4REN6 VM WalkThrough Guide

As promised in previous post, hereby I release the 4REN6 VM WalkThrough Guide, you can find how to install comprehensive list of forensics tools on Ubuntu 10.04, here's the link for the guide -

http://www.scribd.com/doc/35816772/4REN6-VM-Builder-Guide

Currently you need an account to download it but no problem for quick read, I will upload this guide to my own server later so that you can download it freely(both pdf and odt format in case you want to edit). Maybe wiki is good way to go for documentation collaboration but right now I don't have any plan about it yet.

Feel free to comment and appreciate any valuable inputs! By the way I'm still looking for anyone who is willing to host the 4REN6 VM image.

Cheers (;])

Home For 4REN6 VM

Yes I'm still working in IT industry and I'm not dead yet, right now I'm working on both tech and non-tech stuffs so this first paragraph is just ice breaking for me to say something.

I have Virtual Machine Image I have prepared for Digital Forensics Training, and I would like to release it, it has the name - 4REN6 but it doesn't has a home now, the size of the VM is 2.6G so if any of you is interested to host the image, please do contact me via

geek00l[at]gmail[dot]com

Please make sure you send to my email correctly as geek zero zero L and not o o L as there are couple of people tried to send me email but fail to do so, I'm sorry about that but I can do nothing about it.

Don't ask me why I'm doing this while there are similar stuffs such as SIFT, Helix, PlainSight or some I may not know, the main reason being I just want to have exercise and to confirm all the stuffs I work on really working, bear in mind I'm doing this alone so please don't shout at me if it breaks. On the other hand, I will release the documentation of how to install everything you need to make forensic desktop using Ubuntu since I have already taken all the notes during the making of this VM and it's just matter of putting them together.

Some sneak peaks -




By the way the wallpaper is designed by myself so it is not really a slick wallpaper we used to have in HeX.

Last but not least, I would like to thank to my blog readers who have encouraged me to continue my blog again, and some other friends along the line. I think this is right thing to do.

Cheers (;])

Ubuntu: Unicornscan Revisit

I have written about how to install unicornscan on Ubuntu previously here, and it seems a lot of people have problem getting unicornscan compiled on Ubuntu/Debian. So here's the revisit of mine to make it more clear and it should work on Ubuntu 8.x if you are following the steps accordingly.

Install all dependencies -

shell>apt-get install \
libpcap0.8-dev libgeoip-dev libltdl3-dev ibdumbnet1 libdumbnet-dev

shell>sudo ln -s /usr/include/dumbnet.h /usr/include/dnet.h

Download unicornscan and decompress it -

shell>tar xvjf unicornscan-0.4.7-2.tar.bz2

shell>cd unicornscan-0.4.7

shell>./configure --prefix=/usr/local/stow/unicornscan-0.4.7

Thanks to Debian package, since libdumbnet is used, so we need to replace the linker flags, search for files with ldnet

shell>find ./ -type f -exec grep -H 'ldnet' '{}' \;
./src/Makefile.in:G_LDADD=$(LDFLAGS) -lscan -lparse -lunilib -lpcap -lltdl -ldnet -luext
./src/tools/Makefile.in: $(LIBTOOL) --mode=link $(CC) $(CFLAGS) -o fantaip fantaip.lo $(G_LDPATH) $(G_LDADD) -lpcap -ldnet
./src/tools/Makefile: $(LIBTOOL) --mode=link $(CC) $(CFLAGS) -o fantaip fantaip.lo $(G_LDPATH) $(G_LDADD) -lpcap -ldnet
./src/Makefile:G_LDADD=$(LDFLAGS) -lscan -lparse -lunilib -lpcap -lltdl -ldnet -luext
./src/scan_progs/Makefile.in:G_LDADD=-lscan -lparse -lunilib -lltdl -ldnet -luext
./src/scan_progs/Makefile:G_LDADD=-lscan -lparse -lunilib -lltdl -ldnet -luext

To replace ldnet to ldumbnet at one shot, do

shell>for i in `find ./ -type f -exec grep -l 'ldnet' '{}' \;`; do sed -i bak -e 's/ldnet/ldumbnet/g' $i; done

Now we can compile and install

shell>make

shell>sudo make install

You should now have it install in /usr/local/stow, just do

shell>cd /usr/local/stow

shell>sudo stow unicornscan-0.4.7

DONE!

