Sguil Cutting Edge

Okay, finally it is up. I'm talking about Sguil Demo Server. This demo server is running sguil CVS, I'm putting this up so that everyone can check out the latest features that are in development cycle.

The demo server detail is shown below:

Server: nsm.kicks-ass.org
Port: 7734
Username: sguil
Password: leave it blank

Since this is just for anonymous login, thus I didn't put up the password. I have very poor internet link(thanks to my wonderful ISP) so if any of you have problem or delay in connecting to demo server, please be patient. By the way, you may need to use sguil client in CVS as well in order to conenct to the demo server. If you are on *nixes platform, just run -

shell>cvs -d:pserver:anonymous@sguil.cvs.sourceforge.net:/cvsroot/sguil checkout sguil

You don't need to install anything else if you already have all the dependencies for sguil client installed before, just run sguil.tk under client directory will do. If you are using Ubuntu Linux, here's how-to get sguil client installed in painless way. Have fun.

Enjoy (;])

PgOSS Meetup Cancel

I'm sorry to announce that the event has to be cancelled due to it falls on second day of Thaipusam and many people unable to attend the meetup, we will try to make it as soon as possible and hopefully everyone can attend the meetup soon.

If you have posted the event in the mailing lists or anywhere, please do inform them the suspension of the event. Thanks.

Peace :]

PgOSS 2nd Meetup

After long delay, we finally get to arrange and organize the second Penang Open Source Software Meetup. There will be 2 presentations in the meetup and teh tarik session after meetup as usual. The meetup details as below -

Date: 2007 Feb 2nd
Time: 7:45pm - 9:15pm
Venue: University Science Malaysia(Penang)
Presentation Topics:
- OSS General(geek00L)
- Open Source Web Development with Grails(Sey)

By the way, we will also discuss about the security meetup after long gone of mydefcon. If you are staying nearby, feel free to join us.

Enjoy and Cheers ;]

TcpXtract - 3gp

This is considered the 3rd part of my write up in tcpxtract series, I have previously written two posts about it. I never think of writing that much about tcpxtract(this tool is kinda buggy), but it is really useful especially when you need to extract certain type of files.

Last week I was told about 3gp media file format by mypapit, 3gp is 3rd generation new mobile phone video standard format. Most of mobile handphone nowadays ship with 3GPP and 3GPP2 content capture and playback capabilities. Thus most of the pr0n video clips are distributed in 3gp format from server to client end(mobile phone users). I don't really know much about it as I'm still using old handphone.

Thanks to mypapit again as he pointed me out where to get the 3gp files so that I can have chance to look at the meta header in the file and writing the tcpXtract sig for it. I have logged the network traffic with tcpdump when downloading the 3gp file.If you are administering many servers, I don't think you would like to dig out 3gp files on all the servers as it is much of works, it's better to detect and identify it at network level so that you can easily eliminate it.

One of good resource when writing file signature that I found is -

http://filext.com/detaillist.php?extdetail=3gp&Search=Search

However the identified header that given are too common in the packet payload, I don't think 00 00 00 at the beginning offset makes a good signature. I need to dig more to write more accurate signature for 3gp. I have downloaded the file and renamed it to pr0n.3gp.

shell>file pr0n.3gp
pr0n.3gp: ISO Media, MPEG v4 system, 3GPP (H.263/AMR)

Then I examined it's data in hex|ascii format and idenfitied the fix strings - ftype3gp4, in fact it comes after 00 00 00 and the 4th dynamic byte. Before writing the sig, I tested it with ngrep -

shell>ngrep -i -I 3gp.pcap -t 'ftyp3gp4'
input: 3gp.pcap
match: ftyp3gp4
.....

shell>ngrep -I 3gp.pcap -xX '0x6674797033677034'
input: 3gp.pcap
match: 0x6674797033677034
.....

