TaoSecurity Blog

I noticed three interesting blog posts that address security instrumentation failures. First, security software developer Charles Smutz posted Flushing Out Leaky Taps : How many packets does your tapping infrastructure drop before ever reaching your network monitoring devices? How do you know? I’ve seen too many environments where tapping problems have caused network monitoring tools to provide incorrect or incomplete results. Often these issues last for months or years without being discovered, if ever... One thing to keep in mind when worrying about loss due to tapping is that you should probably solve, or at least quantify, any packet loss inside your network monitoring devices before you worry about packet loss in the taps. You need to have strong confidence in the accuracy of your network monitoring devices before you use data from them to debug loss by your taps. Remember, in most network monitoring systems there are multiple places where packet loss is reported... I’m not going ...

Recently I railed against PowerPoint . In this post I'd like to congratulate Black Hat and some of their Briefings speakers for submitting white papers, not just PowerPoint presentations. This evening while cleaning out a tmp directory I noticed a copy of a white paper by IBM's Tom Cross from Black Hat DC 2010 titled Exploiting Lawful Intercept to Wiretap the Internet . The paper describes Tom's analysis of Cisco's implementation of CALEA for law enforcement-directed wiretaps. The paper is 18 pages, but the last 3 are basically citations. It's a great piece of work which I wish I had read earlier. For me, this paper emphasized how much of a failure it is to try to deliver complicated information in PowerPoint form. I got more out of taking 20 minutes to read Tom's 15 pages of material than I could have trying to make sense out of his 41 slides. Tom is a good writer whose paper delivers solid arguments. Rather than just praise the paper and slam the Powe...

In my post NSM-Friendly VMware Lab Setup I mentioned wanting to use NSMNow to install Sguil on Ubuntu 8.04 for student use in my next class. I had tried the Securix-NSM live CD but I had not tried installing Sguil using the same project's NSMNow scripts. I just did it: root@twsu804:/usr/local/src# wget http://www.securixlive.com/download/nsmnow/NSMnow-1.1.1.tar.gz --22:14:38-- http://www.securixlive.com/download/nsmnow/NSMnow-1.1.1.tar.gz => `NSMnow-1.1.1.tar.gz' Resolving www.securixlive.com... 202.191.61.156 Connecting to www.securixlive.com|202.191.61.156|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 164,613 (161K) [application/x-gzip] 100%[====================================>] 164,613 53.85K/s 22:14:42 (53.80 KB/s) - `NSMnow-1.1.1.tar.gz' saved [164613/164613] root@twsu804:/usr/local/src# tar -xzvf NSMnow-1.1.1.tar.gz NSMnow-1.1.1/ NSMnow-1.1.1/NSMnow-core NSMnow-1.1.1/RELEASE.NOTES NSMnow-1.1.1/templ...

It's been 16 days since I responded to public notification of DNS problems in Thoughts on Latest Kaminsky DNS Issue , and 4 days since Halvar Flake's post On Dan's request for "no speculation please" . Apparently the tubes are still working, since I presume you're reading this post via the Internet and not carrier pigeon. It's still been a remarkable period, characterized by the acronymn in the title of this post. I'm not referring to the TARDIS of Doctor Who, although centrality of "Time" is the reason I used the TARDIS theme. I mean Time and Relative Data in Security. Time and Relative Data were the key issues in the DNS issue. Who knew more about the problem, and when? Halvar understood this in his post, when he estimated that a savvy attacker would need 1/4 the time of a normal security person to understand the nature of the DNS problem, given the same starting point. Since Halvar's speculation, Matasano's confirmation , M...

It's been nine days since Dan Kaminsky publicized his DNS discovery . Since then, we've seen a Blackberry vulnerability which can be exploited by a malicious .pdf, a Linux kernel flaw which can be remotely exploited to gain root access, Kris Kaspersky promising to present Remote Code Execution Through Intel CPU Bugs this fall, and David Litchfield reporting "a flaw that, when exploited, allows an unauthenticated attacker on the Internet to gain full control of a backend Oracle database server via the front end web server." That sounds like a pretty bad week! It's bad if you think of R only in terms of V and forget about T and A. What do I mean? Remember the simplistic risk equation, which says Risk = Vulnerability X Threat X Asset value. Those vulnerabilities are all fairly big V's, some bigger than others depending on the intruder's goal. However, R depends on the values of T and A. If there's no T, then R is zero. Verizon Business unders...

I learned about the MPAA University Toolkit at Brian Krebs' always-excellent SecurityFix blog. If you want to know more about the user experience, please check out that post. Here I take a look at the monitoring software, focusing on Snort, operating on this application. I downloaded the 534 MB peerwatch-1.2-RC5.iso and started it in a VMware Server session. I used ctrl-c and then 'sudo bash' to exit from the initial script presented within X, set a root password, then used 'apt-get ssh install' to install OpenSSH and thus enable root access. From this point forward I accessed the system using OpenSSH remotely to facilitate copying information into this blog post. First, this looks like Ubuntu (Xubuntu, if you really care) Feisty Fawn , or 7.04. root@ubuntu:~# uname -a Linux ubuntu 2.6.20-15-generic #2 SMP Sun Apr 15 07:36:31 UTC 2007 i686 GNU/Linux I was most interested in learning about Snort on this toolkit. I saw this version installed. root@ubuntu:~# s...

