Showing posts with label hacking. Show all posts
Showing posts with label hacking. Show all posts

Wednesday, July 28

Project Razorback has been unleashed on the World

For several months, the Vulnerability Research Team (VRT) here at Sourcefire has been heads down in coming up with a new framework for detection called Razorback, and now, it's been unveiled to the world this this morning.

Being announced at Defcon this weekend by the VRT, so if you are in Defcon this week, reading my posts, First: Have a beer for me, as I am not there this year due to the impending birth of my child, and Second: Attend this talk.  If no other talks are attended during your drunken hacking binge in Vegas, go to this talk.

OH AND BUY THE VRT BEER IF YOU MEET THEM.  Mkay?

What is Razorback?


In Marketing speak: "Razorback is an Open-Source Framework for an intelligence driven security solution."  Okay, okay, what does that mean?

Razorback is a system that detects and decodes, well, just about anything you need it to.  Following that, it has the ability to then block and alert on that activity.  So, for example:

  • Obfuscated Javascript?  Decoded, Blocked?

  • Bad PDFs? Decoded, Blocked?

  • Bad Word Documents? Powerpoint Documents? Decoded, Blocked?


This framework is aimed primarily at these Client based attacks, and, dare I use it?  Advanced Persistent Threat (APT).  It was born out of necessity and a discussion with the VRT during a panel they participated in last year about detection.  The community asked for something to be able to perform a function like this, and well, here it is.  Better.  There is nothing to combat these threats, so Sourcefire created one.

So, say for example, a PDF comes in via email.  The PDF is sent to Razorback by the SMTP engine, Razorback runs it through the detection, -- which I'm not even going to begin to explain here, because it's extremely awesome and complicated, and you should go to the talk to fully understand --, and if the detection decides the PDF is bad, it will record that fact in it's database so that all further attempts with a PDF like that one will be blocked from there on out.   Now, that's just one example.

Since Razorback is an Open-Source project and framework, anyone can write a detection "nugget" for it.  These nuggets, written in C, can detect pretty much anything and provide actionable intelligence on it afterwards, and of course, since it's Open-Source, many different "feeds" can be provided to Razorback.

SMTP, ClamAV, Snort, Web proxies, Web filtering devices, et all.  They can all be written to feed data to Razorback which then can have the ability to take further action after it's analyzation.

This is a different approach to detection than what's been tried before.  While IPS is great, it can't really grab a PDF off the wire, reassemble it, decode it, and block it in real-time.  With Razorback, Snort can grab the PDF off the wire, pass it to Razorback where it will be analyzed, and so on.

After the talk if the VRT puts their slides and more info up on their website, I'll make sure that I post further information about it.  But for now, here it is:

Razorback.

Here's another article about Razorback over at DarkReading.

Safari 5.0.1 Posted this morning

Back in June I wrote a post on a problem with Safari 5 creating a black background around certain objects when moved from one application to another.  For instance, when you attempt to use the "Mail this PDF" function from Preview.  Well, this morning Apple released version 5.0.1 of Safari.  This fixes the issue I described here, along with many others.  As posted on Apple's website here, the following are fixes:

  • More accurate Top Hit results in the Address Field

  • More accurate timing for CSS animations

  • Better stability when using the Safari Reader keyboard shortcut

  • Better stability when scrolling through MobileMe Mail

  • Fixes display of multipage articles from www.rollingstone.com in Safari Reader

  • Fixes an issue that prevented Google Wave and other websites using JavaScript encryption libraries from working correctly on 32-bit systems

  • Fixes an issue that prevented Safari from launching on Leopard systems with network home directories

  • Fixes an issue that could cause borders on YouTube thumbnails to disappear when hovering over the thumbnail image

  • Fixes an issue that could cause Flash content to overlap with other content on www.facebook.com, www.crateandbarrel.com, and other sites when using Flash 10.1

  • Fixes an issue that prevented boarding passes from www.aa.com from printing correctly

  • Fixes an issue that could cause DNS prefetching requests to overburden certain routers

  • Fixes an issue that could cause VoiceOver to misidentify elements of webpages


Safari 5.0.1 also packs in a bunch of security updates.  Of course Blackhat and Defcon are this week, so that may have something to do with this update being released.

Safari
Impact: Accessing a maliciously crafted RSS feed may cause files from the user's system to be sent to a remote server
Description: A cross-site scripting issue exists in Safari's handling of RSS feeds. Accessing a maliciously crafted RSS feed may cause files from the user's system to be sent to a remote server. This issue is addressed through improved handling of RSS feeds.
Credit to Billy Rios of the Google Security Team for reporting this
issue.


