Noise

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

This is my first diary entry in several years. I am returning as a handler after a lengthy hiatus. I joined an organization which took too much time and did not permit this kind of interaction. It was worth it. That ride is coming to a close and I am happy to be able to return to this fine organization.

Today many of us are working through the monthly onslaught of patches and updates. Between the Microsoft May 2012 updates, PHP, ESX, and some Adobe updates there is quite a bit to think about. This is a monthly occurrence though. There are a number of steps organizations can take to prepare for this recurring event. A simple one is to mark the second Tuesday on a team calendar. Start to clear the deck on the Friday before and make sure that test systems on ready to go following the Tuesday release.

I have seen a number of approaches to patch preparation. At one extreme all critical systems are replicated in a lab, patches applied and a QA team validates key functions. At the other extreme, patches are just applied and then organization deals with the fall out. Not being an extremist I like to somewhere in the middle depending on organization size, mission, and capability.

There is also the triage effort for reviewing updates and determining how long to wait to get updates applied. I have seen one organization which waited 10 days after the MSFT release then applied all release patches counting on the forums and general buzz about the updates to call out any problems with them. This of course can leave the organization open to many other risks if an exploit is in the wild.

I advocate a more hands on approach especially with key systems. The organization just mentioned ran into a problem recently where two RADIUS (IAS) servers were taken offline by a patch which modified the CA cert. This brought the IAS servers down impacting wireless access for several hours while the problem was identified and investigated and resolved. Testing or patching one system at a time could have prevented or mitigated this outage.

What are some that work and some that dont work? Care to share?

–

Dan

MADJiC.net

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

In addition to other announcements, the folks behind PHP have released new versions in the 5.3 and 5.4 branches to address a couple of security issues.
5.3.13 addresses CVE-2012-2311 and 5.4.3 addresses both CVE-2012-2311 and CVE-2012-2329.
Details are available here: http://www.php.net/archive/2012.php#id2012-05-08-1

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

While we patiently await the arrival of this month’s patches from Microsoft (and everyone else who publishes today) I have a little thought experiment for you. We all know that the internet doesn’t work too efficiently if DNS isn’t working or present. NTP is just as critical for your security infrastructure. Without reliable clock synchronization, piecing together what happened during an incident can become extremely difficult.

Consider a hypothetical services network and DMZ: there’s an external firewall, a couple of webservers, an inner firewall with a database server behind it. Let’s also assume that something bad happened to the webservers a couple of months ago and you’ve been brought in as a consultant to piece together the order of events and figure out what the attacker did. The web administration team, and the database team, and the firewall team have all provided your request for logs and you’ve got them on your system of choice.
More About NTP
For a complete background on NTP I recommend: http://www.ntp.org/ntpfaq
There are two main types of clock error that we are concerned with in this example:

Clock Skew an error of 0.001% causes a clock to be off by nearly one second per day. We can expect most clocks to have one second of drift every 2 days. The oscillator used in computer clocks can be influenced by changes in local temperature, and the quality of the electricity feeding the system. Update: Joanne wrote in to point out that the accuracies that I’ve cited in this paragraph are an order of magnitude better than what one would expect in computer hardware. We’ll see later in some example data how optimistic my values were.
Today’s Challenge

How do you begin order the events between the systems? First I’ll solicit general approaches via comments and email, later I’ll summarize and provide some example data to illustrate the most popular/promising approaches.
Example Data
Let’s take a look at what the web team and the firewall team sent to us.

