Best for Last .....

Today is a busy day as I'm packing everything and finally moving out from the Penang Island. I'm glad to meet my former colleague who just back from US, and playing games with my friends. I can't consider it as relaxing day for me as I'm rushing here and there to finish all the stuffs possible. I will be heading to Kuala Lumpur tomorrow and taking flight to this event -

http://conf.vnsecurity.net/

Guess what, with this post I'm hitting 35 in a month which means more than a blog post in a day. Insane!!!!!

Peace ;]

HeX liveCD: CD Label

Our HeX liveCD great graphic designer - Vickson has sent me the CD label that he has just redesigned and asking my opinion about it. This is almost the final version of the CD label for HeX liveCD version 1.0 after some discussion and modification ongoing between me and some of team members, I would like to put it up here and sharing with everyone. To protect his artworks, I have told him to register under Creative Common License.For better view, click on the picture to zoom in, let us know what do you think about it?

Awesome works, Vickson!

Enjoy (;])

Bro: It's not just NIDS

Thanks to Bro team which has published the workshop materials online so that we can learn more about Bro internal. While I have been using Bro in Operational Network, I haven't actually learned about Bro Scripting Language. Therefore I think those materials will be ice-breaker for me because it really makes thing clear and I plan to finish all the exercises to further sharpen my skills in operating Bro.

http://www.bro-ids.org/bro-workshop-2007/agenda.html

There are few things I have noted in the materials provided, in the slide 6 of Bro Overview -

Much of the system is policy-neutral
- i.e. no presumption of "good" or "bad"

This is exactly similar to NSM concept where we don't assume any alert events provided by IDS as intrusion or extrusion without further confirmation and verification with the subsystem given.

From the slide 4 of Bro Conclusion and Outlook -

The Bro Cluster
- A set of PCs running Bro jointly analyze large network streams
- A central manager system

And 5th slide -

Multi-Core Support
- Going to turn Bro into multi-threaded application
- Will fully exploit the multi-core potential of modern CPUs

I would love to see all of them integrated to Bro in near future as it will benefit us with both low or high end hardwares.

Again from the slide 4 of Bro Conclusion and Outlook -

New Functionality
- Time Machine Interface
- Netflow Analyzer

I have written the setup of time machine here previously and time machine will soon be integrated with Bro to provide full content data via its indexing system. If you want to learn more about it, check out its main site -

http://www.net.t-labs.tu-berlin.de/research/tm/

With Netflow Analyzer added that is plus point as most of the companies having Cisco router deployed in their network, or you can use fprobe if running *nixes network appliance.

Think again about the approach, is Bro a Network Intrusion Detection System?

Again I have to emphasize, NSM analyzt is da future!

Peace ;]

Malaysia Honeynet Community

Me and Mel have discussed about running non-profit honeynet group to research on internet threats and attacks trend for a while, and finally Mel launched the website about the group after long delay. We are currently running low level honeypots to capture malwares and plan to deploy high level honeynet once we have found the sponsors because more costs intact in order to operate them.

We welcome any contributors, here's our list -

http://my-honeynet.org/index.php?/archives/Contributions-to-the-Malaysia-Honeynet-Project.html

Current members in the group -

http://my-honeynet.org/index.php?/archives/Malaysia-Honeynet-Project-Members.html

And that includes raWPacket team members too.

Of course if you are interested in the project(researches, contributions, sponsorships), feel free to email us, you can either contact me or Mel.

mel at hackinthebox dot org

geek00l at gmail dot com

We hope this can be the long term R & D with the supports of various parties, and the outcome value is definitely worthwhile.

Cheers ;]

Bro-NIDS: Pairing with Ourmon

Beside Snort, Bro-NIDS is another one of the most powerful open source NIDS that developed by Vern Paxson and his team with community supports.

