I Guess Everyone Else Can Give Up Now?

ouchWow, this was a great piece of…umm…marchitecture on the part of Log Fidelity Corporation:

LogClarity 4.0 Solidifies its Dominance as the Leader in Event Log Management and Forensics by Utilizing Real-Time State-of-the-Art Filtering Intelligence and Log Correlation Technology

The full press release can be found here.

The sad thing is there were so many promising companies in the log management space…oh well 😛

Suggested Blog Reading – Sunday February 10th, 2008

ReadI’m a little confused why more snow has fallen over the past 3 months than has fallen over the past 2 years. I’m getting sick of clearing it!

Here is the list:

Birth of IPv6 – Is your organization pushing towards IPv6? I didn’t think so 🙂

Well tonight’s the night. For the first time, IPv6 domain resolution will be possible from a root server. Just a few addresses mind you, according to this article. You may ask “what took so long?”. The answer is that we did not really need it. IPv6 bakes in some security that was addressed by SSL in IPv4 so that driver did not help. The other issue, a rapidly depleting address space, was managed by NAT(Network Address Translation). But now depletion is really staring us in the face. It is getting hard to get address space. Soon you will see the first bidding wars for owners of large blocks of free IP addresses. Technically you are not allowed to sell IP addresses so don’t expect a market for them. But do expect high valuations for shells that control IP address blocks.

(IN)SECURE Magazine Issue 15 – Looks like Issue 15 is finally out.

Articles in this issue include: Proactive analysis of malware genes holds the key to network security, Advanced social engineering and human exploitation, part 1, Free visualization tools for security analysis and network monitoring, Hiding inside a rainbow, Internet terrorist: does such a thing really exist?, Weaknesses and protection of your wireless network, Fraud mitigation and biometrics following Sarbanes-Oxley, QualysGuard visual walkthrough, Application security matters: deploying enterprise software securely, Web application vulnerabilities and insecure software root causes: solving the software security problem from an information security perspective, A dozen demons profiting at your (jn)convenience, The insider threat: hype vs. reality, Interview with Andre Muscat, Director of Engineering at GFI Software, How B2B gateways affect corporate information security, Reputation attacks, a little known Internet threat, Italian bank’s XSS opportunity seized by fraudsters, The good, the bad and the ugly of protecting data in a retail environment, Interview with Mikko Hypponen is the Chief Research Officer for F-Secure, Interview with Richard Jacobs, Technical Director of Sophos and Interview with Raimund Genes, CTO Anti-Malware at Trend Micro.

A funny thing happened on the way to reviewing my logs – Interesting article from Andy Willingham on his journey implementing a SIEM solution.

At work we’re in the process of implementing a SIEM (Security Information Event Management) system. I’ll leave the vendor nameless for the moment but they have a reputation of making most everything harder than it needs to be. Until that time all logs have to be reviewed manually and obviously that means that they are not reviewed in real time. I have others that monitor most of the logs but I monitor our IPS logs from the UTM device. Usually I review them each morning when I come in but last week I didn’t get a change to so yesterday I was playing catchup.

Interesting tool – pdump.exe – I’ll have to give this a shot.

Toni at Teamfurry.com has a new tool that has some interesting functionality, it dumps process memory, but it also saves each allocated memory region to a separate file.

I’ve played with it a little bit and it seems like it has potential.

Rebecca Herold’s 2008 speaking dates – If you’re in the area I strongly suggest you drop by and check out one of Rebecca’s presentations.

January 18: The Importance of Verifying Third Party Security Programs
Learning event at the Grand Rapids, Michigan ISSA chapter meeting
Web Site: http://www.gr-issa.org/

February 21: Anatomy of a Privacy Breach
Learning event at the University of California, Berkeley
Web Site: http://www.truststc.org/seminar.htm

March 18: Anatomy of a Privacy Breach
Learning event at the Iowa ISACA chapter meeting

April 27: The 30 Second Security Pitch
Learning event at the CSI SX conference
Web Site: http://www.csisx.com/conference/view-by-day.php

April 30 & May 1: Executive Summit: Security and Privacy Collaboration
2-day learning workshop at the CSI SX conference
Web Site: http://www.csisx.com/conference/workshops.php

July 23 & 24: Executive Summit: Security and Privacy Collaboration
2-day learning workshop hosted by the Charlotte, North Carolina ISACA chapter.