Date Time Event Epoch

Web1:

1/1/1972 13:24:04 First Request from badguy 262990.55837962962963

1/1/1972 13:24:04 2nd Request from badguy 262990.55837962962963

1/1/1972 13:24:04 3rd Request from badguy 262990.55837962962963

1/1/1972 13:24:05 4th Request from badguy 262990.558391203703704

1/1/1972 13:24:09 5th Request from badguy 262990.5584375

Web 2:

1/1/1972 13:25:37 First Request from badguy 262990.559456018518519

1/1/1972 13:25:41 2nd Request from badguy 262990.559502314814815

1/1/1972 13:25:57 3rd Request from badguy 262990.5596875

1/1/1972 13:26:49 4th Request from badguy 262990.560289351851852

1/1/1972 13:26:59 5th Request from badguy 262990.560405092592593

1/1/1972 13:27:42 6th Request from badguy 262990.560902777777778

Firewall:

1/1/1972 7:00:41 Accept tcp_80 34153 bad_guy_ip web1 262990.292141203703704

1/1/1972 7:00:43 Accept tcp_80 34154 bad_guy_ip web1 262990.292164351851852

1/1/1972 7:00:45 Accept tcp_80 34155 bad_guy_ip web1 262990.2921875

1/1/1972 7:00:49 Accept tcp_80 34156 bad_guy_ip web1 262990.292233796296296

1/1/1972 7:00:52 Accept tcp_80 34157 bad_guy_ip web1 262990.292268518518518

1/1/1972 7:02:27 Accept tcp_80 59498 bad_guy_ip web2 262990.293368055555556

1/1/1972 7:02:31 Accept tcp_80 59499 bad_guy_ip web2 262990.293414351851852

1/1/1972 7:02:47 Accept tcp_80 59500 bad_guy_ip web2 262990.293599537037037

1/1/1972 7:03:39 Accept tcp_80 59501 bad_guy_ip web2 262990.294201388888889

1/1/1972 7:03:49 Accept tcp_80 59502 bad_guy_ip web2 262990.29431712962963
1/1/1972 7:04:32 Accept tcp_80 59503 bad_guy_ip web2 262990.294814814814815

I’ve merged added the epoch column since that will help some folks apply their favorite methods and trimmed the logs from the three systems down to the activity of one suspicious IP address.
My Naive Approach
My initial assumption is that we should be able to account for the bias between the clocks on sufficiently-small windows of time. We will not likely come up with a simple formula to correct several months-worth of logs. However, for critical periods, we should be able to knit together log events from multiple systems, identify the clock bias, and account for it in the ultimate investigative timeline. So my approach is to pick a small time-frame of events, pick a system to be the reference point, tie events together manually a bit, and plot it out to see if there is a simple linear relationship, or if we have other issues.
Immediately we see that there’s clearly a timezone difference between the web team and the firewall team, that’s not a big deal at the moment. Initially we may feel in luck that the firewall can act as a semi-reliable observer to compare the attack against web1 and web2. Maybe fortune will continue and we can simply shift the times a little to account for clock skew. The event was only a few seconds so the window should be small enough that drift should be undetectable, right?
No, something’s not right. If we compare the elapsed time of the event for web1 and web2 using the firewall as a frame of reference. While the firewall and web2 agree that it was visited over 2 minutes and 5 seconds, web1 records an elapsed time of 5 seconds, while the firewall indicates 11 between the first accept and the last accept.
Let’s plot out the times from the web server vs. the time noted by the firewall. Ideally we should see something of a straight line with a slope of one and a zero-intercept of zero. In this case, we’re hoping for a slope near one, and a zero-intercept that will help identify the timezone used by the firewall or the webservers.

How about a closer look at those two:

Web 1 recorded the first few probes as happening in the same second. Over time though (draw a line between the first and last event) and it’s a bit more in agreement with web2.

A Side Note About the Comments
The comments strayed off-topic pretty quickly today, but there are some nice gems in there about deploying and monitoring NTP. They’re worth a look.

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

Adobe has released their monthly security bulletins today:

Security Bulletin for Adobe Illustrator – APSB12-10 – http://www.adobe.com/support/security/bulletins/apsb12-10.html
Security Bulletin for Adobe Photoshop – APSB12-11- http://www.adobe.com/support/security/bulletins/apsb12-11.html
Security Bulletin for Adobe Flash Professional – APSB12-12 – http://www.adobe.com/support/security/bulletins/apsb12-12.html
Security update available for Adobe Shockwave Player – APSB12-13 – http://www.adobe.com/support/security/bulletins/apsb12-13.html

Note that APSB12-12 addresses Flash Professional, not the flash player add-on to your browser. Also of note is that the first three bulletins simply inform users that their current version of the software is vulnerable, and that the upgraded version isn’t. No free security patch options, just pay to upgrade. At least the Shockwave player update is free.

