Impressions: XBox 360 Forensics

Next is Xbox 360 Forensics (X3F) by Steven Bolt. This book offers a lot of technical detail, but it seems to read more like a coroner's report than a guide for those doing forensics on the Xbox 360 platform. The author spends a lot of time documenting his analysis of the Xbox 360, but after perusing the book I took myself out of the role of scientist and into that of investigator.



An investigator (such as a law enforcement person) is likely to say "that's all nice, but can I read the suspect's email? Can I review his Web browsing history? Can I inspect the content of his instant messaging? How do I do that?" These are practical questions that do not really appear in X3F. Sure, the author tears apart the platform and its file system, but I don't see a way for an investigator to easily move from the current text to answering fundamental investigation questions.



Tweet

Read More

Impressions: Digital Forensics with Open Source Tools

For my fourth impressions post, I'll turn to the digital forensics world for Digital Forensics with Open Source Tools (DFWOST) by Cory Altheide and Harlan Carvey. I took a lot of notes but didn't read closely enough in my opinion to merit a full review.



I didn't like the way this book started. I can't tell if the authors expect the reader to be familiar with open source software or not. The book needed to start in chapter 2 with something like "let's start by selecting Ubuntu for our operating system. We like it for the following reasons..." In contrast, the reader suddenly finds himself in the "Working with Images" section trying to use losetup, mmls, doing math, etc. That's too fast! Many reading this book are going to get lost on page 23 between "sudo apt-get install libfuse-dev libexpat1-dev" and advice to use "a simple ./configure..."



Beyond the rough start, however, I thought the rest of the book was interesting. I liked reading about a variety of tools, especially trying to accomplish the same task on Linux and Windows. I enjoyed reading about hidden Windows Event Logs in ch 4 and about hachoir in ch 8. The book made great use of public evidence sources, like the Digital Corpora.



Near the end of the book (ch 9) I read a reference to Rob Lee's SIFT platform, so I wondered by the book didn't use it throughout? I also would have liked to have read more about log2timeline in ch 9.



One note for a second edition: some figures in the book feature resolutions so high that the text is not legible given the size of the screen captures.



I think you will like DFWOST, but I bet the second edition will be stronger.

Tweet

Read More

Impressions: The Shellcoder's Handbook, 2nd Ed

The third book for which I'd like to share my impressions is The Shellcoder's Handbook, 2nd Ed (TSH2E) by Chris Ainley, John Heasman, FX, and Gerardo Richarte. I liked TSH2E, but I could tell that the collaboration among four authors caused some issues that could have been addressed by better editing. For example, early parts of the book use both Intel and AT&T assembly syntax, but the reader doesn't get an explanation of either until chapter 7.



For me, the best aspect of TSH2E was the integration of real-world obstacles to exploiting victims. The book (although published in 2008) expertly addressed various defenses introduced in operating systems over the past decade. The authors usually start with simple concepts, promising to address tougher challenges later -- and they deliver.



One item early in the text caught my attention though. The book includes the following code to demonstrate spawning a shell:

int main(){

        char *name[2];



        name[0] = "/bin/sh";

        name[1] = 0x0;

        execve(name[0], name, 0x0);

        exit(0);

}

Then they show the following:

[jack@0day local]$ gcc shell.c -o shell

[jack@0day local]$ ./shell

sh-2.05b#

This looks like a section left over from the first edition by Jack Koziol. Why does the prompt change to a root shell? Should it not be a user shell, since user "jack" appears to have been running with user privileges? Maybe not?



Regardless, TSH2E is a very strong book with practical lessons and examples for anyone writing offensive code.

Tweet

Read More

Impressions: Reversing: Secrets of Reverse Engineering

I took a lot of notes while reading Reversing: Secrets of Reverse Engineering (RSORE) by Eldad Eilam, but I didn't read enough of the book to qualify in my opinion to write a true review. What I did read, though, was awesome. RSORE is very well written, clear, interesting, and features high production value and quality. Although Wiley published the book in 2005, I believe it's as relevant now as it was six years ago. In fact, I recommend pairing it with IDA Pro, 2nd Ed for a one-two RE punch.



The introduction part provided sound foundations, great coverage of low-level concepts, a helpful overview of the Win32 environment (albeit with a 32 bit focus) and a quick tools discussion.



The applied engineering part includes hunting for undocumented (as of 2005) native Windows APIs, analyzing the file format of an encryption program, auditing the vulnerability in idq.dll exploited by Code Red, and reversing a backdoor that communicates via IRC.



The cracking part featured solid references to legal precedents, academic papers, and books, then discussed copy protection, DRM, and anti-piracy concepts, followed by anti-reversing measures and cracking learning-tool "crackmes."



The final part described reversing .NET and decompilation.



Overall the book appears very strong and I recommend it based on the material I did read.



Tweet

Read More

Impressions: The IDA Pro Book, 2nd Ed

What better way to start my new book impressions technique than The IDA Pro Book, 2nd Ed (TIDP2E) by Chris Eagle. I didn't read the entire book because I am not a reverse engineer, nor am I an IDA Pro user. However, I find the field, the tools, and the people who do reverse engineering to be interesting.



My overall impression is that TIDP2E is an excellent book. Chris Eagle appears to have written an incredibly detailed and current text on IDA Pro. I noticed he cited material from RECon 2011, which happened earlier this year!



Besides teaching how to use IDA Pro, TIDP2E appears to teach programming and operating system concepts. The book compares various ways to disassemble code (primarily linear sweep vs recursive descent) as well as complementary tools. I like the regular use of footnotes and external references, and the production quality was very high.