Two years ago I wrote Thoughts on NSA IAM Course . That post is still in the top ten Google search results for NSA IAM, which is sad because that means there isn't much about the program online. IAM stands for INFOSEC Assessment Methodology. (Ugh, I hate " INFOSEC ".) The only real material about IAM (beyond the public slides used to teach the classes appears in Security Assessment: Case Studies for Implementing the NSA IAM by Russ Rogers, Greg Miles, Ed Fuller, Ted Dykstra. The Syngress sample chapter nicely summarizes the IAM purpose and compares it to alternatives. The National Security Agency (NSA) Information Security (INFOSEC) Assessment Methodology (IAM) is a detailed and systematic method for examining security vulnerabilities from an organizational perspective as opposed to a only a technical perspective. Often overlooked are the processes, procedures, documentation, and informal activities that directly impact an organization’s overall security posture ...

Based on my summaries of the talks I saw on day one and two of Black Hat USA 2007, some of you have called me "depressed" or "negative." I call it realistic and largely historic. Nothing I described was brand new the day I saw it. Most if not all of everything I saw was already discussed in public forums or private groups. Sometimes it takes a live explanation by a real expert to synthesize and demonstrate the technique to make it come to life and help attendees connect the dots. This was certainly the case for me and I expect other people too. I've spent almost my whole career watching defenses fail and then trying to contain and remove the mess. The fact that nothing has reduce my workload during the last decade indicates our approach to this problem is not working. I attend Black Hat so I can get semi-clued-in to attack techniques, and I recommend everyone else who cares about how they are already being abused attend or ask someone who attended to su...

It's been 2 1/2 years since my first book was published, although I've been writing and speaking about Network Security Monitoring (NSM) for at least five years. I'm starting to see other people cite my works, which is neat. It also means people are starting to criticize what I wrote, so I need to elaborate on some ideas. The December 2006 ISSA Journal includes an article by Robert Graham titled Detection Isn’t Optional: Monitoring-in-depth . (No, it's not the Robert Graham of Black Ice/ISS fame. This is a different person.) The implication of this article is that NSM is insufficient because it does not integrate SNMP data, event logs, and other sources. I do not disagree with this assessment. The reason I focus on NSM is that I start from the premise of self-reliance . In many enterprises, the security team does not have access to SNMP data from infrastructure devices. That belongs to the networking team. They also might not have access to event logs, sinc...

Last week I attended and spoke at the latest Net Optics Think Tank . I've presented for Net Optics twice before , but this was the first event held in northern Virginia. The first half of the event consisted of two briefings. The first discussed tap technology. This was supposed to be a basic introduction but I learned quite a bit, especially with regards to fiber optics. Specifically, I learned of some cases where customers reverse cables when plugging in their taps, thereby causing lots of tough-to-troubleshoot problems. Furthermore, as customers move from Gigabit over fiber to 10 Gigabit over fiber, they are encountering cabling issues. Gigabit is much more forgiving than 10 Gig. At 10 Gig, you apparently have to pay close attention to the specifications, such as core size. I learned that Net Optics is considering ways to "tag" or "label" packets collected by their link aggregator taps. When discussing matrix switches , it occurred to me that tho...

Amazon.com just posted my 4 star review of The TCP/IP Guide . From the review : Right away I must state that I did not read "The TCP/IP Guide" (TTG) cover-to-cover. I doubt anyone will, which raises interesting issues. This review is based on the sections I did read and my comparisons with other protocol books. Protocol books should be divided into two eras. The first is the "Stevens era" meaning those written around the time Richard Stevens' "TCP/IP Illustrated, Vol 1: The Protocols" was published. For six years (1994-2000) Stevens' book was clearly the best protocol book, and it taught legions of networking pros TCP/IP. The second is the "modern era," beginning in 2000 and continuing to today. TTG fits in this group. I question the approach taken by TTG. The book contains extremely basic information (what is networking, why use layers, what is a protocol, etc.) and extremely obscure information (PPP Link Control Protocol Frame T...

While reading a book on Nagios, I learned of net-mgmt/mbrowse , pictured above. It's not fancy -- just a graphical SNMP v1 MIB browser.

I managed to get a SNMP v3 trap to work when sending the trap with Debian. This is important because it confirms a bug was introduced into snmptrap somewhere in the 5.2.x line of Net-SNMP tools. The version of snmptrap installed by Debian stable is 5.1.2. Here is what I set up. The Debian host is macmini. I created /etc/snmp/snmpd.conf with the following. createUser doit MD5 doitpassword DES doitpassword When I ran snmpd, I saw the user created along with the engine ID for this host. macmini:~# snmpd -f -Lo -Dusm usmUser: created a new user doit at 80 00 07 E5 80 54 D7 15 E8 44 FA 12 65 Warning: no access control information configured. It's unlikely this agent can serve any useful purpose in this state. Run "snmpconf -g basic_setup" to help you configure the snmpd.conf file for this agent. NET-SNMP version 5.1.2 This step also created /var/lib/snmp/snmpd.conf with the following: usmUser 1 3 0x800007e58054d715e844fa1265 0x646f697400 0x646f697400 NULL ...