Controls Are Not the Solution to Our Problem

If you recognize the inspiration for this post title and graphic, you'll understand my ultimate goal. If not, let me start by saying this post is an expansion of ideas presented in a previous post with the succinct and catchy title Control-Compliant vs Field-Assessed Security.

In brief, too many organizations, regulators, and government agencies waste precious time and resources devising and auditing "controls," regardless of the effect these controls have or do not have on security. They are far too input-centric; they should become more output-aware. They obsess over recording conditions they believe may be helpful while remaining ignorant of the "score of the game." They practice management by belief and disregard management by fact.

Let me provide a few examples from one of the canonical texts used by the control-compliant crowd: NIST Special Publication 800-53: Recommended Security Controls for Federal Information Systems (.pdf). The following is an example of a control, taken from page 140.

SI-3 MALICIOUS CODE PROTECTION


The information system implements malicious code protection.

Control: Supplemental Guidance: The organization employs malicious code protection mechanisms at critical information system entry and exit points (e.g., firewalls, electronic mail servers, web servers, proxy servers, remote-access servers) and at workstations, servers, or mobile computing devices on the network. The organization uses the malicious code protection mechanisms to detect and eradicate malicious code (e.g., viruses, worms, Trojan horses, spyware) transported: (i) by electronic mail, electronic mail attachments, Internet accesses, removable media (e.g., USB devices, diskettes or compact disks), or other common means; or (ii) by exploiting information system vulnerabilities. The organization updates malicious code protection mechanisms (including the latest virus definitions) whenever new releases are available in accordance with organizational configuration management policy and procedures. The organization considers using malicious code protection software products from multiple vendors (e.g., using one vendor for boundary devices and servers and another vendor for workstations). The organization also considers the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system. NIST Special Publication 800-83 provides guidance on implementing malicious code protection.

Control Enhancements:
(1) The organization centrally manages malicious code protection mechanisms.
(2) The information system automatically updates malicious code protection mechanisms.

At first read one might reasonably respond by saying "What's wrong with that? This control advocates implementing anti-virus and related anti-malware software." Think more clearly about this issue and several problems appear.

• Adding anti-virus products can introduce additional vulnerabilities to systems which might not have exposed themselves without running anti-virus. Consider my post Example of Security Product Introducing Vulnerabilities if you need examples. In short, add anti-virus, be compromised.


• Achieving compliance may cost more than potential damage. How many times have you heard a Unix administrator complain that he/she has to purchase an anti-virus product for his/her Unix server simply to be compliant with a control like this? The potential for a Unix server (not Mac OS X) to be damaged by a user opening an email through a client while logged on to the server (a very popular exploitation vector on a Windows XP box) is practically nil.


• Does this actually work? This is the question that no one asks. Does it really matter if your system is running anti-virus software? Did you know that intruders (especially high-end ones most likely to selectively, steathily target the very .gov and .mil systems required to be compliant with this control) test their malware against a battery of anti-virus products to ensure their code wins? Are weekly updates superior to daily updates? Daily to hourly?

The purpose of this post is to tentatively propose an alternative approach. I called this "field-assessed" in contrast to "control-compliant." Some people prefer the term "results-based." Whatever you call it, the idea is to direct attention away from inputs and devote more energy to outputs. As far as mandating inputs (like every device must run anti-virus), I say that is a waste of time and resources.

I recommend taking measurements to determine your enterprise "score of the game," and use that information to decide what you need to do differently. I'm not suggesting abandoning efforts to prevent intrusions (i.e., "inputs.") Rather, don't think your security responsibilities end when the bottle is broken against the bow of the ship and it slides into the sea. You've got to keep watching to see if it sinks, if pirates attack, how the lifeboats handle rough seas, and so forth.

These are a few ideas.

1. Standard client build client-side survival test. Create multiple sacrificial systems with your standard build. Deploy a client-side testing solution on them, like a honeyclient. (See The Sting for a recent story.) Vary your defensive posture. Measure how long it takes for your standard build to be compromised by in-the-wild Web sites, spam, and other communications with the outside world.


2. Standard client build server-side survival test. Create multiple sacrificial systems with your standard build. Deploy them as a honeynet. Vary your defensive posture. Measure how long it takes for your standard build to be compromised by malicious external traffic from the outside world -- or better yet -- from your internal network.


3. Standard client build client-side penetration test. Create multiple sacrificial systems with your standard build. Conduct my recommendation penetration testing activities and time the result.


4. Standard client build server-side penetration test. Repeat number 3 with a server-side flavor.


5. Standard server build server-side penetration test. Repeat number 3 against your server build with a server-side flavor. I hope you don't have users operating servers as if they were clients (i.e., browsing the Web, reading email, and so forth.) If you do, repeat this step and do a client-side pen test too.


6. Deploy low-interactive honeynets and sinkhole routers in your internal network. These low-interaction systems provide a means to get some indications of what might be happening inside your network. If you think deploying these on the external network might reveal indications of targeted attacks, try that. (I doubt it will be that useful due to the overall attack noise, but who knows?)


7. Conduct automated, sampled client host integrity assessments. Select a statistically valid subset of your clients and check them using multiple automated tools (malware/rootkit/etc. checkers) for indications of compromise.


8. Conduct automated, sampled server host integrity assessments. Self-explanatory.


9. Conduct manual, sampled client host integrity assessments. These are deep-dives of individual systems. You can think of it as an incident response where you have not had indication of an incident yet. Remote IR tools can be helpful here. If you are really hard-core and you have the time, resources, and cooperation, do offline analysis of the hard drive.


10. Conduct manual, sampled server host integrity assessments. Self-explanatory.


11. Conduct automated, sampled network host activity assessments. I questioned adding this step here, since you should probably always be doing this. Sometimes it can be difficult to find the time to review the results, however automated the data collection. The idea is to let your NSM system see if any of the traffic it sees is out of the ordinary based on algorithms you provide.


12. Conduct manual, sampled network host activity assessments. This method is more likely to produce results. Here a skilled analyst performs deep individual analysis of traffic on a sample of machines (client and server, separately) to see if any indications of compromise appear.

In all of these cases, trend your measurements over time to see if you see improvements when you alter an input. I know some of you might complain that you can't expect to have consistent output when the threat landscape is constantly changing. I really don't care, and neither does your CEO or manager!

I offer two recommendations:

• Remember Andy Jaquith's criteria for good metrics, simplified here.




1. Measure consistently.


2. Make them cheap to measure. (Sorry Andy, my manual tests violate this!)


3. Use compound metrics.


4. Be actionable.




• Don't slip into thinking of inputs. Don't measure how many hosts are running anti-virus. We want to measure outputs. We are not proposing new controls.

Controls are not the solution to our problem. Controls are the problem. They divert too much time, resources, and attention from endeavors which do make a difference. If the indications I am receiving from readers and friends are true, the ideas in this post are gaining traction. Do you have other ideas?

Read More

Old School Oracle Auditing

I was again reading for hacking articles and one of the article "Simple Oracle Auditing" caught my attention. Well, its an old article but its still fun to read and learn from the gurus. Check it out guys: http://www.securityfocus.com/infocus/1689

The Hacka Man

Read More

MPAA University Toolkit Phone Home

This is a follow-up to my story Examining the MPAA University Toolkit.

After reading the hysteria posted on the Slashdot story MPAA College Toolkit Raises Privacy, Security Concerns, I thought I would take a look at traffic leaving the box. Aside from traffic generated by the auto-start of Firefox, the only interesting event was the following. I captured it with my gateway Sguil sensor.

Sensor Name: hacom
Timestamp: 2007-11-23 21:27:04
Connection ID: .hacom_5136150487897024842
Src IP:  69.255.105.234 (c-69-255-105-234.hsd1.va.comcast.net)
Dst IP:  66.252.137.155 (Unknown)
Src Port:  39532
Dst Port:  80
OS Fingerprint: 69.255.105.234:39532 - UNKNOWN
 [S4:61:1:60:M1460,S,T,N,W4:.:?:?] (up: 3 hrs) 
OS Fingerprint:   -> 66.252.137.155:80 (link: ethernet/modem)

SRC: GET /version.txt HTTP/1.1
SRC: Accept-Encoding: identity
SRC: Host: universitytoolkit.com
SRC: Connection: close
SRC: User-Agent: Python-urllib/2.5
SRC: 
SRC: 
DST: HTTP/1.1 200 OK
DST: Date: Fri, 23 Nov 2007 21:27:31 GMT
DST: Server: Apache/2.0.52 (Red Hat)
DST: Last-Modified: Fri, 12 Oct 2007 14:14:45 GMT
DST: ETag: "4f4002-7-57333f40"
DST: Accept-Ranges: bytes
DST: Content-Length: 7
DST: Connection: close
DST: Content-Type: text/plain; charset=UTF-8
DST: 
DST: 1.2-RC3

That's it.

Read More

Examining the MPAA University Toolkit

I learned about the MPAA University Toolkit at Brian Krebs' always-excellent SecurityFix blog. If you want to know more about the user experience, please check out that post. Here I take a look at the monitoring software, focusing on Snort, operating on this application.

I downloaded the 534 MB peerwatch-1.2-RC5.iso and started it in a VMware Server session. I used ctrl-c and then 'sudo bash' to exit from the initial script presented within X, set a root password, then used 'apt-get ssh install' to install OpenSSH and thus enable root access. From this point forward I accessed the system using OpenSSH remotely to facilitate copying information into this blog post.

First, this looks like Ubuntu (Xubuntu, if you really care) Feisty Fawn, or 7.04.

root@ubuntu:~# uname -a
Linux ubuntu 2.6.20-15-generic #2 SMP Sun Apr 15 07:36:31 UTC 2007
 i686 GNU/Linux

I was most interested in learning about Snort on this toolkit. I saw this version installed.

root@ubuntu:~# snort -V

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.3.3 (Build 14)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html
           (C) Copyright 1998-2004 Sourcefire Inc., et al.

