The Harimau Watchlist

The other day Spoonfork and I have discussion about the Global Watchlist and we think that it can assist network security analyzt in certain way. Therefore Spoonfork started to work it out and here's the first alpha version of Global Watchlist -

http://watchlist.security.org.my/watchlist

So what's the function of this watchlist anyway, basically we pull the list of suspected malicous IPs/Net ranges from different sources such as Sans dshield, Arbor atlas and so forth, then putting all of them in one place. This can assist security analyzt during their operation especially when they need to determine certain suspected IP is doing what, they can just query the IP at the watchlist link and see if it matches and identify them quickly.

The reason why we put them together not because of eliminating the usefulness of the original site but making use of them efficiently(I don't think you will want to go to each original site and query the IP one by one) so it's best to have the global watchlist that pull everything together and this eases the job of the security analyzt. In fact all the credits goes to the original party as usual.

A lot of virus/malwares researchers rely on Virustotal and we think we should have something for network security analyzt, in fact dakrone will create the module for you to query the IP from NSM Console.

For the moment, you can also query the IP with command line -

shell>curl http://watchlist.security.org.my/watchlist/show?ip=131.247.1.101 | grep '131.247.1.101'

131.247.1.101,www.emergingthreats.net/rules/bleeding-botcc.rules,botcc,2008-01-31 17:15:55

You may notice that we name our global watchlist as The Harimau Watchlist . If you don't know what is Harimau, it means Tiger in Malay Language, thanks to Spoonfork for such creative name ;P

Enjoy ;]

Mumbling about Scope Detection Process

Putting aside the Firewall, IPS and H/N IDS technology, or better forget about it? But now there's one question in mind, what's your answer to detection process?

Mr.Hacko : No I don't need all those crappy technologies, what I need is my 1337 skill to hunt for the bugs and fix "all of them" if they introduces serious security flow. With that I don't need detection no more.

As we are living in the world of dynamic dimensions, security is not something as simple as 1+1. There are many things that we need to take into account aside from identifying vulnerabilities in the softwares, even a single misconfigured router or whatever application can introduce the hole in the network. On the other hand, people who work in large scale environment should know that deploying anything in critical networks requires set of procedures and efforts. As well we all know there are certain issues that can't be solved by technical mean.

To me, I advocate Network Security Monitoring(NSM) as it appreciates the value of data in process of detection and I believe in perimeter security. Forget about how effective it is your Firewall, IPS or IDS such as how well it can detect and block malicious traffics, but think of what they can do to assist you in detection process, the answer is pretty simple - scoping. With scoping it reduces the network traffics you need to examine, and it might as well give you the lead for what you need to look at. It's better than finding a noodle in the haystack without clue. On the other hand, vulnerability assessment and code auditing are important too because they eliminate the security hole in application layer but not all.

If you are following security scene, you may realize most of the successful intrusions/extrusions are using known attack techniques and usually it is driven by script kiddies. While targeted attack is totally different case, it mostly happens with co-operation of insiders with careful planning and the malicious party will choose not to leave the footprint(you can't do this without insider). They can either use 0 days, known vulnerabilities or even valid account in your network to hit you since they have full compromise of how things work in your network(remember the role of insider), it doesn't matter.

Attack techniques are getting complex and dynamic today and it evolves over time, we can't rely on single defensive technology to cover our ass anymore. Therefore if you think you don't need Firewall, IPS or IDS in place, you might as well throw away vulnerability assessment and code auditing because no matter what have you done, you will still be compromised. For better security, I still believe it requires combination of different components to make it harder for the threats, but ease our detection process.

I know there are people who think Firewall, IPS or IDS are useless because they can be bypassed, but have you questioned how many companies that having gone through vulnerabilities assessment and security code audit process but they are still being compromised, I'm really curious about this.

Play your own role!

Peace ;]

Argus 3: German Article

My friend Stefan has sent me this link about argus 3 but it is in German language, so I think it's good to share with others. You can click the link here -

- The Argus-eye watches(German)

Thanks to Google Translator, you can view the english version here -

- The Argus-eye watches(English)

Basically the article demonstrates the usages of argus client tools, and gives brief explanation about them, the article is written by Ralf Spenneberg and it should be good read for people who just started to adapt to argus 3.

Cheers ;]

Argus 3: Statistics for Major Protocols

Most people would like to have macro view of the network, for example how many bytes have been utilized for protocol such as tcp, udp and icmp, or other things like the amount of packets that have been transmitted or received.