Take a look at TIDB2E if you need a modern reference to this powerful tool suite.

Tweet

Read More

Book Reviews vs Impressions

I've been reading and reviewing technical books at Amazon.com since 1999, and trying to meet reading goals since 2000. Most of you know that I only review books that I read, unlike some of the people who post "reviews" at Amazon.com. I personally don't care to read "reviews" by people who don't read the books. What's the point?



However, I believe there is room for commentary on books, where I explicitly state that my reactions are based mainly on impressions and not thorough reading.



After looking at my personal reading list several months ago, I decided to not read some books thoroughly enough to merit a full review. One of the techniques I adopted was to take a book on a cross-country trip (IAD to LAX, for example) and read as much as I could, or as much as interested me, during those 4 to 6 hours.



During that time I would record notes, just as I do when writing book reviews. Unless I complete the book, I will not turn those notes into a proper Amazon.com book review.



Instead, I will post a new category of description, impressions, to this blog. These impressions will let you know what I think of a book based on paying attention to the areas that I find intriguing (if any).



I plan to use this approach with books outside my core areas of interest. For books within my core areas of interest, I will read and review them per normal.



None of these impressions candidates will qualify for my annual Best Book Bejtlich Read award.



For those not familiar with my reading approach, these reading posts might be helpful.



Tweet

Read More

Sorting Windows events by UserID: Part II (Building a Module)

I am a bit late to some v2.0 functionality.  I made my first attempt at creating a module, in this case a six function script that queries general information from an event log. I ran into at least two problems:

• (a) get-winevent is slow for high volume queries


• (b) modules so encapsulate their variables in functions that I could not find how to call all functions globally from an internal or external script.                                                                                                                                                                                                                                                                                                                                                                                           

You can find the system module locations with:


$env:PSModulePath 
(($env:PSModulePath -split(";"))[0])


$env:PSModulePath 
C:\Users\rferrisx\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules\


(($env:PSModulePath -split(";"))[0])
C:\Users\rferrisx\Documents\WindowsPowerShell\Modules


After you have created your functions for your module, you can import them into your session:


Import-Module .\UserIDEventsModule.psm1


If you change your module you can remove it:


remove-module UserIDEventsModule


While your module is imported, you can list your functions:


$commands=(get-module UserIDEventsModule).ExportedCommands
$list=(($commands).Values) | %{$_.Name} | Sort
$list


0Check-EventLogsBySize
1Check-EventLogsByLastWrite
2Count-Providers
3Find-UniqueUserIDs
4UserID-filter
5Event-filter
logtime
Run-AllModFunc


I constructed an internal function to run all the modules that declared all the specific variables to the functions. However, whether I run such a function from as part of a module or an external script, I cannot alter the individual module function variables globally.  Setting the variables global with AllScope (as below) does not help:

function Global:Run-AllModFunc {

[CmdletBinding()]

    Param(

        [Parameter(ValueFromPipeline=$true)]

        [int]$Global:hours=1,

        [string]$Global:filter = "ID",

        [array]$Global:logs = @("Security","System","Application"),

        [string]$Modpath = (($env:PSModulePath -split(";"))[0]),

        $NoRun="Run-AllModFunc",

        $FileTime=[DateTime]::Now.ToFileTime()

        )



sv -Name hours -Option AllScope

sv -Name filter -Option AllScope

sv -Name logs -Option AllScope



$host.UI.RawUI.BufferSize = new-object System.Management.Automation.Host.Size(500,1000)

Import-Module $Modpath\UserIDEventsModule.psm1

$commands=(get-module UserIDEventsModule).ExportedCommands

$list=(($commands).Values) | %{$_.Name} | Sort

logtime | out-file -append  -encoding ascii -FilePath $($Filetime)

foreach ($func in $list) {if ($func -eq $NoRun ){} else {$($func;logtime); &($func) | ft -auto -wrap |  out-file -append  -encoding ascii -FilePath $($Filetime) }}

}

The module runs and produces a text file of critical information, but in the case of a security audit configuration as below, it processes events somewhat slowly, most obviously because of the volume of large amounts 'Filtering Platform Connections' events:



auditpol /get /category:* | findstr Success
  Security System Extension               Success and Failure
  System Integrity                        Success and Failure
  IPsec Driver                            Success and Failure
  Other System Events                     Success and Failure
  Security State Change                   Success and Failure
  Logon                                   Success and Failure
  Logoff                                  Success and Failure
  Account Lockout                         Success and Failure
  IPsec Main Mode                         Success and Failure
  IPsec Quick Mode                        Success and Failure
  IPsec Extended Mode                     Success and Failure
  Special Logon                           Success and Failure
  Other Logon/Logoff Events               Success and Failure
  Network Policy Server                   Success and Failure
  Filtering Platform Connection           Success
  Sensitive Privilege Use                 Success
  Process Termination                     Success
  Process Creation                        Success
  Authentication Policy Change            Success
  Filtering Platform Policy Change        Success



Run-AllModFunc
0Check-EventLogsBySize


2011     8  11   11      19       7 611


1Check-EventLogsByLastWrite


2011     8  11   11      19      12 741


2Count-Providers


2011     8  11   11      19      13 828


3Find-UniqueUserIDs


2011     8  11   11      20      10 522


4UserID-filter


2011     8  11   11      20      25 843


5Event-filter


2011     8  11   11      20      47 190


logtime


2011     8  11   11      21       7 207


If you will run the module as a job you must use the parameter 'initializationScript' to import the module into the job session:


start-job -name AllModFunc -initializationScript {import-module .\UserIDEventsModule.psm1} -scriptblock {Run-AllModFunc}

Read More