Safari
Impact: Safari's AutoFill feature may disclose information to websites without user interaction
Description: Safari's AutoFill feature can automatically fill out web forms using designated information in your Mac OS X Address Book, Outlook, or Windows Address Book. By design, user action is required for AutoFill to operate within a web form. An implementation issue exists that allows a maliciously crafted website to trigger AutoFill without user interaction. This can result in the disclosure of information contained within the user's Address Book Card. To trigger the issue, the following two situations are required. First, in Safari : Preferences : AutoFill, the "Autofill web forms using info from my Address Book card" checkbox must be checked. Second, the user's Address Book must have a Card designated as "My Card". Only the information in that specific card is accessed via AutoFill. This issue is addressed by prohibiting AutoFill from using information without user action. Devices running iOS are not affected.
Credit to Jeremiah Grossman of WhiteHat Security for reporting this issue.
(Nice work Jeremiah!)

WebKit
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue exists in WebKit's handling of element focus. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of element focus.
Credit to Tony Chang of Google, Inc. for reporting this issue.

WebKit
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue exists in WebKit's rendering of inline elements. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved bounds checking.
Credit to wushi of team509 for reporting this issue.

WebKit
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue exists in WebKit's handling of dynamic modifications to text nodes. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved memory management.
Credit? Apple Internal?

WebKit
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue exists in WebKit's handling of CSS counters. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.
This issue is addressed through improved memory management.
Credit to wushi of team509, working with TippingPoint's Zero Day Initiative for
reporting this issue.


WebKit
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: An uninitialized memory access issue exists in WebKit's handling of the :first-letter and :first-line pseudo-elements in SVG text elements. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed by not rendering :first-letter or :first-line pseudo-elements in SVG text elements.
Credit to wushi of team509, working with TippingPoint's Zero Day Initiative for reporting this issue.

WebKit
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue exists in WebKit's handling of foreignObject elements in SVG documents. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through additional validation of SVG documents.
Credit to wushi of team509, working with TippingPoint's Zero Day Initiative for reporting this issue.

WebKit
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue exists in WebKit's handling of floating elements in SVG documents. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved memory management.
Credit? Apple Internal?

WebKit
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue exists in WebKit's handling of 'use' elements in SVG documents. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of 'use' elements in SVG documents. Credit to Justin Schuh of Google, Inc. for reporting this issue.

WebKit
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A heap buffer overflow exists in WebKit's handling of JavaScript string objects. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved bounds checking.
Credit: Apple.

WebKit
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A reentrancy issue exists in WebKit's handling of just- in-time compiled JavaScript stubs. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved synchronization.
Credit? Apple Internal?

WebKit
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A signedness issue exists in WebKit's handling of JavaScript arrays. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of JavaScript array indices.
Credit to Natalie Silvanovich for reporting this issue.

WebKit
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue exists in WebKit's handling of regular expressions. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of regular expressions.
Credit to Peter Varga of University of Szeged for reporting this issue.

WebKit
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue exists in WebKit's handling of "font-face" and "use" elements in SVG documents. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of "font-face" and "use" elements in SVG documents.
Credit to Aki Helin of OUSPG for reporting this issue.

Safari 5.0.1 and Safari 4.1.1 address the same set of security issues. Safari 5.0.1 is provided for Mac OS X v10.5, Mac OS X v10.6, and Windows systems. Safari 4.1.1 is provided for Mac OS X v10.4 systems

The thing to remember with the above vulnerabilities is that things that are labeled "Webkit", affect more than just Safari. They could possibly affect anything using the Webkit framework. Chrome included.

Tuesday, June 1

Google ditches Windows on security concerns

Trying not to bash Windows here, as I personally think that Windows 7 is a much better operating system than it's predecessors.  However, I think this is interesting.  I've seen this happen at several companies lately.  While Google has been very Mac centric for awhile now, according to friends I have in the company, a conscience effort to move everyone off the platform in such a big company is an interesting effort.

FT.com / Technology - Google ditches Windows on security concerns.

Monday, May 24

Top 10 Privacy Tweaks You Should Know About

Along the lines of my Facebook post that I put up on Saturday, I found this article (linked below) over on Lifehacker.

Top 10 Privacy Tweaks You Should Know About.

Saturday, May 22

Facebook privacy, why you should be careful, and what I'm doing personally.

It seems everyone has been jumping on the "Facebook is evil" bandwagon lately, some of it being fair, some of it not.  I thought I'd try and jump on the bandwagon too, but this time, let's lay out the facts and reflect on them and see how they are changing my outlook on Facebook and why it might be good to change yours too.

<bear with me, it's a long one, but it's a real one, and it's meant for you to read>

Facebook is a social networking site.  Two words.

Social -- relating to or designed for activities in which people meet each other for

Networking -- a group or system of interconnected people or things

A place where people come together to be interconnected and share things and activities.  Facebook.  Exactly what it does, so why is everyone so up in the air about it, why are people complaining about it?

Privacy.  Those of you that signed up for Facebook in the beginning, and are like me, take the world on the Internet with the assumption that everything that you do online can be read by anyone, you are careful what you put on Facebook.  I personally live with the realization that I have an Internet stalker.  A guy out there on the Internet -- for whatever reason -- follows me.  Goes to every email listserver I am on, listens to every podcast I do, watches everything that I do.  Now, some of you will look at that and say "Whoa, that dude is nuts!"  Well, I agree.