Previously in argus 2.x, argus offers racount -ar to generate the general statistics but the option -a is gone in argus 3.x, so how can you generate the network utilization for major protocols? I have shown the usage of racluster previously here for network session reconstruction and now I will demonstrate another example of using racluster.

Before I move on, I would like to rephrase racluster's functions from the man page -

Racluster reads argus data from an argus-data source, and clusters/merges the records based on the flow key criteria specified either on the command line, or in a racluster configuration file, and outputs a valid argus-stream. This tool is primarily used for data mining, data management and report generation.

Here you go, you can cluster or merge the records based on the flow key and it is suitable for data mining, data management and report generation, let's generate the statistical report using protocol as flow key. Notice I specify -m proto in command line below and using -s to print the field I want -

shell>racluster -L0 -m proto -r data.arg3 -s proto trans pkts bytes appbytes -\
tcp or udp or icmp
Proto Trans TotPkts TotBytes TotAppByte
udp 18115 72665 8488022 5430758
tcp 22996 1291078 969152661 895531494
icmp 1089 1933 424733 346837

This is something simple from racluster but you maybe scratching your head to figure how to do it when you are still new with argus 3(in fact I did), it is considered one of the most powerful tool in argus 3 client suite and maybe sooner, I will talk more about it. Hopefully you find it helpful(hint, hint).

Enjoy (;])

Loopback header

For system and network adminstrator who put loopback interface for good use(local proxy and so forth), have you ever thought of looking at the network traffics that pass through it? I took a closer look at the packet capture lately and it looks interesting though on different OS platform. Here's the result that I get by capturing it from Ubuntu linux box -

shell>sudo tcpdump -c 1 -XXttttnni lo
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 96 bytes
2008-01-28 15:39:37.190524 IP 127.0.0.1.55555 > 127.0.0.1.33108: P 1689457265:1689461100(3835) ack 1687382572 win 283
0x0000: 0000 0000 0000 0000 0000 0000 0800 4500 ..............E.
0x0010: 0f2f 9c2f 4000 4006 9197 7f00 0001 7f00 ././@.@.........
0x0020: 0001 d903 8154 64b3 1271 6493 6a2c 8018 .....Td..qd.j,..
0x0030: 011b 0d24 0000 0101 080a 01ef 6ceb 01ef ...$........l...
0x0040: 6c47 e938 36b7 4cc3 c0dd d673 2e3a cc65 lG.86.L....s.:.e
0x0050: c257 5cd0 7a0f dc7a d2d7 066d eee3 deb8 .W\.z..z...m....

lo is the loopback interface on my Ubuntu box, and you may notice the link type is ethernet which is 14 bytes.

0000 0000 0000 0000 0000 0000 0800

Since there's no source and destination mac address for loopback interface, they are just padded with 0000 0000 0000 0000 0000 0000(12 bytes) and with another 2 bytes(0800) as next layer protocol) so total up 14 bytes. I think that way it is much easier to read and decode.

However when I capture the packet through the loopback interface on FreeBSD, I got this result -

shell>sudo tcpdump -c 1 -XXttttnni lo0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo0, link-type NULL (BSD loopback), capture size 96 bytes
2008-01-28 15:40:50.695859 IP 127.0.0.1.65304 > 127.0.0.1.6343: UDP, length 304
0x0000: 0200 0000 4500 014c 73f0 0000 4011 07af ....E..Ls...@...
0x0010: 7f00 0001 7f00 0001 ff18 18c7 0138 7937 .............8y7
0x0020: 0000 0005 0000 0001 7f00 0001 0000 0000 ................
0x0030: 0000 2369 09e4 5558 0000 0002 0000 0001 ..#i..UX........
0x0040: 0000 0090 0000 0c8c 0000 0001 0000 0001 ................
0x0050: 0000 0000 0000 0000 0000 0001 3fff ffff ............?...

The loopback interface is lo0 and the link type is null? If you are familiar with IPv4 header(usually it starts with 45 if the header length is 20 bytes(no ip options enabled)). So you can identify that the loopback has the header of 4 bytes -

0200 0000

This tells us that the implementation of both operating system for loopback interface are different. I'm wondering if other packet analysis tools will have problem parsing the packets that are captured from FreeBSD loopback interface. I haven't taken look on other OS yet and maybe you can tell me more about this. Any thoughts?