Wow, that's old. It's probably patched base on the changelog. This is Snort installed via Debian/Ubuntu package:

root@ubuntu:~# dpkg --list | grep snort
rc  snort                                      2.3.3-9
                                Flexible Network Intrusion Detection System
ii  snort-common                               2.3.3-9
                                Flexible Network Intrusion Detection System 
ii  snort-mysql                                2.3.3-9
                                Flexible Network Intrusion Detection System 
ii  snort-rules-default                        2.3.3-9
                                Flexible Network Intrusion Detection System 

Let's see what the snort.conf looks like.

root@ubuntu:/etc/snort# cat snort.conf 
var HOME_NET any
var EXTERNAL_NET !$HOME_NET
var DNS_SERVERS $HOME_NET
var SMTP_SERVERS $HOME_NET
var HTTP_SERVERS $HOME_NET
var SQL_SERVERS $HOME_NET
var TELNET_SERVERS $HOME_NET
var SNMP_SERVERS $HOME_NET

var HTTP_PORTS 80

var RULE_PATH /etc/snort/rules

preprocessor flow: stats_interval 0 hash 2
preprocessor frag2
preprocessor stream4: disable_evasion_alerts detect_scans
preprocessor stream4_reassemble

# preprocessor perfmonitor: time 300 file /var/snort/snort.stats pktcnt 10000

# (#DBSTART#)
output database: log, mysql, user=snort password=snort dbname=snort host=localhost  
# (#DBEND#)

include classification.config
include reference.config

config flowbits_size: 256

include $RULE_PATH/bleeding-p2p.rules
include $RULE_PATH/local-ftp.rules
include $RULE_PATH/local-http.rules
include $RULE_PATH/local-smb.rules
include $RULE_PATH/p2p.rules

include threshold.conf

Excellent, another Snort installation where Snort is logging directly to a MySQL database. That must be the default provided by Debian/Ubuntu. Ouch. Thresholding and suppression are also enabled but the entire contents are commented out in the threshold.conf file.

Let's get a look at those rules.

bleeding-p2p.rules looks like an old copy of the bleeding-p2p.rules, perhaps from mid-year? I think there are 38 rules.

p2p.rules is a really old rule set:

# $Id: p2p.rules,v 1.17.2.1 2004/10/13 20:25:57 bmc Exp $

You may recognize these and the other Snort distributed-rules as being those that accompanied Snort 2.3.3, which pre-dates the new license for Snort rules.

local-ftp.rules is the first rule set written by whomever assembled this toolkit.

# cat local-ftp.rules 
# 1 000 500 - 1 000 699

# active
alert tcp any 20 -> any any  (msg: "FTP Download - MPEG Movie File - B2"; \
content: "|00 00 01 B2|"; depth: 6; rawbytes; \
sid: 1000501; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - MPEG Movie File - B3"; \
content: "|00 00 01 B3|"; depth: 6; rawbytes; \
sid: 1000502; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - MPEG Movie File - BA"; \
content: "|00 00 01 BA|"; depth: 6; rawbytes; \
sid: 1000503; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - MPEG Movie File - BB"; \
content: "|00 00 01 BB|"; depth: 6; rawbytes; \
sid: 1000504; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - MPEG-4 Video File"; \
content: "|00 00 00 18 66 74 79 70 6D 70 34|"; depth: 15; rawbytes; \
sid: 1000505; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - Quicktime Movie File - MOOV"; \
content: "|6D 6F 6F 76|"; depth: 10; rawbytes; \
sid: 1000506; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - Quicktime Movie File - MDAT"; \
content: "|6D 64 61 74|"; depth: 10; rawbytes; \
sid: 1000507; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - Audio Video Interleave (AVI) File - AVI"; \
content: "|41 56 49 20|"; depth: 6; rawbytes; \
sid: 1000508; rev: 1; \
)
                                    
alert tcp any 20 -> any any  (msg: "FTP Download - Audio Video Interleave (AVI) File - RIFF"; \
content: "|52 49 46 46|"; depth: 6; rawbytes; \
sid: 1000509; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - Real Media File"; \
content: "|2E 52 4D 46|"; depth: 6; rawbytes; \
sid: 1000510; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - Windows Media File"; \
content: "|30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C|"; depth: 20; rawbytes; \
sid: 1000511; rev: 1; \
)

# passive
alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - MPEG Movie File - B2"; \
content: "|00 00 01 B2|"; depth: 6; rawbytes; \
sid: 1000512; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - MPEG Movie File - B3"; \
content: "|00 00 01 B3|"; depth: 6; rawbytes; \
sid: 1000513; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - MPEG Movie File - BA"; \
content: "|00 00 01 BA|"; depth: 6; rawbytes; \
sid: 1000514; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - MPEG Movie File - BB"; \
content: "|00 00 01 BB|"; depth: 6; rawbytes; \
sid: 1000515; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - MPEG-4 Video File"; \
content: "|00 00 00 18 66 74 79 70 6D 70 34|"; depth: 15; rawbytes; \
sid: 1000516; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - Quicktime Movie File - MOOV"; \
content: "|6D 6F 6F 76|"; depth: 10; rawbytes; \
sid: 1000517; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - Quicktime Movie File - MDAT"; \
content: "|6D 64 61 74|"; depth: 10; rawbytes; \
sid: 1000518; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - Audio Video Interleave (AVI) File - AVI"; \
content: "|41 56 49 20|"; depth: 6; rawbytes; \
sid: 1000519; rev: 1; \
)
                                    
alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - Audio Video Interleave (AVI) File - RIFF"; \
content: "|52 49 46 46|"; depth: 6; rawbytes; \
sid: 1000520; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - Real Media File"; \
content: "|2E 52 4D 46|"; depth: 6; rawbytes; \
sid: 1000521; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - Windows Media File"; \
content: "|30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C|"; depth: 20; rawbytes; \
sid: 1000522; rev: 1; \
)

Anyone who has written Snort rules is probably going to question the false positive rate on this rule set, especially the "tcp any 1024: -> any 1024:" group. These are straight content matches, and the smaller strings like "|2E 52 4D 46|" are probably going to fire quite a bit on unintended traffic.

Here is local-http.rules.

root@ubuntu:/etc/snort/rules# cat local-http.rules 
# 1 000 100 - 1 000 299

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - MPEG Movie File - B2"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|00 00 01 B2|"; within: 6; \
sid: 1000101; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - MPEG Movie File - B3"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|00 00 01 B3|"; within: 6; \
sid: 1000102; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - MPEG Movie File - BA"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|00 00 01 BA|"; within: 6; \
sid: 1000103; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - MPEG Movie File - BB"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|00 00 01 BB|"; within: 6; \
sid: 1000104; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - MPEG-4 Video File"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|00 00 00 18 66 74 79 70 6D 70 34|"; within: 15; \
sid: 1000105; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - Quicktime Movie File - MOOV"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|6D 6F 6F 76|"; within: 10; \
sid: 1000106; rev: 1; \
)
alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - Quicktime Movie File - MDAT"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|6D 64 61 74|"; within: 10; \
sid: 1000107; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - Audio Video Interleave (AVI) File - AVI"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|41 56 49 20|"; within: 6; \
sid: 1000108; rev: 1; \
)
                                    
alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - Audio Video Interleave (AVI) File - RIFF"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|52 49 46 46|"; within: 6; \
sid: 1000109; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - Real Media File"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|2E 52 4D 46|"; within: 6; \
sid: 1000110; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - Windows Media File"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C|"; within: 20; \
sid: 1000111; rev: 1; \
)

That's 11 rules. There are 22 more. The middle 11 have port 80 replaced by 3128. The final 11 have port 8080. What does that tell you? It means that you can avoid being detected by these rules if the remote Web server runs on a port other than 80, 3128, or 8080. Note also that the original snort.conf doesn't enable the http_inspect or http_inspect_server preprocessors. These rules are more raw content matches, although their specificity will reduce the number of times they fire. They also introduce more evasion options.

Finally, let's check out local-smb.rules.

root@ubuntu:/etc/snort/rules# cat local-smb.rules 
# 1 000 300 - 1 000 499

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - MPEG Movie File - B2"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|00 00 01 B2|"; distance: 54; within: 4; \
sid: 1000301; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - MPEG Movie File - B3"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|00 00 01 B3|"; distance: 54; within: 4; \
sid: 1000302; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - MPEG Movie File - BA"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|00 00 01 BA|"; distance: 54; within: 4; \
sid: 1000303; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - MPEG Movie File - BB"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|00 00 01 BB|"; distance: 54; within: 4; \
sid: 1000304; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - MPEG-4 Video File"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|00 00 00 18 66 74 79 70 6D 70 34|"; distance: 54; within: 15; \
sid: 1000305; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - Quicktime Movie File - MOOV"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "MOOV"; distance: 54; within: 8; nocase; \
sid: 1000306; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - Quicktime Movie File - MDAT"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "MDAT"; distance: 54; within: 4; nocase; \
sid: 1000307; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - Audio Video Interleave (AVI) File - AVI"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "AVI_"; distance: 54; within: 4; nocase; \
sid: 1000308; rev: 1; \
)
                                    
alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - Audio Video Interleave (AVI) File - RIFF"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "RIFF"; distance: 54; within: 4; nocase; \
sid: 1000309; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - Real Media File"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|2E 52 4D 46|"; distance: 54; within: 4; \
sid: 1000310; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - Windows Media File"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C|"; distance: 54; within: 16; \
sid: 1000311; rev: 1; \
)

Notice all the port 445 instances? You can evade these if your SMB session uses port 139 TCP.

