Michael Boman has just posted a short article in which he details some open source tools he uses for "exploit engineering" on the Windows platform. I'm not as familiar with the Windows development tools as I am with their Unix counterparts, but I might have to try some of these myself.
Apparently more articles in this series are under development.
As some of you know, I've been wanting to meet more infosec pros in my local area (sounds like the beginning of a 900 number ad). I started by volunteering as a SANS Local Mentor, and that worked very well, but now I'm going to take the next step.
I've been working with the fine folks at Sourcefire to help me create a local Snort Users Group, and I'm finally ready to announce our first meeting!
Date: 1 Dec 2005
Time: 7:00PM
Place: Williamsburg Regional Library
515 Scotland Street
Williamsburg, VA
(757) 259-4040
Meeting room B
My experience tells me that a lot of people are still confused over the differences between risks, threats and vulnerabilities. In fact, even security pros (who should know better) often find themselves misusing the terms in casual conversation. The following simple analogy may help clarify the situation:
Imagine that you are going on a trip. While packing your suitcase, you realize that you need to bring some shampoo. Your shampoo has a flip top, not a screw top, and so you're concerned that if you pack your bag too full, the airport baggage handlers might treat your bag roughly, exerting excess pressure on the bottle and popping the top. Shampoo could spurt all over your stuff!
In this scenario, you have a vulnerability (the flip top shampoo bottle which might not survive a good squeeze). The threat is that baggage handlers are not known for being gentle. The risk is that your clothes might get doused with shampoo.
Change any one of these conditions and you don't have anything to worry about. If you remove the vulnerability by taking a screw top bottle instead, your clothes will be fine because even the baggage monkeys can't rupture a properly made bottle (you hope). Similarly, if you decide to carry your luggage on, you can probably avoid the baggage handlers altogether, and you will naturally be more careful with your own bag.
While we're on the subject, let's carry the analogy a bit further and talk about countermeasures. There are four basic types of countermeasures: Preventative, Reactive, Detective and Administrative. Preventative countermeasures work by keeping something from happening in the first place. In the example above, enclosing the bottle in a rigid plastic box would certainly help keep it from being crushed, and would count as a preventative countermeasure.
A reactive countermeasure comes into play after an event has already occurred. If you arrived at your hotel and found that your clothes were, in fact, covered with goo, you could make use of the hotel's laundry to correct the problem. This would be an example of a reactive countermeasure.
I can't really think of a realistic example of a detective measure here (a shampoo sniffing dog?) so finally, an administrative countermeasure uses policy to protect an asset. In this case, you could attempt to avoid the situation by making it your policy to rely on the hotel's shampoo, thus removing your need to bring your own.
I hope this has made things a little more clear. It is the combination of the vulnerability (the flip top shampoo bottle) and the threat (baggage monkeys at the airport) that creates a risk (to the clothes). You can attempt to use various countermeasures to bring the risk down to acceptable levels, or you could simply accept the risk and move on.
Of course, as I am a devious person, I might choose to take a different option. I can always transfer the risk by packing the shampoo in my wife's bag. I'll leave you to do your own risk analysis for that one...
The Los Angeles Times is running a great behind-the-scenes story on Nigerian 419 scams, entitled I Will Eat Your Dollars. I think this is the best thing I've ever read on the subject, as it follows an actual scammers in Lagos. The story goes into detail on how the scammer, Stephen (19 yrs old), got into the business and why it was so attractive to him and his colleagues. If you have any interest at all in the subject, you really should read this article.
The Electronic Frontier Foundation has published a short but extremely disturbing release in which they describe the secret watermarks your color laser printer could be placing on all your printed pages. Apparently the Secret Service has negotiated the inclusion of secret watermarks (in the form of patterns on yellow dots) on printers from a variety of manufacturers. This page contains a more technical explanation of how to see these little yellow dots and what they mean. There's also an interactive form you can use to submit your own dot pattern for decoding.
I've said that I find this very disturbing, and here's why: the government has neither the right nor the legitimate need to track arbitrary documents printed by its citizens. Frankly, this is the sort of thing I expect to hear about China, not the US.
What an interesting idea. this article's thesis is that pentest results can potentially be used against the company that ordered the test. In court, opposing counsel could use them to argue that the company failed to exercise due dillegence in protecting its assets.
The solution? Have your attorney arrange the pentest, and then the results will be covered under attorney-client privilege.
This is kind of a neat legal "hack", but it's kinda sad that this could be necessary. Pentests are all about exercising due dillegence, not ignoring it. At least, if a company properly follows through on the response to the findings, which is not always the case. So if you're planning to ignore the results of your next test, read this article.
Ahoy! Simson Garfinkel has announced the immediate availability o' his new Advanced Forensic Format specification, as well as a bit o' code to help developers integrate it into their own projects.
Arr! There be several good ideas here. How long 'fore this makes it into yer favorite forensics tools?
Ahoy, me harties! The underhanded C contest (or, to we pirates, "the underhanded sea contest". Arr!) trains a perspective glass squarely on fine, upstanding looking code with a scurrilous hidden purpose. The winners have just been announced. Check 'em out, or ye'll be forced to drink a bucket 'o bilge!
