I'm Not Dead

Several of you leaving comments, posting your own blog entries, and sending me email seem to think my job at General Electric means I am dead. I am not dead, God willing. Let me reprint the second-to-last paragraph from that post:

What about writing here, or articles, or books? My boss supports my blogging and writing. I have never made a practice of posting "Look what I found at this client!" and he does not expect me to start doing so at GE. You can expect to read more about the sorts of techniques I'm using to address security concerns but never incident specifics or any information which would compromise my relationship with GE. The same goes for articles and books. I plan to continue writing the Snort Report and eventually write the new works listed on my books page.

This blog has never been a site for "tell-all" activity. I don't discuss specifics about clients, or national security matters, or private information shared in a confidential manner. I started this blog when I worked at Foundstone, continued it at ManTech, and kept blogging with TaoSecurity. I intend to remain blogging, time- and interest-willing. Thank you.

Read More

One for Ken Belva

I mentioned Ken Belva's thoughts in Thoughts on Virtual Trust last year. If you don't know Ken's thoughts on "virtual trust" please read that post before continuing further. I refrained from pointing a finger at Ken's Apple DRM example after Steve Jobs posted his Thoughts on Music, where DRM won't apply to Apple music (thereby depriving Ken of one of his case studies and questioning his logic).

Now I'd really like an answer to this article: Retailers Fuming Over Card Data Security Rules; Claim PCI standard shifts burden to them, could alienate customers. Here are a few excerpts:

Several retailers last week bristled at having to comply with the Payment Card Industry (PCI) Data Security Standard, complaining that they carry an unfair burden in securing credit card data.

In interviews and speeches at the annual ERIexchange conference here, retail executives also complained that implementing the PCI standard is costly and could alienate customers...

Robert Fort, director of IT at Virgin Entertainment Group Inc. in Los Angeles... contended that meeting the requirements doesn’t boost a retailer’s bottom line. “There’s no direct return on investment,” he said. “It will not help us sell CDs.” (emphasis added)

Ken -- what do you think about that? I would respond to the vendor by saying customers who can't trust vendors won't give the vendor their business. I might also use an argument that says vendors could be held liable for negligence. Those are two thoughts.

Read More

PIX firewall troubleshooting commands

I am adding some commonly used PIX firewall troubleshooting commands. For those of you who does troubleshooting of the firewall, you know should familiar yourself with these commmands. Handy yet Powerful.

1. show xlate, show xlate detail - display NAT translations and its details

2. show connection, show connection detail - display connection details built in the firewall

3. show service-policy - display inspection policies

4. show local-host 192.168.1.1 - display translation, AAA, connection information

5. show asp drop - show number of packets dropped while processing the packets

6. show mem - display memory usage in the PIX

7. show cpu usage - display cpu usage over a time period

8. show traffic - display total traffic transmitted and received on each individual interfaces on the PIX

9. show block and show cpu usage can determine if the firewall is overloaded.

Of course there are many other things you would need to know like the debug commands, capture commands, show logging, show running logging, show logging setting commands. If you guys need to know more, just email me and i will guide you

Read More

Cisco Router as DNS Server Demonstrates Functional Aggregation

Did you know that a sufficiently new Cisco router can be a DNS server? Apparently this functionality is not that new (dating from 2005), but I did not hear of it until I saw the article Cisco Router: The Swiss Army Knife of Network Services. I think this is a good example of what I may start calling "functional aggregation," whereby features previously provided on separate servers are collapsed to one box. I know others call that "convergence," but that term applies to so many topics (voice + video + data, etc.) that I'll use FA here. It doesn't matter anyway, because some marketing drone will invent a catchy name that everyone will end up using at some point.

One interesting aspect of this story is that it points to a simple blog post called Use your Cisco router as a primary DNS server that shows how easy it is to configure this feature. That post is then followed by a new article called Protecting the primary DNS server on your router, which explains how a router as DNS server can be overwhelmed faster than a separate, robust server. The comments to the second post also provide a justification for DNS on router functionality, namely it saves the cost of a dedicated DNS box if your router is underutilized.

The danger not mentioned in those posts is that a DNS server is another potentially exploitable service. The greater the number of services exposed to the public on a system, the greater the likelihood for compromise. It's one of the reasons people have tried to run separate services on separate servers for years.

I think we'll see the following trends based on these sorts of developments.

• The poorest businesses (in terms of budget, expertise, and time) will seek to not maintain any IT infrastructure at all, and will rely on outsourced services. FA means nothing to them because they don't maintain gear.


• Moderately equipped businesses will adopt some FA solutions because they are "good enough" or "just good enough," given their constraints.


