Category: HowTo’s
How to disable 3rd party cookies in Firefox 2.0
Found an interesting blurb on the Mozillazine Forums:
You used to be able to set this via the standard user interface pre-2.0 but now you must go to the address bar and type:
about:config
You can then search for the following string:
network.cookie.cookieBehavior
change the value from 0 to 1 and restart Firefox.
This will prevent the transfer of cookie information from site-to-site. (i.e. msn.com reading your google.com cookies)
Malware Analysis: Tools of the Trade
Excellent information gathering by Lorna Hutcheson in this Internet Storm Center Handler’s Diary Entry. From the diary entry:
First I want to thank everyone who sent in tools for this endeavor. I hope that this list of tools continues to grow and everyone can get good use out of it. If you look at the diary entry that launched this endeavor, you will find the information that I’m looking to obtain about the tools. If you have some that need would be good to list here, please pass them along and I’ll update the list. Some folks sent in entries and checked the box not to have thier names mentioned, so there are no names by those submissions. If you want me to include your name, I’d love to, but you need to give me permission first when you submit the information. All information has been submitted as provided. If you have any additions, I’d be happy to add them!
The List:
1. Malcode Analyst Pack
• socketTool – manual TCP Client for probing functionality.
• MailPot – mail server capture pot
• fakeDNS – spoofs dns responses to controlled ip’s
• sniff_hit – HTTP, IRC, and DNS sniffer
• sclog – Shellcode research and analysis application
• IDCDumpFix – aids in quick RE of packed applications
• Shellcode2Exe – embeds multiple shellcode formats in exe husk
• GdiProcs – used to detect hidden processes
e. Is the source of the tool considered trustworthy?– as trustworthy as iDefense is 🙂
f. Screen Shots of the tool in action (optional)- there is a wmv of the shellcode logger usage on the site (link at bottom of page)
g. Links to additional resource information about the tool- N/A
2. RegMon, FileMon, Ethereal: Submitted by Ronan Rose
RegMon, FileMon and TCPView at www.sysinternals.com
- RegMon: monitors processes accessing the registry.
- FileMon: monitors processes accessing file system.
- TCPview: lets you see in real time what applications are listening on your ports.
- Ethereal: will give you a good view of what is happening on the network at a packet level.
- MSVPC: will allow you to set up a network on your PC. I have a 2.4 ghz, 60GB HD and 750 mb ram which allows me to run 3 VMs simultaneously in a LAN – server2003 to provide dns, ftp, smtp etc,
- Win2k client as Malware host and to run filemon and reg mon on, and redhat 7.2 vm to use ethereal
- In the case of malware with Regmon look for processes polling the “run” keys in the registry . You will need to exclude some processes from both tools (there is quiet alot happening under the bonnet in windows) to improve legability, but if you are still not finding your problem, remember that some malware can inject itself into legit processes, so drop any filters and start again.
- Filemon should show you any process that is systematically looking for information on your hard drive.
- TCPview lets you see in real time what applications are listening on your ports. Some of the newer malware claims to be able to defeat some of the file, registry, tcp view type apps with rootkits etc. When in doubt, check ethereal – if the network is still busy, then you are still infected!
g. Links to additional resource information about the tool-
3. Windows 2000 RAM dump parsing tools: Submitted by Harlan Carvey
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
4. Wireshark, formerly Ethereal
e. Is the source of the tool considered trustworthy? Yes, trustworthy, would run it on primary systems if needed. Open source, can compile from source code if desired. Having access to the full source code for scrutiny adds to the level of trust.
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool- Numerous links available on the Wireshark home page, www.wireshark.org
5. OllyDbg: Submitted by Vince Maes
-Analyzes complex code constructs such as call to jump to procedure
-Sets conditional, logging, memory and hardware breakpoints
-Traces execution and logs arguments of known functions.