I thought it might be fun to test these rules. I decided to download a 108 MB .avi file to the toolkit host itself and see if would be observed.

file robert-morris.avi 
robert-morris.avi: RIFF (little-endian) data, AVI, 640 x 480, 30.00 fps,
video: Motion JPEG, audio: uncompressed PCM (mono, 11024 Hz)

Hmm, no alerts. I have Sguil running on my gateway. Let's see what the start of a transcript for this session looks like.

Sensor Name: hacom
Timestamp: 2007-11-23 21:32:47
Connection ID: .hacom_5136151961070210685
Src IP:  69.255.105.234 (c-69-255-105-234.hsd1.va.comcast.net)
Dst IP:  164.106.251.250 (Unknown)
Src Port:  58172
Dst Port:  80
OS Fingerprint: 69.255.105.234:58172 - UNKNOWN
 [S4:61:1:60:M1460,S,T,N,W4:.:?:?] (up: 3 hrs) 
OS Fingerprint:   -> 164.106.251.250:80 (link: ethernet/modem)

SRC: GET /docs/netsec/robert-morris.avi HTTP/1.0
SRC: User-Agent: Wget/1.10.2
SRC: Accept: */*
SRC: Host: 164.106.251.250
SRC: Connection: Keep-Alive
SRC: 
SRC: 
DST: HTTP/1.1 200 OK
DST: Date: Fri, 23 Nov 2007 21:38:16 GMT
DST: Server: Apache/2.0.52 (Red Hat)
DST: Last-Modified: Tue, 23 Aug 2005 21:46:31 GMT
DST: ETag: "37804f-6bfad96-ba9f7bc0"
DST: Accept-Ranges: bytes
DST: Content-Length: 113225110
DST: Connection: close
DST: Content-Type: video/x-msvideo
DST: 
DST: 
DST: RIFF....AVI LISTF...hdrlavih8...5...D.&......................I..
LISTt...strlstrh8...vidsmjpg............5...@B...........I...'..............
strf(...(...............MJPG....................LIST\...strlstrh8...auds....
.................+......\ 
DST: ..+...'..............strf.........+...+......IDIT....
FRI JUL 29 15:54:43 2005
DST: .LIST....INFOISFT....CanonMVI02..JUNK~...

After the HTTP response you see the download begin for the .avi. Presumably this would match, this rule?

"HTTP Download > 100M - Audio Video Interleave (AVI) File - RIFF"

Let's look at the two most important packets in the full content pcap file.

16:32:47.335530 IP 164.106.251.250.80 > 69.255.105.234.58172:
 P 1:268(267) ack 133 win 1716 <nop,nop,timestamp 2163691250 1274738>
        0x0000:  4520 013f e980 4000 3006 0fca a46a fbfa  E..?..@.0....j..
        0x0010:  45ff 69ea 0050 e33c f12d d653 a3ca 374e  E.i..P.<.-.S..7N
        0x0020:  8018 06b4 ce3b 0000 0101 080a 80f7 4ef2  .....;........N.
        0x0030:  0013 7372 4854 5450 2f31 2e31 2032 3030  ..srHTTP/1.1.200
        0x0040:  204f 4b0d 0a44 6174 653a 2046 7269 2c20  .OK..Date:.Fri,.
        0x0050:  3233 204e 6f76 2032 3030 3720 3231 3a33  23.Nov.2007.21:3
        0x0060:  383a 3136 2047 4d54 0d0a 5365 7276 6572  8:16.GMT..Server
        0x0070:  3a20 4170 6163 6865 2f32 2e30 2e35 3220  :.Apache/2.0.52.
        0x0080:  2852 6564 2048 6174 290d 0a4c 6173 742d  (Red.Hat)..Last-
        0x0090:  4d6f 6469 6669 6564 3a20 5475 652c 2032  Modified:.Tue,.2
        0x00a0:  3320 4175 6720 3230 3035 2032 313a 3436  3.Aug.2005.21:46
        0x00b0:  3a33 3120 474d 540d 0a45 5461 673a 2022  :31.GMT..ETag:."
        0x00c0:  3337 3830 3466 2d36 6266 6164 3936 2d62  37804f-6bfad96-b
        0x00d0:  6139 6637 6263 3022 0d0a 4163 6365 7074  a9f7bc0"..Accept
        0x00e0:  2d52 616e 6765 733a 2062 7974 6573 0d0a  -Ranges:.bytes..
        0x00f0:  436f 6e74 656e 742d 4c65 6e67 7468 3a20  Content-Length:.
        0x0100:  3131 3332 3235 3131 300d 0a43 6f6e 6e65  113225110..Conne
        0x0110:  6374 696f 6e3a 2063 6c6f 7365 0d0a 436f  ction:.close..Co
        0x0120:  6e74 656e 742d 5479 7065 3a20 7669 6465  ntent-Type:.vide
        0x0130:  6f2f 782d 6d73 7669 6465 6f0d 0a0d 0a    o/x-msvideo....
16:32:47.336654 IP 164.106.251.250.80 > 69.255.105.234.58172:
 . 268:1636(1368) ack 133 win 1716 #60;nop,nop,timestamp 2163691250 1274738#62;
        0x0000:  4520 058c e982 4000 3006 0b7b a46a fbfa  E.....@.0..{.j..
        0x0010:  45ff 69ea 0050 e33c f12d d75e a3ca 374e  E.i..P.<.-.^..7N
        0x0020:  8010 06b4 b5f8 0000 0101 080a 80f7 4ef2  ..............N.
        0x0030:  0013 7372 5249 4646 8ead bf06 4156 4920  ..srRIFF....AVI.
        0x0040:  4c49 5354 4601 0000 6864 726c 6176 6968  LISTF...hdrlavih
        0x0050:  3800 0000 3582 0000 44d0 2600 0000 0000  8...5...D.&.....
        0x0060:  1000 0100 0e07 0000 0000 0000 0200 0000  ................
        0x0070:  c649 0100 8002 0000 e001 0000 0000 0000  .I..............
        0x0080:  0000 0000 0000 0000 0000 0000 4c49 5354  ............LIST
        0x0090:  7400 0000 7374 726c 7374 7268 3800 0000  t...strlstrh8...
        0x00a0:  7669 6473 6d6a 7067 0000 0000 0000 0000  vidsmjpg........
        0x00b0:  0000 0000 3582 0000 4042 0f00 0000 0000  ....5...@B......
        0x00c0:  0e07 0000 c649 0100 1027 0000 0000 0000  .....I...'......
        0x00d0:  0000 0000 8002 e001 7374 7266 2800 0000  ........strf(...
        0x00e0:  2800 0000 8002 0000 e001 0000 0100 1800  (...............
        0x00f0:  4d4a 5047 0010 0e00 0000 0000 0000 0000  MJPG............
        0x0100:  0000 0000 0000 0000 4c49 5354 5c00 0000  ........LIST\...
        0x0110:  7374 726c 7374 7268 3800 0000 6175 6473  strlstrh8...auds
        0x0120:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0130:  0100 0000 102b 0000 0000 0000 5c20 0a00  .....+......\...
        0x0140:  102b 0000 1027 0000 0100 0000 0000 0000  .+...'..........
        0x0150:  0000 0000 7374 7266 1000 0000 0100 0100  ....strf........
        0x0160:  102b 0000 102b 0000 0100 0800 4944 4954  .+...+......IDIT
        0x0170:  1a00 0000 4652 4920 4a55 4c20 3239 2031  ....FRI.JUL.29.1
        0x0180:  353a 3534 3a34 3320 3230 3035 0a00 4c49  5:54:43.2005..LI
        0x0190:  5354 1800 0000 494e 464f 4953 4654 0c00  ST....INFOISFT..
        0x01a0:  0000 4361 6e6f 6e4d 5649 3032 0000 4a55  ..CanonMVI02..JU
        0x01b0:  4e4b 7e06 0000 0000 0000 0000 0000 0000  NK~.............
...truncated...

Do you see it? The HTTP response code and the Content-Length statement appear in the first packet. The .avi begins in the second packet with RIFF. Snort doesn't fire an alert because all of the matches needed for the rule are not present in a single packet.

Technically, there's not much to worry about here -- at least not yet. I do worry about putting monitoring tools in the hands of people who don't know what they're doing and seeing them act on misconceptions. It's also important to identify the fact that this activity could violate wiretap and privacy laws.

Read More

Tap vs Lightning Strike

Earlier this year my lab suffered a near lightning strike. A tree right outside the lab was struck by lightning, causing damage to multiple electronic and electrical devices outside and inside the building.

Outside, the lightning disabled an exterior lighting system and my phone lines. Inside, the lightning took a severe toll on the lab. The cable modem to the outside world was destroyed. The NIC on the lab firewall facing the cable modem was fried, along with a second NIC in the firewall. The NIC on a sensor watching a tap between the cable modem and firewall was also destroyed. So far, this is a grim story.

I have one good piece of news to report, and it involves the tap I mentioned sitting between the cable modem and firewall. The tap survived the lightning strike. More precisely, the tap continued to pass traffic even when its monitoring interface was damaged.

Had the tap been receiving traffic from the modem or firewall, it would have continued to pass it. This truly amazed me. Frequently monitoring practitioners worry that inserting a tap in their network architecture will introduce a single point of failure. In my experience, all of the components around the tap are more likely to fail. A well-engineered tap will continue to pass traffic -- perhaps even when struck by lightning!

The tap that survived my lab lightning strike was built by Net Optics. Congratulations to the Net Optics engineering and manufacturing teams for building quality hardware.

Read More

7 steps to better Solaris Network Settings

I was auditing one of our customer again and this time round, i managed to come up with a 7 step guide to better secure the TCP stack for Solaris. Well, you guys can add on for more.

