really respect - Michal Zalewski. In fact my friend also fixed the packet retransmission handling for fl0p in order to identify the traffic flows more accurately especially in busy networks. We also figure there's error in the command line option where the -q for packet timing threshold is in fact -T, the -q is used for quiet mode instead. We are not too sured to make the patch publically available yet but we hope to fix more things before we do so.

So what's this fun thing about, let's look at the fl0p command lines -

shell>./fl0p -h
Usage: ./fl0p [ -f file ] [ -i device ] [ -s file ] [ -o file ]
[ -u user ] [ -e ms ] [ -T ms ] [ -FUKrqvpdtl ] [ 'filter rule' ]
-f file - read fingerprints from file
-i device - listen on this device
-s file - read packets from tcpdump snapshot
-o file - write to this logfile (implies -t)
-u user - chroot and setuid to this user
-e ms - pcap capture timeout in milliseconds (1)
-T ms - packet timing threshold in milliseconds (400)
-F - disable fuzzy matching on all signatures
-U - display fingerprints for unidentified streams
-K - do not display known signatures (implies -U)
-r - resolve host names (not recommended)
-q - be quiet - no banner
-v - enable support for 802.1Q VLAN frames
-p - switch card to promiscuous mode
-d - daemon mode (fork into background)
-t - add timestamps to every entry
-l - output concise 1-line output

'Filter rule' is an optional pcap-style BPF expression (man tcpdump).

The command line looks innocent as it is. But what if I do -

shell>./fl0p -t -f /usr/local/etc/fl0p.fp -i eth0 -FUK -u geek00l

So this can be interpreted as F-U-tu.....-K u geek00l! Maybe we should implement another command line argument which is -C. Or Zalewski must have something in his mind to implement for -C to the completion of fl0p.

Peace (;])

HeX liveCD: Virtual Appliance

I started to have this idea after conducting the security training with Spoonfork in HITB Security Conference lately, we have created the VMware Image by installing HeX on top of it. However the image is only available to the people who have attended our training only as it also contains interesting pcaps that I have collected during my past network security operation.

I would like to create the platform which network security analyzt can perform network data analysis during network security operation. The HeX liveCD itself is great choice to do so but I believe some folks out there prefer it to be readily installed and can load the network data(pcap format) instantly. However if I have to create the HeX Virtual Appliance, the main issue would be the distribution because of its image size(Gigs). Hence I have thought of few ways to solve it -

- Distribute through p2p networks - bittorrent?

- Getting more download mirrors? Shout to enhancer!!!!!

- Getting support from http://www.vmware.com/appliances/

I'm not too sured creating HeX Virtual Appliance worth the efforts, and I would like to hear from you - the HeX users out there.

Cheers ;]

HeX liveCD: Mailing List

For all the HeX liveCD users out there, we have been developing this liveCD for quite sometimes and I have received some positive and negative comments and various inputs from the users, therefore instead of me receiving the email and redirect to other co-developers, I decide to create the mailing list for the HeX liveCD so that it will has life of its own ;P

There you go -

http://groups.google.com/group/HeX-liveCD?hl=en

Since this is public group and mainly used for mailing list management, I decided to use google group as it is convenience and easy. Therefore feel free to join us!!!!!

On the other hand, you can visit us at Freenode #rawpacket. Most of us are slacking there.

Enjoy ;]

When will spammers' creativity exhaust?

Seriously, I do wonder when will the spammers run out of creativity .....

Even then, they try hard to bypass the detection of "Internet Explorer" strings.

Let's copy it and paste but yet it doesn't work, poor lowpriceoem. com

Peace ;]

VMware-Tool Follow Up

I found this great tip to get VMware-Tool install, in fact the link mentioned that if we are running Xorg 7.2 or later, the driver for VMware is included natively and we just need to install VMware-Guestd. Here's the link -

http://web.irtnog.org/doc/faq/freebsd-vmware-tools

The tip works great if you have installed HeX in your VMware workstation. After VMware-Guestd is installed, what we need is just the editing the section below in /etc/X11/xorg.conf -

Section "Device"
Identifier "Card0"
Driver "vmware"
EndSection

By default it is vesa, just change it and restart X will do.

Enjoy ;]

HeX liveCD: VMware-Tool Inclusion & Status

The HeX liveCD project is inactive for a while and now it goes active again, the 1.0 Release is very very close as we are doing some improvement and housekeeping to make it clean and tidy.