• Well-equipped businesses whose staff can make the case for stand-alone functionality (i.e., separate DNS servers, etc.) will avoid FA solutions for critical infrastructure. Otherwise they will outsource or use FA to save money.

I think these arguments apply equally well to security services such as those found in so-called "unified" security appliances.

Read More

Bejtlich Joining General Electric as Director of Incident Response

Two years ago this month I left my corporate job to focus on being an independent consultant through TaoSecurity. Today I am pleased to announce a new professional development. Starting next month I will be joining General Electric as Director of Incident Response, based near Manassas, VA, working for GE's Chief Information Security Officer, Grady Summers at GE HQ in Fairfield, CT.

My new boss reads my blog and contacted me after reading my Security Responsibilities post five months ago. He has created the new Director position as a single corporate focal point for incident response, threat assessment, and ediscovery, working with GE's six business units and corporate HQ security staff. Grady reports to GE's Chief Technology Officer, Greg Simpson, and works closely with GE's Chief Security Officer, Brig Gen (USAF, ret) Frank Taylor. I will be building a team and I am pleased to have already met my first team member, a forensic investigator.

I am very excited about this new job. First, the scope of the challenge is enormous. GE is probably just bigger than the Air Force (my closest related employer), with 350,000 users. The company's revenues last year exceeded $160 billion and its market capitalization currently exceeds $380 billion. GE is number 6 on the 2007 Fortune 500. In brief, I don't think there's a way for me to get bored working to address GE's digital security concerns.

Second, I look forward to building and working with a team that has a defined, long-term objective. With few exceptions my consulting work has been short-duration engagements which don't allow me to develop security processes or implement products for the long term. I have been impressed by all of the security staff from GE I've met thus far, and encouraged by articles like Does GE Have the Best IT? and GE's repeated rank as the number one most admired company in America.

Third, I hope this new role will improve my family's quality of life. As an independent consultant I was constantly juggling marketing, public relations, business development, client relationships, accounting, invoicing, and other non-tech tasks while trying to deliver quality services to customers and stay current on threats, vulnerabilities, and assets. Knowing my new "customer" on a continuous basis means I can focus my energy on my corporate work and not consider every waking moment a reason to accomplish another TaoSecurity task. While the financial rewards of working independently probably exceeded those of working for a corporation, the personal cost of maintaining that business cycle is very high. I am also confident my travel requirements will be less for GE than they were for TaoSecurity.

What does this mean for TaoSecurity? Simply put, I will not be accepting any new consulting work or private teaching requests that cannot be accomplished by the end of this month. I am currently fulfilling existing obligations, some of which may extend beyond the end of the month. I am not joining GE because my independent work dried up; in fact, I've had to turn down four large engagements within the last week because they would have to occur after the end of this month.

If you're wondering about public training classes, I recommend you review my TaoSecurity training schedule. You'll see only the following are left:

• USENIX 2007: Network Security Monitoring with Open Source Tools and TCP/IP Weapons School Layers 2-3, 20-22 June 2007


• GFIRST: Network Incident Response and Forensics, 25 June 2007


• Black Hat USA: TCP/IP Weapons School, Black Hat Edition (layers 2-7 in two days), 28-29 and 30-31 July 2007


• USENIX Security 2007: TCP/IP Weapons School Layers 4-7, 6-7 August 2007


• Network Security Operations, Cincinnati: 21-23 August 2007


• Network Security Operations, Chicago 28-30 August 2007


• ForenSec Canada 2007: TCP/IP Weapons School, ForenSec Edition (layers 2-7 in two days), 15-16 September 2007


• Virginia Alliance for Secure Computing and Networking: one day class, 19 October 2007

That's it. I do not have any plans to be teaching again, although I have not ruled out the occasional conference presentation. There will definitely not be any private classes, and I imagine the only public venue for a half-, full-, or two-day class would be USENIX or perhaps Black Hat Training next year, if either are interested. The bottom line is that if you want to take one of these classes before I no longer offer them, please sign up as soon as possible.

What about writing here, or articles, or books? My boss supports my blogging and writing. I have never made a practice of posting "Look what I found at this client!" and he does not expect me to start doing so at GE. You can expect to read more about the sorts of techniques I'm using to address security concerns but never incident specifics or any information which would compromise my relationship with GE. The same goes for articles and books. I plan to continue writing the Snort Report and eventually write the new works listed on my books page.

Finally, I should note that both of my grandfathers retired from GE, so I have some personal history with the company. I'd like to thank Grady Summers and everyone at GE that have helped me join this great organization.