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

One of the attacks I always perform when doing internal penetration tests is NetBIOS Name Spoofing. NetBIOS has been a golden mine for penetration testers for years many good articles about how to use NBNS spoofing have been written, and Metasploit comes with a module that allows you to easily abuse NBNS in order to collect LM and NT hashes from victim machines (of course, depending if LANMAN has been disabled or not).
I wrote a diary about this back in January so if you want to see details on how to abuse this Id suggest that you read http://isc.sans.edu/diary.html?storyid=12454 first.
However, attacking clients, retrieving their LM/NT hashes and cracking them, as fun as it is, is only half of the job a penetration tester has to do. Besides capturing the flag, the report you produce must also include recommendations on how to mitigate the detected vulnerability otherwise it is really useless for your client (no matter how cool it is for us penetration testers to pwn something).
So after seeing NBNS being abused in many internal penetration tests (all?) I started checking what potential security controls we have at our disposal to prevent such attacks, or at least to make them less effective.
Obviously, the best way to prevent NBNS spoofing attacks is to completely disable NetBIOS name resolution. However, this maybe be easier said than done from the diary I posted before (link above) it appears that there are many other services that still depend on NBNS.
Since Windows operating systems now come with a firewall (Windows firewall with Windows XP SP2 and Windows Firewall with Advanced Security with Vista and newer OSes) that can have multiple policies, depending on the current location of the machine (home, work or public networks), this sounded like a perfect idea for preventing NBNS attacks. In this scenario, an administrator that controls client machines through group policies could allow NBNS in home and work networks and disable it completely in public networks. While not perfect, this still offers a certain (and Id say decent) amount of protection.
However, while testing this I noticed that the Windows firewall has a nasty bypass vulnerability (the now patched CVE-2012-0174 vulnerability).
In order to test it I turned on both inbound and outbound firewalls remember that the Windows built-in firewall does not stop outbound connections by default:

Besides this, NBNS rules had to be disabled manually, in order to prevent NB-Name-Out network traffic. By stopping this traffic we would make sure that an attacker cannot abuse NBNS spoofing attacks, since the built-in firewall would stop all such outgoing requests. You can see the rules, with their respective profiles in the following picture:

After setting this, I expected that my NBNS spoofing attacks will fail. However, that did not happen the attacks were still successful, and I was able to see NBNS queries on my local network. After setting up logging in the Windows firewall as well, I confirmed that Windows was happily letting this traffic leave, despite all the rules that have been set above:
2012-01-29 11:07:21 ALLOW UDP 192.168.161.137 192.168.161.255 137 137 0 – - – - – - – SEND

This log shows a NBNS query destined to the local networks broadcast address.
The issue here is pretty clear this means that an organizations administrator who set such rules to protect his clients when they leave the organizations network cannot rely on the built-in Windows firewall!
And, if you take a look at the attack scenarios I mentioned in the first diary, this can be particularly nasty for browsers configured in organizations. For example, a lot of organizations configure browsers on client machines to automatically open intranet portals, which are typically hosted on machines with names intranet, portal or similar.
When a user with such a machine connects to an open wireless network and opens a browser, the browser will first try to resolve such a name via DNS. When that fails, the machine will try to resolve this name via NBNS and this is where an attacker can fake the response and start collecting LM/NT hashes.
Another very nasty scenario includes machines looking for WPAD (Web Proxy Auto-Discovery). By spoofing this request, an attacker can push his own machine as the web proxy and the clients web browser will happily use it, allowing the attacker to analyze network traffic and at least try to launch Man-in-the-Middle attacks (hopefully, weve trained our users not to click on certificate warnings, right?).
So, I got in touch with Microsoft and the MSRC guys verified that this is indeed an issue with the firewall. The conversations with the MSRC guys were great and, as you can see, the patch has been released that fixes this vulnerability.
As with other security patches, you should definitely install it as part of your monthly patch install cycles. The whole exercise also shows how one should always test security controls that you put in place just the fact that you added a rule to block certain network traffic does not have to mean that the traffic is really blocked.