1. Configure for more random TCP sequence number generation. Check that in(/etc/default/inetinit), the TCP_STRONG_ISS is set to 2. For instance, TCP_STRONG_ISS=2

2. IP forwarding is to be turned off to prevent the machine acting as a router. To disable IP forwarding, a file "/etc/notrouter" need to be present. If the file is missing, issue the following command to create one : touch /etc/notrouter

To prevent dynamic routes updates via the network, move "in.routed" and "in.rdisc" away from "/usr/sbin" directory by perform the following commands :
mv /usr/sbin/in.routed /export/home/cfgh/base
mv /usr/sbin/in.rdisc /export/home/cfgh/base

3. Change default kernel IP settings for better security. Following the following steps to change the kernel IP defaults values :

Setup files and environment:
touch /etc/init.d/exconfig
ln -s /etc/init.d/exconfig /etc/rc2.d/S70exconfig
chmod 744 /etc/init.d/exconfig /etc/rc2.d/S70exconfig

Edit file "/etc/init.d/exconfig" and add the following lines:
#!/bin/sh
# /etc/init.d/exconfig
RELEASE=`/usr/bin/uname -r`
release7 ()
{
/usr/sbin/ex -set /dev/ip ip_forwarding 0
/usr/sbin/ex -set /dev/ip ip_strict_dst_multihoming 1
/usr/sbin/ex -set /dev/ip ip_send_redirects 0
/usr/sbin/ex -set /dev/ip ip_ignore_redirect 1
/usr/sbin/ex -set /dev/ip ip_forward_src_routed 0
/usr/sbin/ex -set /dev/ip ip_forward_directed_broadcasts 0
/usr/sbin/ex -set /dev/ip ip_respond_to_echo_broadcast 0
/usr/sbin/ex -set /dev/tcp tcp_conn_req_max_q0 4096
/usr/sbin/ex -set /dev/tcp tcp_ip_abort_cinterval 60000
/usr/sbin/ex -set /dev/ip ip_respond_to_timestamp 0
/usr/sbin/ex -set /dev/ip ip_respond_to_timestamp_broadcast 0
/usr/sbin/ex -set /dev/ip ip_respond_to_address_mask_broadcast 0
/usr/sbin/ex -set /dev/arp arp_cleanup_interval 60000
id -a mqm > /dev/null 2>&1
if [ \$? -eq 0 ]
then
/usr/sbin/ex -set /dev/tcp tcp_keepalive_interval 600000
fi
}
release8 ()
{
/usr/sbin/ex -set /dev/ip ip6_forwarding 0
/usr/sbin/ex -set /dev/ip ip6_strict_dst_multihoming 1
/usr/sbin/ex -set /dev/ip ip6_send_redirects 0
/usr/sbin/ex -set /dev/ip ip6_ignore_redirect 1
/usr/sbin/ex -set /dev/ip ip6_forward_src_routed 0
/usr/sbin/ex -set /dev/ip ip_ire_arp_interval 60000
}
release6 ()
{
/usr/sbin/ex -set /dev/ip ip_respond_to_echo_broadcast 0
/usr/sbin/ex -set /dev/ip ip_forward_directed_broadcasts 0
/usr/sbin/ex -set /dev/ip ip_strict_dst_multihoming 1
/usr/sbin/ex -set /dev/ip ip_ignore_redirect 1
/usr/sbin/ex -set /dev/ip ip_forward_src_routed 0
}

if [ \$RELEASE = "5.7" ]
then
release7
elif [ \$RELEASE = "5.8" ] || [ \$RELEASE = "5.10" ] || [ \$RELEASE = "5.9" ]
then
release7
release8
elif [ \$RELEASE = "5.6" ]
then
release6
fi

4. Disable multicast from the server, edit the file "/etc/rc2.d/S72inetsvc" and comment out/remove the following lines :
#(
#if [ "$_INIT_NET_STRATEGY" = "dhcp" ]; then
# mcastif=`/sbin/dhcpinfo Yiaddr` || mcastif=$_INIT_UTS_NODENAME
#else
# mcastif=$_INIT_UTS_NODENAME
#fi
#
#echo "Setting default Ipv4 interface for multicase:" \
# "add net 224.0/4: gateway $mcastif
#
#/usr/sbin/route -n add -interface "224.0/4" "$mcastif" >/dev/null
#)&

For Solaris 10
Multicast would be disabled using /etc/rc2.d/S72inetsvc-os10

5. Denial of Service Prevention System Settings.
Services that must be disabled on all servers, unless required by business function from /etc/services. Services include: ftp-data ftp tftp pop2 pop3 pop-2 nntp chargen daytime discard echo finger talk who whois new-rwho klogin eklogin telnet systat netstat time

6. Prevent "core dump" generated by inetd as it may contain login information. This could be achieved by editing the file "/etc/rc2.d/S72inetsvc". Change the line :
/usr/sbin/inetd -s &
to /usr/bin/ulimit -c 0; /usr/sbin/inetd -s -t &
Note :
ulimit -c 0 : set the core file size to 0 byte
inetd -s -t : stand-alone server with tracing of all tcp connections

For Solaris 10
Create the script /etc/rc2.d/S72inetsvc-os10 as per below.
#cat /etc/rc2.d/S72inetsvc-os10
IPADDR=`netstat -nr | grep -w 224.0.0.0 | awk '{print $2}'`
/usr/sbin/route -n delete -interface "224.0/4" $IPADDR
/usr/sbin/svcadm enable inetd
/usr/sbin/inetadm -M tcp_trace=TRUE
#chmod 555 /etc/rc2.d/S72inetsvc-os10

7. .netrc files System Settings (.netrc files, .netrc files in root’s home directory). Files are not permitted, remove the files if any, issue command find / -name .netrc -print

The Hacka Man

Read More

Updating FreeBSD 7.0-BETA2 to 7.0-BETA3

Recently I posted FreeBSD Binary Upgrade News about developments with Colin Percival's FreeBSD Update tool. Today I performed a remote (via SSH) upgrade from FreeBSD 7.0-BETA2 to FreeBSD 7.0-BETA3 using FreeBSD Update. I document the process below so you can see how easy it is and for my future reference.

Here is uname output to show the OS version prior to upgrading.

# uname -a
FreeBSD myhost.mydomain.com 7.0-BETA2 FreeBSD 7.0-BETA2 #0:
 Fri Nov  2 16:47:33 UTC 2007   
 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386

I wasn't sure if the version of FreeBSD Update packaged with FreeBSD 7.0-BETA2 would natively support this process, so I gave it a try.

# freebsd-update -r 7.0-BETA3 upgrade
usage: freebsd-update [options] command ... [path]

Options:
  -b basedir   -- Operate on a system mounted at basedir
                  (default: /)
  -d workdir   -- Store working files in workdir
                  (default: /var/db/freebsd-update/)
  -f conffile  -- Read configuration options from conffile
                  (default: /etc/freebsd-update.conf)
  -k KEY       -- Trust an RSA key with SHA256 hash of KEY
  -s server    -- Server from which to fetch updates
                  (default: update.FreeBSD.org)
  -t address   -- Mail output of cron command, if any, to address
                  (default: root)
Commands:
  fetch        -- Fetch updates from server
  cron         -- Sleep rand(3600) seconds, fetch updates, and send an
                  email if updates were found
  install      -- Install downloaded updates
  rollback     -- Uninstall most recently installed updates

Ok, that didn't work. Time to retrieve the new version from Colin's site.

# fetch http://www.daemonology.net/freebsd-update/freebsd-update-upgrade.tgz
freebsd-update-upgrade.tgz                    100% of   21 kB  104 kBps
# fetch http://www.daemonology.net/freebsd-update/freebsd-update-upgrade.tgz.asc
freebsd-update-upgrade.tgz.asc                100% of  187  B  640 kBps

I decided to follow Colin's advice to check the signature of the upgrade file. To do that I needed to install GnuPG.

# pkg_add -r gnupg
Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7-current/Latest/gnupg.tbz... Done.
Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7-current/All/openldap-client-2.3.39.tbz... Done.

************************************************************

The OpenLDAP client package has been successfully installed.

Edit
  /usr/local/etc/openldap/ldap.conf
to change the system-wide client defaults.

Try `man ldap.conf' and visit the OpenLDAP FAQ-O-Matic at
  http://www.OpenLDAP.org/faq/index.cgi?file=3
for more information.

************************************************************

Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7-current/All/curl-7.16.3.tbz... Done.
Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7-current/All/pth-2.0.7.tbz... Done.
Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7-current/All/libiconv-1.11_1.tbz... Done.
Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7-current/All/gettext-0.16.1_3.tbz... Done.
Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7-current/All/libgpg-error-1.5.tbz... Done.
Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7-current/All/libgcrypt-1.2.4_1.tbz... Done.
Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7-current/All/libksba-1.0.1_1.tbz... Done.
Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7-current/All/dirmngr-0.9.7_2.tbz... Done.

###############################################################################
                                A T T E N T I O N

In order to use gpg-agent, you need to install a pinentry dialog.

The following ports of pinentry dialogs are available:

security/pinentry-curses        (ncurses based dialog)
security/pinentry-gtk           (GTK 1.2 based dialog)
security/pinentry-gtk2          (GTK 2.x based dialog)
security/pinentry-qt            (QT based dialog)

###############################################################################

Wow, that installed more dependencies than I expected. Here I import the PGP keys from FreeBSD,org.

# rehash
# fetch http://www.freebsd.org/doc/pgpkeyring.txt
pgpkeyring.txt                                100% of 1406 kB  142 kBps 00m00s
# gpg --import pgpkeyring.txt
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key CA6CDFB2: public key "FreeBSD Security Officer " imported
gpg: key FF8AE305: public key "core-secretary@FreeBSD.org" imported
...edited...
gpg: key D069F2A0: duplicated user ID detected - merged
gpg: key D069F2A0: public key "Thomas Abthorpe " imported
gpg: Total number processed: 262
gpg:           w/o user IDs: 1
gpg:               imported: 261  (RSA: 36)
gpg: no ultimately trusted keys found

With the keys imported I verify the file I downloaded.

