Muxing AccessControl and FileInfo objects

Most of us know the members (partially printed at bottom) of System.Security.AccessControl and System.IO.FileInfo. And most of us know they both share the PS* NoteProperty items:

• PSChildName                     NoteProperty   System.String PSChildName=test.txt
• PSDrive                         NoteProperty   System.Management.Automation.PSDriveInfo PSDrive=C
• PSParentPath                    NoteProperty   System.String PSParentPath=Microsoft.PowerShell.Core\FileSystem::C:\
• PSPath                          NoteProperty   System.String PSPath=Microsoft.PowerShell.Core\FileSystem::C:\test.txt
• PSProvider                      NoteProperty  

These 'NoteProperty' may be what makes co-operation between 'get-childitem' (alias 'ls' or 'gci') and 'get-acl'  straightforward:
[gci * | get-acl]

However, this produces a System.Security.AccessControl object only. What if you need to see both FileInfo properties and AccessControl properties in the same object?  For this we will have to do something more clever. Calculated Properties help us mux AccessControl and FileInfo objects into one, giving us an output of all files with their AccessControl information sorted by LastAccessTime. This is easier to do because AccessControl and FileInfo objects share the 'PSChildName' NoteProperty which acts here as a type of primary key:

function Check-RecentAccess {
[CmdletBinding()]
    Param(
        [Parameter(ValueFromPipeline=$true)]
           [int]$days=1
    )
$StartTime = (get-date) - (new-timespan -days $days)
$List=gci * | where {!$_.psiscontainer}
$Query= foreach ($i in $List) { gci $i |Select FullName,*Time, @{Label="Access";Expression={get-acl $_.PSChildName | % {$_.AccessToString}}}, @{Label="Owner";Expression={get-acl $_.PSChildName| % {$_.Owner}}}}
$Query | Select LastAccessTime,CreationTime,FullName,Owner,Access| where {$_.LastAccessTime -gt $StartTime} |Sort -descending LastAccessTime
}

I have uploaded:


Check-RecentAccess 
Check-RecentAccessRecurse


TypeName: System.Security.AccessControl.FileSecurity


Name                            MemberType     Definition
----                            ----------     ----------
Access                          CodeProperty   System.Security.AccessControl.AuthorizationRuleCollection Access{get=GetAccess;}
Group                           CodeProperty   System.String Group{get=GetGroup;}
Owner                           CodeProperty   System.String Owner{get=GetOwner;}
Path                            CodeProperty   System.String Path{get=GetPath;}
Sddl                            CodeProperty   System.String Sddl{get=GetSddl;}
....


TypeName: System.IO.FileInfo


Name                      MemberType     Definition
----                      ----------     ----------
Mode                      CodeProperty   System.String Mode{get=Mode;}
AppendText                Method         System.IO.StreamWriter AppendText()
CopyTo                    Method         System.IO.FileInfo CopyTo(string destFileName), System.IO.FileInfo CopyTo(string destFileName, bool overwrite)
Create                    Method         System.IO.FileStream Create()
CreateObjRef              Method         System.Runtime.Remoting.ObjRef CreateObjRef(type requestedType)
...

Read More

TaoSecurity Security Effectiveness Model

After my last few Tweets as @taosecurity on threat-centric vs vulnerability-centric security, I sketched this diagram to help explain my thinking.



Security consists of three areas of interest: 1) What defenders think should be defended, whether or not it matters to the adversary or whether it is in reality defended, what I label "Defensive Plan"; 2) What the adversary thinks matters and really should be defended, but might not be, what I label as "Threat Actions"; and 3) What is in reality defended in the enterprise, whether or not defenders or the adversary cares, what I label "Live Defenses".



I call the Defensive Plan "Correct" when it overlaps with the Adversary Actions, because the defenders correctly assessed the threat's interests. I call it "Incorrect" when Live Defenses are applied to areas outside the interest of the security team or outside the interest of the adversary.



I call the area covered by the Live Defenses as "Defended," but I don't assume the defenses are actually sufficient. Some threats will escalate to whatever level is necessary to achieve their mission. In other words, the only way to not be compromised is to not be targeted! So, I call areas that aren't defended at all "Compromised" if the adversary targets them. Areas not targeted by the adversary are "Compromise Avoided." Areas targeted by the adversary but also covered by Live Defense are "Compromise Possible."