Now it should be pretty accurate, the 4th byte offset is dynamic when I examined 3gp file variants. Thus I have the sig added to tcpxtract.conf as below -

3gp(1000000, \x00\x00\x00\?\x66\x74\x79\x70\x33\x67\x70\x34);

I got syntax error when I added this signatures, it appears that the file type(extension) can't be specified with numeric but alphabets(pretty odd and buggy). Thus I have to change it to tgp instead of 3gp for the sake of it.

tgp(1000000, \x00\x00\x00\?\x66\x74\x79\x70\x33\x67\x70\x34);

Then I executed -

shell>mkdir 3gp-extract

shell>tcpxtract -f 3gp.pcap -o 3gp-extract

Examined the file that has been extracted -

shell>file 3gp-extract/00000000.tgp
3gp-extract/00000000.tgp: ISO Media, MPEG v4 system, 3GPP (H.263/AMR)

Now I already got the signature right, move on. Sorry guys, no phone pr0n for you next time!

Cheers (:P)

Bit torrent Clients

I remember I have shown some user applications that I used daily, so here's the new post about one of applications I use on my desktop(not workstation).

Which bit torrent client do you use? I have been asked by many people and seeing this question been asked in various forum. When comes to Windows OS platform, people tend to use either utorrent or bitcomet. So what do we have in oss arsenal?

All I hear are azureus or bit tornado.

I don't really like any of the above, in fact I use ktorrent.

I know user base application is always about preferences, I myself love applications that are simple, slick and with clean ui design. The other best features about ktorrent are it supports encryption and doesn't consume much of your CPU or MEM resources.

Here are the Ktorrent screemshots -




In fact when I checked out all the peers that are connected, it seems that none of them are using ktorrent but other popular torrent clients. Try out ktorrent, I bet you will love it.

Enjoy :]

Helix: Mounting ufs2

I have one of my machine lying around and it was installed with FreeBSD previously. I need to copy everything out from the hard drive. I decide to use helix again as it is pretty easy and the data can be transfered over the network without much configurations.

Once I login, I launched the terminal and tried to mount the ufs file system. The hard drive is connected with external ide usb connector. Therefore the drive appeared to be sd*. As usual, I run this -

shell>mount -t ufs /dev/sda1 /media/sda1

I get an error wrong file type, but I remember I installed it with ufs2 which is default file system that used by FreeBSD. After messing with the man page. I figured as such -

shell>mount -t ufs -o ufstype=ufs2 /dev/sda1 /media/sda1

Now I just enabled the ssh server, and everything can be transfer over network either using scp or just netcat will do.

Enjoy ;]

FreeBSD 6.2 Released

I just got this toy, it's pretty cool as it can be resized when you want it. So i'm still looking for another toy, most probably puffy but hardly find a good one. Now RedDevil is alone and he needs his buddy - puffy to totally match my blog title. So what's new? Yes, FreeBSD 6.2 R is finally here, check out the download mirrors and pick up any that do well for you.

http://mirrorlist.freebsd.org/FBSDsites.php

To navigate what's new and all the changes, you can find the release note at

http://www.freebsd.org/releases/6.2R/relnotes-i386.html

I'm looking at this interesting feature that added to this release -

The enc(4) IPsec filtering pseudo-device has been added. It allows firewall packages using the pfil(9) framework to examine (and filter) IPsec traffic before outbound encryption and after inbound decryption.

This is pretty neat when one need to snoop on vpn connection that provides visible view for monitoring devices.

Time to upgrade when possible!!!!!

Enjoy ;]

Santy or s8 - the analysis process

While chating with fellows in freenode #snort-gui, David raised the interesting s8 probes that targetting web servers. As I'm seeing those probes as well, I would like to figure out what is happening in the network and why there are running in the wild.