Read More

Triple-Boot Thinkpad x60s

Many years ago I thought multibooting operating systems was quite the cool thing to do. This was before VMware when my budget was tighter and so was my living space. Recently with my new laptop configuration I moved to an all-Ubuntu setup, upon which I loaded VMware Server. VMware Server had Windows XP and FreeBSD 6.2 VMs at its disposal. I've spent nearly all my time in Ubuntu, never really needing to turn to Windows or FreeBSD for desktop work.

With the arrival of Ubuntu 7.04, I decided to try a new approach with my laptop. The OEM HDD was 60 GB, which is somewhat small given my use of VMs. Furthermore, I fairly regularly buy brand new hard drives when I make major operating system shifts. I think the best backup I could ever have is an entire old hard drive, and HDDs are cheap compared to the value of the data on them. Moving from 6.10 to 7.04 seemed like a good time to replace the 60 GB HDD with a Seagate Momentus 5400.3 ST9160821AS 160GB 5400 RPM 8MB Cache Serial ATA150.

I also decided to go back to a multiboot situation for those extraordinary circumstances when VMware just won't do. I foresee two situations which require something besides Linux. First, I've been unable to use Skype or other sound utilities on Ubuntu due to some weird sound driver issues. This compels me to reload Windows XP from the recovery CD in order to access the Windows sound drivers shipped by Lenovo. Second, I am attending Black Hat this summer, and I don't trust Windows or Linux to that crowd. Sure, FreeBSD is "just as vulnerable" but the majority of the attackers will be looking for Windows and Linux users. Booting into FreeBSD and staying there will reduce my exposure surface.

In order to triple-boot, I started by reinstalling Windows XP from the Lenovo recovery CD and DVD. Good grief, what a painful and long process. Sure, it worked, but it just looked ugly. Thankfully the media booted from a USB optical drive. I also have to remove all the vendor garbage installed on top of Windows. Ugh. At least Windows XP is available now.

Next, I installed Ubuntu 7.04 (desktop edition), again using the external optical drive. I used Gparted to create a partition for FreeBSD, then let Ubuntu take the remaining biggest chunk for itself. Ubuntu installed without a hitch -- very nice.

Finally, I installed FreeBSD. Being my favorite OS, I was ambitious. I decided to try the newest 7.0 CURRENT snapshot (200706), released within the last few days. Unfortunately, I couldn't get FreeBSD to install from the external optical drive. I decided to try PXE booting, but I couldn't get all the way through the installation. I then downshifted to 6.2 RELEASE and my life got easier. Here's what I set up.

I made my old Thinkpad a20p the PXE server. I created a /freebsd directory to hold the contents of the /boot directory on the 6.2 RELEASE CD-ROM, i.e.:

orr:/# ls -ald /freebsd
drwxr-xr-x  3 root  wheel  512 Jun 10 20:18 /freebsd
orr:/# ls /freebsd/boot/
beastie.4th     boot2           kernel          loader.rc       screen.4th
boot            cdboot          loader          mbr             support.4th
boot0           defaults        loader.4th      mfsroot
boot0sio        device.hints    loader.conf     modules
boot1           frames.4th      loader.help     pxeboot

Notice the presence of mfsroot in that directory. That is not what ships on the CD -- mfsroot.gz is the original file:

orr:/# ls -al /cdrom/boot/mfsroot.gz  
-r--r--r--  1 root  wheel  1063814 Jan 12 06:33 /cdrom/boot/mfsroot.gz

Use 'gzip -d mfsroot.gz' to create the mfsroot file needed by the installation process. Also, edit loader.conf to have the following:

orr:/# cat /freebsd/boot/loader.conf 
mfsroot_load="YES"
mfsroot_type="mfs_root"
mfsroot_name="/boot/mfsroot"
vfs.root.mountfrom="ufs:/dev/md0c"

Now I enabled TFTP and told it where to find what the installation needed:

#tftp   dgram   udp    wait    root    /usr/libexec/tftpd  tftpd -l -s /tftpboot
tftp    dgram   udp     wait    root    /usr/libexec/tftpd  tftpd -l /freebsd

Note what the original says and how I changed it. The omission of the -s flag is probably not needed. Be sure to start inetd via 'inetd' as root.

PXE needs a DHCP server. I installed isc-dhcp3-server and created the following conf file:

orr:/# grep -v ^# /usr/local/etc/dhcpd.conf

option domain-name "taosecurity.com";
option domain-name-servers 172.16.2.1;

default-lease-time 6000;
max-lease-time 72000;

ddns-update-style ad-hoc;

log-facility local7;

subnet 1.1.1.0 netmask 255.255.255.0 {
  range 1.1.1.128 1.1.1.192;
  option routers 1.1.1.1;
}

host neely {
    hardware ethernet 00:16:D3:23:7C:A7;
    fixed-address 1.1.1.2;
    next-server 1.1.1.1;
    filename "boot/pxeboot";
    option root-path "1.1.1.1:/freebsd";
}

The PXE/DHCP server is 1.1.1.1 and it's connected via crossover cable to 1.1.1.2, the x60s.