Enjoy (;])

Expanding Response: Deeper Analysis

My friend Russ McRee just published a paper called Expanding Response: Deeper Analysis for Incident Handlers with SANS for his GCIH Gold cert that includes details on Argus, HeX, NSM-console, and NetworkMiner using content from the original ISSA articles as well as current updates.

You can find his paper here -

http://www.sans.org/reading_room/whitepapers/incident/32904.php

Nice work Russ!

Cheers ;]

Govware: Positive Security?

Few months ago, Dhillon(HITB Founder) told us about Govware which is organized by Ministry Of Home Affairs Singapore and they invited us to their conference.

So HITB is invited to Singapore Govware, and we were quite looking forward to this event as we are told Singapore is first world country and they are great in event organizing. Unfortunately this time, we are going down to Singapore with our own budget(Other events' organizers pay our accomodation for our effort) but we thought since it's just our neighbor country, lets pay on our own.

So we are being supportive to run Web Hacking Challenge for Govware as well(Rufio handles this), me and Mel are also invited to give talk in closed door - Law Enforcement Track to share our knowledge with the audience. In the first day of event, everything goes smoothly. Me and mel are presenting 8 Layers Of Security and performing Network Forensics using HeX 2.0 that we have just released few days ago. We are glad to know some of people who are working in law enforcement units.

So I don't want to comment much about other presentations since I don't really listen to them as we are not allowed to, but we still managed to listen to 3 talks which are also closed door since their people never block us. But then again, we were banned from the room after their clueless dudes figure out we were in the talk, they should have blocked us from going in instead of asking us out in the middle of the presentation.

So nothing much happening in the first day of event except this shit, we went back to apartment and grabbed our dinner.

So today(second day of Govware) we went to the venue, and we just started running Web Hacking Challenge, as usual all of us are wearing HITB t-shirt to present who we are. Then out of sudden, there's some "don't know who"(probably fear to lose(kiasu) organizer) came to us, and informed us that we are not allowed to deliver our HITB conference fliers, we can't promote our HITB Conference in overt style(I don't get this, we just deliver our flier for whoever passes by our booth like everybody else instead of doing it aggresively) and we are also prohibited to wear our own HITB t-shirt as well(but we see others can wear their own company t-shirt(hint: Splunk) and they are not abused.

So what should we do now after coming down all the way from Kuala Lumpur to this Govware Singapore? Absolutely nothing but get out of this crap place. And Govware is promoting Positive Security but can't even allow us to inform the audience about another security conference with world class security experts in neighbor country(to be honest our conference are totally different than Govware as we are emphasizing more on new attack mechanisms and more technical oriented).

So to conclude this, we are now enlightened of how thisso called "First World Country" Ministry people manages international event, with unfair treatment where other companies can do their "not so overt" marketing(because they are sponsors?), they can wear their own company t-shirt, but we are asked to fuck off!

So this is definitely great job from them, and thanks for the awful invitation, you can fuck off now. Kudos!

So Enjoyable ;]

HeX 021: Decode base64

There are a lot of malicious contents which are actually encoded with base64 to create confusion.

This is just quick one as I have friend asking about it on how to decode base64 encoding. One liner with python -

shell>python -c "import binascii; \
binascii.a2b_base64('encoded strings here')

Or you can use nsm console if you are running HeX -

nsm>decode base64 'encoded strings here'

Enjoy ;]

HeX 021: Resolving Ihack 2008 password.pcap

My friend ayoi has posted Ihack 2008: Defense Challenge here, I don't really have time to look into the whole game. However I have tried to give it a shot for password.pcap to figure out what's the passphrase.