Enjoy (;])

More tools

There are few interesting projects out there that looks interesting to me, here's the list -

- Netams

- Comixwall

- Network Forensic Search Engine

I haven't really tried them out except Network Forensic Search Engine(Net/Fse), to me Net/Fse is still in early stage where it is basically providing the interface to allow you to search the collected netflow data with your preferred web browser when there's alert for certain network event, I think it is still in its infancies stage as their developers are keen on developing more supports for different kind of data. Net/Fse is using nfdump as back end engine to collect netflow data so it should scale well(I learn this from my past experience) however marketing wise, Net/Fse is smart enough to give its name(Network Forensic Search Engine) that maybe misleading, it is just allowing you to search through the historical netflow or syslog data. For the moment, you can just use nfsen to do the same thing, or better use sguil as you can query the session data that are collected by sancp instantly once you have any alert event. The only advantage of collecting netflow data is because it is built in for most of Cisco based routers and ISP should learn to love them. If you are GUI phobia, argus and silktools are best suited for the job as it has own set of analysis tools to perform in depth flow analysis using CLI.

I don't have much comment about Comixwall and Netams as I haven't tried them out, Comixwall is the firewall system based on OpenBSD, for more detail you can check out here. Netams is more of web based network traffic accounting and monitoring system based on collected netflow data. Maybe I will spend sometime to take closer look at them.

Otherwise, I'm toying with network graphing. There are two graphing toys you should take a look in case you haven't -

- Gnuplot

- Rrdtool

All for now, I'm still not into blogging mood but I will keep it up.

Cheers ;]

Hex from Errata Security

I follow Errata Security blog for quite sometime. Living in defensive security, you will still have to see what people with offensive security mindset can come out with. I just came across this post from Errata Security and it's about base 16 - Hexadecimal magic and the role of it in computer security. Personally I like this post a lot(not because it has the same name as our HeX system) but one of the reason why I give HeX system its name is because of its evil spell(curse) and the hex number where packet monkeys need to deal with. More details can be found here. On the other hand, I used to mention this in my training class - it's important to master hexadecimal when comes to dissecting protocol header(mind you, more importantly the application layer protocol).

I think hex is double edge sword, it plays important role for both offensive and defensive security, the blog post from Errata Security demonstrates the use of hex number with short but incredibly clear explanation and I hope you enjoy reading their post too.

By the way, me and spoonfork will conduct the network security training for HITB again. I hope we can deliver new analysis mechanism for network based forensics and again we wish to see you in HITB Dubai in coming April 2008!!!!!

Cheers (;])

Malaysia HoneyNet Project

Ok, I have to admit I'm being lazy to blog, I'm playing game(blame warcraft) and poking with argus 3 most of the time.

On the other hand, there's another project that quietly moving into main stream(we won't put HeX aside but currently it should be in honeymoon status due to the delay release of FreeBSD 7). The project is HornyD liveCD, chfl4gs_ is currently working on its base system, and hopefully the developer version will be released as soon as possible so whoever interested can work on it. Other than that, most of the things are ready, you can check out the official announcement here.

While we welcome anyone interested to join us, we encourage Malaysian(especially University/College students) because this is more of local project but so far except the core team members, we don't hear anything from local people yet.

Don't be horny, you will get trapped.

Cheers ;]

Tidbits for Packetysis

I have uploaded new tidbits here -

http://www.rawpacket.org/papers/geek00ls-junk

Those two are -

1. SANS: Christmas Packet Challenge
2. Cheatsheet: TCPdump VS Snoop

Most properly the first one is how I get to finish the SANS Christmas Packet Challenge and the second is the TCPdump VS Snoop cheat sheet as my own reference when I need to deal with Sun Operating System. Feel free to check it out if you like network packet analysis.

Enjoy (;])

NSM Console: Screencast

We are trying to prepare couple of screencasts for HeX demonstration, unfortunately December is really bad month for productivity but slacking.

For dakrone's dedication to HeX system, I would like to make my first post in 2008 about the tool he has written for HeX - NSM Console.

NSM Console is great to glue all the network packet analysis tools. Aside from that, it provides the unified interface to run all the analysis tools, the standardization command line can help you to easily adapt to most of the tools easily while it also provides you flexible environment to run the tool with its own arguments and options natively. There are many tools that offering same functionality but doing it in different way, in that case you can write the module to combine all of them and just execute the module in one shot to produce more trustworthy result you want(you don't believe in one tool, do you). To cut it short, NSM Console provides supportive environment for people who like to poke with network packets.

This time, dakrone has brought you the first screencast of his tool - NSM Console, more details can be found at -

http://thnetos.wordpress.com/2008/01/05/screencast-an-introduction-to-nsm-console/

Feel free to enjoy the screencast and comment, and email either me or dakrone if you are interested in NSM Console development.