However, having someone like that is like a check and balance in Government.  It makes you realize that what you put out there on the Internet, no matter how mundane and stupid it may be, someone will jump on it like a horse and ride that sucker for all it's worth.  So you really pay attention to what you put up on the Internet in the first place.

Facebook, when it started out was this concept, very different from "MySpace", where MySpace was "Everything is public".  When Facebook started many people jumped on it, thinking, "Wow, some privacy!"  Everything you put on Facebook could only be seen by your friends.  Those you invited to be your friends, or you authorized to be your friends.  Then, along the way, as Facebook started stealing ideas from Twitter, started making things more public, if you didn't change you privacy settings at each step along the way, your privacy was gone, and everything that was yours and your friends was now available to "Everyone".

Facebook's privacy policy got longer and longer, more and more confusing, until recently this article came out that compared Facebook's privacy policy length to that of the United States Constitution, the document that established and Governs our ENTIRE country, and found that the Facebook privacy policy was longer.

I started thinking about ditching my Facebook page back in November or December of last year when all of this was coming down, and it's just gotten worse and worse.  Take a look at this article written by Jason Calacanis (say what you will about Calacanis, but he brings up some good points to think about, and things that you might want to read yourself).

Jason recently wrote another article about Facebook has overstepped the lines and violated the privacy and trust of it's users.  Both are worth a read.  He talks about how Facebook screwed Foursquare, how they screwed Twitter, how they have screwed their users by changing their privacy model three times.

All of this stems from one guy.  Mark Zuckerberg.  Facebook's CEO and Founder.

"Zuck" as he's known in the "Valley" (I've never met the dude.) started Facebook, or at least came up with the concept for it while he was at Harvard.  Now, there is a lot of controversy about how the idea for Facebook came up, and that he stole it from other people, and this that and the other thing.  I'm not here to decide that, there are lawsuits in progress, and the courts will decide that one.

Zuckerberg has apparently (allegedly) screwed over many companies, partners, etc in the setting up of Facebook.  Claims are (from "they") that he wants to be the next Bill Gates, and is doing so by doing the same thing that Bill Gates allegedly did back in the 80's/90's, by "stealing" the idea for "x" from "y".  (Not mentioning names, because, like I said, allegedly.)

"Good artists copy, Great artists steal" -- Pablo Picasso (Allegedly)

Personally, I don't trust the dude, and neither should you.  <-- Read that.

So what does that mean for you?

If you have the realization that everything you put on the Internet, everyone can see, you are fine.  However, I don't like the fact that Facebook started off with one idea about privacy, and now it's a different story.

So what am I doing personally?

My "content" that I "produce" will no longer go on Facebook.  I'll point to my content on other places, (my pictures, my posts, my comments), however, I won't put things on Facebook anymore.  This will give me a metric.  A metric that says "How much do you really use Facebook".

I use Facebook for a couple things.  I like to put pictures up there and have people comment on them.  I like to put funny sayings and what not up there, but I also like to read what people have to say and look at their pictures as well.  I really use mine as a Social Network.

The people that I add on Facebook are my real-life friends.  Not "Facebook friends".  Not "Internet Friends".  I probably receive about 10 requests to be my "Facebook friend" from people everyday.  People who read my articles on the blog, people who read my articles on the Internet Storm Center..  People who just read my emails on the Snort user groups (or God knows where else) and want to be my friend.  However, no, I don't add them.  Unless I've met you in real life, I don't add you.  In fact, I've deleted a bunch of people recently.

Facebook isn't for those people.  Those people can read this blog, and they are welcome to participate with me through the comments fields.  They are also welcome to follow me on Twitter.  But on Facebook, I have stuff like, pictures of my daughter and other things on there that I just don't want everyone to have complete access to.

I've locked down my Facebook profile along the way as well, making my profile viewable "Only to Friends".  But the trust that I've put in Facebook is lost.  Have you read their privacy policy?

Here are some choice quotes:

"Access Device and Browser Information. When you access Facebook from a computer, mobile phone, or other device, we may collect information from that device about your browser type, location, and IP address, as well as the pages you visit."

I'm not tracking you when you come to my blog.  I don't know who you are.  I don't much care.

"If in any of these cases we receive data that we do not already have, we will “anonymize” it within 180 days, meaning we will stop associating the information with any particular user."

But they don't delete it.

"Deactivating or deleting your account. If you want to stop using your account you may deactivate it or delete it. When you deactivate an account, no user will be able to see it, but it will not be deleted. We save your profile information (connections, photos, etc.) in case you later decide to reactivate your account."

But they don't delete it.

So make sure you read the privacy page.  Oh but wait there's more!  There's the Statement of Rights and Responsibilities page.

My favorite is here:

"For content that is covered by intellectual property rights, like photos and videos ("IP content"), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook ("IP License"). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it."

So..  Anything I upload to Facebook belongs to Facebook.  They can use it however they want.  Including photos, and videos, and what else.

What about individual Apps?  Oh, there's a page for that too.  Check this out.  Good luck locking that down!


So, where am I putting my pictures?