The various intersections produce some interesting effects. For example:

1. If you're in the lower center area titled "Incorrect, defended, compromise possible," and your defenses hold, you're just plain lucky. You didn't anticipate the adversary attacking you, but somehow you had a live defense covering it.



2. If you're near the left middle area titled "Correct, undefended, compromised," this means you knew what to expect but you couldn't execute. You didn't have any live defenses in place.



3. If you're in the area just below the previous space, titled "Incorrect, undefended, compromised," you totally missed the boat. You didn't expect the adversary to target that resource, and you didn't happen to have any live defenses protecting it.



4. If you're in the very center, called "Correct, defended, compromise possible," congratulations -- this is where you expected your security program to operate, you deployed defenses that were live, but the result depends on how much effort the adversary applies to compromising you. This is supposed to be "security Nirvana" but your success depends more on the threat than on your defenses.



5. The top-most part titled "Incorrect, undefended, compromise avoided" shows a waste of planning effort, but not wasted live defenses. That's a mental worry region only.



6. The right-most part titled "Incorrect, defended, compromise avoided" shows a waste of defensive effort, which you didn't even plan. You could probably retire all the security programs and tools in that area.



7. The area near the top titled "Incorrect, defended, compromise avoided" shows you were able to execute on your vision but the adversary didn't bother attacking those resources. That's also waste, but less so since you at least planned for it.

What do you think of this model? Obviously you want to make all three circles overlap as much as possible, such that you plan and defend what the threat intends to attack. That's the idea of threat-centric security in a nutshell -- or maybe a Venn diagram.

Tweet

Read More

TCP/IP Weapons School 3.0 in McLean, VA 26-27 Oct

I just created a class page for my upcoming TCP/IP Weapons School 3.0 in McLean, VA on 26-27 October 2011. I decided to offer this class because I haven't taught anything nearby in quite a while, and many people asked for a class in NoVA. I don't plan to offer this sort of "solo" (i.e., outside Black Hat) class again (or anytime soon). So, if you're in the neighborhood and you'd like to attend a TWS3 class, this could be your chance! The venue only seats 20-25 students, so please keep that in mind. You can register through RegOnline immediately. Thank you.



Tweet

Read More

New-Object -ComObject Shell.Application

Here are some notes on exposing  the Shell as a ComObject with Powershell. Here, I trace down the cookies folder:


$a = New-Object -ComObject Shell.Application
$b=1..100
 foreach ($i in $b) {write "$i $($a | % {$_.Namespace($i).Self.Path})"}
....
32 C:\Users\rferrisx\AppData\Local\Microsoft\Windows\Temporary Internet Files
33 C:\Users\rferrisx\AppData\Roaming\Microsoft\Windows\Cookies
34 C:\Users\rferrisx\AppData\Local\Microsoft\Windows\History
...
($a | % {ls -recurse $_.Namespace(33).Self.Path }).count
2385

($a | % {ls -recurse $_.Namespace(33).Self.Path | gc }) | more

__utma
173272373.1981518736.1312989611.1312989611.1312989656.2
google.com/mail/help/
1088
187792384
30315796
433027780
30168945
*
...

Powershell gives us some opportunities to look at Windows file structure internals. The output of these commands gives us the objects referenced by the file system for the Windows Shell:

$a = New-Object -ComObject Shell.Application

$b=0..60

foreach ($i in $b) {write "$i $($a | % {$_.Namespace($i).Title})"}
foreach ($i in $b) {write "$i $($a | % {$_.Namespace($i).Self.Path})"}

I can line them up in  spreadsheet (as below). Some are file paths give as GUIDs (or CLSIDs?). Others are blank:

0	Desktop	C:\Users\rferrisx\Desktop
1	The Internet	::{871C5380-42A0-1069-A2EA-08002B30309D}
2	Programs	C:\Users\rferrisx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
3	All Control Panel Items	::{26EE0668-A00A-44D7-9371-BEB064C98683}\0
4	Printers	::{21EC2020-3AEA-1069-A2DD-08002B30309D}\::{2227A280-3AEA-1069-A2DE-08002B30309D}
5	My Documents	C:\Users\rferrisx\Documents
6	Favorites	C:\Users\rferrisx\Favorites
7	Startup	C:\Users\rferrisx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
8	Recent Items	C:\Users\rferrisx\AppData\Roaming\Microsoft\Windows\Recent
9	SendTo	C:\Users\rferrisx\AppData\Roaming\Microsoft\Windows\SendTo
10	Recycle Bin	::{645FF040-5081-101B-9F08-00AA002F954E}
11	Start Menu	C:\Users\rferrisx\AppData\Roaming\Microsoft\Windows\Start Menu
12	12
13	My Music	C:\Users\rferrisx\Music
14	My Videos	C:\Users\rferrisx\Videos
15	15
16	Desktop	C:\Users\rferrisx\Desktop
17	Computer	::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
18	Network	::{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
19	Network Shortcuts	C:\Users\rferrisx\AppData\Roaming\Microsoft\Windows\Network Shortcuts
20	Fonts	C:\Windows\Fonts
21	Templates	C:\Users\rferrisx\AppData\Roaming\Microsoft\Windows\Templates
22	Start Menu	C:\ProgramData\Microsoft\Windows\Start Menu
23	Programs	C:\ProgramData\Microsoft\Windows\Start Menu\Programs
24	Startup	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
25	Public Desktop	C:\Users\Public\Desktop
26	Roaming	C:\Users\rferrisx\AppData\Roaming
27	Printer Shortcuts	C:\Users\rferrisx\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
28	Local	C:\Users\rferrisx\AppData\Local
29	Startup	C:\Users\rferrisx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
30	Startup	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
31	Favorites	C:\Users\rferrisx\Favorites
32	Temporary Internet Files	C:\Users\rferrisx\AppData\Local\Microsoft\Windows\Temporary Internet Files
33	Cookies	C:\Users\rferrisx\AppData\Roaming\Microsoft\Windows\Cookies
34	History	C:\Users\rferrisx\AppData\Local\Microsoft\Windows\History
35	ProgramData	C:\ProgramData
36	Windows	C:\Windows
37	System32	C:\Windows\System32
38	Program Files	C:\Program Files
39	My Pictures	C:\Users\rferrisx\Pictures
40	rferrisx	C:\Users\rferrisx
41	SysWOW64	C:\Windows\SysWOW64
42	Program Files (x86)	C:\Program Files (x86)
43	Common Files	C:\Program Files\Common Files
44	Common Files	C:\Program Files (x86)\Common Files
45	Templates	C:\ProgramData\Microsoft\Windows\Templates
46	Public Documents	C:\Users\Public\Documents
47	Administrative Tools	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
48	Administrative Tools	C:\Users\rferrisx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
49	Network Connections	::{21EC2020-3AEA-1069-A2DD-08002B30309D}\::{7007ACC7-3202-11D1-AAD2-00805FC1270E}
50	50
51	51
52	52
53	Public Music	C:\Users\Public\Music
54	Public Pictures	C:\Users\Public\Pictures
55	Public Videos	C:\Users\Public\Videos
56	Resources	C:\Windows\Resources
57	409	C:\Windows\Resources\0409
58	OEM Links	C:\ProgramData\OEM Links
59	Temporary Burn Folder	C:\Users\rferrisx\AppData\Local\Microsoft\Windows\Burn\Burn

What are those GUID (or CLSID) paths? The 49th appears to be the non-browsable folder:
"All Control Panel Items"\"Network Connections"

$a | % {$_.Namespace(49).ParentFolder.Self.GetFolder.Self}

Application  : System.__ComObject
Parent       : System.__ComObject
Name         : All Control Panel Items
Path         : ::{21EC2020-3AEA-1069-A2DD-08002B30309D}
GetLink      :
GetFolder    : System.__ComObject
IsLink       : False
IsFolder     : True
IsFileSystem : False
IsBrowsable  : False
ModifyDate   : 12/30/1899 12:00:00 AM
Size         : 0
Type         : System Folder

$a | % {$_.Namespace(49).ParentFolder.Self.GetFolder.Self.Name}
All Control Panel Items

$a | % {$_.Namespace(49).Self.GetFolder.Self}

Application  : System.__ComObject
Parent       : System.__ComObject
Name         : Network Connections
Path         : ::{21EC2020-3AEA-1069-A2DD-08002B30309D}\::{7007ACC7-3202-11D1-AAD2-00805FC1270E}
GetLink      :
GetFolder    : System.__ComObject
IsLink       : False
IsFolder     : True
IsFileSystem : False
IsBrowsable  : False
ModifyDate   : 12/30/1899 12:00:00 AM
Size         : 0
Type         : System Folder

$a | % {$_.Namespace(49).Self.GetFolder.Self.Name}
Network Connections

Read More

Tutorial Geek is moving to China!