Enjoy (;])

500th Blog Post: Should I change my blog title?

Just recently when I visited certain websites, and I can't figure what are those sites about by just reading the title. I started to realize that my blog title doesn't make sense to a lot of people.

It is pretty odd when you read this title "When {Puffy} Meets ^RedDevil^" and you definitely have no clue at first glance. Since there are quite a few people asking why I name my blog title as it is now and I hate to repeat the explanation all over again, here's the short brief.

Puffy is OpenBSD mascot.

RedDevil is FreeBSD mascot.

Few years back when I first started learning *nix based Operating System which is RedHat Linux 6.2, but switching to OpenBSD quickly after I accidentally found it when looking for other distros. Since then OpenBSD becomes my favourite Operating System especially running it as router, firewall or IDS. I have tried to use OpenBSD as my desktop but figured that it lacks of application ports/packages that I need so I have to find the alternative and that's where FreeBSD kicks in and becoming the important OS platform for me. The time I started my blog was the time I addicted to BSD and I thought it would be cool to just name my blog title as "When {Puffy} Meets ^ReadDevil^". After all don't ask me why no penguin because my preference goes to BSD. I'm not anti-linux but I'm just more comfortable with BSD(just like you may like Windows but I'm not).

Later my friends told me that my blog is gearing towards network security instead of open source stuffs and why not just change my blog title to "Network Security Blog"? That may sound right to most people and making more sense, however I have my simple answer to this -

I won't change my blog title, it's been with me since 2005.

To everything, Happy New Year 2008!!!!!

Peace (;])

Thanks to whoever reading my blog, I know it sucks ..... but I just can't stop writing.

Packets -> Flows -> Session

This is my last post before reaching the milestone 500th, so I try my best to write great post. Since I want to keep this post simple and clear, I will try my best to explain it in details. If you are network flow analysis guru, you can skip this post because I consider this as introductory post but may help others understanding more about network flow because it was me who taking amount of time to learn how to utilize network flow data. My approach will be similar to my previous post here but the topic is totally different. The "Not So Upcoming" Argus 3 will be the main weapon to be discussed here. Lets walk through it now.

Network Packets

For this matter, I need to obtain the network packets, I have logged the network traffic using tcpdump during the time I was downloading wireshark. Here's how I do it -

shell>sudo tcpdump -s 0 -nni lnc0 -w http-download.pcap

After I finished downloading wireshark, I terminated tcpdump and get initial view of the pcap file with capinfos.

shell>capinfos http-download.pcap
File name: http-download.pcap
File type: Wireshark/tcpdump/... - libpcap
Number of packets: 19782
File size: 1981512 bytes
Data size: 18047455 bytes
Capture duration: 405.100833 seconds
Start time: Thu Dec 20 23:43:22 2007
End time: Thu Dec 20 23:50:07 2007
Data rate: 44550.53 bytes/s
Data rate: 356404.20 bits/s
Average packet size: 912.32 bytes

For single file download which is approximately 20MB, it contains 19872 packets. It is painful to look at every single packet if it is not important. What if I don't want to know the payload in the packet but the connection summary such as how many packets have been sent by one host to another, how many bytes have been transferred in this connection? How long is the duration of this particular connection? Packet centric analysis doesn't fit well here. Therefore I introduce you network flow analysis. But before that, lets have fun with packets -

------------------------------------------------------------
Scenario:

Host A(Client) - 192.168.0.102
Host B(Server) - 128.121.50.122

Host A downloads the wireshark source from Host B
-------------------------------------------------------------

To get the count of how many packets have been sent by Host A to Host B -

shell>tcpdump -ttttnnr http-download.pcap \
ip src 192.168.0.102 | wc -l
reading from file http-download.pcap, link-type EN10MB (Ethernet)
7801

To get the count of how many packets have been sent by Host B to Host A -

shell>tcpdump -ttttnnr http-download.pcap \
ip src 128.121.50.122 | wc -l
reading from file http-download.pcap, link-type EN10MB (Ethernet)
11981

What if you want to know how many bytes have been sent by Host A to Host B and the reversal? It would be exhaustive if you have to look into those packets and count. Now this is where network flow kicks in.

Network Flows

Network Flow is really different beast. To give you the idea what is flow, I define it as -

Flow is the sequence of packets or a packet that belonged to certain network session(conversation) between two hosts but delimited by the setting of flow generation tool. To cut it short, it provides network traffic summarization by metering or accounting certain attributes in the network session.