I'm going to put them on my MobileMe gallery.  That allows me to have public photo albums, photo albums I can mark as private, and even more, I can secure certain photo albums with a password.

My Mobile Photo gallery is here. (Pictures that I take while I am on the go.)

But otherwise all my public galleries are here.

Can you subscribe to those photo galleries?  Yes, you sure can.  Via the RSS button at the top.  You can even subscribe to them in iPhoto if you are an iPhoto/Mac user.

If I have a special gallery that I want you to be able to see, I'll post it.  But I don't want my Intellectual Property rights being turned over to Facebook just because I uploaded a photo.  My pictures are mine.  Free for me to do what *I* want to with them.  Not Facebook.

I'm not going to put anymore photos on Facebook.  Done with that.  When I put new photos up in one of my galleries, I'll post a link on Facebook pointing to the gallery.

I'm not going to put any more "content" on Facebook.  I'll put it here, on the blog, or I'll put it on Twitter, then I'll point to it on Facebook.  Annoying as that may be for those of you that are my Facebook Friends, I ask that you respect that I do that, and play along.  I feel that my real friends will still participate, and my "Facebook friends" will fall off.  That's life.

Lock your stuff down people, you have no idea what you are sharing with the world.  For proof, go here.  Take a look at what people are saying!

Does this mean I'm getting off Facebook?  No.  I am just controlling what goes up there.  I'm still going to participate with my friends, I'm still going to comment, and I'm still going to have fun.

Plus this alleviates my annoyance about having to "hide" and "ignore" all those stupid Applications that you people keep putting on there, wanting to share your Pirate Gold and wondering if I'll help you water your crops in Farmville.

I ask that you read what I've written above, click on those links I've put in the post, and decide for yourself.

Oh, and for God's sake.  Lock your PROFILE DOWN.

Saturday, March 27

Day Two: No One Even Attempts Hacking Chrome at Pwn2Own Competition

Day Two: No One Even Attempts Hacking Chrome at Pwn2Own Competition - Google Chrome - Lifehacker.

Found this interesting.  I didn't make it to CanSecWest this year, but several of my friends did go to this event/competition.  While I did see that every other major browser was cracked on day one, (IE8, Firefox, and Safari) Chrome didn't even get  tried, apparently.

While Chrome does use the Webkit (safari) engine, Chrome starts each browser tab in a separate process which is in a 'sandbox'.

On the usability side, I've been using Chrome on the Mac since they opened up the dev channel for it, and I really like it.

Wednesday, February 17

Tuning Snort with Host Attribute Tables - CSO Online - Security and Risk

Tuning Snort with Host Attribute Tables - CSO Online - Security and Risk.

Here is an article I wrote for CSO magazine, thought the readers of my blog might like to check it out as well.

I was asked to write a fairly technical article for CSO magazine about Snort, the problem is, which part of Snort do you write the article for?  An article about Snort can be very technical or not so technical.  One of the advantages of having Open-Source software.

In any case, enjoy.

Tuesday, February 16

Will Hack For SUSHI » MiFi Config Hack

Will Hack For SUSHI » MiFi Config Hack.

A post by friend and collegue at SANS Joshua Wright.  Joshua is one of the guys I know that is really proficient at hacking wireless.  Bluetooth, wifi, etc.  He does some really wonderful work at that, and he's fantastic at it.

This post is about him hacking his Mifi (Verizon).  He has two posts on the subject you should check out if you have a Mifi.

The other post is here.

Monday, February 1

Snort Ruleset tuning, by the VRT

Awhile back here on this blog I wrote about PulledPork 0.3.4 being released and about the VRT making the "Connectivity, Balanced, and Security over Connectivity" policies.  Also about how you can use PulledPork to automate the updating of your open source Snort rules to take advantage of these recommendations.

Around about the same time VRT put a post up entitled the "VRT Guide to IDS Ruleset Tuning".  It was a good post, and I didn't really highlight it.  They post some really great examples towards the bottom of the post.  If you run a Snort installation and you've read some of my posts about Snort tuning, and "I've installed Snort, now what".  This is a good read as well.

Check it out here.

Monday, January 11

PulledPork 0.3.4 released

I know plenty of you that read my blog are interested in Snort Rules, and are always open to the management of Snort rules in an easier fashion.  Often, in the past our (our being the 'Snort Professionals') recommendation has been "Oinkmaster".  Perl program, pretty stable, kept rules up to date and such.  Well, Oinkmaster kind of died in terms of support so one of our own guys at Sourcefire stepped up for the community and put out, for free, Pulled-Pork.  (Originally called "Baconator", but we asked him to change the same so that Wendy's didn't sue.)

Anyway, JJ, the author of Pulled-Pork, a fellow Sourcefire employee, and the guy that runs openpacket.org released version 0.3.4 of Pulled-Pork today.  It has some very significant updates that we hope Snort users will be keen on.

For some time, within the Sourcefire interface, you can start off the creation of your policies (and the further updating of your policies) from one of three "bases".  Connectivity, Balanced, or Security.

