Laptop: Alternatives For Security Road Warrior

Which laptop model are you using? This is my question today. I have been looking for laptop of choice for myself, as a security road warrior, I prefer it to be -

1. Lightweight(small/medium size and compact)

2. Black and solid look

3. Miminum 150G of Disk and 4G of Rams

4. Great keyboard touch build(old thinkpad?)

5. 12-14inch display

6. Good battery life

7. FreeBSD/Linux Compatible or I will use VMware/VirtualBox

Currently there are 3 laptop models I have in my mind -

1. Macbook Black

2. Thinkpad T61

3. Dell Xps m1330

What do you think and what's your favorite laptop if you work in security industry, and you need to travel frequently? I'm looking forward for any good suggestion and sharing. Thanks!

Peace ;]

HeX 021 Series

I will start this HeX Zero To One(021) Series in my blog while HeX 2.0 is in active development, and all of them will be imported to HeX Handbook. In future you will see my post with the title prefix of HeX 021: belongs to the series.

Enjoy ;]

HeX: From Zero To One

These days, I have encountered questions like this,

1. How can I be an efficient network security analyst?

2. Is there a quick path or short cut to be one?

3. I'm just system administrator/programmer and don't know crap about security, I'm interested in it but don't know where to start?

4. There are so many resources in the internet, what's the specific knowledge required to be network security analyst so that I can be more focusing on particular subjects?

If you are a student, or just starting to work as network security analyst, I hope this post will shade some lights for you -

I would like to point out 3 posts that I have written -

http://geek00l.blogspot.com/2008/05/hex-handbook.html

http://geek00l.blogspot.com/2007/07/hex-livecd-analogy.html

http://geek00l.blogspot.com/2007/03/netsecanalyst-handbook.html

The HeX System that we are developing is the key to answer almost all your questions, but you might not be able to know where to look at if I throw you HeX liveCD without giving you hints or tips. The HeX Handbook which is derived from my own Network Security Analyst Handbook is actually designed to lead you to the right path.

If you read my post about HeX liveCD analogy, I mentioned this -

The HeX liveCD can only make up to this part(see below) -

Obtain Network Based Data -> Utilizing NSM Based Tools -> Generate Output

The rest depends on how analyst able to perform it -

Output Interpretation -> Output Analysis -> Output Summarization -> Report

Clearly enough, the HeX itself can't do everything for you, you have to help yourself starting from Output Interpretation process.

If you apply the reverse thinking, what are the obstacle you have encountered during Output Interpretation? You have used the tools to generate the output for you, for example - snort, bro-ids or even simple tcpdump. Apparently if you find yourself can't understand those output, you can't interpret them correctly. Now the important question is "Why can't you understand those output?" There are few answers to it -

1. You may not have enough network protocol knowledge.

2. You may not familiar with the tools because different tools tend to generate the output in different ways or results.

3. You may not update yourself with current security trends(follow bug traq, cve and so forth)

4. You are being lazy

Now I flash back again to my Network Security Analyst Handbook post, I have put the book into four sections -

Sec 1 - Net Sec Analyst: The RoadMap
Sec 2 - Net Sec Analyst: The Workflows
Sec 3 - Net Sec Analyst: The Tools
Sec 4 - Net Sec Analyst: The Case Study

For the Section 1 and Section 2, I have elaborated them as -

Network Security Analyst: The RoadMap
What are good foundations and technical knowledge that should be acquired to become good network security analyst? I hope The RoadMap can answer question like that, until now I haven 't seen any books discussing about this topic yet.

Network Security Analyst: The WorkFlows
What are the methodologies and mechanisms that are used by network security analyst to handle their tasks? The routine daily tasks, the automated and manual process of performing analysis, situation handling and so forth.
This is more of how to think or work like a network security analyst. I will try to standardize the common work flows but you are free to extend it to your own way.

If you have gone through Section 1 and 2, you should be able to do this -

Output Interpretation -> Output Analysis -> Output Summarization -> Report

Unfortunately we don't offer these in HeX version 1.x, but this is going to change, we are currently working on integrating things that are discussed in Section 1 and 2 into HeX version 2.x which will be released sometime around June. As Section 3 is already integrated into HeX, you should be able to complete Section 1-3 with HeX, all you need is discipline!