After discussed with David, I tried not to dive into the network data but googling, however google doesn't return much useful information regarding the probes. In fact you may not know what I'm talking about regarding s8 myth, here are some entries -

1168444804.073301 %252740 GET /s8Region.asp
1168444830.868371 %252837 GET /s8qq.txt (404 "Not Found" [394] blablalo.com)
1168444909.394569 %253078 GET /s8qq.txt (404 "Not Found" [387] blablalo.com)
1168444992.374820 %253366 GET /eWebEditor/db/s8ewebeditor.mdb (404 "Not Found" [412] blablalo.com)
1168452273.423501 %275283 GET /s8qq.txt (404 "Not Found" [389] forum.blablalo.net)
1168453495.280041 %278412 GET /s8showerr.asp?BoardID=0&ErrCodes=54&action= script JavaScript:alert(document.coo
kie); /script ( span style="font-weight: bold;" 404 /span "Not Found" [390] blablalo.org)
1168453512.055104 %278412 GET /s8flash/downfile.asp?url=jackie/../../conn.asp (404 "Not Found" [397] blablalo.org)

I have renamed all the hostname to blablalo and I think it doesn't hurt. So it is all about http get requests to the file with s8 prefix. Since I have no clue at all as those requests are unsuccessful - 404 and I don't have the files it requested, thus I tried to figure out what kind of domains they are targetting. After some info gathering, apparently all the sites that crawled by s8 requests are powered by discuz content management system. It seems discuz is very popular in China and it offers both asp and php based solutions.

To analyze further, I decided to go through the web server logs by looking for the s8 strings. Then extract all the IPs and performing whois to help me in doing correlations. Interestingly it helps me to conclude my finding. Below are the commands I executed when inside apache logs directory -

shell>for i in `egrep -i '/s8[a-z0-9]*\.asp' * \
| awk '{ print $1 }' | cut -f 2 -d : | uniq`; \
do jwhois $i >> s8whois.log; done

I navigated the results in s8whois.log and found that almost all source IPs are from China. Then I came to realize why google doesn't show up much results with their caches even regarding the s8 probes. Check out the link below -

http://www.baidu.com/s?wd=powered+by+discuz&cl=3

Baidu.com is the most popular search engine in China and I suspected that they are actually performing something similar to this but utilize their own popular search engine to query targeted vulnerable cms.

In fact the automated scripts that running to look for all the malicious scripts that been uploaded to vulnerable sites that powered by discuz should perform operating system or web server fingerprinting(latter easier to be done and more accurate) with better search engine query strings before performing http request on malicious scripts to remain unseen in unix based server.

I guess China system administrators(or whoever) use discuz cms have more headaches than us -

http://www.discuz.net/thread-433875-3-1.html

All for now, Peace (;])

Temp solution: Blocking user agent - InetURL:/1.0 via mod_security, all of the requests are carried by it that is pretty identical.

1.2.3.4 - - [08/Jan/2007:17:30:05 +0800] "GET /s8servu.aspx HTTP/1.1" 404
- "-" "InetURL:/1.0"

Wireless traffic analysis - the 802.11

I rarely find any online resources regarding wireless traffic analysis. Then I came through this book that given very good kickstart on performing wireless traffic analysis. I would not much into confirming whether the book has no errors technically until I read this book which is recommended.

Yesterday I found two useful links regarding wireless network. One is at security focus and another one at uninformed. Both are interesting reads and I think it helps analyst to improve themselves when performing wireless traffics analysis.

If you know any good resources about wireless networks, feel free to comment.

~ Monitor the AIR(WNSM) huh ~

Cheers :]

Blog tagged

My blog is tagged, becoming victim is not so bad sometimes.

Somehow people don't know me enough, 5 things I need to clarify here -

1. I'm neither from military or education lines, either me or my teachers totally suck when I was in school. In fact I'm self-learner, I learn most of the things from google and yes, some from people I know.

2. No one is total geek or nerd, there must be something you do besides computing. I do swimming and some basketballing, it refreshes me most of the time when my brain is nearly dead. By the way if you find yourself hating geeks so much, please love yourself. Popular quote from my friend - "You hate what you are!"

3. I ain't vampire, I do sleep, but when? I can't even tell myself, be it.

4. I love no war.

5. .....

Unfortunately, I don't do tag.

Cheers ;]

Offline pcap analysis?

Now you are staring at your screen looking for culprits after downloading the logged pcap files. You are considered performing offline pcap analysis as you don't make contacts to the network while doing it but I'm sured most of you will need internet connection to acquire necessary data sometimes so you will still leave your internet connection on.

