http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2015-09-19 17:29:58 - Paul Melson's Blog : Earlier this month I had the privilege of speaking at BSides Augusta I gave a lightning talk on working with the Viper Framework for static analysis Here's the talk I also released the module and API scripts I wrote for the talk I cannot say enough about the talent and quality technical content in the BSides Augusta talks This is easily a Top 5 defensive security event I seriously have no idea how I managed to sneak into this speaker lineup Definitely going back next year http://www.secuobs.com/revue/news/584042.shtmlhttp://www.secuobs.com/revue/news/584042.shtml Secuobs.com : 2014-12-11 18:07:10 - Paul Melson's Blog - In October I gave the keynote entitled Effects of Cyber Security Breaches at a closed session of GrrCON The presentation was about the new relationship between cybersecurity, the board of directors, and a realistic look at the impacts of data breaches I've been asked for these slides by a number of folks and have just now gotten around to publishing them, including my presenter's notes Cybersecurity and The Board from Paul Melson http://www.secuobs.com/revue/news/549734.shtmlhttp://www.secuobs.com/revue/news/549734.shtml Secuobs.com : 2013-08-20 15:17:58 - Paul Melson's Blog - In June I gave a presentation at BSides Detroit entitled, Broke, Note Broken An Effective Information Security Program With a 0 Budget Here's the video I have teased the BSides Detroit organizers that they ought to rename their conference to ASides Detroit because, unlike other BSides events, it doesn't coincide with another security conference, and also because it is has the best content and activities of any security conference in Detroit If you're in Michigan or the Great Lakes region at all, I recommend making plans to attend next year I'll be there Also, here are some other upcoming security-related events taking place in Michigan GrrCON Sep 12-13, Grand Rapids mi4n6 meeting Sep 19, Livonia Michigan Cyber Summit Oct 25, Novi http://www.secuobs.com/revue/news/463914.shtmlhttp://www.secuobs.com/revue/news/463914.shtml Secuobs.com : 2012-10-13 07:30:03 - Paul Melson's Blog - This is my first post to this blog in well over a year But it's big, so that's good, right This is a walk-through of the GrrCON 2012 Forensics Challenge that was designed by Jack Crooks jackcr Special thanks to Jack for making it so much fun and challenging 1 How was the attack delivered Open outpcap in Wireshark, find first TCP session, and follow the TCP stream Oh, look A file that ends in docexe, that can't be good Note the MZ file magic number and This program cannot be run in DOS mode text -- sure signs that this is a Win32 executable file IMAGE Answer HTTP download of http 663211938 tigers BrandonInge Diagnostics swing-mechanicsdocexe 2 What time was the attack delivered In Wireshark, find the HTTP GET request ACK packet from the stream we just looked at In the Frame section of the packet, locate the timestamp IMAGE Answer Apr 27, 2012 22 00 59 3 What was that name of the file that dropped the backdoor Looking at the same HTTP GET request in Wireshark, what was the name of the file from the URL Answer swing-mechanicsdocexe 4 What is the ip address of the C2 server In Wireshark, clear the current TCP stream filter, and browse through the packets As the HTTP session with the malware dropper ends, we see a new outbound connection to TCP port 443 from our victim The destination address is the command control C2 server for our back door IMAGE Answer 2215419732 5 What type of backdoor is installed Run foremost to extract the Win32 EXE file we found in the first question foremost -t exe outpcap IMAGE Foremost will create an output directory with a subdirectory named 'exe' that should contain our backdoor Now upload the file to VirusTotal You should see that VirusTotal has already scanned this file When I did it on 10 6, the last scan date was 9 28, the first day of GrrCON IMAGE Answer Poison Ivy 6 What is the mutex the backdoor is using This is the first answer to the challenge you have to work hard for In order to do this the right way, you must use the memory dump to identify which process initiated the connection to the C2 server, then use its PID to find the base address and memory range, then use that to match any mutexes for that range You can cheat here and Google search Poison Ivy mutexes and see if any of them are present in the mutantscan output, too, but as I said, that's cheating So, volatility First, find the process that's connecting to the C2 from question 5 volpy -f memdumpimg connscan grep 2215419732 IMAGE We see it's the process at PID 1096 So now we need find out what process it is and, more importantly, it's base address and memory range volpy -f memdumpimg psscan grep 1096 IMAGE Uh-oh, that's explorerexe, isn't it Process injecting basterds Anyhow, the base address of our pwned process is 0x0214a020 Any mutexes we find in that range are of interest to us volpy -f memdumpimg -s mutantscan grep 0x0214 IMAGE There happens to be a mutex close to our base address It's not a guarantee that this is the answer we're looking for, but a quick Google search for Poison Ivy mutex validates the finding Answer VoqAI4 7 Where is the backdoor placed on the filesystem To answer this question, we'll examine the SleuthKit file compromisedtimeline that Jack was kind enough to include in this challenge We'll start by looking around the time that the backdoor was downloaded 4 27 12, 22 00 59 in question 2 and working forward PS - If you got stuck here at GrrCON because you assumed that the filesystem time and the packet capture time were perfectly in sync, you learned the most valuable lesson there is in DFIR There is always drift in timestamps between sources Unfortunately, you learned it the hard way Also, we'll want to look for any files that are the same size as the one we extracted from the pcap file with foremost 8,192 bytes in question 5 IMAGE At 21 59 20 on 4 27 12, we find the prefetch temp file for the swing-mechanicsdocexe file, and immediately after it, another file that matches the size of that file from our pcap being written to c windows system32 svchostsexe Note There is a svchostexe file in pourcentssystemrootpourcents system32 on WinXP and Win7, but there is no svchostsexe, another clue that this is not legit Answer C WINDOWS system32 svchostsexe 8 What process name and process id is the backdoor running in Now, if you got this far, but cheated at question 6 instead of doing the work, you may have run the volatility pslist module, saw svchostexe, and given the wrong answer Oops Cheaters never prosper We already know that the right answer is explorerexe and its PID is 1096 Answer explorerexe 1096 9 What additional tools do you believe were placed on the machine Back to where we left off in question 7 Keep working forward in the SleuthKit timeline, and IMAGE That's weird Prefetch files indicate a program launch Somebody ran netexe, ipconfigexe, and pingexe Likely our attacker testing network connectivity - But wait There's more IMAGE One thing DFIR will do to you is make you something of an expert on the names of files and folders that live within C WINDOWS, and, well, this doesn't look right for a lot of reasons And when we see a file named sysmonexe which normally is in WINDOWS system32 created in this folder, and it's the same size as our binary from question 5 8,192 bytes , we know we're looking at more bad stuff So in addition to a backup copy of our backdoor, there is a text file of some kind and four additional executables named ftxt, gexe, pexe, rexe, and wexe You can also find the handles to these files in memory with volatility as well volpy -f memdumpimg filescan grep -i svchostsexe volpy -f memdumpimg filescan grep -i systems IMAGE Answer gexe, pexe, rexe, wexe, and sysmonexe 10 What directory was created to place the newly dropped tools Answer C WINDOWS system32 systems 11 How did the attacker escalate privileges We can assume from the work we did in 9 and 10, that those binaries aren't copies of calcexe, so likely one of those was used for privilege escalation It would be great if we could extract them from the memory image, but since we didn't see them when we used the volatility psscan module, our chances aren't very good Maybe we can find the command syntax that was used and get an idea of which tool was used to do what volpy -f memdumpimg cmdscan IMAGE Well, that looks like an FTP command mixed in with Jack creating the memory dump we're analyzing, which is interesting, but not what we're looking for Yet Note There's a good point to be made here about how by gathering the evidence, evidence was also destroyed In the process of copying down and running mdd, Jack also overwrote most of the cmdexe history that we are interested in for this question So, no easy win to be had here Maybe we can find what we're looking for in strings We'll use strings and the volatility strings module to pull all of the strings 5 in length out of our memory image and see if we can find anything in there By looking at the SleuthKit timeline file, we see that wexe was the first of the suspicious binaries to be launched first, so we'll look for that in particular strings -n 5 -t o memdumpimg stringstxt volpy -f memdumpimg strings -s stringstxt vol-stringstxt grep w exe vol-stringstxt IMAGE Bingo Those command line arguments are the username, domain name, NTLM hash, and program to run for a pass the hash attack tool of some sort So now our attacker is running cmdexe as Administrator Possibly for the whole COMPANY-A domain If this is your network, this is where you excuse yourself to put on clean shorts Answer pass-the-hash attack 12 What level of privileges did the attacker obtain See above Answer Administrator 13 How was lateral movement performed Once we understand that the attacker has become COMPANY-A Administrator on what is probably an Active Directory domain controller, they can go wherever they want Let's look for hostnames that aren't dc01company-acom and see if they did anything interesting there grep -i company-a com vol-stringstxt IMAGE In addition to our own hostname, we see the following dc01company-acom res-lab02company-acom If we look back to when we ran the volatility connscan plugin for question 6, we saw a bunch of NetBIOS and LDAP connections to 1721615010, which is dc01company-acom That's pretty much a tell-tale sign that dc01 is the COMPANY-A domain controller Which means our attacker is in fact a domain admin, and can pivot freely onto dc01 and anything else he wants Maybe he'll do something like map a drive later Who knows Answer Credential re-use as Administrator 14 What was the first sign of lateral movement Now that I think of it, was there anything from 1721615010 in the pcap file ssldump -n -r outpcap IMAGE You can do this in Wireshark, too, but one trick I wanted to show off is ssldump's ability to summarize all of the TCP sessions in a pcap file Oh, and it looks like dc01 is also phoning home to the C2 server Hope you packed two pair of clean shorts