This is not a myth, the HeX Handbook will guide you to complete Section 1-3 using HeX System itself, you don't need more.

For the Section 4, I already have other plan and maybe you can see them in HeX 3.x, who knows.

If you want to learn to be a competent network security analyst, you can start with HeX. It will take you from 0 to 1.

Now I start to think that University should offer this kind of course for students, as far as I know country like Philippine has their Universities offering malware analysis course and therefore you can see a lot of them working in AntiVirus Industry, if our country want to produce competent network security analyst, they should offer security related courses in University. Not wait until they are out of school and busy with works.

Enjoy ;]

Training: Practical Network Flow Analysis

This time, me and spoonfork will bring you our new and upcoming training which is -

Understanding Network Conversations:
Practical Network Flow Analysis

Here's the description of our training -

Network Flow data represents a summary of conversation between two end points. It provides valuable information to assist investigation and analysis of network and security issues. Unlike deep packet inspection, flow data does not rely on packet payloads. Instead the analyst relies on information gathered from packet headers and its associated metrics. This provides the analyst a neutral view of network traffic flow by tracking network sessions between multiple endpoints simultaneously. In addition, having network flow data will provide a better visibility of network events without having the need to perform payload analysis.

With the implementation and deployment of Network Flow technologies, an analyst can discover different types and classes of network activities, be it normal or abnormal. In this training we will show you how to interpret Network Flow data and perform practical Network Flow Analysis.

While high level theory explanations are extremely useful, hands-on exercises are even better. Each chapter is accompanied by practical hands-on exercises such as exporting network flow data from Unix and Cisco-based routers, performing simple operations such as IP accounting, network baselining, and identifying different kinds of network anomalies and attacks.

Who should attend?

Network Security Analyst
Network Administrator
ISP Network Architect
System Administrator

Bonus

+ First 10 registrants get free seat for HITB Conference Kuala Lumpur in October 2008

+ Human Resources Development Fund(HRDF) Claimable

For more information, check it out at -

http://training.hitb.org/flowanalysis/

Cheers (;])

HeX: Handbook

While we are in the active development of HeX 2.0, we will start a side project mainly for documentation purpose. We call it HeX Handbook, the link is here -

https://trac.security.org.my/hex/wiki/HeXHandbook

Currently there's nothing yet, but I will import all the contents from my incomplete Network Security Analyst Handbook to there, and I'm now trying to design the standard template so that whoever want to contribute can follow the template.

If you are using HeX, and you know different way of doing analysis using the tools in HeX, we would like to hear from you. By the way, if you are good in language translation, please do let me know.

Thanks to scholar who always gives me very fruitful input!

Cheers (;])

Como: Installation on Ubuntu

I found this without intention while searching for tool that can convert pcap format to netflow v5 format, its name is Como, the project which is developed by Intel people. If you want to know more about Como, check out their publications here -

http://como.sourceforge.net/publications.php

Here's the quick way to get it installed on Ubuntu -

shell>sudo apt-get install cmake

shell>wget \
http://como.sourceforge.net/download/como-1.5.tar.gz

shell>tar xvzf como-1.5.tar.gz

shell>mkdir build-como

shell>cd build-como/

shell>cmake -DCMAKE_INSTALL_PREFIX=/usr/local/stow/como-1.5 ../como-1.5

shell>make

shell>sudo make install

Once you have it installed, you can run it via command line interface but make sure you have configured its paths and modules. The configuration file is como.conf which can be found under directory /usr/local/stow/como-1.5/etc/como, you can also enable its module in run time. Here's the available modules -