Connectivity focused on Connectivity over security, less interruptions from the IPS and more dropping of traffic that is obviously evil

Balanced focused on a good balance of the above and below.

Security focused more on the Security of the network the Sourcefire sensor was providing more than people getting to Facebook.

VRT makes these categories up, and they make up which rules go into which categories.  In the Sourcefire product, if you are "inline", each one of these above standard bases have a certain number of rules that are set to drop by default.  Obviously, less at the Connectivity over Security, and more set to drop in Security over Connectivity.

The way that we get this information out to the Sourcefire customers is through "metadata" within a rule.  If a rule is written as so:

"alert tcp $HOME_NET !21:23 -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES Microsoft cmd.exe banner"; flow:established; content:"Microsoft Windows"; content:"|28|C|29| Copyright 1985-"; distance:0; content:"Microsoft Corp."; distance:0; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop; reference:nessus,11633; classtype:successful-admin; sid:2123; rev:4;)"

See the section I have in bold above?  That's the metadata, it tells, in which of the three categories I named above, what the rule should do in that instance.  In this case, since this rule is looking for traffic that is exiting the network and going back to an attacker, we want to drop this at all costs.  So that's what the metadata says.  First the name of the policy, then the state.

This feature has been reserved for the automated (notice automated) use for our Sourcefire customers, but has always been available for our open-source Snort users.  Until now.

Pulled-Pork 0.3.4 allows the Open-Source users to use these three policies automatically, of course, you have to choose which policy you want to use with the "-I" command parameter.

If you were using pulled-pork in the past, you can't just copy over the pulledpork.conf file into this new instance, you'll need to use the new .conf file that comes with this release, but, in a matter of about 5 minutes, I had the new pulledpork up and running and my Snort instance is now running the "-I security" policy, PulledPork generated a changelog for me, and restarted Snort via a HUP (which you can specify in the pulledpork.conf file).

So, someone that is familiar with Snort, and .conf files, you should be up and running a great security policy in about 5-10 minutes.

Good job JJ and the VRT!

For further information, please go to JJ's blog post on the release and download it at the link he has there on his blog.

Tuesday, August 4

Defcon was awesome, you should go next time.

Just wanted to say hello to all my friends that I hooked up with at Defcon this year. It was great. Great parties, good friends, good talks, good times. I’ve put up a couple videos that I took during Defcon, one being this one:


http://www.youtube.com/watch?v=nWondV3e1r8


Of the Bendy Girl at the IOActive Party. She was good. DJ Keith Myers did an excellent job of DJ’ing the party on Saturday.


I went to several talks, one being the Adobe 0day “debacle” talk. Where the disclosure of the PDF Vuln from Adobe was discussed. I think the presenter (from Shadowserver) did a good job of trying to explain the benefits of partial disclosure, full-disclosure, and non-disclosure. I still think full-disclosure is the way to go.


In any case, good times had by all, thanks to all for making it a great, safe, Defcon.


Wednesday, April 8

Sourcefire's Exploit Development Class

First off, if you were to go look at this class on Sourcefire’s website, it states “Exploit Development Class for Snort Rule Writers”. We need to fix this. In the words of Lurene, “This class has nothing to do with Defense. At all. Ever.” The class should be more appropriately named, “Fundamentals of Exploit Development”, or “Writing Exploits, we’re going to hurt you”


So, let’s describe this class in two words or less:


Freakin Awesome.


Beginning on day one with a lot of terminology, introduction and drinking from the firehose on Assembly and gdb, by the end of the first day, you are well versed in how to read assembly, pick it apart, and even being able to reverse simple programs at this point. Your Brain will hurt.


Day Two, more drinking from the firehose, more reversing, more assembly, more gdb, drawing stacks, and by the end of the second day, you are learning to control EIP, and doing it. Your Brain will hurt even more.


Day Three, you just sit all day and hack programs. From simple to intermediate, (you aren’t cracking Microsoft Office just yet ;), by the end of the day, you are using reverse shells and shellcode like nothing. Your Brain is now fried. Go drink beer. Seriously.


This was the best class I have ever taken in my life. Srsly.


You know those classes where you go and sit, and you could probably figure out 80% of it, and the other 20% of the class you pick up little tricks and tips on whatever you are learning? This is not one of those. If you know assembly, or have experience in reversing assembly, this is not the class for you (even though you will probably learn something). The class I took was taught by 4 of the Vulnerability Research Team members, people I am glad to call my friends.


So, my hat’s off to Lurene, Matt, Ryan, and Nigel, along with all the other members of the VRT that contributed, came out, and helped with the class. It was great, and I’d gladly take it again anytime.


The best part of the class, I thought, was during the class, on a separate projector, they fuzzed software and found some 0days. I don’t want to disclose which pieces of software were fuzzed, but let’s just say that they are pieces of software that people use everyday.


In one piece of software, over 200 crashes and bugs were caused. No word on how many were exploitable yet.


No, I will not tell you which piece of software it was either.

Monday, December 22

Immaculate Collection

(Preface: I wrote this around January of 2007 and simply forgot about it. I wrote it around the time that Marty was writing these posts: here. Also when Richard was writing these posts here.)