More information and the patch is available at the Microsofts web site: http://technet.microsoft.com/en-us/security/bulletin/ms12-032
Advisory details at http://www.infigo.hr/en/in_focus/advisories/INFIGO-2012-05-01

–

Bojan

INFIGO IS

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

Overview of the May 2012 Microsoft patches and their status.

#
Affected
Contra Indications – KB
Known Exploits
Microsoft rating(**)
ISC rating(*)

clients
servers

MS12-029
Microsoft Word RTF Import

(Replaces MS10-079, MS11-089, MS11-094)

Microsoft Word 2003 and 2007

CVE-2012-0183
KB 2680352
No publicly known exploits
Severity:Critical

Exploitability: 1
CRITICAL
N/A

MS12-030
Microsoft Office Remote Code Execution Vulnerabilities

(Replaces MS11-072, MS11-089, MS11-094, MS11-096)

Microsoft Excel 2003/2007/2010

CVE-2012-0141

CVE-2012-0142

CVE-2012-0143

CVE-2012-0184

CVE-2012-0185

CVE-2012-1847
KB 2663830
Yes (CVE-2012-0143)
Severity:Critical

Exploitability: 3,3,1,1,2,1
CRITICAL
N/A

MS12-031
Visio Viewer 2010 Remote Code Execution Vulnerability

(Replaces MS12-015)

Microsoft Visio Viewer 2010

CVE-2012-0018
KB 2597981
No publicly known exploits
Severity:Important

Exploitability: 1
CRITICAL
N/A

MS12-032
TCP/IP Elevation of Privilege and Firewall Bypass Vulnerability

(Replaces MS11-083)

TCP/IP, Windows Firewall

CVE-2012-0174

CVE-2012-0179
KB 2597981
No publicly known exploits
Severity:Important

Exploitability: 1
important
important

MS12-033
Vulnerability in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege

Plug and Play (PnP) Configuration Manager Vulnerability

CVE-2012-0178
KB 2690533
Elevation of Privilege
Severity:Important

Exploitability: Likely
Important
Important

MS12-034
Combined Security Update for Microsoft Office, Windows, .NET Framework, and Silverlight

(Replaces MS11-029, MS12-018)

Microsoft Windows, Microsoft .NET Framework, Microsoft Silverlight, Microsoft Office

CVE-2011-3402

CVE-2012-0159

CVE-2012-0162

CVE-2012-0164

CVE-2012-0165

CVE-2012-0167

CVE-2012-0176

CVE-2012-0180

CVE-2012-0181

CVE-2012-0184
KB 2681578
Yes
Severity:Critical

Exploitability: 1,1,1,1,2,1,1,1,1,1
CRITICAL
CRITICAL

MS12-035
.Net Framework Remote Code Execution

(Replaces MS11-044, MS11-078, MS12-016)

.NET Framework

CVE-2012-0160

CVE-2012-0161
KB 2693777
No publicly known exploits
Severity:Critical

Exploitability: 1
CRITICAL
CRITICAL

We will update issues on this page for about a week or so as they evolve.

We appreciate updates

US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY

(*): ISC rating

We use 4 levels:

PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
Critical: Anything that needs little to become interesting for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
Important: Things where more testing and other measures can help.
Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.

The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a t ypical worst-case role.
Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.

(**): The exploitability rating we show is the worst of them all due to the too large number of ratings Microsoft assigns to some of the patches.