I added these to /etc/rc.conf to enable DHCP.

dhcpd_enable="YES"                          # dhcpd enabled?
dhcpd_flags="-q"                            # command option(s)
dhcpd_conf="/usr/local/etc/dhcpd.conf"      # configuration file
dhcpd_ifaces="fxp0"                         # ethernet interface(s)

fxp0 is the interface connected to the x60s.

Thus far the PXE client will be able to access the pxeboot program, but the installer needs NFS to continue the process. For that I created this /etc/exports file:

orr:/# cat /etc/exports 
/freebsd -ro -network 1.1.1.0 -mask 255.255.255.0
/cdrom -ro -network 1.1.1.0 -mask 255.255.255.0

These lines in /etc/rc.conf enabled inetd and NFS:

inetd_enable="YES"
nfs_server_enable="YES"
rpcbind_enable="YES"

It's a good idea to test what's exported.

orr:/# showmount -e 1.1.1.1
Exports list on 1.1.1.1:
/cdrom                             1.1.1.0 
/freebsd                           1.1.1.0 

Initially I wanted to set up the a20p as a NATing gateway from the x60s, so the x60s could reach the Internet. I ended up just pointing the installer towards 1.1.1.1:/cdrom and using NFS to retrieve the installation sets. I installed the User distribution because I want to try the new modular Xorg 7.2 later. When done FreeBSD looked like this via df -h:

Filesystem     Size    Used   Avail Capacity  Mounted on
/dev/ad4s3a    1.9G     36M    1.7G     2%    /
devfs          1.0K    1.0K      0B   100%    /dev
/dev/ad4s3e    989M     22K    910M     0%    /home
/dev/ad4s3g    2.9G    4.0K    2.7G     0%    /nsm
/dev/ad4s3h    1.1G     12K    1.0G     0%    /tmp
/dev/ad4s3d    9.7G    306M    8.6G     3%    /usr
/dev/ad4s3f    2.9G    7.9M    2.7G     0%    /var

The major setback for the x60s with FreeBSD is lack of native support for the wireless NIC. I plan to try the ClearChain Intel 3945ABG driver at some point. Right now I'm just using an old wireless NIC recognized as wi0.

To enable FreeBSD in Ubuntu's GRUB boot loader, I added this entry:

title           FreeBSD
root            (hd0,2,a)
kernel          /boot/loader
savedefault
makeactive
chainloader     +1

I based this on the following fdisk -l output from Linux.

Disk /dev/sda: 160.0 GB, 160041885696 bytes
255 heads, 63 sectors/track, 19457 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1        3060    24579418+   7  HPFS/NTFS
/dev/sda2           18830       19457     5044410    6  FAT16
/dev/sda3            3061        6081    24266182+  a5  FreeBSD
/dev/sda4            6082       18829   102398310    5  Extended
/dev/sda5   *        6082       18305    98189248+  83  Linux
/dev/sda6           18306       18829     4208998+  82  Linux swap / Solaris

Partition table entries are not in disk order

Overall I'm pleased with this setup. I would have liked trying FreeBSD 7.0 CURRENT but 6.2 will meet my needs. FreeBSD on the Lenovo Thinkpad X60s by M.C. Widerkrantz has some tips, as does JoeKuze.com.

I plan to begin moving data to the new setup using a AZiO ENC211SU31 eSATA+USB 2.0 External 2.5" Hard Drive Enclosure that will hold the original 60 GB HDD.

Read More

PowerLite S4 Multimedia Projector

This week I taught TCP/IP Weapons School, Layers 2-3 at Techno Security 2007 in Myrtle Beach, SC. I enjoyed teaching the class, especially since several students were repeat customers. Two were even alumni from classes I taught at Foundstone five years ago! Because the cost of renting a projector and screen from the hotel (and even from rentacomputer.com) seemed outrageous, I decided to buy my own. I purchased an Epson PowerLite S4 Multimedia Projector and Da-Lite 72263 Versatol Tripod Screen 70"x70" Matte White with Keystone Elim for use in the class. I was extremely pleased with both. In fact, right after I bought the Epson projector I saw it covered in a USA TODAY review, which helped validate my purchase.

If you're in the market for a projector and screen combination for less than $800 (or even $700 if you're not time-crunched, as I was) then I think you'll like these products.

Read More