-And lots more…
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
6. IDA Pro: Submitted by Vince Maes
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
7. Holodeck: Submitted by Vince Maes
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
WEBSITE LINKS:
1. Pedram’s site: http://pedram.redhive.com/ Submitted by Vince Maes
Exporting NetFlow on Cisco Routers and Switches
A lot more Network Security Monitoring (NSM) products these days (Freeware and Open-source Applications & Commercial Applications) are capable of receiving NetFlow from routing and switching devices. Configuring the export of these flow records are not the most straightforward task as the steps differ between device models. This article will explain the basics behind configuring NetFlow on various Cisco devices:
Perform the steps in this required task to configure Netflow and Netflow Data Export:
1) In global configuration
– ip flow-export source |interface|
– ip flow-export version |number|
– ip flow-cache timeout active 1
– ip flow-export destination |ip| |port|
Where:
|interface| – is the interface you want your NetFlow export to originate from
|number| – is the NetFlow version you wish to export (i.e. 5)
|ip| – is the destination IP of your QFlow collector
|port| – is the port you wish to export NetFlow on
2) In the interface configuration mode of each major interface (not sub-interface) you must run the following command:
– ip route-cache flow
Perform the following steps if using Cisco 4000/4500 switches
1) Commands for enabling NetFlow:
– ip flow-export destination |ip| |port|
– ip flow-export version |number|
– ip flow-export source |interface|
– ip flow-cache timeout active 1
– ip route-cache flow infer-fields
Where:
|interface| – is the interface you want your NetFlow export to originate from
|number| – is the NetFlow version you wish to export (i.e. 5)
|ip| – is the destination IP of your QFlow collector
|port| – is the port you wish to export NetFlow on
Note – You will not enter the ip route-cache flow command on each interface. Also the 4000 and 4500 series switches require a Supervisor IV with a Netflow Services daughter card (WS-F4531) and IOS version 12.1(19)EW or above to support NetFlow.
Perform the following steps if using Catalyst 6500 Switches
On Catalyst 6500 switches, there are two fundamentally different operating systems or modes that can be used: Native and Hybrid. Regardless of mode, in order to run NetFlow the switch must comply with the below table as far as Supervisor Engine and operating system level.
A Catalyst 6500 in Native mode provides the best NetFlow data because it correlates the switch port information to the VLAN information. For sizing purposes, this means that the customer only needs to count the VLANs on the switch toward the total interface count.
A Catalyst 6500 in Hybrid mode provides NetFlow data but does not correlate the switch port information to the VLAN information. For sizing purposes, this means that the customer must count both the VLANs and the individual switch ports toward the total interface count. Either Native or Hybrid mode will work with NetFlow, but the number of interfaces monitored is drastically increased in Hybrid mode.
1) To configure a SupII (Native) with an 12.1(13)E3 IOS version:
– mls nde sender version |number|
– mls flow ip interface-full
– mls nde interface
2) To configure a SupII (Hybrid) with a 7.6.1 CatOS and 12.1(13)E3 IOS version (on the CatOS side):
– set mls flow full
– set mls nde |ip| |port|
– set mls nde version |number|
– set mls nde enable
Where:
|number| – is the NetFlow version you wish to export (i.e. 5)
|ip| – is the destination IP of your QFlow collector
|port| – is the port you wish to export NetFlow on
Note – The above commands are in addition to the required NetFlow commands ‘ip flow-export’ and ‘ip route-cache flow’. SupII in Hybrid commands are CatOS side.
Perform the following steps if using Cisco 7600 switches in native mode
1) If running in native mode make sure the following commands are set:
– mls nde sender version |number|
– mls flow ip interface-full
– mls aging long 64
– ip flow-export source |interface|
– ip flow-export version |number|
– ip flow-export destination |ip| |port|
– snmp-server ifindex persist
Where:
|interface| – is the interface you want your NetFlow export to originate from
|number| – is the NetFlow version you wish to export (i.e. 5)
|ip| – is the destination IP of your QFlow collector
|port| – is the port you wish to export NetFlow on
2) For each interface:
– ip route-cache flow
Problems with flexwan feature card modules for 6500 and 7600 routers
If you have a 6500 or 7600 Cisco series router running in hybrid mode with flexwan feature cards the interface reporting may not be accurate. It is likely that will discover that not all interfaces on your Cisco 6500 or 7600 router are reporting data to QRadar. It is also possible that the interfaces that do show data in Network Surveillance do not appear to be accurate.
In conversations with Cisco TAC, NetFlow is being sent correctly from the router, however the NetFlow datagrams contain inaccurate IFIndex values. This causes problems with data reporting.