# gpg --verify freebsd-update-upgrade.tgz.asc freebsd-update-upgrade.tgz
gpg: Signature made Fri Nov 16 09:01:38 2007 EST using DSA key ID CA6CDFB2
gpg: Good signature from "FreeBSD Security Officer "
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: C374 0FC5 69A6 FBB1 4AED  B131 15D6 8804 CA6C DFB2

Note I need to generate my own key and sign the FreeBSD Security Officer's key with my generated key if I want to avoid GPG's warnings, i.e.:

gpg --gen-key
gpg --sign-key security-officer@FreeBSD.org

Now I am ready to proceed with the upgrade.

# tar -xf freebsd-update-upgrade.tgz 
# sh freebsd-update.sh -f freebsd-update.conf -r 7.0-BETA3 upgrade
Looking up update.FreeBSD.org mirrors... 1 mirrors found.
Fetching public key from update1.FreeBSD.org... done.
Fetching metadata signature for 7.0-BETA2 from update1.FreeBSD.org... done.
Fetching metadata index... done.
Fetching 2 metadata files... done.
Inspecting system... done.

The following components of FreeBSD seem to be installed:
kernel/generic src/base src/bin src/cddl src/contrib src/crypto src/etc
src/games src/gnu src/include src/krb5 src/lib src/libexec src/release
src/rescue src/sbin src/secure src/share src/sys src/tools src/ubin
src/usbin world/base world/dict world/doc world/games world/info
world/manpages world/proflibs

The following components of FreeBSD do not seem to be installed:
src/compat world/catpages

Does this look reasonable (y/n)? y

Fetching metadata signature for 7.0-BETA3 from update1.FreeBSD.org... done.
Fetching metadata index... done.
Fetching 1 metadata patches. done.
Applying metadata patches... done.
Fetching 1 metadata files... 
Inspecting system... done.
Preparing to download files... done.
Fetching 1289 patches.....10....20....30....40....50....60....70....80....90....
...edited...
Applying patches... done.
Fetching 329 files... done.

The following files will be removed as part of updating to 7.0-BETA3-p0:
/etc/pf.conf
/usr/share/doc/es_ES.ISO8859-1/books/handbook/LEGALNOTICE.html
/usr/share/doc/fr_FR.ISO8859-1/books/handbook/x20872.html
/usr/share/doc/fr_FR.ISO8859-1/books/handbook/x20918.html
/usr/share/doc/fr_FR.ISO8859-1/books/handbook/x21123.html
/usr/share/examples/etc/pf.conf
/usr/src/etc/pf.conf

The following files will be added as part of updating to 7.0-BETA3-p0:
/boot/kernel/if_zyd.ko
/boot/kernel/if_zyd.ko.symbols
...edited...
/usr/share/examples/pf/pf.conf
/usr/src/share/examples/pf/pf.conf

The following files will be updated as part of updating to 7.0-BETA3-p0:
/bin/ps
/boot/kernel/3dfx.ko
...edited...
/usr/src/usr.sbin/wpa/wpa_supplicant/driver_freebsd.c
/var/named/etc/namedb/named.root

# sh freebsd-update.sh -f freebsd-update.conf install 
Installing updates...
Kernel updates have been installed.  Please reboot and run
"freebsd-update.sh install" again to finish installing updates.
# shutdown -r now

After a reboot I run the following.

# sh freebsd-update.sh -f freebsd-update.conf install 
Installing updates... done.
# shutdown -r now

After a second reboot the system is completely upgraded.

$ uname -a
FreeBSD myhost.mydomain.com 7.0-BETA3 FreeBSD 7.0-BETA3 #0:
 Fri Nov 16 22:20:33 UTC 2007     
 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386

That's excellent. The whole process took only a few minutes.

Read More

Network Monitoring: How Far?

In my January post The Revolution Will Be Monitored and elsewhere I discuss how network monitoring is becoming more prevalent, whether we like it or not. When I wrote my first book I clearly said that you should collect as much data as you can, given legal, political, and technical means because that approach gives you the best chance to detect and respond to intrusions. Unfortunately, I did not provide any clear guidance for situations where I think monitoring might not be appropriate. While this is by no means a political blog, I would not want my NSM approach to be taken as justification for monitoring and retaining every electronic transaction, especially beyond the security realm.

In that spirit I would like to point out three recent stories which highlight some of the contemporary problems I see with electronic monitoring.

First is Boeing bosses spy on workers. From the story:

Within its bowels, The Boeing Co. holds volumes of proprietary information deemed so valuable that the company has entire teams dedicated to making sure that private information stays private.

One such team, dubbed "enterprise" investigators, has permission to read the private e-mails of employees, follow them and collect video footage or photos of them. Investigators can also secretly watch employee computer screens in real time and reproduce every keystroke a worker makes, the Seattle P-I has learned...

"Employees should understand that the law generally gives employers broad authority to conduct surveillance, whether through e-mail, video cameras or other forms of tracking, including off the job in many cases."

The law grants companies the right to protect themselves from employees who break the law, such as by embezzling money or using the company warehouse to run a drug-smuggling ring.

The problem, [Ed] Mierzwinski [consumer program director at the federation of Public Interest Research Groups] said, is when companies use the surveillance tactics available to them to root out whistle-blowers.

"We need greater whistle-blower protections," he said. But, "if you're using the company's resources and you think it's protected because you're using Hotmail, think again."

My first point on this story is that I have never advocated NSM as a means to combat fraud, waste, and abuse by employees, let alone whistle-blowers. I have almost exclusively focused on external threats. I say let legal and human resources look for non-security policy violations.

My second point on this story is that I think the operative word here is surveillance. NSM is not a surveillance methodology. NSM does not advocate identifying a person of interest, then examining all traffic generated by or directed at that person. NSM is more channel- and system-centric. If I am going to conduct network surveillance of any type, I expect legal and human resources tasking. I do not engage in network surveillance for my own security purposes. I conduct NSM.

The next story is Cal-Ore Telecommunications on Solera Networks. This is a blog posting advertising the adoption of a packet capture appliance sold by Solera Networks to the Cal-Ore ISP in California. From the story:

Cal-Ore, a rural telephone company and ISP headquartered in Northern California, has been serving customers for more than 55 years. In order to comply with CALEA requirements, Charles Boening, Cal-Ore’s network manager considered three choices. First, they could do nothing and hope they never received a lawful intercept warrant request. Second, they could contract with a trusted third-party (TTP) that would perform any tapping services and bring them into compliance: at a six-figure price tag with ongoing fees. Or third, they could purchase a Solera DS 1000 from Solera Networks...

“We not only capture traffic that goes to the Internet, we can also use those extra Ethernet ports to capture traffic from other areas of our network,” Boening said...

While not being used to fulfill a warrant, Boening uses the Solera DS 1000 for complete network packet capture and storage. This has become an integral component to network management at Cal-Ore...

“We’ll hear from other providers telling us that we have a customer who is sending out spam,” said Boening. “Before I disconnect that customer, I need to verify it is a legitimate compliant. I use the Solera Networks box to find specific traffic over a period of time and put it into an analyzer, such as WireShark, to determine whether it is junk. If it is, I will then turn off the customer.”

When I read this I thought "This ISP is logging all traffic that customers send to the Internet?" I read their terms of service and found this:

Use of any Cal-Ore Telephone network service constitutes consent to monitoring at all times. If monitoring of any device in the Cal-Ore Telephone network reveals any evidence regarding violation of copyright laws, security regulations or any instance of unauthorized use of any system, this evidence and any other related information, including identification information about the user, can and will be provided to law enforcement officials.

It appears Cal-Ore is relying on the consent exception to the wiretap act to not break Federal law. They could also hope that their activity "is a necessary incident to the rendition of his service or to the protection of the rights or property of the provider of that service" and thereby receive another exception to the wiretap act.

However, California law is a little different. As noted in Applying the Wiretap Act to Online Communications after United States v. Councilman, California is a two-party consent state, meaning that both parties to the communication must give consent in order to make interception of a communication permissible. I am not a lawyer (I may have to rectify that situation at some point), but it sounds like the consent exception is lost when a Cal-Ore user who has not granted consent communicates via IM to any Cal-Ore user.

The third story is actually a set of articles posted by The Baltimore Sun about the National Security Agency and "cyber security." A slightly more recent article called In focus: Targeting Internet terror offers a few items of interest:

President Bush quietly announced yesterday his plans to launch a program targeting terrorists and others who would seek to attack the United States via the Internet, according to lawmakers and budget documents.

Bush requested $154 million in preliminary funding for the initiative, which current and former government officials say is expected to become a seven-year, multibillion-dollar program to track threats in cyberspace on both government and private networks...

At the White House, spokesman Sean Kevelighan would say only that the money would be used for "increased monitoring capabilities, as well as to increase the security of our networks."

I'm interested in this article because it and previous stories hint that the government might monitor private networks for security purposes. This would be quite a step if true.

Monitoring remains a hot topic, so I plan to keep my eye on these issues going forward.

Read More

Hacking Iphone the fun way

I got my iphone and i know there are exploits and vulnerabilities in it discovered by H.D Moore, creator of metasploit. However i wasn't too enthusiastic about the damage that this exploit can do but more into the fun aspect aspect of how to install new 3rd party application in phone. I know that you can install hacking tools too, but thats not my goal. Why install those tools when you can install it in the PC? Anyway, I managed to unlock the phone with a few help and of course start using it. It is the coolest phone out on the planet and of course with the video below, i managed to install more applications in my phone. Check it out.



The Hacka Man

Read More

Hacking SCADA

While i was in Dubai, i got a chance to visit one of our customers who was using SCADA. Back then, it was so new to me and i have no idea of how to actually audit it. Back here in Singapore, i got another chance to actually test and audit SCADA systems and this time round, i found a way to actually break the application and network apart. However, i have to be very careful during the audit, as one wrong move may affect the whole of Singapore.