I decide to use HeX liveCD for this quick challenge since chfl4gs_ has presented it in IHack. Initial look at the traffic -

shell>tcpdump -ttttnnr password.pcap

reading from file /home/analyzt/rp-Analysis/password.pcap, link-type EN10MB (Ethernet)
2008-08-14 12:21:11.469308 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 1879048192:1879048192(0) win 512
2008-08-14 12:21:11.469524 IP 10.10.75.1.31337 > 10.10.3.126.1337: R 0:0(0) ack 1879048193 win 0
2008-08-14 12:21:12.212445 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 872415232:872415232(0) win 512
2008-08-14 12:21:12.212549 IP 10.10.75.1.31337 > 10.10.3.126.1337: R 0:0(0) ack 3288334337 win 0
2008-08-14 12:21:12.959563 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 603979776:603979776(0) win 512
2008-08-14 12:21:12.959710 IP 10.10.75.1.31337 > 10.10.3.126.1337: R 0:0(0) ack 3019898881 win 0
2008-08-14 12:21:13.656942 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 889192448:889192448(0) win 512

Output truncated .....

Initial view of the network traffic tells you that the network traffic contains no data transfer, and it is heavily crafted(port). It also hints you that the passphrase should be residing in the packet header. Therefore I start dig into the header by printing it in hex and ascii dump output.

shell>tcpdump -XXttttnnr password.pcap
2008-08-14 12:21:11.469308 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 1879048192:
1879048192(0) win 512
0x0000: 000c 294b dcf1 000c 2945 914a 0800 4500 ..)K....)E.J..E.
0x0010: 0028 5c00 0000 4006 bc3d 0a0a 037e 0a0a .(\...@..=...~..
0x0020: 4b01 0539 7a69 7000 0000 0000 0000 5002 K..9zip.......P.
0x0030: 0200 5bad 0000 ..[...
2008-08-14 12:21:11.469524 IP 10.10.75.1.31337 > 10.10.3.126.1337: R 0:0(0) ack
1879048193 win 0
0x0000: 000c 2945 914a 000c 294b dcf1 0800 4500 ..)E.J..)K....E.
0x0010: 0028 0000 4000 4006 d83d 0a0a 4b01 0a0a .(..@.@..=..K...
0x0020: 037e 7a69 0539 0000 0000 7000 0001 5014 .~zi.9....p...P.
0x0030: 0000 5d9a 0000 ..]...
2008-08-14 12:21:12.212445 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 872415232:8
72415232(0) win 512
0x0000: 000c 294b dcf1 000c 2945 914a 0800 4500 ..)K....)E.J..E.
0x0010: 0028 2000 0000 4006 f83d 0a0a 037e 0a0a .(....@..=...~..
0x0020: 4b01 0539 7a69 3400 0000 0000 0000 5002 K..9zi4.......P.
0x0030: 0200 97ad 0000 ......
2008-08-14 12:21:12.212549 IP 10.10.75.1.31337 > 10.10.3.126.1337: R 0:0(0) ack
3288334337 win 0
0x0000: 000c 2945 914a 000c 294b dcf1 0800 4500 ..)E.J..)K....E.
0x0010: 0028 0000 4000 4006 d83d 0a0a 4b01 0a0a .(..@.@..=..K...
0x0020: 037e 7a69 0539 0000 0000 3400 0001 5014 .~zi.9....4...P.
0x0030: 0000 999a 0000 ......

Output truncated .....

When comes to examing the packet header, it's best to look at the pattern, and realizing that some fields are usually static in this case helps you to identify the different, if we look at the 4 packets above, you may spot

10.10.3.126 -> 10.10.75.1 - tcp sequence number
10.10.75.1 -> 10.10.3.126 - tcp acknowledge number(tcp sequence number + 1)