Answer Well, I saw the C2 traffic from dc01 in the pcap file before any of the other evidence, so that's my answer Note I think the login to the domain controller as Administrator from a workstation, which came first, should also be caught by the security ops team if they are monitoring the security EventLog on the domain controllers Which they should be 15 What documents were exfiltrated For this one, we had to wander around in the vol-stringstxt file we made to put the pieces together less vol-stringstxt IMAGE IMAGE So I admit, this is a bit of a guess, but all of this looks suspicious to me Here we have a set of files that look like the kinds of things we would want to exfiltrate Then not that far away, we have a net use mapping a drive to dc01, then making a local directory named 1 if you look around some more, you discover it's C WINDOWS system32 systems 1 After that, the files from the shared drive are copied to that folder, and that folder is compressed in a rar file and password protected Then an FTP command is made That looks like data exfiltration to me Answer confidential1pdf, confidential2pdf, confidential3pdf Note You will see later that I'm close, but managed to miss about half of the files 16 How and where were the documents exfiltrated Answer FTP to 663211938 17 What additionl steps did the attacker take to maintain access Unless I missed something which is actually quite likely , we already talked about this in question 14 Answer Installed Poison Ivy RAT on dc01 18 How long did the attacker have access to the network So, there are two possible answers Jack is looking for There's the cynical defeatest answer, Clearly as long as he wanted Or there's the specific answer whereby we look at the time from the start of the first C2 connection to the end of the data exfiltration For that, we fire up Wireshark IMAGE IMAGE The first screen is the first packet of the first C2 connection, when our attacker actually got control of the first victim system The second screen has the filter tcpflagsfin 1 applied to prove a point The last packets in the pcap file are ACKs for the C2 connections to both 1721615020 and 1721615010 res-lab01 and dc01 respectively The FTP connections complete at 22 13 26, but the C2 goes on, likely past the end of the file Answer 12 minutes, 21 seconds or indefinitely 19 What is the secret code inside the exfiltrated documents To get at the secret documents, we need to recreate our own copy of the encrypted rar file used for exfiltration, then decrypt it, extract the files, and view them Fortunately, we already know everything we need to get this done First, extract the rar file from the pcap foremost -t rar outpcap IMAGE Now, extract the files We'll need the password, but we caught that in the volatility strings we sifted through for question 15 unrar x -pqwerty 00002134rar IMAGE Note the bottom of the screenshot there Jack's got an evil sense of humor Those aren't even PDFs But that is in fact an OpenOffice file IMAGE Answer 76bca1417cb12d09e74d3bd4fe3388e9 20 What is the password for the backdoor Whilst reading the article we Googled for about Poison Ivy mutexes for question 6, we also learned that Poison Ivy doesn't typically use packers or cryptors, and that the C2 server and password are coded in the binary file I wonder if they'll stick out like a sore thumb strings 00000002exe IMAGE We totally recognize that IP address as the C2 server from question 4 You'll never guess Jack's favorite baseball team Answer tigers If you made it this far, thanks for reading Hope you liked it Oh, and your reward for reading the whole thing In case you didn't catch it, this challenge is essentially a mirror of the attack on RSA that led to the theft of their token seed data files in 2011 When I made that realization, it gave me lulz Jack, you're the man http://www.secuobs.com/revue/news/405423.shtmlhttp://www.secuobs.com/revue/news/405423.shtml Secuobs.com : 2011-10-27 03:21:22 - Paul Melson's Blog - Roughly a year and a half ago, Rocky DeStefano and I had a conversation about the SIEM market in which he predicted mass acquisitions It took longer than he originally guessed, but 1 HP Completes Acquisition of ArcSight 2 SolarWinds Buys TriGeo for 35M 3 IBM to Acquire Q1 Labs 4 McAfee to Acquire NitroSecurity I'll throw another one out there - after more than 2 years of steady speculation of a Splunk IPO, they hired David Conte as CEO fresh from his setting up the sale of IronKey to Imation Expect Splunk to be acquired in 2012, or at least try really hard http://www.secuobs.com/revue/news/337118.shtmlhttp://www.secuobs.com/revue/news/337118.shtml Secuobs.com : 2011-05-13 21:38:12 - Paul Melson's Blog - The Grand Rapids chapter of ISSA has announced a new event called GrrCON It's a 1-day security conference that will be held in Grand Rapids, MI in September 2011 This will be one to keep an eye on over the next month or so as they get the speaker line-up solidified I expect some cool talks and even a few surprises Website http wwwgrrconorg Twitter GrrCON LinkedIn Events GrrCON 2011 http://www.secuobs.com/revue/news/304733.shtmlhttp://www.secuobs.com/revue/news/304733.shtml Secuobs.com : 2010-10-10 07:28:45 - Paul Melson's Blog - I recently had the pleasure of guest lecturing to a group of MBA students at Grand Valley State University on the topic of Information Security This was a fun presentation for me to put together because it challenged me to think of how to present the business value of information security in a way that's meaningful and relate-able to a wider audience not already indoctrinated with the market and regulatory constraints in which I operate And in this case, I think I pulled it off So here are the slides from that presentation, minus a few that won't translate and aren't core to the presentation itself anyway I've also included my slide notes by title below Information security for business majorsView more presentations from pmelson 1 Title What part of the car allows it to go fast I think it s brakes How fast would you drive if your car had no brakes Security is like brakes - it's a set of controls, only some of which are always on, that allows your company to take bigger risks with greater confidence Who can define what a DoS attack is And can anyone describe to me how the DoS handshake works in the book, figure 66, page 269 I am sorry to inform you that you will never need to know this Every major vendor out there fixed this bug nearly a decade ago That s the nature of security you don t get to stop learning or adapting, because the attackers don t stop learning and adapting I hope to share with you this evening things that will take a little longer to become obsolete 2 OK, so how bad is it really 3 Are you scared or skeptical Gauge your response to the previous slide If you were scared, consider whether or not you would panic in the face of a catastrophic security event If you were skeptical, consider whether or not you would take a threat serious enough to be prepared 4 The sky is always falling The average time for an unpatched Windows server on the Internet to be compromised is 3-6 hours The overwhelming majority of data breaches are caused by human error If you have any one of these things, hackers can monetize them Computers of any kind can be rented out to send spam or launch DDoS attacks Personal data, referred to as dumps are stolen and sold by the thousand on the Internet Money in bank accounts is transferred by EFT and then wire transfer out of the country where it is laundered Credit card numbers are used to purchase stolen goods which are shipped overseas Despite all of this, consumer-based ecommerce continues to grow 15-20pourcents annually If you sell to consumers, the Internet isn t where you want to be, it s where you HAVE to be 5 Information Security's Business Value Information security can be summed up as loss avoidance The value proposition is that these efforts are less expensive than the consequences of not having them Regulation makes some parts of security the price of admission, the rest is about striking a balance between security and flexibility Bruce Schneier s book, Beyond Fear 6 How Information Security Works Known as the CIA Triad, these are the ilities that security controls impact directly There are other ilities Flexibility Scalability Portability Profitability But even at its best, security is only an enabler of these things At either extreme, security blocks them 7 The Goals of Security 8 Policy 9 Controls Preventive IT controls are not infallible, and covering 100pourcents of corner cases with your controls costs too much and hamstrings your actual business Auditing controls are time-consuming, and usually any damage is already done by the time an audit discovers it Monitoring controls are typically based on sampling, which means you might miss something More intended as a quality or health check 10 Tools of The Trade - Preventative 11 Tools of The Trade - Auditing 12 Tools of The Trade - Monitoring 13 Risk Management 1 14 Risk Management 2 15 Incident Response I like the Richard Clarke quote from your book If you spend as much on information security as you spend on coffee, you will be hacked, and you ll deserve to be hacked Of course, Mr Clarke is wrong, because having a security incident is not an issue of if, but an issue of Wrong Not when but how often 16 graph 17 Awareness Consultation Consulting on projects or with operations teams leads to better security outcomes because security is considered earlier in the process Raising awareness and then inviting people to share concerns is a great way to organically scale your visibility to issues By being proactive and meeting colleagues where they are, you gain goodwill for your security efforts This is a key piece of a successful security program Strong-arm tactics are a guaranteed path to failure Without goodwill and trust, the security practice in your company quickly becomes an obstacle for people to bypass in order to get their jobs done This is how you lose your job 18 How IT Security Fails 19 image 20 image 21 image 22 You say potato, I say No 23 Communication 24 Why Buying Security Fails Buying and integrating security technology only works some of the time, and that time is not right now Information security is an arms race Technology is both the weaponry and the battlefield Security is not a problem that can be solved Security is a practice that must be maintained with people and process 25 Discussion http://www.secuobs.com/revue/news/255624.shtmlhttp://www.secuobs.com/revue/news/255624.shtml Secuobs.com : 2010-05-21 05:44:51 - Paul Melson's Blog - Bill Roth of LogLogic commented on my Twitter exchange with Rocky DeStefano of Visible Risk where we talked about LogLogic's announcement that they were discounting their SIEM product I then wrote a reply, and it got a little long So I made it a blog post instead Rocky, Paul The ClueTrain Manifesto calls markets conversations , so here goes I think you're falling into a the trap of conventional wisdom First off, the basic assumption that the world falls neatly into the