–
Adam Swanger, Web Developer (GWEB, GWAPT)

Internet Storm Center – https://isc.sans.edu

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

John writes in to report that Symantec has announced an issue with their current definition files that may generate false-positive alerts on .xls files.

http://clientui-kb.symantec.com/kb/index?page=contentid=TECH188271actp=RSS
http://www.symantec.com/connect/forums/bloodhoundexploit459-false-positive

Thanks John!
The fix should be going out today as a rapid release: 134129 2012-05-08 rev. 016

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

I’ve enabled a new poll today in honor of this month’s Patch-Tuesday. In your organization is it easier for you to set aside that 2nd week of the month to focus on security patching, or is it easier for you to integrate security patching into your everyday system administration? I’ve always felt that if your environment was large enough to have it’s on vulnerability management team, a steady stream of security advisories was preferable to the shock of all arriving at the same day. However, not everyone is that size, so it may be easier to schedule widespread reboots on Tuesday nights, saving Wednesday for dealing with any consequences (which seem to be happening less often, thankfully.)
Which would you prefer in your environment?

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

Apple released iOS 5.1.1 for iPod, iPhone, iPad (exclude Mac OS X) only available through iTunes. The updates address Safari and WebKit for iPhone 3GS, iPhone 4, iPhone 4S, iPod touch (3rd generation) and later, iPad, iPad 2. At the time of this writing, the advisory was still not posted (APPLE-SA-2012-05-07-1) but the update is available through iTunes.
[1] http://support.apple.com/kb/HT1222
———–
Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

Rumor has it that somewhere outside the bat cave, it is a beautiful summer-ish day, but fear not, we shall shun the sunlight and watch for internet evil. Well, okay, I’m inside for the moment watching the handlers list, but that probably won’t last for long. Since it has been a slow day, I figured this would be good time pass on some info on updates to some of my favorite tools. In particular, Harlan Carvey has updated RegRipper to v2.5 and laid out his roadmap toward v3.0 which he expects to release later this year. It doesn’t look like this will affect me much personally since Imostly run RegRipper from the command-line on Linux, but it did cause me to update the Parse::Win32Registry perl module on may analysis system to v1.0 (something you may want to do too, see Harlan’s post about running into ‘big data’ issues).
Also, Didier Stevens has updated his TaskManager.xls spreadsheet, that allows injecting of shellcode to kill stubborn processes.
And, finally, Windows 8 is available to testers, so Iwas interested in Amanda C.F.Thomson’s Windows 8 Forensics Guide, available for download over at the Propeller Head Forensics blog.
References:
http://windowsir.blogspot.com/2012/05/regripper-update-road-map.html
http://search.cpan.org/~jmacfarla/Parse-Win32Registry-1.0/
http://blog.didierstevens.com/2012/05/01/update-taskmanager-xls-v0-1-3-killer-shellcode/
http://propellerheadforensics.com/2012/04/18/download-windows-8-forensic-guide/
—————

Jim Clausing, GIAC GSE #26

jclausing –at– isc [dot] sans (dot) edu

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

Today there was a brief discussion among a few Handlers regarding the vulnerability reported by Microsoft in March. The discussion was not so much on the fact that there was an exploit for a Mac OS, or that it was published by Microsoft. The discussion was focused on the sense of complacency that has seemed to develop around Mac products where security is concerned.

Looking back to 2001, Larry Ellison proudly proclaimed Oracle was unbreakable (That statement proved to be untrue, and the hacking community gladly pointed that out to Oracle very quickly.) At the time he most likely based his statement on the fact that there were no known vulnerabilities in the database application at the time. And, at that moment in time, it may have been true. But time marches on….

While the Mac operating systems may not have the number of vulnerabilities that exist in other operating systems, they do exist, and it is only a matter of time before those vulnerabilities play out in the public. We as security professionals would be wise to look at the history of end-user platforms and plan accordingly. It is only a matter of time, as the exposure of these systems increases, the number of reported vulnerabilities will increase.

Thoughts?

tony d0t carothers – gmail

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

On a slow Saturday in May I thought I would open the forum for discussion here at the ISC on a topic. I am working on a project to update the Continuous Vulnerability Assessment (CVA) capability for a client, and I have found a lot of good information on the web. What I havent found a lot of is good experiences on the web. Guy Bruneau wrote a great article in October on CVAand Remediation for the Critical Controls discussed in October.