I figure out the lacking part of Bro, the detail explanation of analysis flow definitely. So what's the problem with that? Let's take a look at its logs -

shell>ls -la logs
-rw-r--r-- 1 bro wheel 196714 Jul 26 12:17 alarm.hostname.07-07-23_00.00.01
-rw-r--r-- 1 bro wheel 406878 Jul 23 17:33 alarm.hostname.07-07-23_00.00.01-07-07-23
-rw-r--r-- 1 bro wheel 142239 Jul 24 21:39 alarm.hostname.07-07-23_00.00.01-07-07-24
-rw-r--r-- 1 bro wheel 585678 Jul 25 22:39 alarm.hostname.07-07-23_00.00.01-07-07-25
-rw-r--r-- 1 bro wheel 258391385 Jul 23 00:00 conn.hostname.07-07-18_15.25.41-07-07-22
-rw-r--r-- 1 bro wheel 130996 Jul 23 00:00 conn.hostname.07-07-18_15.25.41-07-07-23
-rw-r--r-- 1 bro wheel 35500032 Jul 26 12:17 conn.hostname.07-07-23
-rw-r--r-- 1 bro wheel 100144755 Jul 24 00:00 conn.hostname.07-07-23_00.00.01-07-07-23
-rw-r--r-- 1 bro wheel 76778138 Jul 25 00:00 conn.hostname.07-07-23_00.00.01-07-07-24
-rw-r--r-- 1 bro wheel 83297924 Jul 26 00:00 conn.hostname.07-07-23_00.00.01-07-07-25
-rw-r--r-- 1 bro wheel 856239 Jul 23 00:00 ftp.hostname.07-07-18_15.25.41-07-07-22
-rw-r--r-- 1 bro wheel 603 Jul 23 00:00 ftp.hostname.07-07-18_15.25.41-07-07-23
-rw-r--r-- 1 bro wheel 765952 Jul 26 12:17 ftp.hostname.07-07-23
-rw-r--r-- 1 bro wheel 2371772 Jul 24 00:00 ftp.hostname.07-07-23_00.00.01-07-07-23
-rw-r--r-- 1 bro wheel 2529580 Jul 25 00:00 ftp.hostname.07-07-23_00.00.01-07-07-24
-rw-r--r-- 1 bro wheel 1646301 Jul 26 00:00 ftp.hostname.07-07-23_00.00.01-07-07-25
-rw-r--r-- 1 bro wheel 179461957 Jul 23 00:00 http.hostname.07-07-18_15.25.41-07-07-22
-rw-r--r-- 1 bro wheel 47554 Jul 23 00:00 http.hostname.07-07-18_15.25.41-07-07-23
-rw-r--r-- 1 bro wheel 77824 Jul 26 11:49 http.hostname.07-07-23_00.00.01
-rw-r--r-- 1 bro wheel 642726 Jul 24 00:00 http.hostname.07-07-23_00.00.01-07-07-23
-rw-r--r-- 1 bro wheel 627456 Jul 25 00:00 http.hostname.07-07-23_00.00.01-07-07-24
-rw-r--r-- 1 bro wheel 202697 Jul 26 00:00 http.hostname.07-07-23_00.00.01-07-07-25
Output truncated .....

Ouch! There are so many logs here and how should I start? Just like sguil where you must speak mysql pretty well to perform better analysis, you must speak shell scripting enough to perform smooth analysis flow on Bro logs. The power of Bro lies in it's protocol anomaly detection and therefore having different protocols logging in different files(prefix with its protocol) do make things clear. However you can't consider its logs as alert and indicator of malicious event(different approach comparing with snort) even though alarm, notice and weird logs do give some clues about suspected network event. Another problem should be when the file grows larger in a day, it is pretty hard to crawl the file to check on malicious event. For example look at one of the file -

shell>du -h \
conn.hostname.07-07-18_15.25.41-07-07-19_00.00.00
510M conn.hostname.07-07-18_15.25.41-07-07-19_00.00.00

It could be deep pain if you want to read them, don't you? Therefore it becomes unclear when one first learn about Bro and want to proceed to examine the logs but don't know where to start. Here I will give you some insight of how I perform analysis using Bro but I need another powerful tool to assist me, I vote ourmon!