Most people do not know that they are actually generating network traffic when they performing analysis on pcap files, and they are telling you they are doing it offline. But this is totally not right. Take a look at the screenshot below.

I'm running two virtual terminal, the first shows I'm running -

shell>tcpdump -XXttttr soulseek.pcap

At the same time I monitor my network interface in second virtual terminal -

shell>tcpdump -i bge0 port 53

If you look at the second one, apparently there are dns traffics ongoing. Yes, I'm using tcpdump, but most of network analysis tools will try to resolve the host address or port when possible if you are not telling them not to do it. Now you still consider performing offline analysis, I bet no. To actualy do it, you will have to run tcpdump with -n option, by doing that you don't convert host address and port number to name anymore.

shell>tcpdump -XXttttnr soulseek.pcap

Now you will see no network traffics generated, this is the real offline pcap analysis. And guess what, you gain extra speeds when analyzing large pcap file since you don't try to resolve the host addresses or ports(refer /etc/services file) anymore.

Remember this is not only applied to tcpdump but many other network analysis tools(argus, wireshark and so forth).

Enjoy (;])

P/S: On linux, specify -n alone will prevent from doing dns lookup, however it will still tries to convert the port number to name, you will have to run -nn to avoid resolving anything.

Regex - Magic for NetSe[x|c]Anal(yst)?

There are certain knowledge that should be armed by network security analyst, however sometimes we don't know what should we learn and master when everything seems to be interesting, plus we are always lack of time(this is important factor indeed). Thus we need a clear scope and defined roadmap so that one can quickly pick up and becoming a decent network security analyst.

I will discuss the complete roadmap for network security analyst in my future blog post, while I think it won't apply to everyone, I hope it helps one to become better network security analyst. Hereby I would like to talk about one of important knowledge that considered crucial to most network security analyst - REGEX.

Regular expression is very powerful tool when one master it. I won't be explaining what is regex but you should already know it is mainly used for pattern matching most of the time. Not many network security analysts think that they should learn regex as it doesn't seem to be important.

As for me, I first learned about regex when using shell tool called egrep, egrep is very efficient tool when one need to process large log files and extract certain strings out of it. I realized that only by mastering regex then I can actually fully utilize it. However it doesn't seem so much related or applied to network security analyst job at that moment.

Later when I'm adapted to network security monitoring, there are many network security tools that I have to deal with. Surprisingly most of them have something to do with regex. Hereby I will show few examples of them, let's look at ngrep -

shell>ngrep -I ./bugger.pcap -i 'ping[0-9]\:'

U 192.168.0.35:25555 -> 1.2.3.4:14730
d1:ad2:id20:.Q.ÐÏE¬8nÛ.?ÍYp¸£.ñ.e1:q4:ping1:t8:M..]`.&"1:y1:qe
####
U 192.168.0.35:25555 -> 1.2.3.4:27843
d1:ad2:id20:.Q.ÐÏE¬8nÛ.?ÍYp¸£.ñ.e1:q4:ping1:t8:só.ÔP£..1:y1:qe

Ngrep allows one to use extended regex when performing pattern matching on packet payloads(application layer). But it only performs matching on single packet instead of the complete network session, this maybe bypassed using fragmentation technique, no worry we have flowgrep for the job instead which will reassemble the network traffic and examine to avoid evasion.

Yet that's not the end, the most popular open source nids - snort, it needs to be compiled with pcre. Snort has very powerful signatures matching engines, and if we take a closer look at more complicated snort rules -

alert udp $EXTERNAL_NET any -> $HOME_NET 699 (msg:"EXPLOIT RADIUS registration vendor ATTR_TYPE_STR overflow at tempt"; content:"|01|"; depth:1; content:"|01 01 1A|"; depth:3; offset:32; content:"|00 00 15 9F|"; depth:4; of
fset:36; byte_test:1,>,30,1,relative; isdataat:29,relative; pcre:"/^\x01.{23}(\x25|\x26).{15}(\x0A|\x34)/smi";
reference:bugtraq,12759; reference:cve,2005-0699; reference:nessus,19120; classtype:attempted-admin; sid:3540; rev:3;)

alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"EXPLOIT Ethereal SIP UDP CSeq overflow attempt"; content:"CSeq|3A|"; nocase; isdataat:16,relative; content:!"|0A|"; within:16; pcre:"/^CSeq\x3A\s*[^\nA-Za-z]*[A-Za-z][^\n]{16,}/smi"; reference:bugtraq,13504; reference:cve,2005-1461; reference:nessus,18986; reference:url,www.ethereal.com/news/item_20050504_01.html; classtype:attempted-dos; sid:3677; rev:5;)