To understand them better, lets convert the packet data(pcap) to argus format flow data -

shell>argus -mAJZRU 512 -r http-download.pcap \
-w http-download.arg3

I run argus with the option -mAJZRU 512 so that it will generate as much data as possible for each flow record. I won't explain each option here since you can find them in the man page or argus -h.

Now I can examine/parse http-download.arg3 with argus client tools for further flow processing. To make it easy to read, I use ra here as it is the most basic argus flow data processing tool. I choose to print the necessary field with -s option such as (start time|src address|src port|direction|dst address|dst port|src packets|dst packets) -

shell>ra -L0 -nnr http-download.arg3 \
-s stime saddr sport dir daddr dport spkts dpkts - ip
StartTime SrcAddr Sport Dir DstAddr Dport SrcPkts DstPkts
23:43:22.024899 192.168.0.102.51371 -> 128.121.50.122.80 1165 1800
23:44:22.068631 192.168.0.102.51371 -> 128.121.50.122.80 1186 1807
23:45:22.101391 192.168.0.102.51371 -> 128.121.50.122.80 1246 1919
23:46:22.117747 192.168.0.102.51371 -> 128.121.50.122.80 1125 1751
23:47:22.171437 192.168.0.102.51371 -> 128.121.50.122.80 1160 1759
23:48:22.209375 192.168.0.102.51371 -> 128.121.50.122.80 1080 1664
23:49:22.186030 192.168.0.102.51371 -> 128.121.50.122.80 839 1281

There are totally 7 flow records here for just single network session. Why?

If you read the argus configuration manual page, it mentions -

ARGUS_FLOW_STATUS_INTERVAL
Argus will periodically report on a flow’s activity every ARGUS_FLOW_STATUS_INTERVAL seconds, as long as there is new activity on the flow. This is so that you can get a view into the activity of very long lived flows. The default is 60 seconds, but this number may be too low or too high depending on your uses.

The default value is 60 seconds, but argus does support a minimum value of 1. This is very useful for doing measurements in a controlled experimental environment where the number of flows is <>
Command line equivalent -S

ARGUS_FLOW_STATUS_INTERVAL=60

For better understanding, I print the start time field only to get better interpretation -

shell>ra -nr http-download.arg3 -s stime - ip
23:43:22.024899
23:44:22.068631
23:45:22.101391
23:46:22.117747
23:47:22.171437
23:48:22.209375
23:49:22.186030

With the default setting, you may notice the boundary is 1 minute for each flow record, that's actually what I try to explain above -

Flow is the sequence of packets or a packet that belonged to certain network session(conversation) between two hosts but delimited by the setting of flow generation tool.

If the network session longer than 1 minute(long lived flow), then it will generate another flow(with same attribute/label) which is actually belonged to the same network session though. Of course you can tune this with -S option in argus. Lets try -

shell>argus -S 480 -mAJZRU 512 -r http-download.pcap \
-w http-download-480.arg3

I set 480 seconds here which is 8 minutes as the network session duration falls in that time range. Now we read it again with ra -

shell>ra -L0 -nr http-download-480.arg3 \
-s stime saddr sport dir daddr dport spkts dpkts - ip
StartTime SrcAddr Sport Dir DstAddr Dport SrcPkts DstPkts
23:43:22.024899 192.168.0.102.51371 -> 128.121.50.122.80 7801 11981

However in the real world implementation, this is not the right way to construct the network session from multiple flows, especially if your network structure is complex(provides various of network services) and busy(heavy network traffics) and this is really arbitrary. You can't easily identify that multiple flows belong to the same network session as there will be many other flow records inserted in between, another issue is what if the network session duration is longer than 480 seconds(8 minutes). That's where racluster(another argus client tool) comes into rescue.

Network Session

From the racluster partial man page -

Racluster reads argus data from an argus-data source, and clusters/merges the records based on the flow key criteria specified either on the command line, or in a racluster configuration file, and outputs a valid argus-stream. This tool is primarily used for data mining, data management and report generation.
The default action is to merge status records from the same flow and argus probe, providing in some cases huge data reduction with limited loss of flow information.

Racluster is easy to use but hard to master, however here's the simple usage to construct the network session from multiple network flow records.

shell>racluster -L0 -nr http-download.arg3 \
-s stime saddr sport dir daddr dport spkts dpkts
StartTime SrcAddr Sport Dir DstAddr Dport SrcPkts DstPkts
23:43:22.024899 192.168.0.102.51371 -> 128.121.50.122.80 7801 11981

It is just really that simple, to explain this network session.