As most people who uses HeX liveCD prefer to load it on VMware, it raises the question to us whether it's fine to distribute HeX with VMware-tools. I have discussed with chfl4gs and interestingly we found this link -

http://www.vmware.com/download/eula/tools_policy.html

Effective immediately, VMware has modified its current policy with regard to VMware Tools as follows:

Subject to your compliance with the VMWARE MASTER END USER LICENSE AGREEMENT, the restriction in Section 3.5 of the VMWARE MASTER END USER LICENSE AGREEMENT prohibiting distribution of the VMware Tools to third parties is hereby removed. You may distribute VMware Tools to third parties in object code format only and solely in conjunction with, and as part of, any Virtual Machine you create with the Software or with any update for any such Virtual Machine.

For now, it seems to be fine to distribute the FreeBSD VMware-tool6 package and we may do so . But changes will be made later if the vendor changes their mindset but from what I know, VMware Inc usually plays well with FOSS community.

From now onward, we are in the package/port freeze state and concentrating on bug fixes until the release of HeX v1.0R.

Cheers ;]

Sigsssss or Sicksssss

Another post about Bro-Nids regarding the conversion of signatures from Pads to Bro format.

You can find it here -> click

Has been three weeks I adapted in research and development process and it seems to be pain in the ass .....

Peace ;]

Bro - Signature Testing

Unlike snort, Bro-Nids is not signature centric NIDS, however it does offer certain level of signature capability in order to be more comprehensive in event detection. Following is the example of Bro signature in detecting one of trojan -

signature thinstall_trojan
{
ip-proto == tcp
dst-port == http_ports
http /[pP][oO][sS][tT]\x20{1,}\/bi\/servlet\/ThinstallPre/
tcp-state established,originator
event "ThinstallPre Adware Trojan, personal and machine data theft, successful"
# reference:
}

It looks pretty straight forward comparing to snort sigs as I would admit snort offers more powerful and flexible capability for sig rule writing. Again we see regular expressions(regex) here. I can't recall how many times I have told about the important of regex to network security analyzt.

[pP][oO][sS][tT]\x20{1,}\/bi\/servlet\/ThinstallPre

What if I want to test the signature on the fly, here's what I do. Write the signature that based on the standard format above and save it as testing.sig, then -

Export bro environment variables -

shell>cd /usr/local/bro

shell>. etc/bro.cfg

Test it with the packet capture data(holycow.pcap) with -s option, and remember to load the other analyzer or policy scripts such as tcp, udp, icmp, http and signatures. All of them can be found under policy directory with .bro suffix. Then execute -

shell>bro -s testing.sig -r holycow.pcap \
tcp udp icmp http signatures

If there's traffic that matching the signature, it will be logged to signatures log file. I will write more tips and tricks about Bro-Nids in future when possible especially at security.org.my.

Cheers (;])

Ubuntu: Afterglow

Afterglow version 1.5.9 is released lately, I would like to try it out on my laptop that running Ubuntu Linux, the steps are quite straight forward. Here's the less than 1 minute steps -

shell>sudo apt-get install libtext-csv-perl graphviz

After that, just download afterglow source tarball and untar it.

You are good to go now.

shell>perl afterglow.pl -h

Afterglow 1.5.9 ---------------------------------------------------------------

A program to visualize network activitiy data using graphs.
Uses the dot graph layout program fromt the Graphviz suite.
Input data is expected to be in this simple CSV-style format:

[subject], [predicate], [object]
10.10.10.10, ACCEPT, 216.239.37.99

Usage: perl afterglow.pl [-adhnstv] [-b lines] [-c conffile] [-e length] [-f threshold ] [-g threshold] [-l lines] [-o threshold] [-p mode] [-x color] [-m maxsize]

-a : turn off labelelling of the output graph with the configuration used
-b lines : number of lines to skip (e.g., 1 for header line)
-c conffile : color config file
-d : print node count
-e length : edge length
-f threshold : source fan out threshold
-g threshold : event fan out threshold (only in three node mode)
-h : this (help) message
-l lines : the maximum number of lines to read
-m : the maximum size for a node
-n : don't print node labels
-o threshold : omit threshold (minimum count for nodes to be displayed)
Non-connected nodes will be filtered too.
-p mode : split mode for predicate nodes where mode is
0 = only one unique predicate node (default)
1 = one predicate node per unique subject node.
2 = one predicate node per unique target node.
3 = one predicate node per unique source/target node.
-s : split subject and object nodes
-t : two node mode (skip over objects)
-u : export URL tags
-v : verbose output
-x : text label color

Example: cat somedata.csv | perl afterglow.pl -v | dot -Tgif -o somedata.gif

The dot exectutable from the Graphviz suite can be obtained
from the AT&T research website: http://www.graphviz.org

Cheers ;]

Bro-Nids + Afterglow

Yes, I'm in the Bro mood now, I have written about generating insightful flow graph from Bro connection log using afterglow where you can find at security.org.my here.