Mailinator has created a nifty new Google map application to track the geographic origins of spam they receive. Check it out!
If you haven't already, head over to the Daily Dave archives and read through the thread, Hacking: As American as Apple Cider. This is Dave's response to the recent Marcus Ranum editorial, The Six Dumbest Ideas in Computer Security.
Marcus' thesis seems to be that we can prove that many of the bedrock foundations of a modern infosec program are ineffective, so we should instead be focused on other more productive avenues to defense. I find myself sympathetic to this postion, though I do not agree with it. His argument that user-level security awareness training doesn't work is obviously false, for example. Although the typical computer user will never know as much as we do about security issues, I've personally observed my own users contacting me with security concerns that were brought to their attention because of our annual awareness training. Can we approach the security of our systems in some better way? Yes, we can and must. Do we know of a workable better way? Well, I don't, so I'm going to keep my eyes and ears open while I continue to implement what I know works.
I also have some problems with Dave's line of reasoning. In his essay Why hacking is cool, so that Marcus changes his website Dave tries to go for the high ground, equating hacking with fighting back against repressive regimes. There are some cases for that, I suppose, but that really doesn't seem to apply to any of the cases I deal with, nor with the vast majority of cases handled in this country.
I find hacking cool, of course, if done by authorized personnel. If you're a would-be Chinese dissident, then you've probably got a case there, too. But otherwise, it's not cool at all.
Ok, this is a bit frustrating. Microsoft recently announced a critical patch would be issued tomorrow (September 13th). MS defines "critical" as "remote execution of code", which sounds reasonable to me. But I'm a bit frustrated about their decision over the weekend to delay releasing the patch. Make no mistake, I'm all for good quality control, but I don't like being told that there's a critical vulnerability for which I'm not allowed to have the patch.
I'm a big Sun Tzu fan. I've got a small collection of different translations and interpretations of his work, as well as a few other similar texts. I've also long harbored a secret desire to do an updated infosec interpretation of The Art of War, so when I saw this link, of course I was immediately interested.
Overall, I like this paper. Though I don't agree with all of Mr. Toderick's points, it's well worth a read.
Are Chinese cyberspies massively hacking US government and military networks? Perhaps. Read this. Then read Richard Bejtlich's take on it.
The theory that the Chinese government is behind this campaign seems very plausible. China has a well documented history of espionage, going back more than 2,000 to the time of Sun Tzu. If you're interested, I'd recommend The Seven Military Classics of Ancient China, Including The Art of War and (far more recently), The Tao of Spycraft: Intelligence Theory and Practice in Traditional China.
I enjoyed this short piece on what it's like to be part of the F-Secure response team during a global worm outbreak. Glad I'm not them!
PS: 100th post!
If you're going to be at LinuxWorld next week in San Francisco, why not drop by and say hi?
This is hillarious. People, if you go to a hacker conference, make sure you practice safe computing. I would have thought this was just common sense.
Reuters (and many other sources) are reporting that astronomers at CalTech may have been pressured by hackers to reveal their discovery before they had completed their analysis.
I must have missed this statement when I first read about the planet, but I think this is pretty interesting. Apparently attackers had compromised a "secure server" and determined that the astronomers had made this discovery, and threatened to make the information public if the researchers didn't do it themselves. It makes me wonder what they got access to. I'm betting it was email, because I'm not sure I'd buy the idea that they'd be able to make sense of the scientific data itself. Anyone know?
In case you haven't heard, there's a big controversy over one of yesterday's Black Hat presentations. I frankly don't see what all the fuss is about.
According to Cisco, Lynn reverse engineered parts of IOS while working for ISS. This allowed him to discover methods to make use of existing vulnerabilities to gain shell access or execute arbitrary code on a Cisco router.
People, this is a big technical step forward, but it's just not news. First, Mr. Lynn has not created or publicized new Cisco vulnerabilities, he's merely come up with some more creative ways to make use of existing vulnerabilities. Second, I don't think any security professional should be surprised that it's possible to use a stack or heap vulnerability to execute code. It's been done to death on every other platform, why not IOS too? My hat's off to Mr. Lynn for what is definitely some masterful coding on his part, but we've seen this before elsewhere.
What really puzzles me, though, is why anyone is surprised that he's apparently going to be sued by both Cisco and ISS. I'm not privy to the agreements he may have signed with ISS when he was employed there, nor do I know any details about any NDAs that might be in place between ISS and Cisco. However, if he was paid by ISS to work on this project, the work belongs to ISS and not to Mr. Lynn. That alone could be sufficient grounds for ISS to complain, especially because by outing the work, he has also probably opened ISS itself to lawsuits from Cisco.
So please everyone, let's get over this teacup imbroglio. This just isn't the story everyone thinks it is.
Yes, this article's conclusions are a little obvious. An anonymizing network protects the privacy of normal users and evildoers alike. That was just about my second thought on hearing about Tor (the first was, "Cool!").
I like this article, though, because it has a step-by-step guide to running some simple Nessus scans through Tor. I haven't been using Tor in my penetration tests, partly because being anonymous isn't much of an issue, but mostly because I don't know that I trust it to work well for all the various Nessus tests. I might give this guy's method a try, though, and see how it goes.