First off what is a vulnerability assessment? Wikipedia defines a vulnerability assessment as the process of identifying, quantifying, and prioritizing (or ranking) the vulnerabilities in a system. Vulnerability assessments are often confused with penetration testing, however these two functions serve different roles in a the organization and the overall security assessment. A CVA program, as a component of the overall enterprise systems management program, needs to consider the process for asset identification, vulnerability reporting and remediation.

Information I have collected runs the gamut of technical and marketing information. A great report on assessment tools is available here. Search the web for Vulnerability Assessment, Continuous Vulnerability Assessment, or CVA and the results range greatly. Technical, marketing, best practices, etc., but what is not abundant is experiences. What Im asking of you today is input on experiences and challenges that you’ve encountered in your implementation or update of a CVA program. Id love to hear about both the technical and environmental challenges encountered along the way. Ask yourself If I had to do it differently, what would I change? thats what I would like to hear.

tony d0t carothers – gmail

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

Adobe released a critical patch for Flash Player addressing an object confusion vulnerability (CVE-2012-0779). If exploited, it could cause the application crash and potentially allow an attacker to take control of the system. The security bulletin is posted here and the update can be downloaded here.
Affected Software
- Windows, Macintosh and Linux version 11.2.202.233 and earlier

- Android 4.x version 11.1.115.7 and earlier

- Android 3.x and 2.x version 11.1.111.8 and earlier
[1] http://www.adobe.com/support/security/bulletins/apsb12-09.html

[2] http://get.adobe.com/flashplayer/
———–
Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

Overview
We have launched some new data collection projects relatively recently in addition to the original DShield project. What happens to all that data being collected? When there appears to be enough data to publicly release, the reports will likely be linked to from our Reports page at https://isc.sans.edu/reports.html. You can get there by clicking Data/Reports or its sub-menu Summary Page on the top-right menu. We’ve highlighted some of these projects in past Features but let’s list them all out here.
Features
Data Collection – https://isc.sans.edu/reports.html#collect

This section was added recently as a central location to list new and existing data collection and reporting projects.

ISC/DShiled API – Click for previous feature diary coverage.
HTTP Headers – Project to find how many sites use security relevant headers. Read Jason Lam’s diary on HTTP Headers.
404Project – Click for previous feature diary coverage.
Fake Call Tech Support Calls – Newly launched information collection form in response to understanding the growing number of cold-call Fake Tech Support Calls.

Top 10 Ports – https://isc.sans.edu/reports.html#top10ports

Summary table of the top 10 ports listed by Reports, Targets, Sources with link to Port Report Page at https://isc.sans.edu/portreport.html

Available on the ISC Dashboard.
Option on customization page once logged in.

World Map – https://isc.sans.edu/reports.html#worldmap

Graphics map of country statistics (This deserves more in-depth coverage in another feature diary…Stay Tuned!) with link to Country Report Page at https://isc.sans.edu/countryreport.html

Available on the ISC Dashboard.
Option on https://isc.sans.edu/customize.htmlisc.sans.edu/customize.html once logged in.
Available in the right column on the homepage.

Top Source IPs – https://isc.sans.edu/reports.html#top10source

Top 10 Source IPs as collected by DShield sensor listed with count, number of attacks, first seen and last seen with link to Top Sources Page at https://isc.sans.edu/sources.html

Available on the ISC Dashboard.
Option on customization page once logged in.

Additional Reports – https://isc.sans.edu/reports.html#additional

AS Reports – DShield data by ASN information
Country Reports – Dshield data by Country information
Survival Time – calculated as the average time between reports for an average target IP address
Trends of Ports – attempt to put a number to the increase in activity for a given port. Also available on the Dashboard and right column of the homepage.
Daily Data Volume (Submissions/day) – Summaries with graph, table and criteria form

Post suggestions or comments in the section below or send us any questions or comments in the contact form on https://isc.sans.edu/contact.html#contact-form

–

Adam Swanger, Web Developer (GWEB, GWAPT)

Internet Storm Center – https://isc.sans.edu

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

———– Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

What happens when your helpdesk gets a call from a frantic staff member whos positive his computer isbeing hacked by Government X this very second?