shell>ls -la /usr/local/stow/como-1.5/libexec/como-1.0/

total 596
drwxr-xr-x 2 root root 4096 2008-05-23 10:34 .
drwxr-xr-x 3 root root 4096 2008-05-23 10:34 ..
-rw-r--r-- 1 root root 21281 2008-05-23 10:34 apps.so
-rw-r--r-- 1 root root 18778 2008-05-23 10:34 assoc.so
-rw-r--r-- 1 root root 23131 2008-05-23 10:34 autofocus.so
-rw-r--r-- 1 root root 15151 2008-05-23 10:34 dhcp.so
-rw-r--r-- 1 root root 21425 2008-05-23 10:34 ethtypes.so
-rw-r--r-- 1 root root 25640 2008-05-23 10:34 ewma.so
-rw-r--r-- 1 root root 16434 2008-05-23 10:34 flowcount.so
-rw-r--r-- 1 root root 27356 2008-05-23 10:34 flow-reassembly.so
-rw-r--r-- 1 root root 16169 2008-05-23 10:34 frames.so
-rw-r--r-- 1 root root 20629 2008-05-23 10:34 hwtm.so
-rw-r--r-- 1 root root 14416 2008-05-23 10:34 ipssi.so
-rw-r--r-- 1 root root 14736 2008-05-23 10:34 macssi.so
-rw-r--r-- 1 root root 13290 2008-05-23 10:34 nfexlist.so
-rw-r--r-- 1 root root 16080 2008-05-23 10:34 pattern-search.so
-rw-r--r-- 1 root root 20117 2008-05-23 10:34 protocol.so
-rw-r--r-- 1 root root 27098 2008-05-23 10:34 scanner-detector.so
-rw-r--r-- 1 root root 17405 2008-05-23 10:34 ssid.so
-rw-r--r-- 1 root root 21645 2008-05-23 10:34 superaddr.so
-rw-r--r-- 1 root root 25659 2008-05-23 10:34 topaddr.so
-rw-r--r-- 1 root root 25433 2008-05-23 10:34 tophwaddr.so
-rw-r--r-- 1 root root 21516 2008-05-23 10:34 topports.so
-rw-r--r-- 1 root root 15122 2008-05-23 10:34 trace.so
-rw-r--r-- 1 root root 19080 2008-05-23 10:34 traffic.so
-rw-r--r-- 1 root root 27192 2008-05-23 10:34 tuple.so
-rw-r--r-- 1 root root 20970 2008-05-23 10:34 unknown-ports.so
-rw-r--r-- 1 root root 39547 2008-05-23 10:34 worm-signature.so

To enable any of module at run time, you can just execute -

shell>/usr/local/stow/como-1.5/bin/como topports

It also provides http access to the data but I keep getting the error below while connect to http://localhost:44444 -

Module "" not found in the current configuration

I believe I have the modules configured properly but I can't get rid of the error, anyway that's all for Como and I will write more about it after some testings.

Peace ;]

Argus 3 Release

This is nothing new, argus 3 is finally released after long testing period. Thanks to everyone who involves in the argus 3 development and testing cycle especially Carter. You can download it at -

- http://qosient.com/argus/downloads.htm

If you are using FreeBSD, good new is argus 3 port is available now and you can check out the information about it here -

- http://www.freshports.org/net-mgmt/argus3/
- http://www.freshports.org/net-mgmt/argus3-clients/

I will try out the argus 3 ports on FreeBSD and see how it goes, have fun!

Enjoy ;]

HeX: Hardware Compability List

We started this list a while ago, and if you have tried out HeX and for the basic part it works properly, please update the list or at least email me about it.

https://trac.security.org.my/hex/wiki/Hardwares

So what are the basic things that must work in order to be included in the list, here you go -

- boot properly
- display properly
- ethernet adapter is supported

Please help out to improve the list, thanks!!!!!

Cheers ;]

SecurityDistro: Interview

Thanks to Dakrone who has committed HeX to SecurityDistro which I don't know myself, and interestingly Josh from SecurityDistro sent me the interview questions via email and here's the interview result -

http://securitydistro.com/articles/407/Interview-with-CS-Lee-creator-of-HeX.php

Thanks to Josh for his kindness and free promotion from SecurityDistro.

I would like to thank to all the team members for progressive HeX development, and feel great to have you guys working together with me.

Cheers ;]

Network Flow Analysis: The Tools

I need to keep track of all the network flow analysis tools and study their offerings, this link contains many tools which may be useful for that purpose -

http://www.switch.ch/network/projects/completed/TF-NGN/floma/software.html

Enjoy ;]

Blog: Quick Update

I haven't been updating my blog lately, here's the quick one.

- I'm not in the mood of blogging but learning.

- I'm preparing myself for many things now which I can't tell yet.

- I'm learning network protocols that I'm not familiar with.

- I'm learning the advance usage of wireshark, and I'm glad the presentation slides of Sharkfest are available online here.