Again it is regex thingy, what can I say more? Lets take a look at another nids alternative - bro-ids. Bro-ids has many policy scripts and it either contains signatures for worms or network protocols(application protocol can be very identical sometimes by looking at packet payloads). Lets navigate some of its signatures -

signature s2b-103-7 {
ip-proto == tcp
src-port == 27374
event "BACKDOOR subseven 22"
tcp-state established,originator
payload /.*\x0D\x0A\[RPL\]002\x0D\x0A/
}

signature s2b-106-8 {
ip-proto == tcp
src-port == 80
dst-port == 1054
header tcp[8:4] == 101058054
header tcp[13:1] & 255 == 16
header tcp[4:4] == 101058054
event "BACKDOOR ACKcmdC trojan scan"
tcp-state stateless
}

What you see in bold is regex to match the packet payload to identify subseven backdoor. In fact this is the one of snort signature that converted for Bro-ids compatibility. Last example that I would like to show is pads, the passive asset detection system to identify what network services that are running in your network which will be integrated to next version of sguil. The following are pads signatures -

www,v/Apache/$1//,Server: Apache\/([\S]+)[\r\n]
smtp,v/Postfix SMTP//$1/,^220 ([-.\w]+) ESMTP Postfix
bit,v/Bittorrent///,^\x13BitTorrent\x20protocol

Going through so many network security tools, one should already understand the important of regex which is widely utilized in the network security arsenal. I know most of the network security analyst wannabe that actually considering mastering network protocols(tcp/ip) or finishing their degree in university or college should do enough, but you should seriously think of taking yourself to next level, be competitive and serious network security analyst!

Trust me, regex can do more magic than you can imagine!!!!!

Enjoy (;])

P/S: I'm taking this as serious post, that's why it takes me so long to post it, it's my 300th blog post and the last one in year 2006, happy new year 2007!!!!!

Pro OpenSSH

I have finished reading it while going to Border Book Store with the infamous Seymour at Queensbay. While I'm not a book reviewer, but I would like to recommend this book to anyone especially system administrators who use ssh in their daily administration task.

The book is written by Michael Stahnke. At first glance of this book, I thought it might be the book for people who want to understand about ssh protocols in depth(Pro OpenSSH), however I'm totally wrong, this book is not about the protocol itself but more of practical implementation and deployment of OpenSSH services. The book itself is not for OpenSSH power users only, but it introduces OpenSSH from basic to advance topics so that anyone can pick up OpenSSH quickly. The explanation of each OpenSSH options is not just man page kind only but rather showing various useful examples that can improve your ssh experience. It also introduces many usages of ssh management tools such as ssh-agent and so forth.

The automated task via ssh plus shell scripting also comes into handy, people can find it effective working in ssh environment since many administration jobs can be automated as long as you know the tricks with creativity.

The last chapter demonstrates ssh clients on different OS platforms(if I'm not forgotten), this may help people who want to learn how to use ssh on Windows Platform. It also guides you on how to install and run Windows SSH server. This is pretty neat when you need secure remote access to Windows Server without using other crappy services.

Overall the book is good, but actually I'm looking for kind of book which explains ssh protocols breakdown analysis to sharpen my skill. Again I seriously recommend this book to system administrators who work in *nixes environment. Book like this can be very useful for people who need to practice it in time.

Enjoy :]

Merry Christmas

Hiho ..... hohohohohohoohohohoh .....