I started playing with Sguil again recently, and for the benefit of those that don’t know, Sguil is a Snort based “NSM” system. It uses Snort and some other tools brought together in one interface to provide better analysis and results. The main factor of Sguil is that it runs something like Tcpdump, Snort, or Daemonlogger in order to dump ALL traffic to disk.

I bought my good friend Richard Bejtlich’s “The Tao of Network Security Monitoring” book earlier this year.


Richard has the theory of: “collect all packets, because without all packets the total picture isn’t seen”. In principle, I agree. I used to use this methodology heavily in my last job, and it worked quite well at the time.


While he also goes on to say that IDS “alerting” has its place, without “context” (the surrounding traffic on the network) the alert will make no sense. I don’t know if I rightly agree with that statement as a whole. Let me explain my difference in “context”.


At my company, Sourcefire, we make a product called “RNA” which stands for “Real-Time Network Awareness”. This product coupled with our IPS’s and Defense Center make an extremely powerful tool for analyzing “alert traffic”. Let me give you an example.


Simple Example:

Hacker attacks your network with an exploit against IIS servers. If any of you have ever seen something like this before in your analyst lives, you probably know that they will either 1) Prescan your network for open http ports, or 2) just automate the attack so no prescan takes place, just the attack, very quickly.


If you have plain vanilla Snort, you will get an alert for every one of these attempts. Using the “Collection” theory, we would also collect all traffic for these connections and we are able to see which attacks got through the firewall, not which ones didn’t. You can even take it this a step further and rebuild the session to see what took place (if anything). This is a lot of data. We’re talking a pcap file that is containing not only all these hundreds of potential connections, but every other connection that is taking place on the network at the same time.


Now, there is nothing wrong with that if:

A) You have the hard drive space.

B) You have the time.

  1. Your machines doing the sniffing can keep up.
  2. You have the personnel to manage all the time, data, and storage.


The problem with it is, at modern network speeds, and the speed at which a program would have to write this stuff to disk, something would give. Now I am not talking at your 500 Mbit/s speeds. I’m talking about the majority of the networks that I deal with that are >1 Gig/s. Whether it be the hard drive, memory, or whatever, but something would buffer somewhere, and more than likely you are going to drop packets. Again, I’m not saying that this is totally a bad idea, I’m just bringing up cons to the pros.


But lets look at it a different way. RNA profiles the hosts on your network, both pre-attack and during, in real-time. RNA knows which machines are running IIS (if any) and which ones aren’t. So it already knows if you will be affected by the IIS exploit attempt.


When these alerts come back to the DC (Defense Center), the DC correlates the RNA event with the Intrusion Sensor alert and the “fat rises to the top” as it were. The DC knows to say “Hey, this attack affects IIS version 5, and only version 5, on Windows...etc..” This is technology that Sourcefire has invented and patented.


So instead of you now having to analyze 100’s of alerts and 1000’s of packets, hey, I only have “these two machines” over here running IIS, and the DC told me that I need to look at these alerts first. Are the other alerts still recorded? Yes, but now I know through the correlation which machines will receive a greater IMPACT from the attack. The two IIS machines. My other Apache boxes aren’t affected at all, so who really cares.


Lets take it a step further. Say the exploit was against IIS 5.0. Well, our two machines are running IIS 6.0. (I’m inferring patch level with this example)


So do we really care? Well, we might like to know, hey, there was an attempt, that’s great, but it doesn’t affect us, we’re not vulnerable to it, lower the IMPACT, and lets move on to the next alert.


If you were collecting packets using the “Immaculate Collection” theory, you’d have to analyze all these streams to make sure that each IIS/Apache/etc.. box returned 404 and whatever else error codes.


Could we do that with Snort? Yes, of course we could. But if RNA knows our network already, then is it important to us? Or is it just informational at this point?


Take it a step further. Think about the exploits that affect browsers, Mail Clients, versions of SSH, telnet, snmp, etc.. RNA already knows these services and applications on your network. Before the attack even takes place.


Single glances allow us to look at these 1000’s of alerts, and say hey, these 2 machines are running IIS, but we’re not vulnerable to the attack. In a matter of seconds.


If you’ve ever heard Marty Roesch speak, you’ll know that it is his belief that “Humans” basically can’t make the decisions for the IDS. Why don’t we let RNA tune it directly? But that’s for a totally different post, one that Marty has covered on his blog as well.


Of course there are strong points to both sides of the discussion. Share your thoughts in the comments.







® Snort, Daemonlogger, RNA, Defense Center, and Sourcefire are all registered trademarks of Sourcefire, Inc.

Friday, July 18

iPhone 3G review

Okay, so I have had my iPhone 3G with iPhone 2.0 software for a solid week now.  

BLUF:  I like it.