So I am in the San Francisco airport right now waiting to board a plane for China. This could mean that Tutorial Geek will be blocked by the great firewall of China for the next year, or it could be that my next few tutorials are how to get past that. Perhaps there will be some Chinese posts coming up in the near future!

Read More

Jaime Metzl Describes "China's Threat to World Order"

Props to LS for pointing me to this WSJ article titled China's Threat to World Order. I found the following pertinent for the "cyber" aspect:



Allegations that the Chinese government is behind the largest computer hacking operation in history will not come as a surprise to observers of recent trends in international relations. If there is one thing that China's actions across a range of fields have made clear, it is that Beijing will do whatever it takes to advance its narrowly defined economic interests, even if that requires riding roughshod over global norms...



It is no longer acceptable for China to claim global leadership in some areas but then pretend it is a weak developing country and shirk its responsibilities in others. A China that leads the world in the theft of intellectual property, computer hacking and resource nationalism will prove extremely destabilizing. If it continues on this course, Beijing should not be surprised if other countries begin to band together to collectively counter some of the more harmful implications of China's rise.



I think contrasting China with Russia may be helpful here. We tend to have more cooperation with Russia, even in areas of digital security; for example, see the work of the EastWest Institute.



After publishing the WSJ article, Jaime then summarized open reporting on China's activities over the last few years and published the result at China and Cyber-Espionage.



Tweet

Read More

Expect to Hear "IDS Is Dead" (Again)

Do you remember when IDS was dead, and supposed to be replaced by "thought-leading firewalls" by 2005?



Well, that prediction died pretty quickly. However, I expect to hear it again after reading DIB cybersecurity pilot has stopped 'hundreds' of intrusions, says Lynn:



About 20 companies participate in the Defense Department's 90-day pilot for an active network defense capability for the defense industrial base analogous to the Homeland Security Department's Einstein 3 effort, said Deputy Defense Secretary William Lynn.



During an address to the 2011 DISA Customer and Industry Forum in Baltimore, Md., Lynn said the sharing of malicious code signatures gathered through intelligence efforts to pilot participants has already stopped "hundreds of intrusions."



Lynn also laid blame for intrusions into military and defense industrial base networks on "foreign intelligence services," stating that they have stolen military plans, weapons system designs, source code and other intellectual property.



"This kind of cyber exploitation does not have the dramatic impact of a conventional military attack," Lynn said. "But over the long term, it has a deeply corrosive effect. It blunts our edge in military technology and saps our competitiveness in the global economy."



Foreign intruders have extracted terabytes of data from defense companies, he added.



This sort of story is likely to lead to the same arguments I heard eight years ago regarding "Intrusion Detection Systems" vs "Intrusion Prevention Systems," namely:



If you can detect it, why can't you prevent it?



This is a broad topic, so rather than try to answer everything here and now, I'll likely work on it over the coming weeks in individual posts.



Tweet

Read More

Bejtlich Leading Session at IANS

The IANS group just posted their fall forum announcement. It states I will be leading a session on the APT at their event in Boston on 20 September 2011.



Kicking off the morning will be Richard’s session on “Mitigating the Advanced Persistent Threat.” IANS continually hears from our clients that APT and cyber crime is a constant, nagging concern (if not for their own company… yet, then because of headline news read by company executives), and it is the CISO’s job to deal with real, perceived, and impending APT issues.



Thus, during his session Richard will provide advice and real-life use cases on what he’s seen, what’s worked, what doesn’t, and what CISOs can do to deal with APTs at their own organizations.



Following the short presentation portion of the session, CISOs will collectively discuss 1) How to keep up with industry-specific threats; 2) Tactics and techniques to detect and mitigate the APT; and 3) The real implications of APT incidents



This should be a great event, because the afternoon session also features Grady Summers, my old boss from GE (who was the CISO there). Grady will:



lead CISO participants through a follow-on discussion on managing cyber security at a board level. With today's threats consistently making front-page news, even the most traditional boards are starting to ask about cyber security.



To be prepared for such an event, Grady will walk participants through varying scenarios on handling: 1) What works and what’s not effective with regard to board communication on information security; 2) What audit committee chairs at some of the world's biggest companies are saying about security; and 3) Why you might not be doing your job if you're trying to "speak the language of the business" to your board.



I think this will be a great event, without death by PowerPoint. Please visit the announcement for registration information. Thank you.