So to get the answer, you can just print the connection from one side(from 10.10.3.126 to 10.10.75.1) -

shell>tcpdump -XXttttnnr password.pcap ip src 10.10.3.126
2008-08-14 12:21:11.469308 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 1879048192:
1879048192(0) win 512
0x0000: 000c 294b dcf1 000c 2945 914a 0800 4500 ..)K....)E.J..E.
0x0010: 0028 5c00 0000 4006 bc3d 0a0a 037e 0a0a .(\...@..=...~..
0x0020: 4b01 0539 7a69 7000 0000 0000 0000 5002 K..9zip.......P.
0x0030: 0200 5bad 0000 ..[...
2008-08-14 12:21:12.212445 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 872415232:8
72415232(0) win 512
0x0000: 000c 294b dcf1 000c 2945 914a 0800 4500 ..)K....)E.J..E.
0x0010: 0028 2000 0000 4006 f83d 0a0a 037e 0a0a .(....@..=...~..
0x0020: 4b01 0539 7a69 3400 0000 0000 0000 5002 K..9zi4.......P.
0x0030: 0200 97ad 0000 ......
2008-08-14 12:21:12.959563 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 603979776:6
03979776(0) win 512
0x0000: 000c 294b dcf1 000c 2945 914a 0800 4500 ..)K....)E.J..E.
0x0010: 0028 6200 0000 4006 b63d 0a0a 037e 0a0a .(b...@..=...~..
0x0020: 4b01 0539 7a69 2400 0000 0000 0000 5002 K..9zi$.......P.
0x0030: 0200 a7ad 0000 ......
2008-08-14 12:21:13.656942 IP 10.10.3.126.1337 > 10.10.75.1.31337: S 889192448:8
89192448(0) win 512
0x0000: 000c 294b dcf1 000c 2945 914a 0800 4500 ..)K....)E.J..E.
0x0010: 0028 8d00 0000 4006 8b3d 0a0a 037e 0a0a .(....@..=...~..
0x0020: 4b01 0539 7a69 3500 0000 0000 0000 5002 K..9zi5.......P.
0x0030: 0200 96ad 0000 ......

Output truncated .....

If you want to see another side of the traffic, just tune the bpf filter to ip src 10.10.75.1, however for that you will need to look at the acknowledge number. You should have the answer now.

Anyway when comes to print certain field in the header, you can use tshark(part of wireshark), and force it to print certain field, for example -

shell>tshark -Tfields -e 'tcp.seq' -nr password.pcap -o tcp.relative_sequence_numbers:FALSE -R 'ip.src == 10.10.3.126'
1879048192
872415232
603979776
889192448
1996488704
805306368
1912602624
1677721600
536870912
822083584
889192448
536870912
822083584
838860800
855638016
167772160

That's your answer in decimal, you can convert the number to hex and from hex to ascii. Using pythong quickies -

Decimal to Hex -
shell>python -c 'print hex()'

HeX to Ascii
shell>python -c 'import binascii; print binascii.a2b_hex("")'

You should have the passphrase to unrar Questions.rar

shell>unrar e Questions.rar

Bump in the passphrase and you will be able to retrieve all the files you need.

During the challenge event, I don't see any participants use HeX for this purpose. And lot of them just use wireshark to examine, my opinion is using wireshark is not effective in this scenario as wireshark is great when you want to do per packet examination or dealing with network protocols you are not familiar with. However for this, I would say tcpdump and tshark are more effective tools to obtain the clue.

Enjoy (;])

FreeBSD: Bpfstat is in Netstat

My friend Richard(Taosecurity) has blogged about bpfstat here, and for now bpfstat is already ported as part of netstat in FreeBSD 7. You can run the netstat with -B option -

shell>netstat -B -I le0

Pid Netif Flags Recv Drop Match Sblen Hblen Command
820 le0 p--s--- 989344 0 958346 0 0 bro
761 le0 p--s--- 989444 0 989444 216 0 argus
754 le0 p--s--- 410 0 410 1392 0 ourmon
330 le0 -ifs--l 989458 0 440 0 0 dhclient

As you can see it is very useful when comes to monitor the libpcap based tools, however there's one feature I miss during the time I use bpfstat which is -i(interval of wait second to report). To simulate similar function, I have found a simple way by using infinite loops -

shell>z=1; while [ $z -eq 1 ]; do netstat -B -I le0; sleep 3; done

This way it will report every 3 seconds(sleep 3), and if you just want to monitor particular tools, use grep will do.