This is the simple idea demonstration but I found it useful, at least.

Enjoy (;])

P/S: Thanks to sudugarpu for security.org.my account access.

Malaysia Network Security Community

I have added security.org.my link to my site which initiated by spoonfork, we are currently digging into Bro-NIDS and you will find a lot of tips regarding Bro in the site. However that's not the only purpose of Malaysia Network Security Community Site, there are many things we would like to do such as honeynet, security commentary, getting Malaysia security professionals together and so forth but time is the limitation to both of us.

Anyway if you had noticed, we have

- honeynet project

- raWPacket project

Both will host all the projects we are working on such as HeX liveCD, honeynet and etc.

Maybe its time to recruit new bloods?

From my point of view, our country is still lacking of real security professionals. On the other hand, computer security certification itself destroys the security industry by training a lot of junks and talk cockers as long as you know how to pass the exam(not that you have the knowledge to pass the exam), the capability of the security professional can never be measured relying on how many related certifications you have as this field requires a lot of studies and steep learning curve as well as self-discipline.

I'm not anti-certification, but with people I have met thus far, the quality is always not up to the par with the title in the given certification and it creates the fake reality and self-ego to the person himself/herself.

Those big companies are the helpers too, they will always recruit people with more certifications than less, and do we think more is always better? In this century, the quantity seems to overtake the quality. With this kind of undesirable trend, I have heard from some of my friends where they have to obtain related certification in order to get employed or better pay or even promoted.

To whoever think I'm ranting now, I'm seriously not. Face it, this is the reality.

It's time to wake up .....

Peace ;]

BPF - Birectional Filter

Imagine you have the server farm, and one of your web server is suspected to be under attack or in the state of uncertainty, and you would like to examine the traffics that flowing to your web server and the exchange session from the remote nodes to your web server(port 80 by default). How can you do it with BPF filter?

The network conversation is illustrated as below -

Host A - Web Client
Host B - Web Server

Host A (any port) -> Host B (port 80)
Host B (port 80) -> Host A (any port)
Host A (any port) -> Host B (port 80)
Blablablabla .....

Given the web server IP address is 192.168.0.55, here's the pretty quick tip for you to assess the network traffics that flowing in and out from your web server that initiated by the remote node. As the port 80 resides on the web server, therefore the filter below should work -

(src host 192.168.0.55 and src port 80) or (dst host 192.168.0.55 and dst port 80)

There you go, the bidirectional filter!!!!!

Happy packetysis (;])

BPF - Non RFC Compliant?

It's been a while I haven't written anything about network traffics analysis and it's fun to do it again. If you don't know what is BPF, you can check it out here -

- FreeBSD BPF Man Page

- Good Old BPF paper

Here's the description of the Berkeley Packet Filter, it provides a raw interface to data link layers in a protocol independent fashion. All packets on the network, even those destined for other hosts, are accessible through this mechanism.

I came across this when I was trying to filter multicast network traffics from the packet capture file. From my understanding and the RFC references, IPv4 multicast addressing is in the class D of which the first octet of IP address is in the range of 224-239. I tried to confirm what I have learned from the resources below -

- IANA Address Assignment

- RFC3171

- RFC2365

- RFC3330

- IETF Draft

Then I use this BPF filter(ip multicast) to accomplish my need -

shell>tcpdump -ttttnnr multicast-mix.pcap 'ip multicast'

As expected, the tcpdump output shows all the multicast traffics. But wait, it shows other unexpected traffics where I spotted there are some traffics with the destination IP of 255.255.255.255 which I don't think it belongs to multicast addressing. To understand the BPF filter , I dump the compiled packet-matching code in a human readable by running -

shell>tcpdump -d ip multicast
tcpdump: WARNING: eth0: no IPv4 address assigned
(000) ldh [12]
(001) jeq #0x800 jt 2 jf 5
(002) ldb [30]
(003) jge #0xe0 jt 4 jf 5
(004) ret #96
(005) ret #0

From the instruction 000 and 001, we know it is IPv4 traffic. 002 will look at the 30th byte offset in the Ethernet frame where it is actually the location for first octet of destination IP address and 003 performs jge #0xe0 which it will jump into that byte offset and check if it is equal or greater than 0xe0(in decimal it is 224).

If the condition is true(jt 4), it will jump to 4th instruction and returns 96 bytes which is the default snap length of what tcpdump has captured in single ethernet frame, else(jf 5) it will just return nothing.