Getting over the hump with vulnerability counts – What is more important? The total number of vulnerabilities or the number of highly exploitable vulnerabilities?

Should our vulnerability counts be going up or going down? That is an important question every security professional should be considering when laying out a security program.

If you believe vulnerability counts should be increasing, then presumably you believe that we are only covering the tip of the iceberg with respect to the total number of vulnerabilities in production. In this case, you are taking a short-term view of what is happening in security – it is okay to be hoping the counts increase in the short term, but eventually you want them to decrease (right?).

Give yourself a little time with SQL Injection – Interesting article on blind SQL injection.

I was recently involved in web application assessment and discovered something that I wanted to pass along. Keep in mind that this has probably been utilized before, but it is something that I just noticed so … I wanted to throw it out for your amusement.
To set the stage, I had been looking at this application for quite some time and had an idea that SQL Injection might exist, but I was having much difficulty determining if the injection was actually present. The application was catching errors, displaying 404’s, (etc) and really not displaying any good data to make a decision. So …. the question was … if the application is catching our errors and really not giving us anything to work with … how could we ask the question to the database to indicate if we were actually getting our requests processed by the database server?
Answer? Time.

Security Metrics – How Often Should We Scan? – Personally, I think your frequency of scans should be dictated by the criticality of the systems, the type of systems, the data stored on the systems, and of course…your documented security policy.

I get this question from Nessus users and Tenable customers very often. They want to know if they are scanning too often, not often enough and they also want to know what other organizations are doing as well. In this blog entry, we will discuss the many different reasons why people perform scans and what factors can contribute to their scanning schedule.

German Police Creating LE Trojan – “Law Enforcement Trojan”? I’m not sure if this will fly.

German cops are pushing ahead with controversial plans, yet to be legally approved, to develop “remote forensic software” – in other words, a law enforcement Trojan. Leaked documents outline proposals by German firm Digitask to develop software to intercept Skype VoIP communications and SSL transmissions. A second leaked document from the Bavarian Ministry of Justice outlines costing and licensing proposals for the software. Both scanned documents (in German, natch) have found their way onto the net after being submitted to Wikileaks…

From the SANS Information Security Reading Room:

Spending for IT security gains ground in 09 budget – I can’t remember a time when security/IT/(random item) spending wasn’t “gaining ground”.

New details on federal IT spending plans, made available by the Office of Management and Budget today, show that $103 out of every $1,000 requested for IT spending next fiscal year — or about $7.3 billion in total — will be devoted to improving IT security. That is 9.8 percent more than what was slated for fiscal 2008, and 73 percent more than the $4.2 billion budgeted for cybersecurity in fiscal 2004.

DFRWS 2008 Announcement – I need to come up with a paper for this 🙂

The DFRWS 2008 CfP and Challenge have been posted!

The CfP invites contributions on a wide range of subjects, including:

  • Incident response and live analysis
  • File system and memory analysis
  • Small scale and mobile devices
  • Data hiding and recovery
  • File extraction from data blocks (“file carving”)

And here’s a couple that should be interesting:

  • Anti-forensics and anti-anti-forensics
  • Non-traditional approaches to forensic analysis

Submission deadline is 17 Mar, with author notification about 6 wks later.

Python for Bash scripters: A well-kept secret – Good post for all of us who know Bash scripting but want to break into Python.

Python is easy to learn, and more powerful than Bash. I wasn’t supposed to tell you this–it’s supposed to be a secret. Anything more than a few lines of Bash could be done better in Python. Python is often just as portable as Bash too. Off the top of my head, I can’t think of any *NIX operating systems, that don’t include Python. Even IRIX has Python installed.

The Flow of MBR Rootkit Trojan Resumes – Why…won’t…this…die?

Back in final weeks of 2007 the GMER team discovered the emergence of a new rootkit that hooked into the Windows master boot record (MBR) in order to take control of a compromised computer. The people responsible for this threat kept busy cranking out newly compiled versions of this Trojan in the weeks following its discovery. However, near the beginning of January the output of new variants mysteriously halted. Taking a quick look at the following table of Trojan.Mebroot sample data it appears as though a massive QA plan was performed by the gang, starting back in November 2007.

A Practical Approach to Managing Information System Risk – Another paper to check out.