Tweet

Read More

Check Out MANDIANT Job Postings

If you visit www.mandiant.com/hireme you'll notice MANDIANT is looking to hire a ton of people over the next few weeks and months. We have openings all over the company, including my MCIRT business line. Basically if you're the go-to person in your organization for coding, doing, or supporting incident detection and response tools and/or techniques, you will probably find an interesting job here!



The easiest way to start the process is to pick a role and submit your resume. Thank you for your consideration.



Tweet

Read More

Tao of NSM Errata and Possible Book Plans

Recently an astute reader, Greg Back, submitted three corrections for typos to my first book, The Tao of Network Security Monitoring. I just uploaded these to the errata page and will submit them to the publisher now. Thanks to Greg for so closely reading the text and catching the errors! They involved miscounting bytes in two packets, and saying bytes where I should have said bits elsewhere.



On a related note, I'm considering reviewing my material from the TCP/IP Weapons School (versions 1, 2, and 3) and writing a book based on the best aspects of each class. I wouldn't expect the book to arrive any earlier than late 2012, when I expect to retire the third version of TWS, currently taught in live classes. Over the last few years many of you have asked what I plan to do with the older TWS material, and I think this might be the best way to put it to good use. As I figure out what to do I will keep you informed here.



Tweet

Read More

Bejtlich Webinar for Dark Reading and InformationWeek

Thanks to Dark Reading and InformationWeek I will participate in the How Security Breaches Happen online virtual event on 25 August 2011. At 1330 ET I present with Nicholas J. Percoco and Kelly Jackson Higgins on "Why Bad Breaches Happen To Good Companies."



I will share the enterprise/CSO perspective while Nicholas will present the adversary simulation/pen tester perspective. Kelly will moderate. Lots of other speakers will participate from 1030 ET to 1815 ET.



We hope you can attend!

Tweet

Read More

Bejtlich Keynote at Hawaiian Telcom Conference

Thanks to Hawaiian Telcom I will be speaking at their 2011 Security Conference in Honolulu on 7 September 2011.



My topic is "Putting the A, P, and T into the Advanced Persistent Threat:"



Advanced Persistent Threat, or APT, is a controversial term. Just what qualifies as the APT? Who invented this term? Is it a marketing vehicle or is there a method to its use? In this keynote, Mandiant CSO Richard Bejtlich will explain the history of the APT, and what makes it Advanced, Persistent, and a Threat. He will discuss the concepts of "fighting through" an intrusion and "operating in a contested network," approaches to dealing with the APT that work in the real world.



My colleague and friend Kris Harms will also attend, presenting "Network Security FTW."



We hope to see you there! And no, Jeremiah Grossman, we will not be joining you to fight MMA-style. Well, maybe Harms will.



Tweet

Read More

Feedback from Latest TCP/IP Weapons School 3.0 Class

At Black Hat in Las Vegas and USENIX Security in San Francisco I taught three TCP/IP Weapons School 3.0 classes. I think my weekday class at Black Hat set a personal record student count, and I was glad to have Steve Andres from Special Ops Security there to help students with questions and lab issues!



I wanted to share some feedback from the classes, in case any of you are considering attending an upcoming class. Currently I'm scheduled to teach at Black Hat Abu Dhabi on 12-13 December. The only other possibilities for training this year include a class in northern VA in either September or October, and a class the weekend before USENIX LISA in Boston on 3-4 December 2011. Next year I will likely return to Las Vegas again in the summer (21-24 July) and DC in the fall (30-31 Oct) but beyond that I am not sure how much training I might do in 2012.



Student feedback from TWS3 included:

• I've been to a lot of training sessions and this was by far the best. The discussions were useful and practical. The labs were well done enough to repeat and follow them later.



• Excellent speaker, well-prepared and extremely engaging. Perfect balance of real world scenarios and information.



• Great course! More lab-based and little [i.e., fewer] PowerPoints is a recipe for success. Will recommend to others.



• This is the best Black Hat Training class I've ever taken. The techniques and information Richard taught are instantly usable in my day-to-day security analyst work. Well worth the time and money.



• Richard worked hard to answer our questions and tailor the class to our needs.



• Discussion-based training without PowerPoint was a great experience -- much more rewarding than death by .ppt!



• Richard does an excellent job presenting material in an engaging way.



• Excellent job handling diverse student population with very different skill levels.



• I would take another security course taught by Richard as well as recommend this course to others.

The students who attend to learn how to collect and analyze network- and log-centric artifacts and data in order to detect and respond to intrusions tend to like the class best.



Thank you to the students from all three classes for your participation!