Cheers ;]

HeX 2.0 RC1 is now

After long time development, we have finally reached the stage where we are brave enough to release version 2 of HeX, Release Candidate 1. This is the first public version for HeX 2.0 and we hope that by releasing this, people who are interested in it can help testing out this version. I won't be mentioning the new features that we are adding to HeX 2 here as I will put up all the information once we reach the 2.0 Release instead of RC. For the moment, we need people to test all the applications that we have added, a lot of them can be accessed via fluxbox menu so please help in testing.

Currently there are few known problems -

- Netdude is broken
- Autopsy is broken(sleuthkit issue)
- Gvim is broken(font not available)
- Flowtag is broken(Looking for older version of tk while new one is installed)
- NSM Console(Snort module where wrong path is defined in snort configuration file)
- Silktools(Flowcap and Rwflowpack)
- Ragraph is broken
- Zsh is missing

Most of the issues are already fixed in the development repository, therefore don't report to us if you encounter similar problem in HeX 2.0 RC1. If you encounter any other issues, please do report to us via mailing list -

http://groups.google.com/group/HeX-liveCD

Anyway here's the HeX 2.0 RC1 iso -

http://my.rawpacket.org/hex-i386-2.0-RC1-20080803.iso
http://my.rawpacket.org/hex-i386-2.0-RC1-20080803.iso.md5
http://my.rawpacket.org/hex-i386-2.0-RC1-20080803.iso.sha256

Alternatively, you can download from US mirror -

http://us.rawpacket.org/image/hex-i386-2.0-RC1-20080803.iso

Thanks to all the raWPacket members who have put the effort in HeX 2.0 development, you guys are walys rocking!

Enjoy (;])

Ubuntu: Netdude Manual Installation

I use netdude for pcap file editing, it's simple and straightforward since it is gui based, however the ubuntu package is rather old(0.3.x) and I need to use the latest version, here's quick way to get the latest version of netdude installed on Ubuntu 8.04.

Download the latest version of netdude, libpcapnav and libnetdude from here -

http://netdude.sourceforge.net/download.html

Then install all the necessary packages -

shell>sudo apt-get install stow

shell>sudo apt-get install build-essential

shell>sudo apt-get install libgtk1.2-dev

shell>sudo apt-get install libpcap0.7-dev

Decompress netdude, libpcapnav and libnetdude, and install them following the sequence - libpcapnav, libnetdude and netdude. It should be prety quick to get it done.

Enjoy ;]

EmergingBro: HowTo

First of all, make sure you have Bro installed on your machine, or you can download it at http://bro-ids.org. If you are using HeX, Bro is installed by default. Once installed, you may find the directory structure of Bro looks like this -

shell>ls -la

total 34
drwxr-xr-x 15 analyzt wheel 512 Jul 10 17:36 ./
drwxr-xr-x 3 root wheel 512 Jul 10 07:51 ../
drwxr-xr-x 2 analyzt wheel 512 Jul 10 07:51 archive/
drwxr-xr-x 2 analyzt wheel 512 Jul 10 17:35 bin/
drwxr-xr-x 2 analyzt wheel 512 Jul 10 17:39 etc/
drwxr-xr-x 2 analyzt wheel 512 Jul 10 17:35 include/
drwxr-xr-x 2 analyzt wheel 512 Jul 10 17:35 lib/
drwxr-xr-x 3 analyzt wheel 1024 Jul 10 18:01 logs/
drwxr-xr-x 3 analyzt wheel 512 Jul 10 17:36 perl/
drwxr-xr-x 3 analyzt wheel 5120 Jul 10 17:59 policy/
drwxr-xr-x 2 analyzt wheel 512 Jul 10 07:51 reports/
drwxr-xr-x 2 analyzt wheel 512 Jul 10 17:36 scripts/
drwxr-xr-x 4 analyzt wheel 512 Jul 10 07:51 share/
drwxr-xr-x 2 analyzt wheel 512 Jul 11 22:50 site/
drwxr-xr-x 2 analyzt wheel 512 Jul 10 07:51 var/

Please take note on few important directories -

policy directory contains all the policy and analysis scripts with the file extension .bro.

site directory contains site policy files which you can define or configure for specific site.

logs directory contains all the log files that are generated by bro.

etc directory contains bro configuration files, for start up and bro environment variable settings.