Start Time - 23:43:22.024899
Source Address - 192.168.0.102
Source Port - 51371
Destination Address - 128.121.50.122
Destination Port - 80
Source Packets - 7801
Destination Packets - 11981

Start Time is the time when the network session started, others are pretty self-explained except Source Packets and Destination Packets. Source packets count how many packets have been sent by the Source Address, Destination Packets count how many packets have been sent by Destination Address. To generate summarization of this network session, you can run -

shell>racluster -L0 -nr http-download.arg3 \
-s dur pkts bytes
Dur TotPkts TotBytes
405.100830 19782 18047455

This network session duration is approximately 405 seconds, the total packets in this network session is 19782, and the total bytes is 18047255. Yes, this is where network flow analysis can be useful - traffic accounting but I won't really explain it much here since it will be another topic.

Maybe I should make this post title sounds more interesting with "Network Flow Demystified". There are other topic about network flow where I don't mention here such as Cisco Netflow, Unidirectional vs Bidirectional model, other interesting flow metrics that provided by argus and so forth, I wish I can close the gap in coming posts.

Enjoy (;])

SANS: Christmas Packet Challenge

I was back from Singapore and still in holiday mood, yesterday while chatting to my friend ayoi, he told me that SANS Incident Handler(Lorna Hutcheson) has posted the Christmas Packet Challenge where you can find here -

http://isc.sans.org/diary.html?storyid=3781

To be honest, being lazy I'm, I don't take a look at first but again thinking that this might refresh my packetysis skill since I haven't really done that for a while. If any of you have spare time to kill, feel free to try it out.

I primarily use HeX 1.0.2 liveCD for this game. I'm not too sured if I finish the game but I have sent my write up to SANS Incident Handlers. Interestingly the email I sent is blocked by email filter. Check out the screenshot -

Being spammer I'm, I figure I have two urls in the email, one is -

http://isc.sans.org/diary.html?storyid=3781&rss

The other one is my own blog url which resides in my email signature. I deleted both of the urls and tried to send the email again and finally the email got through. Sometime the false positive thing is really annoying.

I will post up my write up once the handler has posted the answer for the challenge.

Anyway it's end of the year, back to holiday mood again ..... zzZZZ

Cheers (;])

HeX 1.0.2 - The Christmas Release

Ho ho ho, Christmas is around the corner .....

For the sake of it, the HeX development team would like to present you HeX 1.0.2 - The Christmas Release!!!!! Get it now!

Malaysia Main

liveCD
- HeX liveCD 1.0.2
- HeX liveCD 1.0.2 md5 checksum
- HeX liveCD 1.0.2 sha256 checksum

Mini liveUSB
- HeX Mini liveUSB 1.0.2
- HeX Mini liveUSB 1.0.2 md5 checksum
- HeX Mini liveUSB 1.0.2 sha256 checksum

US Mirror

liveCD
- HeX liveCD 1.0.2
- HeX liveCD 1.0.2 md5 checksum
- HeX liveCD 1.0.2 sha256 checksum

Official Annoucement

We are no longer calling this project HeX liveCD but now simply HeX, as it has expanded quickly and the liveCD is one of the project under HeX.

Two sub projects will be launched under this release as well -
- NSM Console
- liveUSB

NSM Console

Matthew(Dakrone) is the main developer of NSM Console, here's the short description about it -

NSM Console (Network Security Monitoring Console) is a framework for performing analysis on packet capture files. It implements a modular structure to allow for an analyst to quickly write modules of their own without any programming language experience which means you can quickly integrate all the other NSM based tools to it. Using these modules a large amount of pcap analysis can be performed quickly using a set of global (as well as per-module) options. NSM Console also aims to be simple to run and easy to understand without lots of learning time.

If you want more information about what it is (and what it does), check out this introductory post

http://thnetos.wordpress.com/2007/11/27/nsm-console-a-framework-for-running-things/

You can access NSM Console by clicking the menu -> NSM-Tools -> NSM Console

HeX liveUSB

JJC(enhanced) created the liveUSB initially so instead of using a read-only liveCD, you can use a read-write USB thumb drive. Here's the short description of it -

After receiving numerous requests to create a HeX liveUSB Key Image we decided to go ahead and build one. This image includes all of the standard tools that you will find on HeX and it is writable; so you can update things (signatures etc), make changes and so on.