To all people around the globe,

Merry Christmas & Joys to the world!!!!!

o<(8<-)>

P/S: By the way I have a christmas wish that wanna tell - I wish to have my own "Network Security Analyst Lab & Library" when I able to buy all related books and accesories :P

Bro-IDS: Enable Full Content Data Logging

To enable Bro-ids full content data logging so that you can perform network forensic, just set it in bro.cfg under bro configuration directory(etc) will do -

BRO_CREATE_TRACE_FILE=YES

You can just disable it by setting it to NO, the pcap file will be stored at the logs directory.

shell>file trace.hostname.06-12-19_00.36.41
trace.hostname.06-12-19_00.36.41: tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 8192)

However in future, I think time machine will replace this for full content data logging management.

Enjoy :]

3Com 3226: Enable Port Mirroring

If you have 3Com Network Switch 3226 Model, and you would like to monitor your network, it does provide port mirroring feature. In order to enable it, you can login to the console via telnet, then execute commands accordingly to the screenshot below -

feature -> rovingAnalysis -> add|remove|start|stop|summary

3Com uses Roving Analysis as the term for the port mirroring, you will have to specify monitor port and analyzer port. Monitor port is the port you will want to monitor and analyzer port is the port to mirror traffic on monitor port. From my example I will monitor port 1 and its network traffic will be mirrored to the analyzer port which is port 25. Once I start monitoring, you can view the summary where roving analysis is enabled.

By now you can just plug in your IDS sensor or traffic collector to port 25 of the switch and start your network security monitoring.

Enjoy :]

P/S: I by no mean promoting or selling 3Com product, this is just to help in case one has the same device or as my own reference.

Bro Offline Packet Analysis(DPD Enabled)

Bro-ids is a beast, you will have to spend some times to actually understand how it works, or maybe just understand it partially. There's no good guide that you can find regarding Bro-ids, the only thing you can do is either subscribing to the mailing list, or either reading Bro-ids Wiki or maybe reading its codes(Ouch). The documentation that comes with Bro-ids is rather old. I think most of people out there are using Snort, it is lightweight, snort related documentation and books are everywhere too. I will have to admit that Bro-ids is not very easy to use but you can find it very powerful from time to time. Anyway you can download it at here, to install it -

shell>tar xvzf bro-1.2-devel.tar.gz

shell>cd bro-1.2-devel

shell>./configure --prefix=/usr/local/stow/bro-1.2-devel

shell>make && make install

You will have to run make install-brolite so that configuration can be done easily. Once you have finished the configuration, now let's navigate the installed bro. The reason why I choose to install bro in non-standard directory because it will be more easy for us when we need to either remove or upgrade it next time.

shell>ls -la /usr/local/stow/bro-1.2-devel/
total 38
drwxr-xr-x 16 bro wheel 512 Dec 15 19:33 .
drwxr-xr-x 16 root wheel 512 Dec 12 14:35 ..
drwxr-xr-x 2 bro wheel 512 Dec 6 09:17 archive
drwxr-xr-x 2 bro wheel 512 Dec 6 10:00 bin
drwxr-xr-x 5 bro wheel 512 Dec 6 10:00 doc
drwxr-xr-x 2 bro wheel 512 Dec 6 12:23 etc
drwxr-xr-x 2 bro wheel 512 Dec 6 09:57 include
drwxr-xr-x 2 bro wheel 512 Dec 6 09:57 lib
drwxr-xr-x 4 bro wheel 5632 Dec 15 16:04 logs
drwxr-xr-x 3 bro wheel 512 Dec 6 10:08 perl
drwxr-xr-x 4 bro wheel 4096 Dec 15 19:34 policy
drwxr-xr-x 2 bro wheel 512 Dec 6 09:17 reports
drwxr-xr-x 2 bro wheel 512 Dec 6 10:08 scripts
drwxr-xr-x 4 bro wheel 512 Dec 6 09:14 share
drwxr-xr-x 2 bro wheel 512 Dec 6 12:42 site
drwxr-xr-x 2 bro wheel 512 Dec 15 16:04 var

I won't be going through every directory and explaining them one by one, however you should look at site which is used to store your site configuration, you should check and tune the configuration of the files in site directory especially the one with your hostname as prefix. By default brolite is enabled to load all the default policies.