Obtain the latest signatures from Emerging Bro -

shell>cvs -d:pserver:anonymous@cvs.emergingthreats.net:/cvsroot/bro co emerging-bro

shell>cd emerging-bro

shell>ls -l

total 14
drwxr-xr-x 7 analyzt wheel 512 Jul 10 07:58 ./
drwxr-xr-x 4 analyzt wheel 512 Jul 10 07:55 ../
drwxr-xr-x 2 analyzt wheel 512 Jul 10 11:23 CVS/
drwxr-xr-x 3 analyzt wheel 512 Jul 10 07:58 CVSROOT/
drwxr-xr-x 3 analyzt wheel 1024 Jul 10 18:24 rules/
drwxr-xr-x 4 analyzt wheel 512 Jul 10 18:28 scripts/
drwxr-xr-x 17 analyzt wheel 512 Jul 10 11:23 sigs/

sigs directory contains all the individual signature in different category

rules directory contains main signature file for each category. For example emerging-bro-malware.sig contains all the signatures for MALWARE category.

scripts directory contains all the policy and analysis scripts that are contributed by the community members.

To perform quick test, you can use invoke the signature file using command line option -

Set Bro environment variables -

shell>. bro.cfg

Execute Bro -

shell>bro -s emerging-bro-all.sig -r whatever.pcap `hostname`

If you plan to run it in long term, it's best to edit the file generated during make install-brolite. The file name starts with your hostname, for example it is raWPacket.bro in HeX liveCD since my hostname is raWPacket. Just edit the following section in the file -

-----------------------------------------------------------------------
# To run signatures, uncomment the following line.
# @load brolite-sigs

@ifdef ( use_signatures )
# Load Bro signatures. This is the default file containing Bro
# signatures.
redef signature_files += "signatures";
@endif
-----------------------------------------------------------------------

To this -

@load brolite-sigs

redef signature_files += "emerging-bro-all.sig"

Please do note that other policy scripts must be loaded in order to have signatures invoked properly especially brolite.bro.

Enjoy ;]

DefCraft: Official Launching

After long consideration, I decide to start a company that focuses on security research, development and consultancy. The company name is straightforward - Defensive Craft (DefCraft).

The company offers a wide range of consulting services for specific domains, here's the list -

• Network and Web Application Security Assessment
• Network Security Architecture Planning & Deployment
• Network Security Monitoring Implementation
• Network Security Architecture Auditing
  
• Network Device Testing & Evaluation
• Network Based Forensics
• Network Profiling Operation
• Incident Response & Handling
• Digital Security Training

If you have any inquiry, please feel free to contact me.

Contact Number: 016 415 9873
Contact Email: defcraft at gmail dot com

For more information, you can check out at -

http://www.defcraft.net

The company has its own blog too which we will blog about what we do behind the lab -

http://blog.defcraft.net

On the other hand, I will still contribute my free time to various open source projects that I'm working on since this is part of company principle I'm emphasizing.

Emerging Bro

I'm sured not many have heard of Bro comparing to Snort in NIDS arsenal, while both are actually applying different approach in intrusion detection, they are the Open Source NIDS I like to use to complement each others in different setup and deployment.

I'm now working closely with Matt Jonkman from EmergingThreats(ET) to start the new project calls Emerging-Bro, basically the project is about converting set of latest signatures from Snort to Bro so that Bro operators can take advantage of it. You can find more information from the announcement here -

http://www.emergingthreats.net/content/view/80/1/

If you are Bro operators, you might have question of why I'm doing this as Bro is more focused on policy and analysis script development to detect network event(be it normal or abnormal) instead of relying on signatures matching in byte stream. There are reasons why I'm doing this and I'm going to explain here -

Edge
Emerging-Bro will only focus on latest or critical signatures from ET, therefore the project is basically more concerning about latest/critical attacks because most networks are more vulnerable to newly discovered attacks than the old one, therefore detecting and preventing them at network boundary is much important. Currently there are about 100 latest signatures converted from ET to Emerging-Bro, and if you think certain Snort signature should be included, please do let me know.