So what is SCADA? SCADA stands for Supervisory Control and Data Acquisition and they are the systems that deliver water, power supply, gas and some other items to your home. Check out http://en.wikipedia.org/wiki/SCADA if you would love to read more about it. There had been incidents where SCADA systems had been hacked and information was stolen by terrorist. Also, internet worms like the Slammer worm also affected the systems and cause a total DoS. Why is all these happening? All i can say is either because those systems are exposed to the internet or they are using proprietary protocols and they think that they are safe from hackers and doesnt care about it. Those people working in SCADA are so wrong, they doesnt bother about security at all, and i guess its because something disturbing might have happen and only then they start to panic and need people like us to audit their systems.

SCADA uses their own proprietary protocols like DNP3, OPC, Modbus, DCS, etc, and its possible to use Wireshark to actually monitor the traffic and see how the handshaking process work. By observing the handshake, i realised that it was possible to perform man in the middle attacks, but of course would require developing of some tools to perform the job. Some other attacks that are possible include DoS, capturing of username and password, injecting worms and virus and many other old school techniques.

The problems with SCADA:
1. Windows & Linux Vulnerabilities
2. Not patched regularly – maximum uptime needed
3. Denial of Service Attack
4. Continuous string of reboot command
5. No Authentication
6. No Accounting
7. Traffic sent in clear text (username & password)
8. No encryption

To Pentest on SCADA systems, you can do the following:
1. Port Scanning
2. OS Fingerprinting
3. Vulnerability Scanning
4. Exploitation
5. Credentials Guessing
6. Sniffing
7. Fuzzing

Of course there are many other possibilities for pentesting SCADA systems. I for sure want another session with SCADA because it is so fun having to touch on mission critical systems that can affect the whole country. There are tons and tons of possibilities and problems with SCADA and i have just outline a few obvious ones. Of course, you got to be in the SCADA environment if you actually want to discover more possibilities, but then again, do we have such chances everyday?

The Hacka Man

Read More

Two factor authentication bypassed

It had been a long fortnight and i have not finished writing my report for various banks. It was really that much report to write and especially for one specific particular bank. I managed to bypass the security control mechanism setup by this bank and steal the username and password of any user.

Most of the banks here in Singapore practised two factor authentication and for most people, they think that it is secure because of the extra added security. However, a PoC was released to the bank depicting to them that it was possible to bypass the security control mechanism and it was possible to capture the username and password of any user. I am sorry guys, i am not supposed to leak out any information here. It is very sensitive from the bank's point of view. The best part of the exploit was there was no XSS or sql injection or any sorts of vulnerability that facilitate this exploit. It was purely just information gathered during the passive information gathering exercise.

I was browsing their site and i discovered a section where some information could help me facilitate the research of writing the exploit. I had an albeit pedantic thought when i saw that particular section. I was thinking that with all that information, i am definitely able to bypass the security mechanism. However to do that, i would require someone else to write the code for me with my ideas. Nevertheless, within a week, i managed to come out with a PoC and display a great deal of demostration. Guys, i know you want to know the details, but i simply can't reveal anything because of the Non Disclosure Agreement I signed. All i can say is passive information gathering is a very important exercise when trying to attack huge organizaton and guys can spend hours and days writing a cool exploit, with me, all i need is total observation and i got the results i want with ease. Why bother to go all the way to do something difficult when something easy can be accomplished faster??

I would love to attach a screenshot of what i managed to captured, but then again, it is too sensitive. I am sorry, but just know that it is possible to bypass 2FA.

The Hacka Man

Read More

Image upload xss

Also, i stumble across an old blog post by rsnake where it was possible to execute XSS on an upload function.

http://ha.ckers.org/blog/20070603/image-upload-xss/

http://pstgroup.blogspot.com/2007/06/tipsimage-upload-xss.html

an example of something you might test for:



So you upload this file:

http://ha.ckers.org/image-xss/"onerror="alert('XSS')"a=".jpg

This ends up making the page look like:



The Hacka Man

Read More

DOM Based XSS

I was reading Amit Klein's 2005 article on DOM Based XSS and he actually mentioned a few things to look out for in DOM XSS. In that article, he gave us an insight look of how to look for potential XSS in the DOM and why sanitizing is important on the client side.

The full article is here: http://www.webappsec.org/projects/articles/071105.html

Below is a snippet:

2. Analyzing and hardening the client side (Javascript) code. Reference to DOM objects that may be influenced by the user (attacker) should be inspected, including (but not limited to):

document.URL
document.URLUnencoded
document.location (and many of its properties)
document.referrer
window.location (and many of its properties)
Note that a document object property or a window object property may be referenced syntactically in many ways - explicitly (e.g. window.location), implicitly (e.g. location), or via obtaining a handle to a window and using it (e.g. handle_to_some_window.location).

Special attention should be given to scenarios wherein the DOM is modified, either explicitly or potentially, either via raw access to the HTML or via access to the DOM itself, e.g. (by no means an exhaustive list, there are probably various browser extensions):

Write raw HTML, e.g.:
document.write(…)
document.writeln(…)
document.body.innerHtml=…
Directly modifying the DOM (including DHTML events), e.g.:
document.forms[0].action=… (and various other collections)
document.attachEvent(…)
document.create…(…)
document.execCommand(…)
document.body. … (accessing the DOM through the body object)
window.attachEvent(…)
Replacing the document URL, e.g.:
document.location=… (and assigning to location’s href, host and hostname)
document.location.hostname=…
document.location.replace(…)
document.location.assign(…)
document.URL=…
window.navigate(…)
Opening/modifying a window, e.g.:
document.open(…)
window.open(…)
window.location.href=… (and assigning to location’s href, host and hostname)
Directly executing script, e.g.:
eval(…)
window.execScript(…)
window.setInterval(…)
window.setTimeout(…)

The Hacka Man

Read More

Deadly execution in huge Financial Company

I was auditing one of the biggest financial company in the world and here in the Singapore branch, it was just really bad. I was playing around with the software and noticed an uploading function. With evil thoughts in my mind, i quickly wanted to see if this application does allow uploading of exe, bat or some other executable files. To my wildest surprise, it does allow the uploading of exe files and i tell you, i could upload any sorts of trojan or virus and execute it on the client's pc. I actually did upload an exe program and tried execute it on the client's pc and it did execute the program accordingly and smoothly with no protection on the client's pc. It was really just bad. Moreover, the application itself also does allow command execution on the querystring which was really an eye opener. It was just a lucky day with my audit and an unlucky day for the customer. Report had been submitted and lets hope they will rectify the problem to avoid any attacks.

Check out for my next post on Two Factor Authentication Man in the Middle attack PoC

The Hacka Man

Read More

Basics of Mod_Security

This past week, i was auditing a customer's web server defence against web attacks and i realised that he did not install mod_security as one of their modules in the server. Well, considering it is a huge customer, they should at least do some basic filtering using mod_security since their servers are running on linux. I had mentioned about mod_security in my previous post and for those who are still not sure what it is, mod_security is a web application firewall that is an Apache Web Server add-on module that provides intrusion detection, content filtering, and web-based attack protection. It is good at detecting and stopping many known web attacks, such as many SQL injection type attacks, cross-site scripting, directory traversal type attacks, and many others. Below is a snippet of a simple basic mod_security configuration:


# Turn the filtering engine On or Off
SecFilterEngine On

# Make sure that URL encoding is valid
SecFilterCheckURLEncoding On

# Unicode encoding check
SecFilterCheckUnicodeEncoding On

# Only allow bytes from this range
SecFilterForceByteRange 0 255

# Only log actionable requests
SecAuditEngine RelevantOnly

# The name of the audit log file
SecAuditLog /var/log/apache2/audit_log

# Debug level set to a minimum
SecFilterDebugLog /var/log/apache2/modsec_debug_log
SecFilterDebugLevel 2

# Should mod_security inspect POST payloads
SecFilterScanPOST On

# By default log and deny suspicious requests
# with HTTP status 500
SecFilterDefaultAction "deny,log,status:500"

# Add custom secfilter rules here


Of course, you can add on more items and it depends on what you need it to filter and protect. Mod_Security does come with a performance cost, however, the security benefits far outweight the performance cost. Do consider using it.

The Hacka Man

Read More

Analyzing Protocol Hopping Covert Channel Tool

I enjoy analyzing covert channels, although my skills are far inferior to someone like Steven Murdoch. However, today via Packetstorm I learned of Protocol Hopping Covert Channel Tool by Steffen Wendzel. He wrote a text file describing his thoughts behind the tool called Protocol Hopping Covert Channels. Quoting the paper:

This paper describes a new way to implement covert channels. This is done by changing the protocol of the tunnel while the tunnel exists and even change the protocol on a randomized way without restarting the tunnel or reconnecting to the tunnel. A simple proof of concept tool called 'phcct' (protocol hopping covert channel tool) also known as 'takushi' (what is japanese for taxi) is available on my website http://www.doomed-reality.org. phcct implements only one (the easiest) version of such a randomized protocol hopping covert channel.

As soon as I read this I thought "this is so different from normal traffic, it will be easy to identify." I know that is true for manual inspection of traffic. I am not sure how automated tools would deal with it. The paper continues:

Do not forget the reason why doing this: It is to be stealth [sic]. Even if _one_ of the protocols you are using is recorded, the monitoring system will not collect ALL packets of ALL protocols in a network. This simply is a too huge amount of data. And yes, it makes the forensic analysis of network traffic much harder if there are multiple protocols used for a covert channel.

Apparently the author does not know about NSM or Sguil. Assuming you are performing this protocol hopping from a host on an enterprise network to a host on the Internet, a NSM sensor monitoring your Internet gateway will see and record this traffic.