- I will spend 2 months of my free time on non-tech stuffs soon, which means I will still online but more for casual browsing, email checking and light reading. I need to be more focus!

- I will still blog even though the mood is not with me.

Cheers ;]

CERT: Vulnerability Analysis Blog

CERT has launched its Vulnerability Analysis Blog which you can find at -

http://www.cert.org/blogs/vuls/

Another useful resource for security professional.

Cheers ;]

Dnstop: Statistical Tool for DNS Traffics

I learn about dnstop when reading rolland's presentation slide, thanks to his comment in my blog.

You can find his presentation at -

http://homepage.mac.com/roland.dobbins/FileSharing5

The presentation title is Listening to the Network: Utilizing Telemetry to Detect and Classify Network Traffic, I enjoy reading it as I have learned some new tricks or two from his presentation. One of the tool he has mentioned in the presentation is dnstop and I figure it is available in either Ubuntu packages repository or FreeBSD ports, I decide to try it out.

Just like the top command in Unix based system, it can run as real time monitor for your dns traffic by listening to the network device or it can also do post processing by reading the pcap file. The command option for dnstop is pretty straight forward and you can find them in man dnstop. It also provides a set of run time option to show different results from the statistical analysis output. To perform real time monitoring of dns traffic, you can listen to the device -

shell>sudo dnstop -4 lnc0

It looks pretty straightforward, you can also read the pcap file by specifying them -

shell>dnstop -4 -b ip -l 9 testing.pcap

Queries: 1005 new, 34812 total Wed Apr 30 18:10:46 2008

Sources Count %
-------------- --------- ------
192.168.42.149 3644 10.5
192.168.42.56 1965 5.6
192.168.42.33 1791 5.1
192.168.42.78 1790 5.1
192.168.42.163 1530 4.4
.....

I truncated the output here, then if you press 1, it will show the first level query names -

Queries: 44 new, 34856 total Wed Apr 30 18:11:55 2008

Query Name Count %
------------ --------- ------
com 13200 37.9
in-addr.arpa 8843 25.4
my 5950 17.1
org 3145 9.0
net 2630 7.5
biz 223 0.6
de 92 0.3
.....

If you press 3, it shows third level query names -

Queries: 0 new, 34856 total Wed Apr 30 18:13:10 2008

Query Name Count %
----------------------------- --------- ------
waumail.com 2805 8.0
208.218.in-addr.arpa 1883 5.4
excitedd.com.my 1388 4.0
sharishit.com.my 1112 3.2
sbl-xbl.spamhaus.org 938 2.7
.....

If you press !, it will show the sources that are performing first level query names -

Queries: 0 new, 34856 total Wed Apr 30 18:15:14 2008

Source Query Name Count %
-------------- ------------ --------- ------
192.168.42.149 in-addr.arpa 3007 8.6
192.168.42.78 in-addr.arpa 1009 2.9
192.168.42.56 in-addr.arpa 845 2.4
192.168.60.253 com 833 2.4
192.168.125.201 my 697 2.0
.....

There are many other options which you can figure it out yourself and this is really great tool for dns traffic analysis. For more information, you can find at its home page -

http://dns.measurement-factory.com/tools/dnstop/

Btw, I like the use of the word 'telemetry' here and enjoy some dns voodoo .....

Cheers (;])

Thinking: Enumerating Goodness & Security Through Obscurity

I read about this and this.

Enumerating Goodness has its own weakness though, the mimic attacks that look legit will create false negative and be categorized as Goodness.

Security through obscurity is not a great idea and to certain people it sounds dumb as if the application/software that you are trying to protect is vulnerable, you will be eventually exploited, however it does asist for defensive side because it helps to prevent against automated tools and also requires offensive side to perform more steps to achieve what they are trying to do and this leaves more footprints to be examined and traced by the defensive side. It can be considered as early warning of its kind if you know how to make use of it.

This is just my personal thought and feel free to discuss about the topic. There's no perfect model or principle.

Export Cisco NetFlow in Single Screenshot

I'm digging into network flow analysis for a while. The single screenshot below is to show how to export Cisco Netflow version 5 to the flow monitor at 172.16.1.55, simple and straightforward. The router model is Cisco 7200 series.

Note to myself.

Cheers ;]

Malaysia Tourism, visit the malwares!!!!!