To use HeX liveUSB, you simply download the image and dd it to your USB Key (Thumbdrive). The 1.0.2 liveUSB is released inline with liveCD. However JJC will create the liveUSB with more spaces in case you want to store stuffs inside it soon.

Other Addition(Surprise)

Christmas Gifts for the Analyzt
1. HeXtra 1.0.2(Very soon because it needs to be tested with HeX 1.0.2 before release)
2. aimsnarf - aim protocol analyzer script
3. argi-PASVFTP.sh - argus 3 passive ftp extraction script
4. 4 additional PADS signatures
5. dsniff and honeysnap(thanks dakrone for porting this)
6. Add rp-Reference under analyzt home directory, and there's script resources.sh which will download all the useful docs, papers or articles which may assist analyzt wannabe.

Christmas Gifts for Everyone

Everyone loves eye candy, so do we! Since we call this as The Christmas Release, here's your Christmas gift(The Shiny & New HeX Christmas Wallpaper) -

1. HeX-WhiteChristmas.jpg
2. HeX-DarkChristmas.jpg

Thanks Vickson again for his artistic skillz!

Bug Fixes
1. unicornscan run time error
2. svn run time error
3. lsof run time error
4. firefox startup issue
5. pidgin and liferea dbus issue

6. CDROM-Mount.sh syntax error
7. script command issue
8. ping setuid issue

Other known major or minor issues in the Base System are fixed, thanks chfl4gs_

For quick glance, check out HeX 1.0.2 liveCD screenshots below -

The White Christmas

The Dark Christmas

Note to Everyone(Mailing List, Trac, Backports and IRC Channel)

For anyone who wants to learn about the network security tools that are included in HeX, please feel free to ask in the mailing list, or if you have a specific idea for HeX, we welcome your input.

However, if you want to submit a bug report, please do use trac and create the ticket, all you need to do is register an account and you can create the bug report ticket quickly. Otherwise if you are reporting it to the mailing list, developers will have to create the ticket on behalf of you. By helping yourself, you are helping us. Trac is available at -

https://trac.security.org.my/hex/

On the other hand, you can also browse the tickets at -

https://trac.security.org.my/hex/report

Just in case the bug has been previously reported.

Feel free to join the IRC Freenode #rawpacket channel if you need "not so real time" support.

From now on, we will have the backport too. The backport is basically serving extra application packages that are not available in the HeX base system. In order to install them, just download them from -

http://www.rawpacket.org/hex/packages/

For example to install tftpgrab, just run -

shell>sudo pkg_add -v tftpgrab-0.2.tbz

Last but not least, we are always looking for new contributor or developer. If you are interested in joining us, feel free to email -

geek00l[at]gmail[dot]com

To know more about HeX Project, check it out at -

http://www.rawpacket.org/projects/hex

Merry Christmas and happy holidays from the entire HeX Team, see you all in 2008!

Enjoy (;])

Tip for RTFM

Read The F*ing Manual(RTFM) is considered as one of the most famous quote around. Most of the time we can read the manual page by using command -

shell>man ls

There you will be able to read the manual page for ls command, but what if you are not installing the manual page to the default path(usually /usr/share/man but it may be vary in different operating system). You can do this if you want to read argus client tool - racluster man page.

shell>nroff -man racluster.5 | less

And what if you want to convert them to html format, just use man2html -

shell>man2html racluster.5 > racluster.5.html

Here's the html page -

Pretty simple isn't it.

Peace ;]

VMware Inconsistent Time Issue: Blame the clock rate

Here's the interesting thing I have found when running FreeBSD VM on my laptop, the problem is with the inconsistent time which can't be solved even with this post.

You get to blame the clock rate because that's the cause of inaccurate timing when running FreeBSD VM using VMware. I try to unplug my power cable and check out the dmesg -

[14580.568000] /dev/vmmon[26067]: host clock rate change request 228 -> 100
[14580.568000] /dev/vmmon[26067]: host clock rate change request 100 -> 228
[14956.836000] /dev/vmmon[26067]: host clock rate change request 228 -> 100
[14956.836000] /dev/vmmon[26067]: host clock rate change request 100 -> 228
[15333.080000] /dev/vmmon[26067]: host clock rate change request 228 -> 100
[15333.080000] /dev/vmmon[26067]: host clock rate change request 100 -> 228
[15709.332000] /dev/vmmon[26067]: host clock rate change request 228 -> 100
[15709.332000] /dev/vmmon[26067]: host clock rate change request 100 -> 228
[16085.612000] /dev/vmmon[26067]: host clock rate change request 228 -> 100
.....