Bro only generates network statistical data in its daily report therefore we don't have real time view of current network statistic, therefore ourmon plays the main role for you to access to the network statistical data via its well crafted graph. But where's our flow data to understand each connection? Bro does store connections flow data, all its connections flow stored in the file with the prefix of conn.*. The only data we don't have is full content(pcap), you can either use tcpdump, daemonlogger or Bro alone to do the job for you however I would like to ignore this part for the moment because generally you can have idea of each connections because most of the widely used and popular protocols such as http, smtp and so forth are decoded and stored in its corresponding file such as http.*, smtp.* and so forth, other protocols that are not decoded(provided no decoder for it) still can be seen in conn.* to understand its nature. Here's the example when you find unconfirmed or suspected malicious activity in certain time frame via notice log -

notice.sguard.07-07-23_00.00.01-07-07-25_00.00.00:t=1185314110.984062 no=ProtocolFound na=NOTICE_FILE sa=1.2.3.4 sp=33071/tcp da=10.0.0.1 dp=443/tcp num=14 msg=1.2.3.4/33071\ >\ 10.0.0.1/https\ FlashCom\ (via\ HTTP)\ on\ port\ 443/tcp sub=FlashCom\ (via\ HTTP) tag=@2113

Interesting connection from 1.2.3.4 to 10.0.0.1, you have the tag number @2113 for this connection flow, now we can grep the flow from connections log -

shell>egrep '@2113' \
conn.sguard.07-07-23_00.00.01-07-07-25_00.00.00 | cf
Jul 25 05:55:05 122.708121 1.2.3.4 10.0.0.1 https 33071 443 tcp 13384 12298 RSTR L %332 @2113 HTTP

You may see I pipe to cf, cf is small utility to translate unix epoch time format to human readable form, therefore it's more easy for you to read and correlate the event based on time frame. The format of connections flow should be read in this way -

| Start | Duration | Local IP | Remote IP | Service | Local PORT | Remote PORT | Protocol | Orig Bytes Sent | Res Bytes Sent | State | Flags | Tag |

The only part which is not clear is the connection state - RSTR, you can check out here -

RSTR Established, responder aborted.

While L means connection is initiated locally.

There are two tags, %332 and @2113, so now we know about the connection flows which is http, we should search the tag %332 in http log -

shell>egrep '%332' \
http.hostname.07-07-23_00.00.01-07-07-25_00.00.00

1185314105.742038 %332 (200 "OK" [10])
1185314107.122409 %332 POST /idle/315397832/2 (200 "OK" [67] ic.flashcom.peopleim.userplane.com:443)
1185314107.750136 %332 POST /send/315397832/4 (200 "OK" [1260] ic.flashcom.peopleim.userplane.com:443)
Output truncated .....

Here you go, you are now having full understanding of the network connections(all those http requests with same tag number), this is kind of batch analysis to identify network events. I don't explain how I make use of ourmon here or maybe I will make it for future post. Ourmon generates the graph by plotting such as TCP flags ratio, network errors, irc stats and some other graphs that you can correlate with the data provided by Bro to fully understand your network and readily countering any network threats.

Below I demonstrate some of the tips I use before I examine Bro logs, it's good catch if we want to read the separate kind of logs in timely manner, for example I want to check out the alarm log only, I just execute -

shell>ls -lac alarm*
-rw-r--r-- 1 bro wheel 0 Jul 23 00:00 alarm.hostname.07-07-18_15.25.41
-rw-r--r-- 1 bro wheel 3999 Jul 19 00:00 alarm.hostname.07-07-18_15.25.41-07-07-18_15.25.50
-rw-r--r-- 1 bro wheel 4515 Jul 20 00:00 alarm.hostname.07-07-18_15.25.41-07-07-19_00.00.00
-rw-r--r-- 1 bro wheel 4525 Jul 21 00:00 alarm.hostname.07-07-18_15.25.41-07-07-20_00.00.00
-rw-r--r-- 1 bro wheel 1551 Jul 22 00:00 alarm.hostname.07-07-18_15.25.41-07-07-21_00.00.00
-rw-r--r-- 1 bro wheel 1363 Jul 23 00:00 alarm.hostname.07-07-18_15.25.41-07-07-22_00.00.00
-rw-r--r-- 1 bro wheel 0 Jul 23 00:00 alarm.hostname.07-07-18_15.25.41-07-07-23_00.00.00
-rw-r--r-- 1 bro wheel 206776 Jul 26 13:50 alarm.hostname.07-07-23_00.00.01
-rw-r--r-- 1 bro wheel 406878 Jul 24 00:00 alarm.hostname.07-07-23_00.00.01-07-07-23_00.00.04
-rw-r--r-- 1 bro wheel 142239 Jul 25 00:00 alarm.hostname.07-07-23_00.00.01-07-07-24_00.00.00
-rw-r--r-- 1 bro wheel 585678 Jul 26 00:00 alarm.hostname.07-07-23_00.00.01-07-07-25_00.00.00