The IT helpdesk is the face, voice or automated greeting that most staff and/or customers get to deal with when calling for help*. Most IT helpdesk staff have run sheets or scripts to walk the caller through common problems or perform basic tests. With scripts and the frequency of typical requests, helpdesk staff can become very slick and effective making everyone lives easier. But what happens when a call comes through and it might be a security issue?
Here are some questions to pose to your organisation:

Has there ever been any discussion between the helpdesk and security teams on what should be done if the call is security related?
Is this scalable in time and work load to get every security related possible call routed to the security team answer?
Should the IT helpdesk staff be provided scripts for basic security procedures other than Tell them to touch nothing and you call me!?

Each work place and environment has its own unique factors on how security related call are handled but lets imagine the security team doesnt want to field every call that may or may not be anything to do with a security issue. This is where a helpdesk team could,with guidance and coaching,be invaluable in saving time and effort to all parties.
A crucial first step is to define what the helpdesk should do and what they should definitely not do. This sets clear lines of demarcation, stopping any misunderstanding that can occur in the heat of the moment with someone attempting to do what they believe is the right thing and it ends up causing an awful mess.

On the do lists are:
- Get a clear description of the problem
- Provide standard details on the caller (username, computer details, IP address, location and so on)
- Record only the facts.

On the should not do lists are:
- Connect to the system to try and fix it themselves
- Offer advice on how to fix the problem
- Jump to unsupported conclusions
- Any other actions that may cause harm or impact.

From this point onwards both the security and helpdesk teams have some ground rules and can work together without causing problems.

Feel free to add any comments, thoughts or suggestions on your experiences, good or bad, onsolving this problem.

Chris Mohan— Internet Storm Center Handler on Duty

* Help this coversactual questions on topics the IT helpdesk staff are trained inrather thanthose random questions such as why isnt the fridge working. In case you were wondering, the correct answerwas the fridges fuse had blown. Obvious really…

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

Post suggestions or comments in the section below or send us any questions or comments in the contact form on https://isc.sans.edu/contact.html#contact-form

–

Adam Swanger, Web Developer (GWEB, GWAPT)

Internet Storm Center https://isc.sans.edu

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

Virtualization is so popular today that there is almost no company that does not use a virtualization platform. VMWare is definitely the most popular one (at least the most popular one I seem to be running into).
It is also not uncommon to see VMWare farms growing exponentially as people tend to throw more hardware and just create new VMs. In such cases, controlling what your administrators do is a must yet I also see that organizations auditing their VMWare farms (and especially administrator this is something a lot of SIEMs and similar log collection and analysis tools fail at. So lets see what we have to work with here and how we can improve things.
System components
For the sake of this diary, Ill write mainly about the typical setups today that consist of ESXi (or ESX, for older setups) host servers and one or more vCenter management servers.
ESXi is VMWares host operating system that actually runs the virtual machines. It is highly optimized and has a footprint of only 150 MB. This is what is usually installed on those big servers that today run 20+ virtual machines.
Of course, when you have more than one ESXi server, you want to manage it centrally, not only to make management easier but to also allow some more sophisticated processes such as vMotion and similar. This management is done through a vCenter server.
vCenter basically just runs on a normal Windows operating system machine that itself can be a VM as well. Administrators normally use the VMWare vSphere client application to connect to vCenter and to manage virtual machines (of course, depending on their role and permission).
The same client (vSphere client) can be used by an administrator to connect directly to an ESXi server and to manage VMs that are hosted on that server. As you can probably guess, this creates problems for activity auditing since, in this case, any changes are performed directly on the ESXi host server so vCenter will not see those activities directly.
Finally, if you are trying to troubleshoot some problems, you can allow SSH access directly to the ESXi hosts this access is disabled by default, but I found it quite often that organizations enable it and leave it enabled.
Log collection
We can see that there are multiple system components that generate logs that we should be collecting. While vCenter keeps its own logs and allows reviews from the console, ESXi hosts will also independently keep their logs that should be audited. Actually, when an administrator modifies something in vCenter, a task will be created that will cause vCenter to connect to the target ESXi host and issue the change.
At the moment Im usually recommending clients to collect logs from the following components:

Since vCenter is the brain we should collect all logs we can from the server it is running on. VMWare creates text log files (see http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKCexternalId=1021806 for information about VMWare logs) that are, unfortunately, not easy to read and often lack information.

What Ive found is that the VMWare SDK API allows much easier retrieval of logs that will be nice and structured but, if your SIEM does not support it directly, you will have to code a script to retrieve such logs yourself.

Of course, do not forget about the OS logs as well as the database logs since this server is the most important one, make sure that youve protected it accordingly and that you collect all other log files that might be important.

ESXi host logs are also very important since an administrator can connect directly to them (unless this has been prevented). With ESXi there arent many options and probably the best one is to configure a local Syslog to send logs to the central Syslog server, as shown in the picture below.

Keep in mind, though, that VMWare creates many multi-line logs which will eventually be broken due to size limits of Syslog so correlating them on the server side might be quite a bit difficult, if not impossible.
By using Syslog we will also take care of SSH logins, since these will be logged by the console and sent through Syslog to the central server.
Auditing
Now that we have all the logs at one place, we can correlate them and setup alerts on suspicious activities.

Regular log reviews are very important. One of the things you should particularly take a look at is console access. For example, if the administrator that accessed a servers console through vCenter forgot to logout, any other vCenter administrator can access that servers console (if he has vCenter permissions to access it, of course).
Good log collection and correlation (remember to collect both vCenter logs as well as logs from all your guest servers) can tell you which servers consoles were accessed as well as if the administrator had to log in or not.
So check your VMWare environments today and see if you can answer these questions: who, from where and when logged in to my vCenter console, which VMs were migrated and which consoles have been accessed by which administrator in last 30 days?

Let us know what your experiences with collecting and analyzing VMWare logs are and if you did something youd like to share with our readers so everyone can benefit from your work.

–

Bojan

INFIGO IS

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

This post was syndicated from: SANS Internet Storm Center, InfoCON: green and was written by: SANS Internet Storm Center, InfoCON: green. Original post: at SANS Internet Storm Center, InfoCON: green

After hearing about my wife’s iPad disconnecting from wireless for a couple of weeks (ok, maybe a bit longer than that), I decided to do some upgrades to the home network and replace the problem Access Point (and older home unit).
So off to the store I went, and came home with a bright shiny new A/B/G/N AP. After throwing the DVD away (you know, the one that comes in every box with the outdated firmware on it), and updating the unit to the current rev, my kid and I started setting it up.

It’s been a while since I worked on a standalone AP – my builds normally involve controllers and *lots* of AP’s. So imagine my surprise and joy when I found that these home units no longer default to an SSID with a default name and no security! This one started the setup by defaulting to WPA-2 / Personal, and asked me what I wanted to use for a key ! You really have to be determined now to create an Open SSID ( good news ! )

So are we looking the long, slow goodnight of open wireless on home networks? I’ve written in the past about how tablet users that don’t know better routinely steal wireless from whoever is close without thinking twice – is this going to get harder and harder from them over the next few years, as people migrate to newer APs?
On the other hand, we’re seeing more and more guest networks that are open, things like coffee shops, municipal offices, hair salons – pretty much anyplace you’re likely to spend more than 5 minutes at seems compelled to offer up free wireless. But using free wireless that’s offered to you is a much different proposition than stealing it from someone who’s misconfigured their home network..

I invite your comments – my AP’s name starts with and L and ends with an S (made by our friends at C***o). Are the current models from other vendors implementing better defaults now too?

===============

Rob VandenBrink

Metafore

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.