SIEM categorization is just plain false I stand by LogLogic's modelit all starts with log management as the crucial piece, without that key use cases like network forensics are not even possible Second, the notion that dropping the price is bad is just plain weird Is LogLogic dropping the price to sell more Sure we are Are we dropping the price to take market share Sure we are Are we seeing a great response Sure we are Since when is saving people money a bad thing And we're always interested in a podcast Bill Roth, EVP LogLogic Hi Bill, Thanks for the comment And thanks for participating in the dialogue I think it's awesome that LogLogic is out front and engaging on its business decisions Very refreshing As to your point about log management being that crucial initial component of a SIEM implementation, I agree completely Log management has also developed as its own market segment as well, independent of SIEM But I don't need to tell you that - On the topic of LogLogic's decision to discount its SIEM product, I didn't mean - and I don't believe Rocky did either - that charging less for SIEM is bad, or even a bad business move That said, I do believe that for some significant portion of potential customers log management is a commodity technology However, from my own experience and from everything I've seen to date, SIEM is not a commodity technology, and I'm not convinced it will be As such, I don't see price as a strong competitive differentiator in the SIEM market Following the recent recession, where IT capital budgets still haven't caught up to the hopefully sustained economic upturn, I imagine the feedback on LogLogic's price cut has been positive, and that you'll see some SIEM sales where you wouldn't have but for the discount But in the mid- to long-term, I have my doubts as to whether there is any meaningful gain in market share to be had for LogLogic - or any SIEM vendor for that matter - simply by competing on price with other SIEM vendors Let's be frank, if price were a big piece of why companies choose a particular SIEM, Cisco MARS would have the lion's share of the market and ArcSight would be folding Instead, it's the other way around http://www.secuobs.com/revue/news/224288.shtmlhttp://www.secuobs.com/revue/news/224288.shtml Secuobs.com : 2010-05-20 17:55:39 - Paul Melson's Blog - I've been really busy both in my personal and professional life for the past year or so, with no signs of slowing down soon But I have to acknowledge that the main reason my blog posts have fallen off is Twitter Now, all of the ideas that I have that I might have developed and expanded into a blog post are prematurely evaluated for length If they can be abbreviated to a couple of 140-character haikus or less, they go on Twitter Which means they never grow up to be blog posts They're like the high school dropouts of ideas But every once in a while, a Twitter exchange becomes so interesting that, despite the compressed and fleeting nature of Twitter, it turns into something worthy of framing The other night, Rocky DeStefano of Visible Risk and I had an exchange on SIEM that I thought the wider world might find interesting The background to the conversation is this post from Rocky's blog about the recent announcement from LogLogic that they were discounting their SIEM product, and then this responding blog post from LogLogic rockyd The LogLogic response - http bitly bAQSZO to my discounting SIEM Post http bitly aiW3kB 8 47 PM May 18th via TweetDeck rockyd I need to noodle on the LogLogic response more I appreciate the conversation, I think I may see the opposite end of the customer spectrum 9 02 PM May 18th via TweetDeck pmelson rockyd I think you nailed the issue If you NEED SIEM, you won't compromise features functionality for capital cost savings 9 06 PM May 18th via TweetDeck pmelson rockyd If Cisco couldn't make Free SIEM With Purchase work, it's not ever going to work 9 07 PM May 18th via TweetDeck rockyd pmelson let's be honest how could they possible respond any differently than they did time for a podcast on the subject 9 50 PM May 18th via TweetDeck pmelson rockyd They could just fess up We're shipping log management appliances, but SIEM isn't moving So we put it on clearance sale - 9 52 PM May 18th via TweetDeck pmelson rockyd I think with Gartner's SIEM MQ being released, we're about to see another round of SIEM casualties as VC pulls out 9 54 PM May 18th via TweetDeck rockyd pmelson There has to be quickening soon, there is way too much of the same thing in the market 9 57 PM May 18th via TweetDeck pmelson rockyd Right I've been thinking about the key SIEM differentiators and I've only got three 10 00 PM May 18th via TweetDeck rockyd pmelson which three 10 06 PM May 18th via TweetDeck rockyd pmelson Like - Sources, Scalability, Analytical Usage, Correlation Statistical Evaluation, and getting Intelligent information out 10 08 PM May 18th via TweetDeck pmelson rockyd 1 performance scalability 2 UI and drill-down 3 supported sources 10 07 PM May 18th via TweetDeck rockyd pmelson there are some others like context of Host, Vuln, Registry, Applications and Users that lead you towards more advanced usage 10 09 PM May 18th via TweetDeck pmelson rockyd OK, so asset data model s makes 4, pre-defined content is 5 That's still not a lot 10 15 PM May 18th via TweetDeck rockyd pmelson each is several years of development and refinement with customers 10 32 PM May 18th via TweetDeck rockyd pmelson this comes down to a compliance check box sale versus a security team needing to integrate a tool into their process 10 35 PM May 18th via TweetDeck pmelson rockyd Agree But a handful of differentiators a handful of potential market leaders Time to thin the herd Again 10 42 PM May 18th via TweetDeck rockyd pmelson now I see where you're headed BTW I think you'll see 3 more acqusitions by end of year 10 45 PM May 18th via TweetDeck rockyd I was thinking about creating a vegas odds website for SIEM Quickending and donate some portion of the funds to HFC 10 47 PM May 18th via TweetDeck pmelson rockyd A SIEM futures market Very DARPA 10 49 PM May 18th via TweetDeck So there, for your parsing and edification, some thoughts on the SIEM product space, the recent Gartner MQ for SIEM, and the near-term ramifications of Gartner's paper on the market Also, if you aren't already, you should be reading Rocky's blog, especially if you're interested in SIEM and security ops Rocky's a guru in this space, and in addition to his blog he has already put together some great podcasts since launching his latest venture, Visible Risk http://www.secuobs.com/revue/news/224059.shtmlhttp://www.secuobs.com/revue/news/224059.shtml Secuobs.com : 2010-05-19 06:04:39 - Paul Melson's Blog - You are here because you are searching for information on Splunk vs ArcSight Logger I actually wrote this post months before posting it, but sat on it for reasons that may become apparent as you read on If you want to hear me talk about my experience with Logger 40 through the beta process and beyond, you can check out the video case study I did for ArcSight In short, Logger is good at what it does, and Logger 40 is fast Ridiculously fast But that's not what I want to talk about I want to talk about the question that's on everyone's mind ArcSight Logger vs Splunk Comparing features, there's not a strong advantage in either camp Everybody's got built-in collection based on file and syslog Everybody's got a web interface with pretty graphs The main way Logger excels here is in its ability to natively front-end data aggregation for ArcSight's ESM SIEM product But if you've already got ESM, you're going to buy Logger anyway So that leaves price and performance as the remaining differentiators Splunk can compete on price, especially for more specialized use cases where Logger needs the ArcSight Connector software to pick up data ie Windows EventLog via WMI, or database rows via JDBC And if you don't care about performance, implying that your needs are modest, Splunk may be cheaper for you for even the straightforward use cases because of the different licensing model that scales downward So for smaller businesses, Splunk scales down For larger businesses, Logger scales up For example, if you need to add storage capacity to your existing Logger install, and you didn't buy the SAN-attached model, you just buy another Logger appliance You then 'peer' the Logger appliances, split or migrate log flows, and continue to run search reporting out of the same appliance you've been using, across all peer data stores With Splunk You buy and implement more hardware on your own And pay for more licenses My thinking on performance Logger 40 is a Splunk killer, plain and simple To analogize using cars, Splunk is a Ford Taurus for log search It gets you down the road, it's reliable, you can pick the entry model up cheap, and by now you know what you're getting Logger 40, however, is a Zonda F with a Volvo price tag To bring the comparison to a fine point, I'd like to share a little story with you It's kind of gossipy, but that makes it fun When ArcSight debuted Logger 40 and announced its GA release at their Protect conference last fall, they did a live shoot-out of a Logger 7200 running 40 with a vanilla install of Splunk 4 on comparable hardware and the same Linux distro CentOS that Logger is based on They performed a simple keyword search in Splunk across 2 million events, which took just over 12 minutes to complete That's not awful But that same search against the same data set ran in about 3 seconds on Logger 4 This would be an interesting end to an otherwise pretty boring story if it weren't for what happened next Vendors other than ArcSight - partners, integrators, consultants, etc - participate in their conference both as speakers and on the partner floor One of these vendors, an integrator of both ArcSight and Splunk products, privately called ArcSight out for the demo His theory was that a properly-tuned Splunk install would perform much better Now, it's a little nuts and perhaps a little more dangerous to be an invited vendor at a conference and accuse the conference organizer of cooking a demo But what happened next is even crazier ArcSight wheeled the gear up to this guy's room and told him that if he could produce a better result during the conference that they would make an announcement to that effect Not one to shy away from a technical challenge, this 15-year infosec veteran skipped meals, free beer, presentations, more free beer, and a lot of sleep to tweak the Splunk box to get better performance out of it That's dedication There's no doubt in my mind that he wanted to win Badly I heard from him personally at the close of the conference that not only did he not make significant headway, but that all of his results were worse than the original 12 minute search time You weren't there, you're just reading about it on some dude's blog, so the impact isn't the same But that was all the convincing I needed But if you need more convincing we stuffed 6mos of raw syslog from various flavors of UNIX and Linux 3TB into