I use ls with -c switch so that I can sort them by file creation time, that way making us easy to check out any daily log we want by date especially searching for connections tag. In the alarm log, you may see the time stamp of every network event started with t=, that render cf tool unable to convert the time stamp from unix epoch time to human readable form correctly -

shell>head -2 alarm.hostname.07-07-23_00.00.01
t=1185379996.560573 no=ProtocolViolation na=NOTICE_ALARM_ALWAYS sa=1.2.3.4 sp=33762/tcp da=2.3.4.5 dp=25/tcp msg=1.2.3.4/33762\ >\ 2.3.4.5/smtp\ analyzer\ SMTP\ disabled\ due\ to\ protocol\ violation sub=reply\ code\ out\ of\ range tag=@4363
t=1185380009.544433 no=PortScan na=NOTICE_ALARM_ALWAYS sa=1.2.3.4 da=2.3.4.5 dp=443/tcp msg=64.86.142.65\ has\ scanned\ 50\ ports\ of\ 10.14.42.154 tag=@4364

You can use sed to remedy this issue -

shell>sed 's/^t=//g' alarm.hostname.07-07-23_00.00.01 | cf

Just discard t= and parse it to cf. Bingo! Piping to less command is also great because you can perform certain function such as search by regular expression, easy log navigation and so forth(vi style functions).

Both Bro and Ourmon provide you great context for most of anomaly network events, I have spent my time to figure out the better way to utilize them and hopefully this help anyone who uses them because I did face difficulty when first dealing with Bro that it seems to require more man power to examine them. One more tip, remember to turn on dynamic protocol detection(DPD) when dealing with stealthy attackers.

Some of you may wonder why not examining the application protocol log(http.*, ftp.*) and instead of digging the connections log first, the answer is pretty simple, if you examine the connections log and found no data transfers(Orig Bytes Sent | Res Bytes Sent), it's pointless to look at the application protocol log and may indicate some kind of network probing or scanning activities. However this doesn't apply to every condition and sometimes you need to tinker of how to perform analysis effectively. I draw the simple diagram for better illustration -

I use color depth to indicate the understanding level of the network event. You may see the color in the entity becomes lighter and lighter from left to right when you have better understanding of network event through out the structural analysis process.

What's the lacking in Bro? Clearly enough that it really needs better way to organize and manage its logs and perhaps OSSEC can fill the gaps with additional log parser. Using this mechanism with the deployment of Snort NIDS, I'm pretty confirmed that you can identify known and unknown(0 days) network attacks.

Enjoy (;])

High Quality Spam, please .....

As usual I login to my webmail after I woke up in the morning, checking the email and there's one with zip attachment, sounds malicious that it may contain executable file? Here's how the email looks like, I discard the sender part as it can be any originator -

I like the Note message, it looks so harmless. Anyway I just unzip it and it appears to be a pdf file -

shell>file 2685.pdf
2685.pdf: PDF document, version 1.2

shell>hexdump -C 2685.pdf
255044462d312e32 200d0a312030206f |%PDF-1.2 ..1 0 o|
626a0d0a3c3c0d0a 2f54797065202f43 |bj..<<../Type /C|
6174616c6f670d0a 2f50616765732033 |atalog../Pages 3|
203020520d0a2f50 6167654d6f646520 | 0 R../PageMode |
2f5573654e6f6e65 0d0a2f506167654c |/UseNone../PageL|
Output truncated .....

Therefore I use xpdf to open the file and here's how it looks like .....

You can click on the image to zoom in, but the image quality is so bad until you can't really read, I know you spammer want it to be small size(68K) only but please deliver with better quality image so that I can read or else how I gonna invest?

I don't see much of small gif file from spamming activities lately, maybe the trend is changing again .....

Enjoy ;]

400th Post: The New Milestone

This 400th blog post means a lot to me because I have never thought of myself able to blog that much continuously but I really make it. On the other hand, today it's my last half day(Saturday) working in Exabytes Network and I'm officially resigned starting from 1200 21/07/2007. Without me noticing, I have already worked in this company for 2 years, time really flies .....