@load brolite

One of the thing you can do is enable the Snort signatures matching by uncomment the following line -

# To run signatures, uncomment the following line.
@load brolite-sigs

The next directory that are important is etc(configuration directory), you may find most of bro path variables are stored in bro.cfg in etc directory. Then comes to policy script, this directory needs a lot of tuning depends on your network environment. You can actually checkout brolite.bro script inside policy directory to see what is loaded by default. Other directories that are shown pretty self descriptive so I won't touch on that.

Since this post is about Bro-IDS Offline Packet Analysis, I will just talk about it. To actually do it, I will have to add or append the following part to .bash_profile since my environment variables are stored there(I'm using bash), you should change it if you use different shell.

BROHOME=/usr/local/stow/bro-1.2-devel
BROPATH=/usr/local/stow/bro-1.2-devel/policy:/usr/local/stow/bro-1.2-devel/site

export PATH PACKAGESITE BROHOME BROPATH

Since I don't have clue for the first time how I can use bro with DPD(dynamic protocol detection), I refer to the brolite.bro to get to know which analyzers are needed if I want dynamic protocol detection. Here's the entry of brolite.bro

.....
## Dynamic Protocol Detection configuration
#
# This is off by default, as it requires a more powerful Bro host.
# Uncomment next line to activate.
const use_dpd = T;

@ifdef ( use_dpd )
@load dpd
@load irc-bot
@load dyn-disable
@load detect-protocols
@load detect-protocols-http
@load proxy

# By default, DPD looks at all traffic except port 80.
# For lightly loaded networks, comment out the restrict_filters line.
# For heavily loaded networks, try adding addition ports (e.g., 25) to
# the restrict filters.
redef capture_filters += [ ["tcp"] = "tcp" ];
# redef restrict_filters += [ ["not-http"] = "not (port 80)" ];
@endif
.....

The default offline packet analysis can be done by using mt.bro which is located at policy directory. Here's the content of my mt.bro -

# $Id: mt.bro 340 2004-09-09 06:38:27Z vern $

@load alarm
@load dns-lookup
@load hot
@load frag
@load tcp
@load scan
@load weird
@load finger
@load ident
@load ftp
@load login
@load portmapper
@load ntp
@load tftp
@load profiling
# Loading DPD
@load dpd
@load irc-bot
@load dyn-disable
@load detect-protocols
@load detect-protocols-http
@load proxy

You should see I have added the dynamic protocol detection(DPD) to mt.bro so that I can use the latest DPD when doing offline traffic analysis.

Running bro offline packet analysis
shell>bro -f tcp -r 060915-Event.pcap mt

After bro is successfully executed, you may find all the logs in current directory.

shell>ls -la *.log
-rw-r--r-- 1 root wheel 0 Dec 11 14:27 alarm.log
-rw-r--r-- 1 root wheel 0 Dec 11 14:27 conn.log
-rw-r--r-- 1 root wheel 0 Dec 11 14:27 ftp.log
-rw-r--r-- 1 root wheel 0 Dec 11 14:27 irc-bots.log
-rw-r--r-- 1 root wheel 104 Dec 11 14:01 irc-bots.summary.log
-rw-r--r-- 1 root wheel 0 Dec 11 14:27 irc.detailed.log
-rw-r--r-- 1 root wheel 0 Dec 11 14:27 irc.log
-rw-r--r-- 1 root wheel 0 Dec 11 14:27 notice.log
-rw-r--r-- 1 root wheel 0 Dec 11 14:27 prof.log
-rw-r--r-- 1 root wheel 0 Dec 11 14:27 signatures.log
-rw-r--r-- 1 root wheel 0 Dec 11 14:27 weird.log

Dynamic Protocol Detection is still new or considered in early developemet, we will see more and more protocols will be supported in future. Interestingly, you can print all the bpf filter expressions of mt.bro

shell>bro -f tcp mt print-filter
(((((((((((ip[6:2] & 0x3fff != 0) and tcp) or (port 111)) or (tcp[13] & 7 != 0)) or (port 6667)) or (port finger)) or (port telnet or tcp port 513)) or (udp port 123)) or (port ftp)) or (tcp port 113)) or (udp port 69)) or (port 6666)

By the way I'm using the wrong term - Offline Packet Analysis, Bro doesn't work that way, it is more of Offline Traffic Analysis instead as it analyses the full network stream instead of packet wise.