Now, I live in a 3G area.  Which means I get the full capabilities of the speed, and it's nice.  Browsing the internet is faster, Mail is faster, everything is nice and quick.  Even the apps I use.  The truth is, I was considering not getting one, but the touchscreen stopped working on my old iPhone about a month ago, and therefore, I had to upgrade (oh darn).

iPhone 2.0 software
--
This is the greatest feature about the new iPhone (and the old iPhone too) is the apps.  Now that you can have apps, it's awesome.  I hacked my phone in the past but there were no apps that I was excited about and I really didn't care to do it again.  There were really three apps I wanted on my old iPhones software.  
1) something to manage my to-do's
2) some kind of music buying app
3) Instant messenger.

Well, now I have Omnifocus for the iPhone (and the mac, and it's great, everything syncs up..  awesome.  Although I do have to call Omnigroup out on something.  They say that their databases sync via "MobileMe".  Now, if I said that to you, that would imply you have to-do syncing through the cloud right?  Well, not really.  All that happens is your Omnifocus DB is stored on your iDisk, and your devices have to sync to iDisk, so while technically true, it's ill worded...anyway..  Omnifocus is great, I recommend it, little high in price, but... yeah)  So that takes care of my to-do's.

2)  Some kind of music buying app.  Well iPhone has had the iTunes store for a while, and it has been great.  But there are occasions that you didn't know what the song was that you heard on the radio and you wanted to know.  Well now my iPhone has an app called Shazam, that will listen to the song I am listening to and tell me what the song is.  Awesome.

3)  Instant Messenger, well I got my AOL IM, but it's just not as polished as I think it should be.  It should be iChat'ish.  Come on Apple, do your thing.

Of course I have some other apps on there as well, games, facebook, pownce, twitter..etc..  and I use them, but they are just add ons.  Not must haves.

The GPS is awesome, quick too.  While it doesn't TELL you where to make turns, it WILL follow where you are at on Google Maps, and you can just get your directions through there.  So it works just fine for a GPS phone.  I'd like to replace my Car GPS with the iPhone, which requires two things.  A touch bit better GPS turn-by-turn software, say from Tom-Tom or Garmin, and a Car Charger.  No car charger yet.  Let's go!

All in all..  Excellent phone, I highly recommend it for people who live in a 3G area.  If you don't live in a 3G area, then don't worry about it, because the speed won't help you.  Get your software update.  

However if you live in a 3G area, or you like the 'flush headset jack' idea, or the fact that it fits better in your hand (with the rounded back), then get it.  The iPhone 3G FEELS thinner.  But in fact it's a 0.2 mm thicker in the middle.  But you probably won't notice.



 Subscribe in a reader

iPhone 3G review

Okay, so I have had my iPhone 3G with iPhone 2.0 software for a solid week now.  

BLUF:  I like it.

Now, I live in a 3G area.  Which means I get the full capabilities of the speed, and it's nice.  Browsing the internet is faster, Mail is faster, everything is nice and quick.  Even the apps I use.  The truth is, I was considering not getting one, but the touchscreen stopped working on my old iPhone about a month ago, and therefore, I had to upgrade (oh darn).

iPhone 2.0 software
--
This is the greatest feature about the new iPhone (and the old iPhone too) is the apps.  Now that you can have apps, it's awesome.  I hacked my phone in the past but there were no apps that I was excited about and I really didn't care to do it again.  There were really three apps I wanted on my old iPhones software.  
1) something to manage my to-do's
2) some kind of music buying app
3) Instant messenger.

Well, now I have Omnifocus for the iPhone (and the mac, and it's great, everything syncs up..  awesome.  Although I do have to call Omnigroup out on something.  They say that their databases sync via "MobileMe".  Now, if I said that to you, that would imply you have to-do syncing through the cloud right?  Well, not really.  All that happens is your Omnifocus DB is stored on your iDisk, and your devices have to sync to iDisk, so while technically true, it's ill worded...anyway..  Omnifocus is great, I recommend it, little high in price, but... yeah)  So that takes care of my to-do's.

2)  Some kind of music buying app.  Well iPhone has had the iTunes store for a while, and it has been great.  But there are occasions that you didn't know what the song was that you heard on the radio and you wanted to know.  Well now my iPhone has an app called Shazam, that will listen to the song I am listening to and tell me what the song is.  Awesome.

3)  Instant Messenger, well I got my AOL IM, but it's just not as polished as I think it should be.  It should be iChat'ish.  Come on Apple, do your thing.

Of course I have some other apps on there as well, games, facebook, pownce, twitter..etc..  and I use them, but they are just add ons.  Not must haves.

The GPS is awesome, quick too.  While it doesn't TELL you where to make turns, it WILL follow where you are at on Google Maps, and you can just get your directions through there.  So it works just fine for a GPS phone.  I'd like to replace my Car GPS with the iPhone, which requires two things.  A touch bit better GPS turn-by-turn software, say from Tom-Tom or Garmin, and a Car Charger.  No car charger yet.  Let's go!

All in all..  Excellent phone, I highly recommend it for people who live in a 3G area.  If you don't live in a 3G area, then don't worry about it, because the speed won't help you.  Get your software update.  