Leverage
The signature set that is developed by EmergingThreats usually give little time window for attacker and reduce the outbreak period significantly, hence you can pretty quick in detecting initial stage of new attacks. Bro operators can take advantage of this if they can monitor the new attack in time and quickly develope more complete detection scheme with Bro policy scripts.

Requests
Yes, according to Matt, there are requests about it, on and off there are people in Bro mailing list asking about the availability of Bro signatures, so why not doing it to help the community?

I think these gives enough reasons for me to work on the project. But providing latest signatures is not the end of Emerging-Bro, I greatly appreciate the help from Seth Hall to step up and discuss with me about the direction of the project and we both agree that it should be the platform for people to share or contribute their policy/analysis scripts as well. Currently he has his own development repository here and I will import them to Emerging-Bro.

For the moment, you can access and download all the signatures at -

http://www.emergingthreats.net/bro/

Enough for now, and this project is also part of the reason why I'm not much blogging last two weeks as I have paid my free time to it. I would like to thank Matt and Seth for the collaboration works, and also Bro developers for their endorsement!

Cheers (;])

Davix: Review

From Davix's main site -

DAVIX, a live CD for data analysis and visualization, brings the most important free tools for data processing and visualization to your desk. There's no hassle with installing an operating system or struggle to build the necessary tools to get started with visualization. You can completely dedicate your time to data analysis.

The clause above is definitely right above Davix liveCD!!!!!

When people ask me which liveCD I use frequently, I always advocate these 3 -

1. HeX liveCD (Network Based Forensics)
2. BackTrack liveCD (Penetration Testing)
3. Helix liveCD (Digital Forensics)

I have mentioned many times that I prefer liveCD which focuses on specific domain very well, and Davix is really one of those. Undoubtedly I would love to include Davix to my CD folder.

Before I start anything serious, lets view the screenshot after startup from the liveCD -

It's based on SLAX, and I guess most of people know how good SLAX is after trying out BackTrack, DAVIX takes advantage of SLAX modularity, stability and hardware supports, I have tested it with my own hardwares and it works pretty well.

If you are familiar with linux desktop solution, you will definitely recognize that it is using KDE from the screenshot. Though I'm not fan of KDE, but KDE is always simple and easy to use for general users. Many of system configuration can be done via gui so it saves a lot of hassle figuring how to get the system working for you.

On top of that, DAVIX offers very informative resources for users to have great kickstart in learning data capturing, processing and visualization by providing a set of firefox bookmark toolbars, you can easily access all the information requires to study the topic, this can reduce time in studying certain tools and learning visualization techniques, and it also saves you from googling hassle. I like the idea of toolbars organization in firefox.

On the other hand, DAVIX also comes with its own manual which is about 108 pages, you can access it via KDE menu -> DAVIX -> DAVIX Manual. If you are serious about learning data visualization with DAVIX, I suggest you to start with its manual instead of playing around with the desktop without knowing what to do. It contains the basic guide of how to use all the tools that are delivered in DAVIX, the best part is you can follow the manual and learn it practically with all the tools available in DAVIX.

There are 3 main categories listed in Kde menu, they are Capture, Process, and Visualize. The Capture contains tools for you to perform data logging, especially network data. The Process contains tools to perform data processing so that the output of data processed can be parsed by visualization tools. The Visualize mainly contains all the tools for you to visualize the data set by generating different kind of images, diagrams or graphs. As I have mentioned you can just learn all the tools shipped by DAVIX with the comprehensive manual itself.

So what are the tools shipped with DAVIX, there are way too many that I can cover here, however here are my favourites -

1. Rumint
2. Tnv
3. Afterglow
4. Inetvis
5. Etherape
6. Gnuplot
7. Rrdtools
8. Mrtg
9. Wireshark

This is more to preference thingy as I have used those tools previously and familiar with them, I will need to explore the potential of other tools which I never use before. If you want to learn how those tools work, you can actually refer to the DAVIX manual, and then refer to the data set example which you can properly find in /usr/local/share/*, different tools may support different kind of data formats so that may require some learning curves. But the real question lies in what kind of visualization techniques should be applied to the data set you have so that it makes most sense.