Logger 4 during the beta I could keyword search the entire data set in 14 seconds Regex searches were significantly worse They took 32 seconds http://www.secuobs.com/revue/news/223403.shtmlhttp://www.secuobs.com/revue/news/223403.shtml Secuobs.com : 2010-04-15 06:49:50 - Paul Melson's Blog - The first rule is actually how we caught the first incident The binary is served on non-standard HTTP ports via fast-flux servers It's a signature we've had in place for years alert tcp HOME_NET any - EXTERNAL_NET 80 msg LOCAL exe file download on port other than 80 flow established content GET depth 4 content exe nocase classtype misc-activity sid 9000160 rev 1 And these are designed to catch the bot HTTP checkins we've seen so far This is likely to be more of a whack-a-mole effort as we've already seen the checkin URL format change once alert tcp HOME_NET any - EXTERNAL_NET HTTP_PORTS msg LOCAL Koobface action fbgen checkin flow to_server,established content POST content sys action fbgen nocase classtype trojan-activity sid 9000220 rev 1 alert tcp HOME_NET any - EXTERNAL_NET HTTP_PORTS msg LOCAL Koobface gojs checkin flow to_server,established content POST content gojs nocase classtype trojan-activity sid 9000221 rev 1 http://www.secuobs.com/revue/news/212396.shtmlhttp://www.secuobs.com/revue/news/212396.shtml Secuobs.com : 2010-01-22 20:50:36 - Paul Melson's Blog - I've just finished compiling the security incident handler case statistics for 2009 This is the second year in a row that I've used the same set of metrics, and having two years worth of data has led to some interesting observations about security trends within my employer's environment One set of statistics that may be of interest to the general Internet public is the volume of malware cases that we have worked over the past two years There are a couple of things worth pointing out in this graph The first, and perhaps most obvious one, is that there is a drop-off in malware related cases in 2009 Surely, that can't be right It is, but it's due to implementing some new security technologies in December of 2008 In fact, those countermeasures reduced the number of malware cases we handled in 2009 by roughly 65pourcents compared to 2008 I want to say two things about this First, this demonstrates the effectiveness of the preventative countermeasures that we employed and confirms the value of those countermeasures Notice that I'm not saying that it proves ROI But the bottom line is that it was worth it The second thing I want to point out about that decline, however, is that it's just a decline It did not eliminate the problem In fact, in 2009 we saw malware chip away at other defenses that were highly effective only two years before And I suspect that, if we do nothing else about it, that those levels will begin to rise in 2010 and regain the same level of frequency we saw in 2008 if not higher There's a hint of that in the graph towards the end of 2009 The next thing I want to point out about this graph is the peak frequency It is consistent Every three months, there is a spike in malware incidents in our environment I would love to see statistics from other companies or the Internet at large to see if this is an Internet-wide pattern I suspect that it is Despite the new countermeasures, despite the decrease in order of magnitude, the spikes occur like clockwork every third month That leads me to believe two things First, I believe that this pattern is driven externally since it didn't deviate, even when our environment changed significantly Second, I believe that this is no accident The vendors that produce malware botnet kits are responsible for introducing most of the new exploits and anti-detection capabilities that we see on a regular basis Their stuff is used more widely than custom malware as well Therefore, this leads me to believe that there is one big group, and they're on a 90-day release cycle I've got no intelligence data to support this, but I have a hard time believing that this pattern repeats itself, without exception, for two years straight Bottom line, this is the kind of useful information that trend analysis can give you, and why metrics are worth gathering and analyzing http://www.secuobs.com/revue/news/184572.shtmlhttp://www.secuobs.com/revue/news/184572.shtml Secuobs.com : 2009-12-28 22:40:23 - Paul Melson's Blog - Back in 2008 I posted a list of the tools I use for doing malware analysis The tools I use have changed over time, and rather than just talk about a couple of recent additions, I decided I'd put a current complete list up with links This is by no means a comprehensive list of malware analysis tools, it's just what I like and use Platform VMWare Workstation The vulnerable stuff Windows XP Internet Explorer 7 8 Firefox Acrobat Reader Flash Player General Tools Cygwin Perl Python Hex Editor Neo HashCalc IZArc Analysis Tools SysAnalyzer iDEFENSE MAP GMER catchme Multipot OSAM HijackThis Startup Control Panel HookExplorer Sysinternals Suite ProcL sniff_hit Wireshark run on Host OS outside VM Binary Tools Mandiant Red Curtain OllyDbg 110 Various OllyDbg plugins PEiD RDG Packer Detector pefile packeridpy ImportREC JavaScript HTTP Tools SpiderMonkey Didier Stevens mod iegetsh script crap2shellcodepl Console2 Firefox plugin NoScript Firefox plugin PDF Flash Tools pdf-parserpy pdftk SWFTools Sothink SWF Decompiler Web Sites as Tools Wepawet VirusTotal CWSandbox Comodo Instant Malware Analysis http://www.secuobs.com/revue/news/176236.shtmlhttp://www.secuobs.com/revue/news/176236.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - MiniMetricon 25 was a one-day security metrics event held in San Francisco back in April Some of the slides decks were published to securitymetricsorg earlier today I'm only about half way through them, but there's some good stuff in there, and if you're doing anything around security metrics, I recommend you check them out So far, the standouts for me are Pete Lindstrom's slides on Enterprise Security Metrics, and Wade Baker's deck on Incident Reponse Trends And speaking of Wade Baker, he and a few of the other rockstars at Verizon Business have a blog that you should add to your feeds list http://www.secuobs.com/revue/news/164971.shtmlhttp://www.secuobs.com/revue/news/164971.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - It's been awhile since I've covered anything to do with honeypots or honeyclients But it's also been awhile since anything new came along Via Thorsten Holz at honeyblog Sicherheit'08 Monkey-Spider Detecting Malicious Web Sites with Low-Interaction Honeyclients Monkey-Spider, not to be confused with SpiderMonkey, is a new honeyclient from Thorsten, Ali Ikinci, and Felix Freiling Like HoneyC, it's a crawler-based client that detects web-based, client-side attacks It was presented at Sicherheit in Germany in April Fortunately, the whitepaper and documentation are in English After reading the whitepaper and playing with the code a little, the thing that occurs to me is that, while this is very cool, and still somewhat useful, what I really want for operationalizing a honeyclient in my enterprise is the ability to seed the honeyclient from firewall proxy logs That way the honeyclient is analyzing my web traffic, not off looking for random malicious sites to add to already big blacklists http://www.secuobs.com/revue/news/164970.shtmlhttp://www.secuobs.com/revue/news/164970.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - When it's also a beer event, of course July's GRSec meetup will be Wednesday, 7 23 08 The reason for the Wednesday date is two-fold First, Tuesdays don't work for everybody, so we're switching it up over the summer to see if we can get some fresh faces out to GRSec Second, this month we're at the new Graydon's Derby Station, and that particular evening, they will be tapping a cask of Victory Hop-Devil IPA If that's not enough reason for you to be there, then I don't know who you are anymore, man I don't know you at all Details Map http://www.secuobs.com/revue/news/164969.shtmlhttp://www.secuobs.com/revue/news/164969.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - My wife was at her mother's tonight when she caught me on GMail chat This is the log of that chat, unedited Jessica boo me hey there Jessica hey baby Just looking at my moms task mamanger, she has a ton of stuff running inlcuiding a bunch of exe file me that's all you should see in task manager - exe files Sent at 10 28 PM on Tuesday Jessica how amobile deviceserviceexe, algexe, msmsgsexe, searchprotectionexe, juschedexe, E-S10IC1exe all of these are listed under Administrator me some of those are fine type them into google liutilitiescom searchprotectionexe sounds suspicious don't log into the bank or anything Jessica why would there be 4 svchostexe's me that's typical Jessica or servicesexe winlogonexe me both fine Jessica csrssexe me also fine Jessica smss me seriously google Jessica mDNSR me that sounds suspicious Jessica I don't need no stinkin google, I have you me meh Sent at 10 33 PM on Tuesday http://www.secuobs.com/revue/news/164968.shtmlhttp://www.secuobs.com/revue/news/164968.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - It seems like I can't go to a coffee shop, conference center, or bar these days without some jackass on the network abusing the bandwidth Running MMO games, BitTorrent, gnutella, or even just a large FTP HTTP download will saturate the wireless access point, let alone the modest DSL line it's connected to, rendering it unusable for the other patrons there This is just plain rude And since the barrista can make a mean caramel cappucino, but doesn't have the ability to blacklist your MAC on the AP which I realize isn't a very effective control, but hey - maybe you'd get the message then , we're all stuck to suffer And I wouldn't do anything hostile on a public network But in the name of network self-defense, there are a couple of tools you might want to take with you to the coffee shop next time Wireshark - The quickest, easiest way to identify the abuser's MAC IP is with a sniffer like Wireshark, tcpdump, or iptraf Snort - Snort with flexresp2 enabled, bound to your wireless interface, and the p2prules set enabled and modified with resp reset_both,icmp_host is an effective deterrent for people using P2P file-sharing software Ettercap - More severe than Snort, you can use Ettercap to perform ARP poisoning and essentially blackhole the client s of your choice by MAC address You could also use this tool to sniff unencrypted traffic between clients and the AP and points beyond But you wouldn't do this It would be uncivilized, and possibly illegal There are lots of other wireless tools out there that have some application here, but many of them either go to far to be civil Void11 or legal Hotspotter , so I don't recommend them For that matter, what I do recommend is getting your own EVDO card Then you don't have to put up with rude WiFi users in the first place http://www.secuobs.com/revue/news/164967.shtmlhttp://www.secuobs.com/revue/news/164967.