Thanks to Mr. Chan who has given me opportunity to join the company, I greatly thanks to everyone who has been working closely with me especially Andy, Jackie, Albert and Guan who has been very supportive(sorry to disclose your name and don't get mad if your name is not listed :P). At the same time, I also greet the whole technical team which dedicated a lot of times and efforts in maintaining the server farms, you guys are just awesome!

I have been involved in many network security operations such as incident response, vulnerability assessment, network forensics and so forth. This is greatly improving my technical knowledge to face new challenge in my next career.

It is undoubtedly that I have mix feeling because I have to leave Pulau Penang and moving to somewhere soon, I must say I love this island very much, great people and delicious foods here. Hopefully the new place won't be disappointing me.

Seriously I don't know what to say, I'm rarely expressing my real feeling in this technical blog, anyway -

good bye to all my friends here and good luck to ya all!!!!! My memory is larger than RAM so I will carry them with me no matter where I go .....

Peace ;]

P/S: Stop being geek, you fool ;-)

HeX liveCD: Ntop

We have included Ntop in our liveCD and here's the simple how to use it to perform offline processing on pcap data, it's another useful to generate network statistic besides tshark and tcpdstat. I always use honeynet-scan18.pcap as example as it is publically available here. Credit to honeypot team for making the trace available.

shell>sudo ntop -u analyzt -M -n \ -f ./honeynet-scan18.pcap -m 172.16.1.0/24 \ -O ntop-output/ -w 192.168.0.50:3000 -W 0 -g -c -a -q

shell>sockstat -4 | grep ntop
analyzt ntop 3054 12 tcp4 *:3000 *:*

Now we have access to port 3000, just point our browser to it -

http://192.168.0.50:3000

Major Protocols Distribution

Application Protocols Distribution

Per Host Information

The down side about ntop is that it will purge the old data therefore you only view the latest data displayed, if anyone of you(experience Ntop user) know how to disable it, please share it with me because I would prefer to use it to process the pcap offline.

Enjoy (;])

Blogmania

I just realized that I have turned planet.foss.org.my to geek00l.blogspot.com except that the white background doesn't turn into black. Thanks to my blogmania!!!!! Kindly checkout the screenshots .....

It's temporarily renamed to planet geek00l .....

Cheers ;]

HeX liveCD: Chaosreader

I have included chaosreader in the HeXtra so that you can use with HeX liveCD, you can use chaosreader to parse the pcap data and it will generate the html report to ease the process of analysis thus you can quickly learn about all the network activities. Just follow the screenshot below -

Once the process is done, you will find index.html and all the files extracted in the rp-chaosreader directory, just open index.html using your internet browser and you will come to the screen below -

You can even download the compressed file(tar.gz) from the session or examine the raw data -

If you would like to have high level understanding of the network data, chaosreader is definitely a good choice.

Enjoy ;]

Malaysia: HITB SEC CONF 2007

Hack In The Box Security Conference is around the corner, if you are interested in attending one of the most interesting security conference on earth and meeting the hackers around the world, feel free to check it out here -

http://conference.hitb.org/hitbsecconf2007kl/

Enjoy ;]

Fl0p - Passive L7 Flow Fingerprinter

Checking back my old posts and I just figured out I have this post in my saved draft and never be posted online. It's all about identifying the flow by fingerprinting the application bytes in packets exchange of the connection stream. Thanks to Michal Zalewski who writes this tool called Fl0p, from the description -

fl0p is a passive L7 flow fingerprinter that examines TCP/UDP/ICMP packet sequences, can peek into cryptographic tunnels, can tell human beings and robots apart, and performs a couple of other infosec-related tricks.

If you are on FreeBSD, you can just install it via package/port system, but for gentoo users, you will have to install via source -

shell>wget http://lcamtuf.coredump.cx/soft/fl0p-devel.tgz

shell>tar xvzf fl0p-devel.tgz

shell>cd fl0p

shell>make
./Build all
Your system type is: FreeBSD

Please help with p0f 2:
http://lcamtuf.coredump.cx/p0f-help/

GNU make not found; failing back to regular (BSD?) make.
gcc -g -ggdb -Wall -DUSE_BPF=\"net/bpf.h\" -I/usr/include/pcap -I/usr/local/include/pcap -I/usr/local/include -o fl0p fl0p.c crc32.c -lpcap
strip fl0p 2>/dev/null || true