Tweet

Read More

Impressions: Android Forensics

My final book in this batch is Android Forensics by Andrew Hoog. Due to the nature of Android and the author's experience with it, this book has a lot of great content. (In contrast, on page xiii, the author thanks iPhone and iOS Forensics co-author Katie Strzempka "for generally taking care of that other book." Hmm, maybe I should have known that before trying to assess that "other book?")



My only real concern with this book is that it might lack the focus required by a normal investigator. I'm sure many investigators simply want to know where to find key data (email, Web history, etc.) and then retrieve and analyze it in a forensically sound manner. It's the "so what" question that hangs over many forensics books. I would have liked a case study focusing on that sort of material to show how an investigator would make sense of the data and structures unearthed by the author throughout the book.



Tweet

Read More

Impressions: iPhone and iOS Forensics

The third forensics book in this batch is iPhone and iOS Forensics (IAIF) by Andrew Hoog and Katie Strzempka. This book is similar to iOS Forensic Analysis: for iPhone, iPad, and iPod touch by Sean Morrissey, in the sense that neither book is as strong as I might have hoped. Oddly enough, the aspects of Morrissey's book that were most compelling (like his overview of the various i-devices and attention to each of them) are weaker in IAIF.



I found IAIF to be a little confusing in its approach, with lack of rigor around discussing iPhone vs other platforms. I felt the authors should have either focused on one platform or given all of them equal attention. I also disliked mixing of what seemed to be jailbroken and non-jailbroken content. I prefer for forensics books to avoid using jailbreak techniques where possible, but it would have been helpful for the authors to be very clear where and why they use such methods.



Chapter 4 was supposed to cover security, but it was overall very disappointing. Chapter 6 probably has the core data of interest to a forensic investigator, namely where to find certain types of evidence (email, Web history, etc.) and how to get it. This is the sort of data missing from the Xbox book I just addressed.



I liked the material on downgrading iOS on a phone, but didn't like reading about basic Linux information in chapter 1. That should have been in an appendix.



Tweet

Read More

Impressions: XBox 360 Forensics

Next is Xbox 360 Forensics (X3F) by Steven Bolt. This book offers a lot of technical detail, but it seems to read more like a coroner's report than a guide for those doing forensics on the Xbox 360 platform. The author spends a lot of time documenting his analysis of the Xbox 360, but after perusing the book I took myself out of the role of scientist and into that of investigator.



An investigator (such as a law enforcement person) is likely to say "that's all nice, but can I read the suspect's email? Can I review his Web browsing history? Can I inspect the content of his instant messaging? How do I do that?" These are practical questions that do not really appear in X3F. Sure, the author tears apart the platform and its file system, but I don't see a way for an investigator to easily move from the current text to answering fundamental investigation questions.



Tweet

Read More

Impressions: Digital Forensics with Open Source Tools

For my fourth impressions post, I'll turn to the digital forensics world for Digital Forensics with Open Source Tools (DFWOST) by Cory Altheide and Harlan Carvey. I took a lot of notes but didn't read closely enough in my opinion to merit a full review.



I didn't like the way this book started. I can't tell if the authors expect the reader to be familiar with open source software or not. The book needed to start in chapter 2 with something like "let's start by selecting Ubuntu for our operating system. We like it for the following reasons..." In contrast, the reader suddenly finds himself in the "Working with Images" section trying to use losetup, mmls, doing math, etc. That's too fast! Many reading this book are going to get lost on page 23 between "sudo apt-get install libfuse-dev libexpat1-dev" and advice to use "a simple ./configure..."



Beyond the rough start, however, I thought the rest of the book was interesting. I liked reading about a variety of tools, especially trying to accomplish the same task on Linux and Windows. I enjoyed reading about hidden Windows Event Logs in ch 4 and about hachoir in ch 8. The book made great use of public evidence sources, like the Digital Corpora.



Near the end of the book (ch 9) I read a reference to Rob Lee's SIFT platform, so I wondered by the book didn't use it throughout? I also would have liked to have read more about log2timeline in ch 9.



One note for a second edition: some figures in the book feature resolutions so high that the text is not legible given the size of the screen captures.



I think you will like DFWOST, but I bet the second edition will be stronger.