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - The whole Dan Kaminsky DNS Thing has gotten me thinking about disclosure I intentionally haven't blogged about it because, well, the speculation around Dan's finding has turned into something of a spectacle And you didn't need to read yet another blog post about the sky falling But on the eve of Black Hat, Dan's talk is less than a week away, and I can't help feeling like we've gotten no closer to understanding the issue of disclosure than we were a year ago So, all I'm going to say about Dan's recent situation is that I, for one, am impressed by the level of care and coordination that went into working with vendors to get patches This is hard Researchers hate it because vendors can be uncooperative, incompetent, and downright vindictive So, thank you, Dan, for spending what must have been countless hours on conference calls and e-mail getting vendors onboard Now that that's out of the way, let's talk about research, disclosure, and the future Dino Dai Zovi noted in a recent blog post that the 90's were the era of full disclosure, and that that is now over It's an excellent post Go read the whole thing And this is evident in a number of ways For one, ZDI and other pay-per-sploit buyers For another, in-the-wild 0days showing up for sale from malware vendors like the MPack team And then there's the ongoing debate read stalemate between researchers and vendors about protocol, grace periods, and credit So disclosure is a mess But I don't think it has to stay this way, at least not in the USA Researchers who publish - as opposed to sell - have the opportunity to become consumer advocates By cooperating with vendors in a way that still holds them accountable, researchers can demonstrate value to the consumer public When that becomes the prevalent sentiment, then other interesting things like grants and nonprofits make it possible for researchers to earn a living without having to also do consulting or sell their exploits to a third party And that's the dead horse I'm beating in the disclosure race - the consumers of IT products don't have a voice in the disclosure dialogue and desperately need one Researchers can, if they're able to forego infighting and ego theatre, be that voice http://www.secuobs.com/revue/news/164966.shtmlhttp://www.secuobs.com/revue/news/164966.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - Dave Hull over at Trusted Signal has an interesting post on his blog right now about blended threats Unfortunately, I can't find a permalink for it, so I don't know how long you'll be able to read it If it's not still there for you to read, let me give you the gist of it There's been some recent research into and discussion of blended threat scenarios by some very smart people So what is a blended threat It's where two or more lesser-severity vulnerabilities are exploited in conjunction with each other to lead to a greater compromise An example would be a pen-test I did some years back where we found a SQL injection vulnerability in a low-value web app with no insert delete grant to an older, unpatched version of Oracle Individually, you wouldn't rank either vuln especially high You could break the web app, but there wasn't sensitive data in there, and you couldn't tamper with the data itself The Oracle database wasn't exposed to the Internet directly But by using SQL injection to attack Oracle, I broke out into the server OS, reverse tunneled a command shell, and had the Administrator password in very short order Which was also the Administrator password of the other servers I could talk to Myself and others have been predicting the emergence of wide scale blended threat attacks since at least about 2002 2003 And so far we've been wrong, which is good For now, blended attacks are, as Dave points out, the stuff of professional pen-testers and other intelligent intruders But frankly, I don't know why The problem with blended threats is that they're harder to identify and calculate risk for CVSS doesn't provide a way for scoring vuln A when also in the presence of vuln B And this has lead to vendors delaying patches or downplaying the severity of vulnerabilities based on the assumption that any vulnerability the only vulnerability present This creates an opening in the patching cycle for malware botnet folks to capitalize on if the right blended threat comes along Maybe we haven't seen it becauuse, to date, these folks simply haven't needed to go there in order to be successful http://www.secuobs.com/revue/news/164965.shtmlhttp://www.secuobs.com/revue/news/164965.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - So, first read this John Dozier, self-described SuperLawyer of the Internet, thinks you kids and your DefCon are a bunch of punks Stay off his lawn Of course, I disagree DefCon used to be a hacker conference by hackers for hackers Now it's the BlackHat afterparty-slash-olympics But what it isn't is a bunch of criminals Sure, there's some mischief, and a few folks even break the rules But everyone I know who attended DefCon this year and that number is solidly in the double-digits , works in InfoSec, and uses what they learn at DefCon in their professional lives Compelling as my argument may fail to be to people like Mr Dozier, his argument is weaker than mine Let's dissect, shall we Defcon began August 8 and it looks like the hackers sitting in the audience and participating in the hacking competitions spent two days trying to hack into the Dozier Internet Law website using SQL Injection Attacks, Mambo Exploits, encoded cross site scripting attempts, shared ciphers overflow attempts, and the like The favorite and most common ISP access was from Vietnam and China, with Beijing the host and doorway of the Olympic Games as well as many, many hackers OK, so what we have here is a number of known, old, web attacks from China against his web server that coincide with the timing of DefCon And aside from the timing, there's nothing to implicate anybody having anything to do with DefCon My guess is that this wasn't even an actual human being at all, but rather an ASPROX scan that Dozier's IDS detected The graph above shows what these hackers do They come to Vegas to learn how to hack into systems and create havoc The funny thing about this is that, with the notable exception of Dan Kaminsky's DNS attacks, there aren't IDS signatures for the research presented at DefCon So any attacks that did come as a result of learning done at DefCon wouldn't be on that graph The frustrated perpetrators they never got access were sitting in the Riviera Hotel ballrooms, I suspect First, the key word there is suspect Mr Dozier has zero evidence that these IDS alerts had anything to do with DefCon None Not a shred Second, they would've gotten in Going after law firm websites and administration areas that contain attorney client protected communications and documentation, and even court ordered sealed files, is a direct attack on the integrity of the judicial process and the judiciary If you have documents that are sealed by a court order stored on your company website, then you have problems Most federal district courts won't allow you to electronically file with the court to have a document sealed if that document must be or otherwise is included in the filing Those general orders aren't accidents It's a recognition on the part of the judiciary that electronic documents are inherently less secure But I digress Many attendees commit criminal acts while in attendance in organized war games This is simply untrue There are organized wargames, conducted on an air-gapped network off the Internet or any other network This is perfectly legal The US Air Force has staffed a team in the past By the way, congratulations to Chris Eagle and sk3wl0fr00t on their CTF win They bested two-time champs 1 stplace, who are some of the smartest people I know, and who are all highly ethical InfoSec professionals Others commit criminal acts as they learn the tools of the trade in the very ballroom during speaker presentations They hack into banks, into personal computers, into businesses, into government agencies, and steal private information, cost businesses billions of dollars annually, and ruin the financial well-being and impair the emotional stability of individuals all across our country This is sensational and unsubstantiated Or as a judge would describe it, hearsay This is the mob of the 21st century No, John, this is the mob of the 21st century The only security researchers in attendance, I suspect, are the good guys Yes, the security researchers at DefCon are the good guys And I promise you that the DoD and DoJ agree, as many of the speakers, attendees, volunteers, and contestants at DefCon are paid consultants to these organizations UPDATE John Sawyer has an excellent write-up on this issue and on this year's DefCon unlike John Dozier, he was actually there on his blog, Evil Bits, over at Dark Reading Go read http://www.secuobs.com/revue/news/164964.shtmlhttp://www.secuobs.com/revue/news/164964.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - Amrit Williams, former Gartner analyst and CTO at BigFix is one of the bloggers that I follow regularly Amrit's a very smart guy and I respect what he has to say He recently wrote a pair of blog posts here and here that compliment eachother Now, in the details of what he has to say, Amrit and I are in agreement But I got to thinking about the second post and how it relates to the first post And, well, I fired up Visio and mapped the relationships between Amrit's greatest and worst ideas lists If we look at the great ideas that didn't spawn or perpetuate the worst ideas, then we're not left with much Just segmentation and theory of least privilege If we drop out planning and segmentation because they're not actually security ideas - just good ideas that work lots of places - we're left with Theory of Least Privilege as the one great idea to come out of security Oddly, that seems about right http://www.secuobs.com/revue/news/164963.shtmlhttp://www.secuobs.com/revue/news/164963.