The time in the VM becomes inconsistent after I unplug my power and return to normal once I plug it back, the dmesg says it all. Maybe it's best not to use laptop for FreeBSD VM, the desktop will do just fine.

Cheers ;]

Ubuntu: Argus 3

I'm currently working hard on network flow analysis stuff, and argus is always my best friend. Another wonderful application suite is silktools and I think you should try it out if you are into network flow analysis. Anyway here's the quick installation for upcoming argus 3 on Ubuntu 7.10.

It is pretty straight forward to get argus 3 installed -

shell>sudo apt-get install libpcap0.8 libpcap0.8-dev flex bison rrdtool

Once you have installed all the dependencies of argus 3, lets download argus 3 server and its client suite to install.

shell>wget \
ftp://qosient.com/dev/argus-3.0/argus-3.0.0.tar.gz

shell>wget \
ftp://qosient.com/dev/argus-3.0/argus-clients-3.0.0.rc.63.tar.gz

Once you have downloaded them, you just need to perform usual compilation steps by decompressing them -> configure; make && make install.

And if you still don't know what argus is about, check out this post.

P/S: Both argus and silktools are included in the HeX liveCD.

Enjoy ;]

PADS: Sigs For Belkin ADSL Router

If you have Belkin ADSL Router running in your network, it's good to identify what services are running by it, there are actually 2 network services running in the Belkin ADSL router, the web and telnet.

After examining the network traffic, I decide to write the PADS signatures for it so that I can track the network assets passively. If I'm not mistaken, the Belkin ADSL router runs Micro Httpd which you can find here -

http://www.acme.com/software/micro_httpd/

I have also examined the telnet traffic so that I can write the sig for it, I have written the rough signatures quickly, and it's great to have them working properly after some testing -

# Belkin ADSL Router
telnet,v/Belkin Router Telnet///,BCM96358 ADSL Router\r\nLogin:[ ]

www,v/Micro HTTP Server///,Server: micro_httpd\r\n

For the quick execution, just check out the screenshot below and you will see the host 192.168.2.1 has been identified to run these two services.

I will add these two signatures to upcoming HeX 1.0.2, the recent that we delay the release of it is because more bugs been found and various stuffs to do.

Enjoy (;])

HeX: Solution to Time Slowness in VMware Server

Thanks to my friend - Richard who has observed the time slowness when running FreeBSD on VMware. I don't really see it because the slowness(delay) is very minimal which scales like 10 minutes in 24 hours but I never run it for a day. I have only observed it after Richard reported this issue to me.

To me I think time is critical issue to network security analyzt(timelining, timestamping and etc), therefore I need to figure out the solution for this. I found there are two great posts which can be considered as solutions to the problem that are available here and there. You might as well read the comments in Richard's blog post too if you encounter the problem.

Here's the sum up for the solutions, put these two lines in /boot/loader.conf(if i recalled correctly, it is there by default in HeX).

kern.hz=100
hint.apic.0.disabled=1

Reboot your VM. However these two lines won't really solve your problem but minimal the time slowness. In order to run consistently with local time, you will have to install vmware tools, follow the instructions in the link above to get it done. Once you have finished the installation of vmware tools, you may find vmware-guestd running as daemon at the background. Now run -

shell>vmware-toolbox

VMware Tools properties configuration box will pop up, and you will see this in first tab -

Check on the option and click on close. Now you should shut down the VM and check your vmx file to see if this setting is there -

tools.syncTime = "TRUE"

If it is there(else add it manually), now you just need to boot the VM again and you are not supposed to encounter the time slowness problem anymore, it will follow the local time and sync(adjust) automatically. For your information, I have this done on VMware Server Console Version 1.0.4 build-56528. Feel free to try it out on VMware workstation.

Enjoy ;]

HeX: Malaysia Download Mirror

Thanks to Ganux(Terengganu Linux) for their initiative to host the mirror for our HeX liveCD. One of the member - Wariola went to the November meetup where me and chfl4gs_ have presented about the HeX project and decided to contribute the space and bandwidth so if you are from local and want to try out HeX liveCD, feel free to download from local mirror now which is located at -

http://www.ganux.com/OSS/hex-i386-1.0.1.iso

There are 4 members in the Ganux team, they are - wariola, Ganux, Hardyweb and Dinoz, I'm glad to hear that we have friends taking initiative to push open source softwares in other state. As usual, I believe every single bit helps. Thumbs up!

Cheers ;]