If you are security.org.my reader, you may find the latest post about Malaysia Tourism Website is serving malwares to everyone. This is not big surprise as Malaysia Internetwork is largely contributing to malwares distribution globally according to Google.

So this "Malaysia Can" spirit continues, we are distributing malwares to people around the world efficiently. I'm wondering how much our lovely government has spent to setup and maintain the web sites, let us know if you have clue.

Enough crap, lets look at the term of usage in the Tourism Malaysia website -

All the information contained herein is correct at the time of publication. Whilst every effort has been made to ensure the accuracy of the contents, Tourism Malaysia shall not be held liable for any errors, omissions or inaccuracies which may occur.

That's great, don't blame them as they have thrown the best effort!

Now time to do some analysis by looking at these two scripts -

http://www.852599.cn/mp3/list.htm
http://www.852599.cn/mp3/MZ.htm

The MZ.htm is the java script, here's the content -

This looks like the black hat SEO technique that quite commonly used by China and Russia hackers which we have seen to increase the counter stat, and of course the charset does tell the story here. On the other hand, the file list.htm doesn't look to be so straight forward to understand -

I truncated the line t="68,105,109....." so that it can be read properly here. The list.htm is VBScript and that's why it won't work on other browsers except Internet Explorer. If you look at the last line, it calls MZ.htm using iframe technique. In order to know what this VBScript, we have to de-obfuscate it and the easiest way is to replace the function execute to msgbox so it looks like this -

msgbox(rechange(t))

Then load the file to Internet Explorer and viola, check out the screenshot below -


Now we can find the location of the malware -

http://www.852599.cn/mp3/setup.exe

I downloaded the executable file and tried to scan it using ClamAV with no result, therefore I uploaded it to Virustotal to scan through different Antivirus Softwares. The result is decent, out of 31 types of Antivirus Software, only 12 recognize it as malware. If any of users who are using those Antivirus Softwares that still don't detect it, congratulations! The result of scanning is here.

I would like to thank to my friend - tehtb who is the decent Windows Programmer, I was silly to tell him maybe we can use print function and he pointed me out msgbox function works well here.

Enjoy (;])

Google Http Redirection

Thanks to Google, you can now redirect anyone to yahoo.com from google.com. Click below -

Google to Yahoo

Basically you can redirect to any site you want, the http request looks like this -

http://www.google.com/pagead/iclk?sa=l&ai=FnzbwS&num=67575&adurl=
http://www.yahoo.com

I think Google doesn't verify ai= or num= field, you can just put whatever input to it and still get it parsed properly, for example -

http://www.google.com/pagead/iclk?sa=l&ai=abcdef&num=12345&adurl=whatverURL

This is the trick from one of the spam I received today which redirects me to download malwares and it still works now, hopefully Google fixes it as soon as possible.

Peace ;]

HITB Dubai 2008 Wrap Up

First of all, thanks to HITB crews, sponsors, speakers and all the attendees to make this happen again. We also thank to Dhillon(HITB Founder) for giving us(me and spoonfork) opportunity to present this time. Lets talk about some craps first -

1. Dubai hotel is expensive!
2. The hotel foods are always the same!
3. Pizza express is nice!
4. We always have great support from Army!
5. Dubai Gold Souk has too much golds!
6. Rufio and Niresh are upset because of .....!
7. I met all the cool people there!
8. The conference party is real fun because we get to hang up with beers!

Here's the sum up of all the presentations that I have attended -

Bruce Schneier
Schneier On Security

Bruce talks about the distance between the feeling and reality of security. I'm not really a guy who emphasizes on conceptual or semantic, however I think people will never get it right between the believe and reality, the line is blur because you can never educate the masses about the technologies that keep evolving from time to time.

Jeremiah Grossman
Hacks Happen
Jeremiah is statistics man, and of course the numbers tell you the changes of threat landscape and that's not really big surprise. He concluded all the quantitative data from different sources to give you macro view of current vulnerabilities and threats state. The web attack is popular as it becomes important business platform, remember the popularity brings paparazzi. And again we can't really defend ourselves from "just surface or 1st day' attack(I don't call it 0 days as the technique is already used) because we don't understand them. The summary is pretty simple, hacks happen .... all the time. That guarantees we won't be jobless too ;P

Christopher J.Rouland
Advances in Intrusion Detection and Prevention

I don't know Christopher personally, I attended his talk because the topic has something to do with intrusion detecion, seriously there's nothing really new or advance if you are following cutting edge intrusion detection technologies for long time. Most of the time Christopher is just explaining what IBM ISS offers and they are better than other vendors in comparison. Their system also emphasizes on session data by importing NetFlow data and we can't consider it as new stuff(think NSM). We are seeing more and more vendors taking session data seriously now.