Running fl0p -

shell>./fl0p -h

Usage: ./fl0p [ -f file ] [ -i device ] [ -s file ] [ -o file ]
[ -u user ] [ -e ms ] [ -T ms ] [ -FUKrqvpdtl ] [ 'filter rule' ]
-f file - read fingerprints from file
-i device - listen on this device
-s file - read packets from tcpdump snapshot
-o file - write to this logfile (implies -t)
-u user - chroot and setuid to this user
-e ms - pcap capture timeout in milliseconds (1)
-q ms - packet timing threshold in milliseconds (400)
-F - disable fuzzy matching on all signatures
-U - display fingerprints for unidentified streams
-K - do not display known signatures (implies -U)
-r - resolve host names (not recommended)
-q - be quiet - no banner
-v - enable support for 802.1Q VLAN frames
-p - switch card to promiscuous mode
-d - daemon mode (fork into background)
-t - add timestamps to every entry
-l - output concise 1-line output

'Filter rule' is an optional pcap-style BPF expression (man tcpdump).

To automatically generate signatures for certain traffics, I decided to run the commands below -

shell>./fl0p -i sk0 -o /nsm/fl0p-logs/smtp-gather -t -l -U -d 'port 25'

shell>./fl0p -i sk0 -o /nsm/fl0p-logs/http-gather -t -l -U -d 'port 80'

shell>./fl0p -i sk0 -o /nsm/fl0p-logs/ssh-gather -t -l -U -d 'port 22'

I'm currently having a lot of signatures collected but having no time to examine about them yet, guess I need some spare time for that.

Argus: Development Testing

I think many of you have heard about argus from my previous blog post. Here's how I maintained my argus installation in my testing environment on FreeBSD platform.

Installing argus server -

shell>wget ftp://qosient.com/dev/argus-3.0/argus-3.0.0.tar.gz

shell>tar xvzf argus-3.0.0.tar.gz

shell>cd argus-3.0.0

shell>./configure --prefix=/usr/local/stow/argus3

shell>make && make install

shell>mv /usr/local/stow/argus3/bin/argusbug /usr/local/stow/argus3/

Installing argus client -

shell>wget ftp://qosient.com/dev/argus-3.0/argus-clients-3.0.0.rc.45.tar.gz

shell>tar xvzf argus-clients-3.0.0.rc.45.tar.gz

shell>cd argus-clients-3.0.0.rc.45

shell>./configure --prefix=/usr/local/stow/argusc-3rc45

shell>make && make install

I have mentioned about the usage of stow previously, you can easily handle source installation with it.

shell>cd /usr/local/stow

shell>stow argus3

shell>stow argusc-3rc45

If there's new version of argus released, you can just unstow and remove all the argus file from /usr/local/stow, then install the new version using the same steps above and you are done. If you want to try out argus 3, just download HeXtra here and load it to HeX liveCD will do.

I'm reading .....

Phrack is alive -

http://www.phrack.org/issues.html?issue=64

Faster PF implementation -

http://www.openbsd.org/papers/cuug2007/

RFC - Real Time Streaming Protocol

http://www.ietf.org/rfc/rfc2326.txt

Fast Flux Service Network

http://www.honeynet.org/papers/ff/index.html

Network Forensics

Link 1

Link 2

I plan to relearn DNS protocol because I found it interesting and may pick up RFC and reread again if I have time. Anyway I'm still reading .....

Enjoy ;]

What is reality?

I have heard many people told me that they have Firewall and IPS in place therefore they don't need monitoring, but can't you think logically what is reality? The simple fact -

Humans > System created by Humans

So you want to argue again, or you are actually humiliating yourself! And if you ask me what's the best IDS again, I will beat your ass and say -

Humans

Don't get mad, this is reality .....

Peace (;])

Network Based Forensics?

Talking about Network Based Forensics, are you going to perform batch analysis on each files that you obtain via network data through network forensics mechanism?

Even if you able to examine each file transfers over network, can you really dig into the details of every single code? Remember malicious contents can be hidden inside picture file(stenography), simple backdoor can be injected into the normal application and so forth, and how do you able to examine every single binaries?

Do you have enough resources to perform this kind of operation?

How do you examine encrypted connections, any trail?