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - I'm on the floor of the ArcSight Protect '08 conference this morning Tim and I gave our talk on ArcSight ESM Tools yesterday, and I will post some version of those slides and some of the code after I return from the conference Right now I'm listening to Hugh Njemanze give his keynote on product lines There's a lot of interesting stuff in the release pipe Logger 30, ESM 45, a new Connector appliance, IdentityView content for ESM, and something called McLovin Anyway, here's what's been good so far Customer presentations other than mine, I mean - I missed out last year, these are the best talks so far Location - the new hotel is within walking distance of stuff and by stuff I mean not trees and the NSA Networking - Always the best part of this conference I love standing around with free beer, talking to other folks about what they're doing with their SIM, and sharing ideas Looking forward to more tonight Here's what's been not-so-good Wireless - the hotel wireless has been unreliable and overloaded Frankly, I'm surprised I've been able to stay on long enough to get this post up Vendor sponsor floor - no offense to these guys, but the freebies this year are unimpressive I've already got a pen, thanks No bag - Instead of a conference bag, everyone was issued a plastic file folio thing Not that I needed another bag, but I can't smoosh the one foam squeezy thing I did get from a vendor booth into this blue plastic thing And I would be remiss if I didn't drop a product scoop or two Logger 30 has adopted a more-ESM-like boolean filter interface Big improvement over the chained-regex search in 25 and earlier Demo of Logger 30 shows that searches of data no details on data set are roughly 80x faster than a similar sized search on 25 The claim is 100x faster, but I counted Still, that's a significant improvement Hugh has hinted that the slick, high-performance append-only storage stuff that Logger has is going to be integrated into ESM in some release beyond 45 That could mean the end of the Oracle PartitionArchiver storage model It won't be missed http://www.secuobs.com/revue/news/164962.shtmlhttp://www.secuobs.com/revue/news/164962.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - Last week Tim and I presented at the ArcSight user conference on using Tools in the ESM console to augment incident response and investigation I'm hoping to have the sanitized slide deck up this week, and maybe a little bit of code to go with it At the end of the talk - and then a couple of times in the hallway - people asked how we manage all of these Tools It's a great question, and the answer is, not very well But here's the best way that I know how in ESM 40 If you've ever looked at the tools editor in the ESM console, you've seen this dialog, which is pretty basic By default, this info is recorded in your AST file C arcsight Console current paulast , which is just a text file with a bunch of values declared The values in the file look like this consoleuitools toolName program consoleuitools toolName workingdir consoleuitools toolName iconFile consoleuitools toolName parameters consoleuitools toolName showInToolBar consoleuitools toolName isExportTool And then there's this consoleuitoolsList Which is pretty self-explanatory It occurs once in the AST file and is just a CSV list of the tool names, used to populate the console's Tools menu I wrote a Perl program that can parse an AST file and extract tool data from it for the purposes of sharing It's designed to help scale and distribute tools across your analysts' consoles so that they don't have to manually recreate and test them In order for it to be useful, there are some best practices Here's what I do 1 Cygwin Surprise If you've been reading my blog for any period of time, you knew this was coming If your analysts use Mac OS X or Linux for their ESM console platform, not to worry They can play, too Beyond, Perl, bash, and Python, that's kind of the point 2 Standardize on a source directory for scripts Put all of your scripts in the same spot Pathing is difficult to manage by hand, so by defining a standard I use usr local bin arcsight , you have less to do each time you distribute a new tool 3 Use a repository like Subversion or CVS for scripts and other tool artifacts That way, you can make a change to your tool, check it in, and the other analysts can check it out quickly and easily No messy manual copies Also, when you foul something up, you have revision history to go back to That can be a life saver if you are - like me - not a developer with good testing habits 4 Use consoleupdatestxt on the ESM manager to distribute tool configs Here's how you do that Let's say my ESM user id is 'paul' and I have developed a whole bunch of tools following the first three rules above I can use this Perl script to create an export of the tool configs for use on the server It looks like this in Cygwin arc_toolpl export all cygdrive c arcsight Console current paulast consoleupdatestxt scp consoleupdatestxt arcsight esmmanager opt arcsight manager config ssh arcsight esmmanager Password arcsight esmmanager chown arcsightarcsight ARCSIGHT_HOME config consoleupdatestxt arcsight esmmanager chmod 644 ARCSIGHT_HOME config consoleupdatestxt If you want your analysts to get the updated tool list, they need to log out of the console, move their AST file somewhere safe, and log back in to the console No restart of the manager is necessary Now they just need to create the same script directory you did and check out your scripts from your CVS server The Perl script I wrote also supports listing the tool names in an AST file as well as exporting single tool configurations, so it's more than just a one-trick pony It's got another half a trick My advice at this time is not to invest a ton of time in doing this unless it's a weekly headache for your security team, but it is worth doing if you've already got the moving parts in place like a CVS server The reason is that ArcSight has already fixed the issue of sharing tool configs in ESM 45 So once that's released later this year , some of this will be a non-issue for you I suspect that the first two or three best practices I list above will still be valid in ESM 45, so it's still a valuable exercise if you have any number of custom tools already http://www.secuobs.com/revue/news/164961.shtmlhttp://www.secuobs.com/revue/news/164961.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - Wow, I've just been buried, both at work and at home I promised a sanitized copy of our slides from the ArcSight User Conference and here they are A month late Enjoy http://www.secuobs.com/revue/news/164960.shtmlhttp://www.secuobs.com/revue/news/164960.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - SecureWorld Expo Detroit is coming up at the beginning of next month I will be presenting on operationalized malware analysis and response In this case operationalized means, without a debugger Cathy Luders, a friend and colleague that I met through the local ISSA chapter, is also presenting at SecureWorld On the same day At the exact same time Which has me bummed out more than a little because I've not gotten to see her present before But now that I know she's got a talk in her back pocket, I'll probably ask her to present at an upcoming ISSA meeting - http://www.secuobs.com/revue/news/164959.shtmlhttp://www.secuobs.com/revue/news/164959.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - Earlier this month I gave a talk at SecureWorld Expo Detroit on malware analysis The goal of the talk was to discuss the state of malware and tools for people who aren't ready to go to town with a debugger Unfortunately, to put it on SlideShare, I had to replace the cool Camtasia videos with lame screen shots Malware Analysis Made SimpleView SlideShare presentation or Upload your own http://www.secuobs.com/revue/news/164958.shtmlhttp://www.secuobs.com/revue/news/164958.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - For those of you who haven't given up on my blog or forgot it was still in your feed list , I want to let you know that I will be back to it later this year More punditry, more metrics, more SIM, more cool random technical stuff I'll try anyway I've been missing it, but I had too much going on, had to prioritize, and this blog has rusted as a result A lot has changed since my last blog post in November - a new position at work, a new baby daughter - and the one thing that I've come to realize is that changing is hard work, but if you want it, it's worth it There's been an excessive amount of talk about change this past year, and on the eve of President Obama's inauguration, I've decided to share with you this story of a moment I had recently On November 5th, the day after Election Day 2008, I spoke at the SecureWorld Expo conference in Detroit I've been in West Michigan for the past several years, but I used to live and work on the East side of the state It was a gorgeous Wednesday, clear and unseasonably warm for November And as I was driving westbound on I-96, into the dusk between me and the sunset, I looked up and found myself in familiar territory - Webberville You've probably never heard of Webberville, Michigan That's OK It's a rural town on the automotive corridor where in the 1990's, companies got huge tax breaks to buy up farmland and build factories And in 2001, I had an office in one of those factories That company a Tier One in industry lingo because we sold directly to car makers , like many automotive suppliers, has since gone out of business And despite working there only a year, I have some very fond and vivid memories of that job Perhaps the most vivid, however, is driving that stretch of I-96 between Webberville and Wixom and hearing the radio newscaster describe the second plane hitting the World Trade Center on 9 11 That day changed everything for Americans I was living in the Midwest, working in a one-story office that had highway on one side and cows on the other, but for the weeks that followed the attacks, I was afraid We all were I recall making that drive to Webberville again a week later while all of the planes were still grounded and thinking to myself, How long until we recover Can we recover What will it take for us to move forward Not get over it Not forget But move forward - take the next step as a society, as a culture, as a country So back to 11 5 2008, and my drive home from SecureWorld, less than 24 hours after learning that Barack Obama - a young, African-American man - would be our next president And it was there, on that piece of highway in rural Michigan that I answered my own question Seven years and two months later, I knew America was moving forward We were moving forward http://www.secuobs.com/revue/news/164957.shtmlhttp://www.secuobs.com/revue/news/164957.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - After many months off, I'm jumping back in to the blog with both feet Mostly in a Howard Beale sort of way Didja miss me Anyway, stealing a meme from Bill Maher, I've got something to say to security vendors Without further ado, New Rules If you are a vendor, especially a vendor of security products or services, these are the rules I expect your product to follow These are common sense, and I feel a little condescending telling them to you But if recent experience is any indicator, you need to hear them And you deserve the condescension 1 Do not store credentials in clear text Seriously, you can get free libraries to hash credentials or store them in a secure container file that requires a secret key There's no reason for a password to be in a text file or HKLM Registry key None 2 Do not hardcode passwords If I can't change every single password associated with your product simply and easily, then there should be a law that strips all of your developers of any degree they hold and forces them to go back to college and learn file IO methods 3 Do not use HTTP Telnet FTP LDAP for authentication Seriously, more than enough free libraries for SSH, TLS, IPSec exist Use one Or buy the one you really like It beats having to issue a patch to sell to government and regulated industry 4 Don't run as root SYSTEM sa DBA Your product is not so special that it actually needs administrative privileges to run on the server or database that hosts it Unless by special you mean coded by lazy fools that don't want to define even the most basic security model OK, then it is special 5 Don't use broken crypto algorithms Sorry, but if you are shipping new product that uses 56-bit DES, RC4, or ROT13, please see rule 3 6 Don't send passwords in e-mail Remote password reset is easy enough to do properly, there's no reason to be lazy and just send me my password if I forget it Also, it means you're breaking rule 1 Busted There are no excuses for any product to not follow these rules, but especially security compliance products Gee, thanks I just spent six figures on a product to help me manage or achieve compliance, and the product itself can't comply with the regulation I'm trying to address http://www.secuobs.com/revue/news/164956.shtmlhttp://www.secuobs.com/revue/news/164956.