Tweet

Read More

Impressions: The Shellcoder's Handbook, 2nd Ed

The third book for which I'd like to share my impressions is The Shellcoder's Handbook, 2nd Ed (TSH2E) by Chris Ainley, John Heasman, FX, and Gerardo Richarte. I liked TSH2E, but I could tell that the collaboration among four authors caused some issues that could have been addressed by better editing. For example, early parts of the book use both Intel and AT&T assembly syntax, but the reader doesn't get an explanation of either until chapter 7.



For me, the best aspect of TSH2E was the integration of real-world obstacles to exploiting victims. The book (although published in 2008) expertly addressed various defenses introduced in operating systems over the past decade. The authors usually start with simple concepts, promising to address tougher challenges later -- and they deliver.



One item early in the text caught my attention though. The book includes the following code to demonstrate spawning a shell:

int main(){

        char *name[2];



        name[0] = "/bin/sh";

        name[1] = 0x0;

        execve(name[0], name, 0x0);

        exit(0);

}

Then they show the following:

[jack@0day local]$ gcc shell.c -o shell

[jack@0day local]$ ./shell

sh-2.05b#

This looks like a section left over from the first edition by Jack Koziol. Why does the prompt change to a root shell? Should it not be a user shell, since user "jack" appears to have been running with user privileges? Maybe not?



Regardless, TSH2E is a very strong book with practical lessons and examples for anyone writing offensive code.

Tweet

Read More

Impressions: Reversing: Secrets of Reverse Engineering

I took a lot of notes while reading Reversing: Secrets of Reverse Engineering (RSORE) by Eldad Eilam, but I didn't read enough of the book to qualify in my opinion to write a true review. What I did read, though, was awesome. RSORE is very well written, clear, interesting, and features high production value and quality. Although Wiley published the book in 2005, I believe it's as relevant now as it was six years ago. In fact, I recommend pairing it with IDA Pro, 2nd Ed for a one-two RE punch.



The introduction part provided sound foundations, great coverage of low-level concepts, a helpful overview of the Win32 environment (albeit with a 32 bit focus) and a quick tools discussion.



The applied engineering part includes hunting for undocumented (as of 2005) native Windows APIs, analyzing the file format of an encryption program, auditing the vulnerability in idq.dll exploited by Code Red, and reversing a backdoor that communicates via IRC.



The cracking part featured solid references to legal precedents, academic papers, and books, then discussed copy protection, DRM, and anti-piracy concepts, followed by anti-reversing measures and cracking learning-tool "crackmes."



The final part described reversing .NET and decompilation.



Overall the book appears very strong and I recommend it based on the material I did read.



Tweet

Read More

Impressions: The IDA Pro Book, 2nd Ed

What better way to start my new book impressions technique than The IDA Pro Book, 2nd Ed (TIDP2E) by Chris Eagle. I didn't read the entire book because I am not a reverse engineer, nor am I an IDA Pro user. However, I find the field, the tools, and the people who do reverse engineering to be interesting.



My overall impression is that TIDP2E is an excellent book. Chris Eagle appears to have written an incredibly detailed and current text on IDA Pro. I noticed he cited material from RECon 2011, which happened earlier this year!



Besides teaching how to use IDA Pro, TIDP2E appears to teach programming and operating system concepts. The book compares various ways to disassemble code (primarily linear sweep vs recursive descent) as well as complementary tools. I like the regular use of footnotes and external references, and the production quality was very high.



Take a look at TIDB2E if you need a modern reference to this powerful tool suite.

Tweet

Read More

Book Reviews vs Impressions

I've been reading and reviewing technical books at Amazon.com since 1999, and trying to meet reading goals since 2000. Most of you know that I only review books that I read, unlike some of the people who post "reviews" at Amazon.com. I personally don't care to read "reviews" by people who don't read the books. What's the point?



However, I believe there is room for commentary on books, where I explicitly state that my reactions are based mainly on impressions and not thorough reading.



After looking at my personal reading list several months ago, I decided to not read some books thoroughly enough to merit a full review. One of the techniques I adopted was to take a book on a cross-country trip (IAD to LAX, for example) and read as much as I could, or as much as interested me, during those 4 to 6 hours.



During that time I would record notes, just as I do when writing book reviews. Unless I complete the book, I will not turn those notes into a proper Amazon.com book review.



Instead, I will post a new category of description, impressions, to this blog. These impressions will let you know what I think of a book based on paying attention to the areas that I find intriguing (if any).



I plan to use this approach with books outside my core areas of interest. For books within my core areas of interest, I will read and review them per normal.



None of these impressions candidates will qualify for my annual Best Book Bejtlich Read award.