To be clear, as long as the first octet of destination IP greater than 224, the BPF filter "ip multicast" will catch it.

ip multicast = 224.x.x.x - 255.x.x.x

This is not RFC compliant, isn't it? Therefore to do what I really want with BPF filter, I have to use this -

ip[16]>=224 and ip[16]<=239

I don't mean everything must be RFC Compliant as we know some evil vendors tend to break it. Anyway I just share my finding.

Enjoy (;])

HITB SEC CONF 2007: The WriteUp

As usual me and mel have conducted the training for HITB this year, everything goes pretty well and organized as we are well prepared and attendees are given the VMware image with HeX and network data(pcap) loaded. Hopefully all the guys who attended our training have good time. The first and second days of the event are just the 7 tracks security trainings and HITB Cinema. I was glad to meet Jose Nazario again and have little conversation with him, SK was there too unfortunately I can't attend to the knowledge session sharing that invited by him due to heavy load of works. After the training is over, the Capture The Flags(CTF) Crews getting together and we started to launch our master plan - the gangbang.

Mel, rd, xwings, takizo, adli, y0muds and me got together and setup the CTF, and we only be able to set everything up in the midnight due to the whatever event in the Hilton hotel.

The third and fourth day of HITB event can be considered the meat of it. Unfortunately we have our CTF game delayed and started by the time of 1430, most of us were not able to attend any interesting talks in the conference though we would like to because we have to monitor the game. On the other hand, we have LockPicking Village and Zone-H Hacking Challenges ongoing. The lock picking stuffs were fun and I have learned how to open the police hand cuff by using the toolkits from TOOOL. Anyway I have sneaked into Rafael Marty's talk about the Insider Threats Visualization. Basically it is all about logs visualization but doing it effectively. If you are interested about graphing stuffs, check out the site maintained by him.

In the fourth day, I only be able to catch up with Luiz and Fx talks regarding Network Protocol Fuzzing and Hacking modern applications. For me Luiz talk is kinda brief but he did mention that Network Protocol Fuzzing has nothing to do with Vulnerability Assessment as the VA uses known vulnerabilities to probe but the Fuzzer usually discovers unknown or 0 days attack, I have checked out the MUsecurity box that brought by him which is pretty cool. Fx has talked about the vulnerabilities that can be found in the modern application with their stupid design flows. And I'm pretty amazed where he can actually design the new logo for ciscock. He also mentioned that attacking is cheap but detection is very expensive which I found it damn right.

Other than that, I have met our good friends from HC2C(Rodrigo and Domingo), US Army Strong guys and I hope they are having good time in Malaysia. After all, the event is over with the CTF and Zone-H prize given ceremony as well as the interesting auction. I bet we can threat Zone-H founder for something else with his unrevealed pictures we have taken ;P

Nothing to mention about the party, except that all the stupid CTF crews as well as the HITB founder been thrown into the swimming pool.

Kudos to all the HITB Members, VLNTs and Speakers who have made this Conference successful.

Cheers (;])

HITB Aftermath: Why you don't know you are having virus in your pocket?

This is something interesting happened during HITB Conference 2007, all of us brought our own USB thumb drive to ease the file transfer process. After the conference is over, Dhillon told us that his USB thumb drive contains virus and ask us to look into ours, interestingly here's what I have in my thumb drive -

shell>cat autorun.inf
[AutoRun]
open=.\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe
shellexecute=.\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe
shell\AutoOpen\command=.\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe
shell=AutoOpen

shell>file \ MSOCache/90000804-6000-11D3-8CFE-0150048383C9/kb915865.exe
MSOCache/90000804-6000-11D3-8CFE-0150048383C9/kb915865.exe: MS-DOS executable PE for MS Windows (GUI) Intel 80386 32-bit

Other crews may also have similar files in their USB thumb drive, therefore if any of you have borrowed USB thumb drive from us, good luck! As most of us are using either linux or osX, we don't even know the malicious files reside in our usb thumb drive.

Thanks to F-Secure sticker, I especially like the quote -

Real Men don't use antivirus.

Good luck to all Windows users in the conference.

Enjoy ;]

The root cause of this - thanks to the rented PC from whatever hardware provider ..... you should pay our monetary losssss

The Good Phisher

Yes, I'm talking about good phisher who kicks his/her own asssss -

For security reasons, you are advised to keep your winning information confidential till your claims are processed and your money remitted to you in whatever manner you deem it fit to claim your prize. This is part of our precautionary measure to avoid double claiming and unwarranted abuse of this program by some unscrupulous elements and most importantly for your own security Please be warned

Sometimes I just love spammers/phishers for no reason .....

Cheers ;]