The mantra spinning around in the heads of most security managers affirms that managing security is about managing risk. Although they know this is the right approach, and they understand the importance of balance in designing and implementing security controls, many of them—including me—came up through the ranks of network engineering, programming, or some other technical discipline. While this prepared us for the technology side of our jobs, the skills necessary to assess and understand business risk arising from the use of information systems were not sufficiently developed.

Suggested Blog Reading – Sunday February 3rd, 2007

ReadWow, February already. I find it hard to believe that at the end of the month I will be starting into my 30th year. Oh well….I’ve looked like I’m 30 for the past 10 years anyway 🙂

Here is the list:

OSVDB API and enhanced cross-referencing – I’m interested to see how well this works. Feedback from anyone?

We are pleased to announce the OSVDB API beta.

Integration and cross-referencing with OSVDB just got a lot easier via the new application programming interface (API), which can provide multiple result formats to fit various needs. Queries can be run against any number of correlation factors, including CVE ID, Microsoft Bulletin ID, Bugtraq ID, and a host of other common reference points. The API is also under constant development, particularly during beta, and suggestions for improvements are quickly and easily implemented by the OSVDB development team.

InfoSec’s Secret Star Promoter: Lauren Nelson, Miss America 2007 – This is a step in the right direction. Also, let’s face it, Al Gore wouldn’t look this good in a bathing suit.

On hand for the crowning will be Miss America 2007, Lauren Nelson. The former Miss Oklahoma has spent the past year traveling the country to promote Internet safety, and appeared on the TV show, “Are You Smarter Than A Fifth-Grader.” (my emphasis)

Open University launches computer forensics course – I’m going to check this one out for sure.

The Open University in the UK has launched a postgraduate course designed to offer a basic understanding of digital evidence collection, forensic computing and IT incident management in criminal investigations. Computer Forensics and Investigations balances the legal and technical aspects of the collection of evidence in internet related crimes such as email bullying, online fraud, and electronic identity theft…

Metasploit Framework 3.1 is out! – Wicked! I love the quote too.

HDM and the metasploit crew have officially released the Metasploit Framework 3.1 release

here is the release note


when asked to come up with a quote for the new release…

“if that new drag and drop meterpreter file browser in the GUI doesnt make you hot for your INFOSEC job, nothing will.”

Are companies doing enough to avoid becoming the first true poster child for data loss? – I think I already knew the answer to this question before reading the article 🙂

Data loss is a burning issue that should be on the mind of every C-level executive and board member, if it isn’t already. According to a recent Ponemon Data Loss Study, the costs associated with data breaches rose 55% in 2007.
What is troubling is the scope and opportunity for such abuse and loss of data, even worse is the fact that the intentional, or malicious, attacks are the easiest to spot and manage, with the unintentional data losses caused by rogue emails and employee ignorance doing the most damage.

Technology helps, but people matter most – Tools are an important part of information security but are useless in the wrong hands. Take this random analogy: Could you build a house without a hammer? Probably, but it’d take you a long time. Conversely, just because you have a hammer, does it mean that you can (or in some cases should) build a house? Probably not. What about giving the hammer to a skilled builder with the knowledge to build the house? Do you think they would have the correct mix of tools and talent to do the job. Probably.

The other day a friend called me up asking what the best scanner (web application vulnerability) is these days because he hadn’t been following the field closely. He recently left a consulting role and signed on as an InfoSec manager at a large organization. His first action was to roll out a website security initiative. He knew of course that I would be highly biased towards Software-as-a-Service. Apparently he would have gone that route, but the company had a policy against outsourcing. No one could quite remembered why. Anyway, before answering his question, I wanted to know more about his environment.

From the SANS Information Security Reading Room – looks like I have some reading to catch up on:

What is PCI all about? – Ever wonder what this “PCI thing” was all about?

This seems to come up every year, or perhaps that’s only the frequency that I address it. It seems everyone has their own view about what PCI compliance is meant to accomplish.
Martin, a friend of mine, writes that PCI is about transferring risk and not mitigating it. This implies that the acquiring bank somehow has the ability or responsibility to prevent a merchant from loosing your credit card number. This is entirely wrong. The heart of the PCI DSS is about mitigating the risk of a direct attack on the cardholder data. I think the one thing we both agree on is that it’s the responsibility of the person closest to the data to protect it – and this just happens to be the merchant in many cases.

The Real Costs of Ignoring IT Security – Interesting article. I really hope people read it because many struggle with the concept of ROI on security investment.

IT security is like insurance: a foolish waste of money — until disaster strikes.