After talking about all the good things, I still think there are few things worth improved.

1. Log sample
As this is the liveCD for data analysis and visualization, except that it has the example data set in /usr/local/share/*, it should provide a set of sample logs(apache, postfix, exim, proftpd and etc). Then demonstrating how to format them to feed those visualization tools will be great.

2. Fat taskbar
You may notice in the screenshot that the taskbar is quite big(double taskbar), this is nothing wrong, but if I have to offer a liveCD for visualization purpose, I would prefer to have everything slicker to give bigger space to display the images that I have generated from the data.

3. Unified keyboard shortcut
This is just my idea, when I work with images, I always like to zoom in and out. Zooming in allows you to focus on detail, zooming out on the other hand can improve macro view to understand the ratio or distribution of data. I do know different tools have always defined different keyboard shortcut layout. If zoom(in/out) uses same set of shortcut key settings across all the tools in DAVIX, that would be really great. I'm glad DAVIX offers gqview as the main application to display images as that's my favorite one with its ease of use interface.

4. Installer
Currently it comes with BackTrack Installer which is quite experimental, it needs some works to get it installed, I have tested the installer and it works fine(if you know what you are doing), I'm looking forward for easy installer in future.

By the way, one might ask why should I use DAVIX, simple enough. Take the old cliche "A Picture Is Worth A Thousand Words". Using correct visualization techniques to process your thousand lines log files, to be honest you can do more with less, it saves your times and brain power to focus on something more important.

Guess I should end my review about DAVIX here, in case you are interested to try out DAVIX -

DAVIX is also part of Raffael's upcoming book Applied Security Visualization which will be published by Addision Wesley.

Currently, DAVIX is only available to beta testers. To participate in testing, please contact jan.monsch at iplosion.com

Thanks to DAVIX development team for allowing me to participate in beta testing, later is better than never. I do know developing a liveCD require hard works if you want to build a solid one, kudos!

Update Note:
DAVIX developer Jan. P. Monsch has informed me that he has actually making the taskbar more slicker now in new version of Davix, thanks for taking positively on my input.

Enjoy (;])

Snort 3.0 Beta

If you are interested to check out what's offered by latest Snort, now you have it. Kudos to snort development team!!!!!

http://www.snort.org/dl/snortsp/

I haven't tried that out personally yet, but you should!

Enjoy ;]

Earthquake? or Storm .....

The terrible disaster .....

The beijing.exe is actually the storm variant, I thought they are making use of festivals only, it seems they don't even let any single chance going with the use of disaster(popularity counts), that's going too far from humanity.

If you run it, it's really disaster!

Peace :[

For Real?

It's year 2008 now, but .....

ZzZzzzz .....

Peace ;]

Good Read on Bro's Signature Engine

The ICIR blog is always informative, and I'm quite please with the latest post about Bro's Signature Engine.

I just learned few things that I don't know from the post, and it appears that Bro uses flex's regular expression syntax. It is important to understand which condition to use when writing the signature .

Otherwise, take the good read on Things To Keep In Mind When Writing Signatures, that section is particularly useful if you are interested to write Bro sigs.

Peace ;]

Forensics Tools

I have to do some forensics work, and the tools below are very handy -

http://www.afflib.org/

http://www.pyflag.net/cgi-bin/moin.cgi

http://ftimes.sourceforge.net/FTimes/

http://p2pmarshal.atc-nycorp.com/

Cheers ;]

M$: Server Hardening & Auditing

Don't laugh, sometimes you have to deal with this whether you like it or not.

I'm looking for tools to perform M$ Windows Server Hardening & Auditing, I know Microsoft Baseline Security Analyzer and IIS Lockdown but are there other tools you use to assist you in Hardening & Auditing operation such as hardening regedit keys, auditing Active Directory and so forth.

If your job is managing M$ Server Farm, how do you perform your task to make sure all servers have same set of configuration and policy, and they are all monitored properly?

I would like to hear from you, and recommend me good tools and methods of doing these. There's no real secure OS, there's only capable or bullshit sysadmin!

Wake up sysadmin, system security is part of your job .....

Enjoy ;]