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - Anonymous writes, Hi Paul, I am one of those who, as you say, found your blog by googling ArcSight, trying to do some recon on the product for my employer I think I see that the most recent posts here are from 2007 so who knows if you or anybody will be seeing my question I'm trying to find out, can Arcsight's data be queried programmatically ie is it stored in a relational database, hopefully SQL Server or Oracle, or if not, is there an API or ADONET provider that can allow it to be queried, preferably with SQL Thanks for any info anyone reading can provide ArcSight ESM uses Oracle 10g for its back-end database At one point, and this may still be true, DB2 was also supported You can query the database directly, and the schema is pretty straightforward The table ARC_EVENT_DATA is where most of the event data lives, for example But depending on your use case, that might not be the best way to get data out of ESM Also, since you didn't specify, it may be worth mentioning that the same is not true of the ArcSight Logger platform, which is flat storage Instead of querying the log store directly, Logger can be configured to forward events based on source, type, etc to another destination, if you need them in real-time There is a PostegreSQL database on Logger, but it's my understanding that it supports the reports engine, and doesn't store the raw or CEF events in any comprehensive way The interesting thing is that the storage technology behind Logger 30, because of its performance and relative cheapness may become the data store for ESM down the road It would only make sense, since you could handle MUCH higher event rates with less disk and no Oracle license fee If it can be done while maintaining the stability and feature set that the Oracle-based data store has, it's a walk-off home run for ArcSight http://www.secuobs.com/revue/news/164955.shtmlhttp://www.secuobs.com/revue/news/164955.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - lmran writes Hi Paul, Do you know any reason why ArcSight ESM does not support the Cisco MARS Right now, all my firwalls send the syslog feeds into Cisco MARS and I'm trying to set the Cisco MARS to send thoes raw feeds data to ArcSight local connector but I just found out that ArcSight does not support the Cisco MARS Thanks in ADV for any info reading this subject Starting in 4x, MARS can forward events to another remote syslog listener ArcSight has a syslog connector So you ought to be able to forward events from MARS to ArcSight via syslog assuming MARS doesn't change the format of the log events too much Even if MARS does mangle the event format, ArcSight will still receive them, but then most or all of the event will be parsed into the CEF Name field and categorization and prioritization won't be accurate If you are unable to upgrade your MARS appliance to 431 or later I think that's the rev you need , another option would be to use a syslog-ng server out front It supports forwarding events by source to other syslog servers You could use this to send the stuff you want in ESM to ArcSight's syslog Connector and the stuff you want in MARS to MARS Or, you could do the environmentally conscious thing and unplug then recycle your MARS appliance - http://www.secuobs.com/revue/news/164954.shtmlhttp://www.secuobs.com/revue/news/164954.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - OK, I'm about to do something dumb and talk about cryptography and cryptanalysis I'm an expert in neither of these things But despite the fact that somebody smarter than me should be telling you this, you're stuck with me, and I think I have a point So here goes I had a bit of an A-ha moment earlier today around PCI-DSS, specifically requirement 34 from v12 of the standard Here's the relevant language from that requirement 34 Render PAN, at minimum, unreadable anywhere it is stored including on portable digital media, backup media, in logs by using any of the following approaches One-way hashes based on strong cryptography Truncation Index tokens and pads pads must be securely stored Strong cryptography with associated key-management processes and procedures The bottom line is that this requirement fails to provide adequate protection to card numbers Here's why Truncation and tokenized strings with pads have limited use cases In the case of truncating card numbers, PCI-DSS recommends only storing the last 4 digits of the card number You wouldn't choose truncation for a program that validates a card number because there would be too great a potential for false matches It would only be helpful for including in receipts, billing statements, and for use in validating a customer identity in conjunction with other demographic information Database tokens only provide adequate protection in environments where there is a multi-user or multi-app security model, and if there are flaws in the applications that have access to the pads, then your data is pwned So for the sake of maximum versatility and security, you're likely or your software vendor is likely to opt for hashing or encryption But you still have a serious problem While one-way hashes like SHA and block ciphers like AES can provide good protection to many forms of plaintext, credit cards aren't one of them That's right, the problem isn't actually in the way you encrypt credit card numbers, it's that credit card numbers make for lousy plaintext to begin with Take for example the following row of data from my hypothetical e-commerce application's cardholder table LNAME,FNAME,CTYPE,EXP,HASH,LASTFOUR Melson,Paul,DISCOVER,06 2009,e4b769607856a2f30b57fd26079dfefb,1111 In this case, we have what we need to use the card, except the card number is hashed with MD5 Ignore what you know about MD5 collisions for a moment, since this problem also exists for SHA or any other method of encrypting the card number If we calculate the possible number of values that could be on the other side of that hash, it would be 10 16, or about 10,000 trillion for the 16-digit card number That's roughly twice as many possibilities as an 8-character complex password 96 8 , which is an acceptable keyspace size, but also completely doable for a tool like John The Ripper But if you know credit card numbers, then you've already realized that it's even worse than that The first 4-6 digits of the card number are a misnomer in calculating keyspace There aren't 1 million actual possible values Since that row from my e-commerce app's database told me the card issuer, I know within 4-5 guesses the first two to four digits of the card number, and the last four are right there as well for inclusion on statements, etc In this case, since it's a Discover card, we already know that the card number is 6011XXXXXXXX1111 Now we've cut the possible values we must guess in half, from 10 16 down to 10 8, which is a mere 100 million possibilities There are other clever things we can do if it's encrypted with a stream cipher like RC4 or FISH, because we know the beginning and end values of the plaintext But guess what It's cheaper and easier to brute-force it even if lousy crypto is used Even on the scale of millions of records Even with salting, it's still worth it to brute-force the middle digits But wait, there's more As if publicly known prefix values weren't enough, credit card numbers are also designed to be self-checking That is to say, the numbers contain something like a checksum that, when a known algorithm is applied to the 7-digit account number, 3 digits of which we know from our last-four field, can be used to validate the card number This was designed as an anti-fraud mechanism that would allow cards to be checked without a need to communicate with a clearinghouse But this algorithm allows us to only generate valid account numbers, combined with partially-known prefixes, to reduce the keyspace significantly And since this is a known algorithm I can and someone already has very easily write a tool that combines a brute-force password cracker with a credit card generator The bottom line is that, because of the already-partially-known nature of credit card numbers, simply encrypting card numbers inside a database or extract file is insufficient protection The PCI Security Standards Council should revisit this requirement and modify it to, at the very least, require symmetric-key block ciphers and disallow stream ciphers and one-way hashes But even then, I suspect, encrypted card numbers will be at risk Certainly row-level encryption of card numbers should not qualify for safe harbor when it comes to breach notification laws PS - Extra credit if you crack the full card number from the hash above and post it below http://www.secuobs.com/revue/news/164953.shtmlhttp://www.secuobs.com/revue/news/164953.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - If you haven't already, I recommend that you take 20 minutes and read Nobody Sells Gold for the Price of Silver by Cormac Herley and Dinei Florencio PDF Link This is an excellent analysis of the research into and press coverage of the underground economy It's a fascinating read, and they make a cogent argument that the underground economy is more myth than reality I don't want to say more because it will ruin it for you Now I have an excercise for you First, read the Herley Florencio article Then, read Bruce Schneier's experiences with trying to sell a laptop on eBay Now think about the implications of the Ripper Tax on eBay Now ask yourself why you haven't already sold any stock you own in eBay http://www.secuobs.com/revue/news/164952.shtmlhttp://www.secuobs.com/revue/news/164952.