Therefore it still falls back to the NSM concept. I have seen expensive commercial system that can extract all the files and categorize them reliably, however I swear I don't want to examine those files one by one, it's too costly and exhaustive. I do agree those data can be stored as historical purpose but doing data mining on them requires better mechanism, and if you know Network Security Monitoring well, I think you will get what I mean as better mechanism.

NSM allows you to research on different area if you ask me, you can study on Network Statistical Analysis, Network Flow analysis, IDS log analysis or even data mining on raw network data(usually pcap). So you say you want to learn Network Based Forensics, then you should again rethink about NSM!!!!!

In fact, we don't need IDS analyzt but NSM analyzt.

Cheers ;]

KDE Applications List

I have been using a lot of KDE based(QT) applications while I'm still using Fluxbox as my window manager. I find them pretty stable and works out of the box and here's the list -

- Koffice

- Kivio

- Ktorrent

- Kopete

- Amarok

I don't know what else is good but they all work pretty well. If you have any QT based application that you think is great, just share it with me. Thanks!

Enjoy ;]

HeX liveCD: Using tshark

We have included Wireshark in our liveCD, therefore it is pretty straight forward if you want to generate network statistic using wireshark command line tool - tshark(or previously called tethereal), just checkout the screenshot below -

There you will have protocol hierarchy displayed, or you can also use tcpdstat as well to compliment the output.

Cheers ;]

Smart NTFS-3G

Again I need to use my large disk and I try to mount it once I have connected it, but this time it has minor issue -

shell>sudo ntfs-3g /dev/sdb1 ~/i-Mnt
$LogFile indicates unclean shutdown (0, 1)
Failed to mount '/dev/sdb1': Operation not supported
Mount is denied because NTFS is marked to be in use. Choose one action:

Choice 1: If you have Windows then disconnect the external devices by clicking on the 'Safely Remove Hardware' icon in the Windows taskbar then shutdown Windows cleanly.

Choice 2: If you don't have Windows then you can use the 'force' option for your own responsibility. For example type on the command line:

mount -t ntfs-3g /dev/sdb1 /home/geek00l/i-Mnt -o force

Or add the option to the relevant row in the /etc/fstab file:

/dev/sdb1 /home/geek00l/i-Mnt ntfs-3g defaults,force 0 0

Smart enough, remind me that I have just passed the disk to my friend and he has actually disconnected the disk uncleanly. Therefore I just need to follow the hint given -

shell>sudo mount -t ntfs-3g /dev/sdb1 ~/i-Mnt -o force
$LogFile indicates unclean shutdown (0, 1)
WARNING: Forced mount, reset $LogFile.
shell>cd ~/i-Mnt shell>ls -la
total 20
drwxrwxrwx 1 root root 4096 Jun 11 15:16 .
drwxr-xr-x 86 geek00l geek00l 12288 Jun 11 16:07 ..
drwxrwxrwx 1 root root 4096 Jun 11 15:40 System Volume Information

It's all working now!

Enjoy ;]

OpenBSD: Wireshark Port

Thanks to Nikns again for sending me this information and I think it would be great to share with everyone especially OpenBSD users who need Wireshark for life.

In 5th of July, new wireshark version 0.99.6 is released. Many of us, who uses OpenBSD has need to use wireshark. However, ethereal (now wireshark), has been removed from OpenBSD ports tree long ago due to the bad security record where many vulnerabilities have been discovered in dissectors code.

Nikns has created unofficial OpenBSD port for Wireshark where you can find here -

http://secure.lv/~nikns/stuff/ports/wireshark-0.99.6_4.1.tar

Some of details about the port -

From pkg/DESCR:
SECURITY MEASURES:

If run with root privileges, wireshark, tshark and dumpcap will drop privileges to unprivileged user "_wireshark" after opening live capture device or dump file.

So, like OpenBSD's tcpdump written previously here...

http://geek00l.blogspot.com/2007/04/tcpdump-privilege-dropping-passive-os.html

If run as root it drops privileges after opening capture device or dump file. This is why it is recommended to start it as root first. The disadvantage for this privilege dropping is that once privileges are dropped wireshark must be restarted to start now capture...

For me I think it's great to have Wireshark on OpenBSD not for the purpose of network sniffing/logging instead of using it for network analysis, therefore thanks to Nikns putting the effort in maintaining the unofficial port himself.

Enjoy ;]