I decided to give the author's proof of concept tool, phcct, a try. I compiled it statically on my Ubuntu laptop.

$ gcc -O -o phcct_s -fstack-protector-all -W -Wall -Wshadow -g
 -ggdb *.c -lpthread -static

Next I copied the binary to a VM running a Ubuntu 7.10 as a live CD/.iso. I used this static version because I noticed the Ubuntu live CD did not have the required libraries to compile from source, but run as a statically compiled binary it worked fine.

Now I started phcct on each workstation and hit return once each side was running. My laptop is neely, 192.168.2.101.

root@neely:~/phcct# ./phcct_s -a 192.168.2.115
starting phcct (a.k.a. takushi) ...
please press return if the peer is setup up.
connecting ...
connected via http
connected via ftp-data
connected via plain proto
waiting for local connection on port 9999 ... 

My VM is ubuntu, 192.168.2.115.

root@ubuntu:/home/analyst# ./phcct_s -a 192.168.2.101
starting phcct (a.k.a. takushi) ...
please press return if the peer is setup up.
connecting ...
connected via http
connected via ftp-data
connected via plain proto
waiting for local connection on port 9999 ... 

Once each side of the tunnel was activated, I used Netcat on each system to connect to port 9999 on localhost. First, neely:

richard@neely:~$ nc -v localhost 9999
localhost [127.0.0.1] 9999 (?) open

Second, ubuntu:

analyst@ubuntu:~$ nc -v localhost 9999
localhost [127.0.0.1] 9999 (?) open

Now I was ready to send traffic. For example, I typed this on neely:

This is traffic from neely to ubuntu.

and it appeared on ubuntu:

This is traffic from neely to ubuntu.

Then I did the reverse. I repeated this cycle four times, for a total of five exchanges or ten total messages. When done I exited each Netcat session.

During this process I captured the traffic using Tshark. You can download it here.

I prefer to start the analysis by looking at session data. Here is what Argus 2.x thought of the traffic.

$ ra -nn -L0 -A -r ph.1.arg -s saddr daddr sport dport proto pkts bytes
  SrcAddr       DstAddr     Sport Dport Type SrcPkt DstPkt SAppBytes DAppBytes   
192.168.2.115 192.168.2.101.43598 2510   tcp 6      4      96        0
192.168.2.115 192.168.2.101.43198 80     tcp 5      3      281       0
192.168.2.115 192.168.2.101.52158 20     tcp 6      4      96        0
192.168.2.101 192.168.2.115.49586 80     tcp 4      4      281       0
192.168.2.101 192.168.2.115.45106 20     tcp 3      3      0         0
192.168.2.101 192.168.2.115.50200 2510   tcp 7      7      192       0

You can see the tool using destination ports 2510, 80 and 20. There are six sessions although one of them is empty. The five active sessions correspond to our five conversations.

Let's look at the traffic on each using Tcpflow. In the ls output I omit the first few fields for space purposes.

taosecurity:/home/analyst$ tcpflow -r ph.1.lpc   
taosecurity:/home/analyst$ ls -al 192*
281 Nov 14 13:59 192.168.002.101.49586-192.168.002.115.00080
192 Nov 14 13:59 192.168.002.101.50200-192.168.002.115.02510
281 Nov 14 13:59 192.168.002.115.43198-192.168.002.101.00080
 96 Nov 14 13:59 192.168.002.115.43598-192.168.002.101.02510
 96 Nov 14 13:59 192.168.002.115.52158-192.168.002.101.00020

Notice the file sizes match the byte counts seen above. Here are the contents of each. Note the use of cat -tev to

taosecurity:/home/analyst$ cat -tev 192.168.002.101.49586-192.168.002.115.00080
GET / HTTP/1.1^M$
Host: google.de^M$
User-Agent: Mozilla/5.0^M$
Accept: text/xml^M$
Accept-Language: en-us;q=0.5,en;q=0.3^M$
Accept-Encoding: gzip,deflate^M$
Accept-Charset: ISO-8859-1,utf-8^M$
Keep-Alive: 300^M$
Connection: keep-alive^M$
Cookie: GPC=2FW=0:This is traffic from neely to ubuntu.$
^M$
^M$
taosecurity:/home/analyst$ cat -tev 192.168.002.101.50200-192.168.002.115.02510
^A^B^C0 FW=0:This is traffic from neely to ubuntu.$
^A^B^C1 FW=0:This is traffic from neely to ubuntu.$
^A^B^C3 FW=0:This is traffic from neely to ubuntu.$
^A^B^C4 FW=0:This is traffic from neely to ubuntu.$

taosecurity:/home/analyst$ cat -tev 192.168.002.115.43198-192.168.002.101.00080
GET / HTTP/1.1^M$
Host: google.de^M$
User-Agent: Mozilla/5.0^M$
Accept: text/xml^M$
Accept-Language: en-us;q=0.5,en;q=0.3^M$
Accept-Encoding: gzip,deflate^M$
Accept-Charset: ISO-8859-1,utf-8^M$
Keep-Alive: 300^M$
Connection: keep-alive^M$
Cookie: GPC=4FW=0:This is traffic from ubuntu to neely.$
^M$
^M$

taosecurity:/home/analyst$ cat -tev 192.168.002.115.43598-192.168.002.101.02510
^A^B^C0 FW=0:This is traffic from ubuntu to neely.$
^A^B^C1 FW=0:This is traffic from ubuntu to neely.$

taosecurity:/home/analyst$ cat -tev 192.168.002.115.52158-192.168.002.101.00020
^A^B^C2 FW=0:This is traffic from ubuntu to neely.$
^A^B^C3 FW=0:This is traffic from ubuntu to neely.$

At the end of the day we have messages exchanged using one real protocol (HTTP, with payload in the cookie field) and two pseudo-protocols (raw traffic on port 2510 TCP and attempted simulated FTP data traffic). The FTP data traffic isn't simulated properly because the SYN segments go to port 20 TCP.

$ tcpdump -n -t -r ph.1.lpc port 20
reading from file ph.1.lpc, link-type EN10MB (Ethernet)
IP 192.168.2.115.52158 > 192.168.2.101.20:
 S 2100176842:2100176842(0) win 5840 
IP 192.168.2.101.20 > 192.168.2.115.52158:
 S 3955486862:3955486862(0) ack 2100176843 win 5792
IP 192.168.2.115.52158 > 192.168.2.101.20: . ack 1 win 183

IP 192.168.2.101.45106 > 192.168.2.115.20:
 S 3970907263:3970907263(0) win 5840
IP 192.168.2.115.20 > 192.168.2.101.45106:
 S 671130558:671130558(0) ack 3970907264
IP 192.168.2.101.45106 > 192.168.2.115.20: . ack 1 win 1460
IP 192.168.2.115.52158 > 192.168.2.101.20: P 1:49(48) ack 1 win 183 
IP 192.168.2.101.20 > 192.168.2.115.52158: . ack 49 win 1448
IP 192.168.2.115.52158 > 192.168.2.101.20: P 49:97(48) ack 1 win 183 
IP 192.168.2.101.20 > 192.168.2.115.52158: . ack 97 win 1448
IP 192.168.2.115.52158 > 192.168.2.101.20: F 97:97(0) ack 1 win 183
IP 192.168.2.115.20 > 192.168.2.101.45106: F 1:1(0) ack 1 win 181
IP 192.168.2.101.45106 > 192.168.2.115.20: F 1:1(0) ack 2 win 1460
IP 192.168.2.101.20 > 192.168.2.115.52158: F 1:1(0) ack 98 win 1448
IP 192.168.2.115.20 > 192.168.2.101.45106: . ack 2 win 181
IP 192.168.2.115.52158 > 192.168.2.101.20: . ack 2 win 183 

Real active FTP data traffic comes from port 20 TCP.

Can this technique be improved? Sure. Is it tough to analyze? Possibly. If you use a packet-by-packet approach, you can see what's happening. For example, here are a few packets containing payloads. Notice the use of the Tshark display filter using the -R switch.

richard@neely:~$ tshark -r ph.1.lpc -x -R 'tcp.len >= 20'
 19  62.570303 192.168.2.101 50200 192.168.2.115 2510 TCP 50200 > 2510
 [PSH, ACK] Seq=1 Ack=1 Win=5840 Len=48 TSV=4768072 TSER=3038481

0000  00 13 02 4c 30 2d 00 13 02 4c 30 2d 08 00 45 00   ...L0-...L0-..E.
0010  00 64 24 88 40 00 40 06 8f e3 c0 a8 02 65 c0 a8   .d$.@.@......e..
0020  02 73 c4 18 09 ce eb e8 a2 75 28 9d e1 d0 80 18   .s.......u(.....
0030  05 b4 e3 5b 00 00 01 01 08 0a 00 48 c1 48 00 2e   ...[.......H.H..
0040  5d 11 01 02 03 30 20 46 57 3d 30 3a 54 68 69 73   ]....0 FW=0:This
0050  20 69 73 20 74 72 61 66 66 69 63 20 66 72 6f 6d    is traffic from
0060  20 6e 65 65 6c 79 20 74 6f 20 75 62 75 6e 74 75    neely to ubuntu
0070  2e 0a                                             ..

 21  70.543503 192.168.2.115 43598 192.168.2.101 2510 TCP 43598 > 2510
 [PSH, ACK] Seq=1 Ack=1 Win=5856 Len=48 TSV=3055661 TSER=4752430

0000  00 13 02 4c 30 2d 00 13 02 4c 30 2d 08 00 45 00   ...L0-...L0-..E.
0010  00 64 13 0f 40 00 40 06 a1 5c c0 a8 02 73 c0 a8   .d..@.@..\...s..
0020  02 65 aa 4e 09 ce 7d 50 49 4a eb ba 86 09 80 18   .e.N..}PIJ......
0030  00 b7 70 7a 00 00 01 01 08 0a 00 2e a0 2d 00 48   ..pz.........-.H
0040  84 2e 01 02 03 30 20 46 57 3d 30 3a 54 68 69 73   .....0 FW=0:This
0050  20 69 73 20 74 72 61 66 66 69 63 20 66 72 6f 6d    is traffic from
0060  20 75 62 75 6e 74 75 20 74 6f 20 6e 65 65 6c 79    ubuntu to neely
0070  2e 0a                                             ..