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - Teguh writes, Hi Paul, could you give some guide to administering logger i searched thru google, but found nothing significant How to s and tutorial would be enough i guess Does it have to have syslog server for the logger to be able to read data from Thanks The documentation for Logger is available from ArcSight's download center Only registered customers have access, but I assume that if you've got a Logger box, that generally qualifies you With regard to your second question, yes Logger has a syslog server It actually has a few In Logger nomenclature these are receivers Logger supports UDP and TCP syslog, FTP and SSH file pull, NFS and CIFS remote filesystem Logger also supports some ArcSight-specific receivers including a SmartMessage receiver for events forwarded from ESM and CEF-over-syslog OK, ArcSight wouldn't agree that this is specific to their products, but despite the C standing for Common, CEF is anything but At least right now 1 Configuring Logger to act as a syslog server is pretty straightforward 2 From the web interface, navigate to Configuration, Event Input Output 3 On the Receivers tab, click the Add button 4 Name your connector and set the type as UDP Receiver then click Next 5 The defaults for Compression Level and Encoding are fine Select the IP address you want the listener to reside on, and set the port number The default syslog server port is UDP 514 6 Click Save 7 On the Receivers tab, click the little no-smoking image next to the new receiver to enable it http://www.secuobs.com/revue/news/164951.shtmlhttp://www.secuobs.com/revue/news/164951.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - Last week I attended ArcSight's annual user conference in Washinton DC More about that in a later post During the conference, ArcSight hosted a panel discussion on cyberwarfare In DC, where many of ArcSight's biggest customer are based, this is a hot topic, and there will be a lot of time spent discussing it and a lot of money spent on defending against it, maybe What struck me about the panel discussion were two comments, both made by James Lewis, one of the panelists, and a director at the Center for International and Strategic Studies At one point, Mr Lewis invoked Estonia as an example of state-sponsored cyberwarfare, and made the comment that, the Russians are tickled that they got away with it Not ten minutes later, an audience member asked a question about retaliation against cyber-attacks Mr Lewis responded to the question by pointing out the problem of attribution That is, from the logs that the victim systems generated, the IP address es recorded can't reliably be used to identify the actual individual s responsible for the attack Now, I don't intend to pick on James Lewis It just so happened that one person on the panel expressed the paradox of cyberwarfare The attribution problem is a big problem for all outsider attacks, not just cyberwarfare A decade ago, security analysts were calling it the legal firewall because US-based hackers would first hack computers in China, Indonesia, Venezuela, or another country that doesn't openly cooperate with US law enforcement, and then hack back into the US from there, causing an investigative barrier that would hinder or prevent an investigation being able to get back to the attacker's actual location So knowing that there's a very real problem with being able to identify the source country for Internet-based attacks, it stands to reason that using the same limited forensic data to not only identify the actual source of an attack, but to determine that it is in fact state-sponsored, and not, say, a grassroots attack armed by a teenager, is a stretch And for that reason, the question of cyberwarfare is an open one Until a government actually comes forward and claims responsiblity for an attack, it's unprovable So as the government spends 100M on cyberdefense over the next six months, it's important to try and answer the question, What is the military actually defending against At the very least, it's fair to say nobody knows for certain http://www.secuobs.com/revue/news/164950.shtmlhttp://www.secuobs.com/revue/news/164950.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - Since ArcSight ESM 40, reports and trends have been based on queries Considering that ESM runs on top of Oracle, a query in ESM is exactly what you think it is Queries are an extremely flexible way to get at event data But as the name implies, they go against the ARC_EVENT_DATA tablespace, and therefore you can't use them to build data monitors or rule conditions, since those engines run against data prior to insertion into the database Anyway, I've got a story about how cool queries are And about how much of an Excel badass I am And also about how queries are still better Last month, I got a request from one of our architects who was running down an issue related to client VPN activity Specifically, he wanted to know how many remote VPN users we had over time for a particular morning Since we feed those logs to ESM, I was a logical person to ask for the information So I pulled up the relevant events in an active channel and realized that I wasn't going to be able to work this one out just sorting columns So, without thinking, I exported the events and pulled them up in Excel So here's the Excel badass part If you want to copy it, here it is SUM IF FREQUENCY MATCH A2 A3653,A2 A3653,0 ,MATCH A2 A3653,A2 A3653,0 0,1 So A is the column that usernames are in This formula uses the MATCH function to create a list of usernames and then the FREQUENCY function to count the unique values in the match lists You need two MATCH lists to make FREQUENCY happy because it requires two arguments, hence the redundancy It took about an hour for me to put it together, most of that was spent finding the row numbers that corresponded to the time segment borders But as I finished it up and sent it off to the requesting architect, I thought, there must be an easier way And of course there is So here's how you do the same thing in ESM using queries So, it's just EndTime with the hour function applied, and TargetUserName with the count function applied, and the Unique box DISTINCT for the Oracle DBA's playing at home checked And then on the Conditions tab you create your filter to select only the events you want to query against That's it Once the query is created, just run the Report Wizard and go All told, it's about 90 seconds to the same thing with a query and report that it took an hour to do in Excel http://www.secuobs.com/revue/news/164949.shtmlhttp://www.secuobs.com/revue/news/164949.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - These two mini-talks were originally going to be blog posts, but I needed a speaker for this month's ISSA meeting So I volunteered myself Here are the slidesTwo-For-One Talk Malware Analysis for EveryoneView more presentations from pmelson http://www.secuobs.com/revue/news/164948.shtmlhttp://www.secuobs.com/revue/news/164948.shtml Secuobs.com : 2009-11-25 01:18:09 - Paul Melson's Blog - With more and more exploits being written in JavaScript, even some 0-day, there is a need to be able to reverse exploits written in JavaScript beyond de-obfuscation I spent some time this weekend searching Google for a simple way to reverse JavaScript shellcode to assembly I know people do it all the time It's hardly rocket science Yet, I didn't find any good walk-throughs on how to do this So I thought I'd write one For this walk-through, I'll start with JavaScript that has already been extracted from a PDF file and de-obfuscated So this isn't step 1 of fully reversing a PDF exploit, but for the first several steps, check out Part 2 of this slide deck What you'll need 1 A safe place to play with exploits I'll be using an XP image in VMWare Workstation 2 JavaScript debugger I highly recommend and will be using Didier Stevens' modified SpiderMonkey 3 Perl 4 The crap2shellcodepl script, which you'll find further down in this post 5 A C compiler and your favorite binary debugger I'll be using one of the example Adobe Acrobat exploits from the aforementioned slides for this example You can grab it from milw0rm Step 1 - Converting from UTF-encoded characters to ASCII Most JavaScript shellcode is encoded as either UTF-8 or UTF-16 characters It would be easy enough to write a tool to convert from any one of these formats to the typical x-ed UTF-8 format that we're used to seeing shellcode in But because of the diversity of encoding and obfuscation showing up in JavaScript exploits today, it's more reliable to use JavaScript to decode the shellcode For this task, you need a JavaScript debugger Didier Stevens' SpiderMonkey mod is a great choice Start by preparing the shellcode text for passing to the debugger In this case, drop the rest of the exploit, and then wrap the unescape function in an eval function eval unescape pourcentsuc92bpourcentsue983pourcentsud9ebpourcentsud9eepourcentsu2474pourcentsu5bf4 pourcentsu7381pourcentsu1313pourcentsu2989pourcentsu8357pourcentsufcebpourcentsuf4e2pourcentsu5222pourcentsu147a pourcentsue340pourcentsu3d2bpourcentsud175pourcentsudeb0pourcentsu44f2pourcentsuc1a9pourcentsudb50pourcentsu3f4f pourcentsud502pourcentsu044fpourcentsu689apourcentsu3143pourcentsud94bpourcentsu0178pourcentsu689apourcentsud7e4 pourcentsuefa3pourcentsub4f8pourcentsu09depourcentsu057bpourcentsuca45pourcentsub6a0pourcentsuefa3pourcentsud7e4 pourcentsue380pourcentsu0e2bpourcentsub6a3pourcentsud7e4pourcentsuf05apourcentsue7d0pourcentsudb18pourcentsu7841 pourcentsufa3cpourcentsu3f41pourcentsueb3cpourcentsu3940pourcentsu6a9apourcentsu047bpourcentsu689apourcentsud7e4 Now run this code through SpiderMonkey SpiderMonkey will create two log files for the eval command, the one with our ASCII shellcode is eval001log Step 2 - crap2shellcodepl This is why I wrote this script, to take an ASCII dump of some shellcode and automate making it debugger-friendly ---cut--- bin perl crap2shellcode - 11 9 2009 Paul Melson This script takes stdin from some ascii dump of shellcode ie unescape-ed JavaScript sploit and converts it to hex and outputs it in a simple C source file for debugging gcc -g3 -o dummy dummyc gdb dummy gdb display 50i shellcode gdb break main gdb run use strict use warnings my crap while crap my hex unpack 'H ', crap my len length hex my start 0 print include n n print static char shellcode for my i 0 i length hex i 4 my a substr hex, i, 2 my b substr hex, i 2, 2 print x b x a print n n --paste-- The output of passing eval001log through crap2shellcodepl is a C program that makes debugging the shellcode easy Step 3 - View the shellcode assembly in a debugger First we have to build it Since we know that this shellcode is a Linux bindshell the logical choice for where and how to build is Linux with gcc Similarly, we can use gdb to dump the shellcode For Win32 shellcode, we would probably pick Visual Studio Express and OllyDbg Just about any Windows C compiler and debugger will work fine, though To build the C code we generated in step 2 with gcc, use the following gcc -g3 shellcodec -o shellcode The '-g3' flag builds the binary with labels for function stack tracing This is necessary for debugging the binary Or at least it makes it a whole lot easier Now open the binary in gdb, print shellcode in x 50i format, set a breakpoint at main , and run it gdb shellcode gdb display 50i shellcode gdb break main gdb run http://www.secuobs.com/revue/news/164947.shtmlhttp://www.secuobs.com/revue/news/164947.shtml