However if you live in a 3G area, or you like the 'flush headset jack' idea, or the fact that it fits better in your hand (with the rounded back), then get it.  The iPhone 3G FEELS thinner.  But in fact it's a 0.2 mm thicker in the middle.  But you probably won't notice.



 Subscribe in a reader

Friday, February 15

Wordpress plugin exploit

Wordpress seems to be getting it's butt kicked lately with all the xploits that are coming out for it and it's plugins. In a new one just published to milw0rm today, this one deals with "Simple Forum". I guess there is no rest for the exploit writers out there, even if this one does seem rather weak. Especially when the tag line at the bottom of the exploit reads: "i AM NOT HACKER". Instead of the much better "I am not A hacker". It's all in the details.

Wordpress plugin exploit

Wordpress seems to be getting it's butt kicked lately with all the xploits that are coming out for it and it's plugins. In a new one just published to milw0rm today, this one deals with "Simple Forum". I guess there is no rest for the exploit writers out there, even if this one does seem rather weak. Especially when the tag line at the bottom of the exploit reads: "i AM NOT HACKER". Instead of the much better "I am not A hacker". It's all in the details.

Thursday, February 14

Teen hax0rs iPhone. Again.

In the quest for people to keep hacking the iPhone (at least, I guess party until the SDK comes out), the Register is running an article about a teen that has re-hacked the iPhone on the new 1.1.3 firmware.  Except this time it wasn't like exploiting the tiff flaw.  This was much harder.

Money quote: "The latest salvo was fired late last week, following a 24-hour hacking spree by Geohot that was broken up by only three hours of sleep. It turns out the latest firmware contained modifications to the device's memory registers to prevent unlocking. Geohot worked around those changes by finding another, much higher register that was vulnerable."

When the SDK comes out, I am sure some of the hacking (or the pace of it) will probably slow down, because people will actually have a legit way of getting apps on the iPhone.  However, there will be a certain percentage that will be interested in it because of the SIM card unlocks.

>People want to be able to take their phones to other networks.  I have a buddy of mine that has his on T-Mobile.

But I know alot of people that have hacked their iPhones for the apps.  I used to have my iPhone hacked, but then the firmware update (1.1.1)? came out that allowed me to download music directly on the phone.  That's all I wanted.  After I got that, there really wasn't any other apps I was interested in.

There are a couple Apps I would like Apple to come out with.
1) A to-do syncer
2) Notes syncer
3) .mac syncing OTA
4) iChat interface.

If Apple had those features on the iPhone (while the top two are also updates to iTunes, pretty much), I'd be pretty happy.
Thanks goes to Craig who sent me this article.

Teen hax0rs iPhone. Again.

In the quest for people to keep hacking the iPhone (at least, I guess party until the SDK comes out), the Register is running an article about a teen that has re-hacked the iPhone on the new 1.1.3 firmware.  Except this time it wasn't like exploiting the tiff flaw.  This was much harder.

Money quote: "The latest salvo was fired late last week, following a 24-hour hacking spree by Geohot that was broken up by only three hours of sleep. It turns out the latest firmware contained modifications to the device's memory registers to prevent unlocking. Geohot worked around those changes by finding another, much higher register that was vulnerable."

When the SDK comes out, I am sure some of the hacking (or the pace of it) will probably slow down, because people will actually have a legit way of getting apps on the iPhone.  However, there will be a certain percentage that will be interested in it because of the SIM card unlocks.

>People want to be able to take their phones to other networks.  I have a buddy of mine that has his on T-Mobile.

But I know alot of people that have hacked their iPhones for the apps.  I used to have my iPhone hacked, but then the firmware update (1.1.1)? came out that allowed me to download music directly on the phone.  That's all I wanted.  After I got that, there really wasn't any other apps I was interested in.

There are a couple Apps I would like Apple to come out with.
1) A to-do syncer
2) Notes syncer
3) .mac syncing OTA
4) iChat interface.

If Apple had those features on the iPhone (while the top two are also updates to iTunes, pretty much), I'd be pretty happy.
Thanks goes to Craig who sent me this article.

Tuesday, January 22

Mailing lists and "Botnets: How they are getting better"

I am subscribed to a couple dozen security type mailing lists. It's one of the best way for sharing of information. A small list:

Incident list (although, i think this one is dead)
fedtalk (An Apple list for people that work for .gov/.mil)
53L (An army.mil list for people in the computer profession)
botnet list
(various internal Sourcefire lists)

Now, I am a member on several more, however, those I am not at liberty to discuss... so anyway, moving on.

I got an email on one of my lists today detailing a web-gui for managing a botnet. Yes, seriously. You can go to this website (I am assuming it's hacked as well) login to this website and manage your botnets point & click style!

Remember the days when you could manage your botnets via IRC? Well, if you want to do things the old school way, fine. But we are Web 2.0 now!

This website is great, it allows you to login, select which targets you want to DDOS (or run other commands as well), even allows you to pick which bots you want to use to perform the attack! (all? Bots that have a ping time < X?) How handy is this?

In the new age of managing your bots. For fun and profit. Welcome.

Subscribe in a reader