 23  84.876175 192.168.2.101 50200 192.168.2.115 2510 TCP 50200 > 2510
 [PSH, ACK] Seq=49 Ack=1 Win=5840 Len=48 TSV=4773648 TSER=3053597

0000  00 13 02 4c 30 2d 00 13 02 4c 30 2d 08 00 45 00   ...L0-...L0-..E.
0010  00 64 24 89 40 00 40 06 8f e2 c0 a8 02 65 c0 a8   .d$.@.@......e..
0020  02 73 c4 18 09 ce eb e8 a2 a5 28 9d e1 d0 80 18   .s........(.....
0030  05 b4 92 56 00 00 01 01 08 0a 00 48 d7 10 00 2e   ...V.......H....
0040  98 1d 01 02 03 31 20 46 57 3d 30 3a 54 68 69 73   .....1 FW=0:This
0050  20 69 73 20 74 72 61 66 66 69 63 20 66 72 6f 6d    is traffic from
0060  20 6e 65 65 6c 79 20 74 6f 20 75 62 75 6e 74 75    neely to ubuntu
0070  2e 0a                                             ..

 25  88.388511 192.168.2.115 43598 192.168.2.101 2510 TCP 43598 > 2510
 [PSH, ACK] Seq=49 Ack=1 Win=5856 Len=48 TSV=3060172 TSER=4770065

0000  00 13 02 4c 30 2d 00 13 02 4c 30 2d 08 00 45 00   ...L0-...L0-..E.
0010  00 64 13 10 40 00 40 06 a1 5b c0 a8 02 73 c0 a8   .d..@.@..[...s..
0020  02 65 aa 4e 09 ce 7d 50 49 7a eb ba 86 09 80 18   .e.N..}PIz......
0030  00 b7 19 c7 00 00 01 01 08 0a 00 2e b1 cc 00 48   ...............H
0040  c9 11 01 02 03 31 20 46 57 3d 30 3a 54 68 69 73   .....1 FW=0:This
0050  20 69 73 20 74 72 61 66 66 69 63 20 66 72 6f 6d    is traffic from
0060  20 75 62 75 6e 74 75 20 74 6f 20 6e 65 65 6c 79    ubuntu to neely
0070  2e 0a                                             ..

 27  97.214303 192.168.2.101 49586 192.168.2.115 80 HTTP GET / HTTP/1.1

0000  00 13 02 4c 30 2d 00 13 02 4c 30 2d 08 00 45 00   ...L0-...L0-..E.
0010  01 4d e2 06 40 00 40 06 d1 7b c0 a8 02 65 c0 a8   .M..@.@..{...e..
0020  02 73 c1 b2 00 50 ec 6f 64 f6 27 b7 a8 06 80 18   .s...P.od.'.....
0030  05 b4 16 d2 00 00 01 01 08 0a 00 48 e3 1d 00 2e   ...........H....
0040  5d 0f 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31   ].GET / HTTP/1.1
0050  0d 0a 48 6f 73 74 3a 20 67 6f 6f 67 6c 65 2e 64   ..Host: google.d
0060  65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d   e..User-Agent: M
0070  6f 7a 69 6c 6c 61 2f 35 2e 30 0d 0a 41 63 63 65   ozilla/5.0..Acce
0080  70 74 3a 20 74 65 78 74 2f 78 6d 6c 0d 0a 41 63   pt: text/xml..Ac
0090  63 65 70 74 2d 4c 61 6e 67 75 61 67 65 3a 20 65   cept-Language: e
00a0  6e 2d 75 73 3b 71 3d 30 2e 35 2c 65 6e 3b 71 3d   n-us;q=0.5,en;q=
00b0  30 2e 33 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f   0.3..Accept-Enco
00c0  64 69 6e 67 3a 20 67 7a 69 70 2c 64 65 66 6c 61   ding: gzip,defla
00d0  74 65 0d 0a 41 63 63 65 70 74 2d 43 68 61 72 73   te..Accept-Chars
00e0  65 74 3a 20 49 53 4f 2d 38 38 35 39 2d 31 2c 75   et: ISO-8859-1,u
00f0  74 66 2d 38 0d 0a 4b 65 65 70 2d 41 6c 69 76 65   tf-8..Keep-Alive
0100  3a 20 33 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f   : 300..Connectio
0110  6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 43   n: keep-alive..C
0120  6f 6f 6b 69 65 3a 20 47 50 43 3d 32 46 57 3d 30   ookie: GPC=2FW=0
0130  3a 54 68 69 73 20 69 73 20 74 72 61 66 66 69 63   :This is traffic
0140  20 66 72 6f 6d 20 6e 65 65 6c 79 20 74 6f 20 75    from neely to u
0150  62 75 6e 74 75 2e 0a 0d 0a 0d 0a                  buntu......

This tool demonstrates the importance of a few NSM concepts. First, intruders are unpredictable. (Remember I use the term "intruder" to mean anyone doing something you don't like on your network, i.e., any policy violater. Second, by collecting everything and investigating once you have indicators, you can find activity not observed by existing inspection and blocking systems. Third, there is no substitute for full content. Statistics are nice, sessions are better, but only full content reveals what's really happening. Even session tools can be fooled or misguided, or at least have their output subject to misinterpretation.

I expect to see additional iterations of this tool and technique.

Read More

No hacking activites

Been really busy with all the results i got from my projects and pretty occupied with report writing. I am handling a few projects currently and well, there ain't anytime for me to research or perform any sorta testing or hacking. This is good in the sense that it keeps me busy and at least i feel "useful" to my company in the sense that i am performing audits for our customers during this peak period. I will definitely resume back to the hacking mode soon and check out for more cool ill street hacking. As of blogging now, i am still writing long unfinished reports. Reports are piling up if i don't start doing it. Till then, stay tuned for my next installment.

The Hacka Man

Read More

Great Papers from Honeynet Project

If you haven't seen them yet, Know Your Enemy: Behind the Scenes of Malicious Web Servers and Know Your Enemy: Malicious Web Servers are two great papers by the Honeynet Project. You might want to see Web Server Botnets and Server Farms as Attack Platforms by Gadi Evron as background. You'll notice people like e0n are using NSM to combat bots. I have not seen any IRC-controlled SIP/VoIP attack bots and botnets yet. If you think your IPS will save you against bots, keep in mind the time it takes to update some of them. I also recommend reading The World's Biggest Botnets by Kelly Jackson Higgins.

Read More

FreeBSD Binary Upgrade News

If you've read my previous posts on FreeBSD binary upgrades you'll see that Colin Percival's work on this subject has been one of my favorite additions to FreeBSD during the last few years. I recommend reading the latest two posts on Colin's blog for even more good news: FreeBSD minor version upgrades and FreeBSD major version upgrades using FreeBSD update.

I plan to deploy FreeBSD 7.0 in production soon, and the native capability to upgrade the OS using binary means is incredibly welcome. I build sensors to inspect and capture traffic, not recompile themselves. Congratulations and thanks to Colin for all of his work in this area and for integrating FreeBSD update into the base OS.

On another FreeBSD note, I need to try this: Building bootable FreeBSD/i386 images.

Read More

Impact of NetFlow on Routers

Thanks to the great IOShints blog for pointing me to NetFlow Performance Analysis. If you have any questions regarding the impact of generating NetFlow records on your routers, check out this Cisco white paper.

Read More

Must-Read Snort 3.0 Post

If you care at all about Snort you must read Snort 3.0 Architecture Series Part 1: Overview by Marty Roesch. Keep reading his blog for future descriptions of Snort 3.0. On a related note, Marty released Daemonlogger 1.0 recently. Daemonlogger is an open source full content packet logging tool.

Read More

More Unpredictable Intruders

Search my blog for the term unpredictable and the majority of the results describe discussions of one of my three security principles, namely

Many intruders are unpredictable.

Two posts by pdp perfectly demonstrate this:

• Bugs in the Browser: Firefox’s DATA URL Scheme Vulnerability


• Web Mayhem: Firefox’s JAR: Protocol issues

How many of you who are not security researchers even knew that data: or jar: protocols existed? (It's rhetorical, no need to answer in a comment.) Do you think your silver bullet security product knows about it? How about your users or developers?

No, this is another case where the first time you learn of a feature in a product is in a description of how to attack it. This is why the "ahead of the threat" slogan at the left is a pile of garbage. This is another example of Attacker 3.0 exploiting features devised by Developer 2.5 while Security 1.0 is still thinking about how great it is no big worms have hit since 2005. (The specific cases here are worse than Developer 2.5, since jar: and data: protocols are apparently old!)

How do I propose handling issues like this? As always, NSM is helpful. If you've been keeping track of what happens in your enterprise, you can perform some retrospective network analysis (RNA) to see if you've seen this latest attack vector. (RNA is a term which Network Instruments would like to have coined. I like it, even though the concept of recording traffic in this manner dates back to Todd Heberlein's original Network Security Monitor in 1988. The first mention I can quickly find is in this 1997 paper Netanalyzer: A retrospective network analysis tool.)

RNA and, from this point of enlightenment, ongoing network analysis via NSM and, ideally, other forms of instrumentation (logs, etc.) facilitates impact assessment. Who cares if the sky is falling somewhere else, as reported in whatever online news story -- is your sky falling? If yes, what's the damage? How best can we mitigate and recover? These are the sorts of questions one can answer when some data is available, enabling management by fact and avoiding management by belief.

Read More