Alessio 'mayhem' Pennasilico
VoIP (in)Security - Italians Do It Better

Alessio talked about his experience of making fun with voip system during CCC in Italy, I like his term of spitting, you should check out his presentation slide once it is up online. I would say fear the embassy who can reach you anytime, that's really entertaining talk from Mayhem. He also demonstrated the device which can change the voice at the end of the talk.

Marc Weber Tobias

How We Cracked Their Codes: A Case Study in Compromising the Most Popular High Security Lock in America - Medeco m3 and Biaxial
I'm not into lock domain or I know nothing about it at all, however I'm really impressed with Marc's work to crack the lock, and respect his 40 years passion in the same domain. I'm just 5 years old in network security industry and hope I can keep my passionate to network security field like he does.

Cesar Ceurrudo

Token Kidnapping

Cesar is the CEO of ArgenISS who sponsored our conference party, he showed us the weakness of design flaw in latest windows technology by kidnapping the token of particular process threads and you can gain the access priviledge to do anything you want. This is not something that can be fixed easily and therefore he has informed Microsoft before the presentation. If you want to know more about it, feel free to check out his presentation slides.

Walter Goulet, Viviana Basso and Benjamin Hagen
Real World Attacks Against 3G Networks Using Subscriber Devices

This is the talk from Motorola guys, they discuss their experience of penetration testing for 3G Networks, their conclusion is pretty simple, most of the security issues derive from the deployment phase where the party that setting up the network has to meet the timeline and leave most of the devices with default setting. As long as they are connected to the IP networks, you can basically probe them easily.

Alexander Kornbrust
Practical Oracle Forensics

I'm not database expert and don't know anything about Oracle at all(I use MySQL or PostgreSQL), I like Alexander's formalized approach to perform forensics process on Oracle Database System, he classifies different kind of malicious attackers with different kind of purposes and attentions, by knowing what kind of malicious attackers you are dealing with, you know what kind of sql statement will be queried by them, and that's really good lead to figure things out. Alex is really a bright guy and he shares his stuffs, he has written the scripts to retrieve all the necessary information to find culprits and evidences from the database system. I'm wondering if similar approach can be applied to MySQL and PostgreSQL and maybe should start looking up on this.

Petko D Petkov

For My Next Trick… Client-Side Hacking
Adrian 'pagvac' Pastor
Cracking into Embedded Devices and Beyond!

Pdp and Adrian are both thinktankers from Gnucitizen, I'm one of their blog readers(as always you can't forget about offensive security techniques while you are in defensive side), they are concluding their works of client side hackings and embedded devices cracking. If you are their blog reader, you should be familiar with all the stuffs they are sharing during the presentation, I like their single slide explanation where they only show the meat of particular hacking trick so that you can understand them easily. I think they are trying to deliver the mindset of "hacking through simplicity" and it will just work most of the time.

Mel(Spoonfork) and I presented Defensive Network Security, this is the first time we deliver our talk in Dubai, I hope whoever have attended our talk enjoy it and thanks to the 22 years old Amy for not sparing even 5 minutes.

I miss some of the presentations as both presentation tracks were running at the same time, anyway I will grab their presentation slide once they are online. Overall I enjoy the HITB conference in Dubai this time(congrates to Rufio as the new CTF overlord this time, hopefully you will suffer for another few years).

This conference party was organized on the cruise, and I bet everyone was enjoying the alcohols after "long fasting". See you guys in next HITB Conference again!!!!!

Cheers (;])

HeX is 1 year old now

Me and Chfl4gs_ decided to start the development of HeX System since mid of April 2007, and it's much improved with the involvement of other active members. Today it turns one year old.

Happy birthday to HeX, and thanks to the raWPacket team members to make it happen.

Happy packetysis!!!!!

Enjoy (;])

HITB Dubai 2008

Here I come!

Enjoy (;])