Still, businesses need to be intelligent about planning and deploying IT security technologies and practices. Just as a driver wouldn’t insure a rusty 1971 Ford Pinto for $1 million, a company shouldn’t adopt security measures that, in the long run, wind up costing more than they’re worth.

Many businesses are tempted, however, to skip key security measures and simply pay to fix things if and when a problem occurs. Is this a good idea? Let’s examine several worst-case security scenarios and see what effect they would have on a business.

A golden nugget of a security blog – Thanks be to Shimmy for introducing me to a new security-oriented blog. I’ll put another drink on your “when we meet up” tab.

A couple of weeks ago I followed a link and wound up on a blog called Security Uncorked, JJ’s complete unofficial guide to Infosec. Though it was a fairly new blog, the person writing it obviously was a pretty hands on security practitioner who knew what they were doing and was doing a good job of writing about it. with some good tips and tricks. Further investigation revealed that the blog belonged to Jennifer Jabbusch. I don’t know a lot about Jennifer other than what she has up on the blog, but she is obviously very deeply involved in nuts and bolts information security and has a great writing style.

Three Categories of Buffer Overflow in the JRE – This is why people need a strong foundation in C/C++ before even starting with Java. Someone needs to “bring sexy back” to C/C++ 🙂

Some people think that writing code in Java is a silver bullet against implementation flaws such as buffer overflows. The truth is a little murky.

But real code, though it might be written in 100% Java, depends heavily on the Runtime Environment (JRE) and the JRE contains methods that are written in straight C. We all know what happens when C hangs out with its buddies: fixed size buffer, strcpy and user input.

OWASP Books Released – Hot off the…umm….press?

An interesting download to come out of the OWASP camp — books are now available for your reading pleasure. The initial group of books are:

  • OWASP CLASP v1.2
  • OWASP Top 10 – 2007 Edition
  • OWASP Top 10 – Testing – Legal 07′
  • OWASP WebGoat and WebScarab
  • OWASP Code Review – 2007 (RC1)
  • OWASP Evaluation and Certification Criteria
  • OWASP Top 10 – Ruby on Rails Version
  • OWASP SpoC 2007
  • OWASP World (Nov2007)
  • OWASP Guide 2.0 (2005)

Bruter 1.0 Released – Parallel Windows Password Brute Forcing Tool – Here is another tool to try out.

Bruter 1.0 BETA 1 has been released. Bruter is a parallel login brute-forcer. This tool is intended to demonstrate the importance of choosing strong passwords. The goal of Bruter is to support a variety of services that allow remote authentication.

Artifact Repositories, part deux A follow-up to Harlan’s last post on this topic.

I received an email from someone recently asking me about checklists for determining the attack vector of an incident. Yeah, I know…that’s a pretty broad question, but I do see the issue here. Sure, some folks are “finding stuff”, but the question is now becoming, how did it get there? That’s the next logical question, I suppose, and it is being asked.

Nessus UNIX Configuration Auditing “sudo” Support – Nice addition.

Tenable’s research group recently added support to all SSH enabled UNIX configuration audits to make use of “sudo”. Support is available in version 1.4.4 of the UNIX compliance checks.

Some organizations explicitly prohibit remote “root” logins to their UNIX servers. However, many of these organizations do allow a “non-root” login which has access to the “sudo” command. The “sudo” facility allows a non-root user to run specific restricted commands at the root level. Activity related to “sudo” can be logged as well.

dc3dd, Version 6.9.91 – Another tool I’ll have to try out.

Jesse Kornblum has released the first version of his new acquisition tool dc3dd. It is based on GNU dd which ship with the coreutils (that explains the version number) and incorporates ideas from the well-known dcfldd. More information is available from the ForensicWiki article on dc3dd and the manual page.

Router Hacking Challenge. – Anyone interested in a little competition? 🙂

So are you up to it? can you handle it? can you find a vulnerability in your personal router? Then you are the perfect candidate to join!

The contest runs from 2 February until 29 February. If there are enough submissions, I will write about it and compose a list of the best router hacks that where submitted. I also pick my personal favorite out of that list as the main winner. The Hacker Webzine currently grows each day. The site has 100 to 150K hits each week, so this can give you a lot of attention and spotlight! The rules are very flexible, every kind of exploit is allowed. From buffer overflows to CSRF issues that plague many routers. My personal favorites are CSRF issues since they always work in any situation.

Scroll to top