Enjoy (;])

Qemu Network on Linux

If some of you have downloaded my OpenBSD Sguil qemu image, and you happen to use linux, I suggest you take a look at this post which explain how to get qemu networking works on Linux. By the way if you like the work of Snort-Inline, just drop by to the blog and say hi to Victor.

http://www.inliniac.net/blog/?p=56

Thanks to Victor, this is the late post from me indeed.

Cheers :)

I know idiot is helpless

I'm pretty dissapointed about SecurePenang. First of all - the speaker from Itrain is just another CEH instructor that been trained to be a Certified Hacker who seriously doesn't know much about the ethic of being Security Professional.

The first event of the day is Wardriving, the funny thing about the speaker is that he told us the best card for Wardriving is Orinoco - that's definitely not true as it depends on the tools and drivers that written for the networking hardware. By the way the WarDriving is pretty boring with whatever stumbler.

Coming to the Presentations that done by Symantec and Microsoft, which don't do any better, everyone feel sleepy and we all know it is boring when comes to vendors talk. Then Niser gaves the Presentation regarding Malaysia Security Outlook, this is by far the best presentation in the day, I don't want to comment anything about it but just one, building threat statistic based on incident reporting of companies is totally inaccurate, I think most of companies prefer things under the umbrella instead of sun. Please deploy sensors at ISP layer instead. I don't think DDOS cases equal to none in a quarter of the year.

The last hacking demo - this is the big woo. The so called certified hacker setup his own web server and I think he added the host mapping to the hosts file - maybank2u.com.my to his own web server with public IP. Then he uses nmap scanning to get all the opened port, then telling everyone that Maybank web server has so many ports opened including port 135 abd 139, therefore he used the script kiddies tool to launch dcom exploits and successfully getting into the server. He even shows how he able to retrieve file and so forth using tftp as well as defacing the website.

I definitely agree that there's no harm to perform live hacking demo, it should creates awareness among the audience to awake how easy your operating system can be compromised. However you should have told the audience that you are actually hacking into the demo server instead of Maybank web server, the certified hacker didn't explain and telling the audience he is hacking into demo server but Maybank Web Server. Almost 90%(can tell as most of audience are non-technical) of them believe that it is real Maybank web server. He is misguiding all the audience by showing how l33t he is, he even stated that there's no firewall or ids and they won't know what he has done(dumbass). Everyone says "WOW" and clapping hands like nobody.

Then when comes to the end of the demo, while people asking him question personally such as is he able to get into Maybank databases? Then he told that Maybank has Multilayer Network Structure and by hacking the Web Server you will have to dig out where the Database Server is located.

At the end, he still want people to believe that he(l33t) is actually hacking into Maybank Server. Remember your audience is public, you shouldn't deliver faulty information, what a breach!

Mike <- You are not qualified as ethical hacker. You just an idiot without brainer! I read from the site the Live Hacking Demo should be done by Scan Associate people and I'm wondering whether he is from Scan. The coolest statements of him - you have greater reputation if you have more bots. I bet he doesn't know the hacker communities enough. The second interesting statement is "I have never been infected by computer viruses" even I have used Windows for so long, and my antivirus program is disabled by default!" - Wow, he is definitely gosu alike.

My words to MIRC - The SecurePenang event sucks, you shouldn't have brought anyone like this to present or deliver.

P/S: I should kick Mike in the nutsack!!!!!!!! :P

Penang ICT Week

I will be going to the Third Event of Penang ICT Week which is Secure Penang that will be held on 8th of December(Tomorrow), so it would be great if any of you are going to the event and we can most properly talked more about the Network Security Scene in Malaysia. There will be Scan Associate and Niser guys around so I hope to see some familiar faces there.

You can find the event detail here.

Anyway ping me if you are going.

Cheers :]