For those not familiar with my reading approach, these reading posts might be helpful.



Tweet

Read More

Sorting Windows events by UserID: Part II (Building a Module)

I am a bit late to some v2.0 functionality.  I made my first attempt at creating a module, in this case a six function script that queries general information from an event log. I ran into at least two problems:

• (a) get-winevent is slow for high volume queries


• (b) modules so encapsulate their variables in functions that I could not find how to call all functions globally from an internal or external script.                                                                                                                                                                                                                                                                                                                                                                                           

You can find the system module locations with:


$env:PSModulePath 
(($env:PSModulePath -split(";"))[0])


$env:PSModulePath 
C:\Users\rferrisx\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\


(($env:PSModulePath -split(";"))[0])
C:\Users\rferrisx\Documents\WindowsPowerShell\Modules


After you have created your functions for your module, you can import them into your session:


Import-Module .\UserIDEventsModule.psm1


If you change your module you can remove it:


remove-module UserIDEventsModule


While your module is imported, you can list your functions:


$commands=(get-module UserIDEventsModule).ExportedCommands
$list=(($commands).Values) | %{$_.Name} | Sort
$list


0Check-EventLogsBySize
1Check-EventLogsByLastWrite
2Count-Providers
3Find-UniqueUserIDs
4UserID-filter
5Event-filter
logtime
Run-AllModFunc


I constructed an internal function to run all the modules that declared all the specific variables to the functions. However, whether I run such a function from as part of a module or an external script, I cannot alter the individual module function variables globally.  Setting the variables global with AllScope (as below) does not help:

function Global:Run-AllModFunc {

[CmdletBinding()]

    Param(

        [Parameter(ValueFromPipeline=$true)]

        [int]$Global:hours=1,

        [string]$Global:filter = "ID",

        [array]$Global:logs = @("Security","System","Application"),

        [string]$Modpath = (($env:PSModulePath -split(";"))[0]),

        $NoRun="Run-AllModFunc",

        $FileTime=[DateTime]::Now.ToFileTime()

        )



sv -Name hours -Option AllScope

sv -Name filter -Option AllScope

sv -Name logs -Option AllScope



$host.UI.RawUI.BufferSize = new-object System.Management.Automation.Host.Size(500,1000)

Import-Module $Modpath\UserIDEventsModule.psm1

$commands=(get-module UserIDEventsModule).ExportedCommands

$list=(($commands).Values) | %{$_.Name} | Sort

logtime | out-file -append  -encoding ascii -FilePath $($Filetime)

foreach ($func in $list) {if ($func -eq $NoRun ){} else {$($func;logtime); &($func) | ft -auto -wrap |  out-file -append  -encoding ascii -FilePath $($Filetime) }}

}

The module runs and produces a text file of critical information, but in the case of a security audit configuration as below, it processes events somewhat slowly, most obviously because of the volume of large amounts 'Filtering Platform Connections' events:



auditpol /get /category:* | findstr Success
  Security System Extension               Success and Failure
  System Integrity                        Success and Failure
  IPsec Driver                            Success and Failure
  Other System Events                     Success and Failure
  Security State Change                   Success and Failure
  Logon                                   Success and Failure
  Logoff                                  Success and Failure
  Account Lockout                         Success and Failure
  IPsec Main Mode                         Success and Failure
  IPsec Quick Mode                        Success and Failure
  IPsec Extended Mode                     Success and Failure
  Special Logon                           Success and Failure
  Other Logon/Logoff Events               Success and Failure
  Network Policy Server                   Success and Failure
  Filtering Platform Connection           Success
  Sensitive Privilege Use                 Success
  Process Termination                     Success
  Process Creation                        Success
  Authentication Policy Change            Success
  Filtering Platform Policy Change        Success



Run-AllModFunc
0Check-EventLogsBySize


2011     8  11   11      19       7 611


1Check-EventLogsByLastWrite


2011     8  11   11      19      12 741


2Count-Providers


2011     8  11   11      19      13 828


3Find-UniqueUserIDs


2011     8  11   11      20      10 522


4UserID-filter


2011     8  11   11      20      25 843


5Event-filter


2011     8  11   11      20      47 190


logtime


2011     8  11   11      21       7 207


If you will run the module as a job you must use the parameter 'initializationScript' to import the module into the job session:


start-job -name AllModFunc -initializationScript {import-module .\UserIDEventsModule.psm1} -scriptblock {Run-AllModFunc}

Read More