TaoSecurity Blog

Thanks to ronaldo in #snort-gui I learned about the LBNL/ICSI Enterprise Tracing Project . According to the site: A goal of this project is to characterize internal enterprise traffic recorded at a medium-sized site, and to determine ways in which modern enterprise traffic is similar to wide-area Internet traffic, and ways in which it is quite different. We have collected packet traces that span more than 100 hours of activity from a total of several thousand internal hosts. This wealth of data, which we are publicly releasing in anonymized form, spans a wide range of dimensions. I decided to take a look at this data through the lens of Structured Traffic Analysis, which I discuss in Extrusion Detection and (IN)SECURE Magazine . I downloaded lbl-internal.20041004-1303.port001.dump.anon and took the following actions. First I ran capinfos to get a sense of the nature of the trace. $ sha256 lbl-internal.20041004-1303.port001.dump.anon > lbl-internal.20041004-1303.port001.dump.ano...

I've wanted to try Metasploit 3 since it was released in late March. I noticed the metasploit/devel FreeBSD port, but it wanted me to install framework-3.0-beta-3-svn.tar.gz. I decided to install Metasploit 3 (gold) manually, using the FreeBSD port dependencies for guidance. I installed the following via the ports tree: devel/subversion devel/ruby-gems databases/rubygem-activerecord lang/ruby18 Then I extracted the framework-3.0.tar.gz I downloaded to /usr/local/src. When I tried to run msfweb, I got this error: Cannot find gem for Rails ~> 1.2.2.0: Install the missing gem with “gem install - v=1.2.2 rails”, or change environment.rb to define RAILS_GEM_VERSION with your desired version. Hmm. First I decided I needed to install www/rubygem-rails, which I did. Next I looked in framework-3.0/data/msfweb/config and found environment.rb, with these lines which I added to specify 1.2.3 instead of 1.2.2: # Specifies gem version of Rails to use when vendor/rails is not present #...

CALEA is the Communications Assistance for Law Enforcement Act . I wrote about CALEA three years ago in Excellent Coverage of Wiretapping : CALEA requires telecommunications carriers to allow law enforcement "to intercept, to the exclusion of any other communications, all wire and electronic communications carried by the carrier" and "to access call-identifying information," among other powers. A lot has happened since then. Basically, all facilities-based broadband access providers and interconnected VoIP service providers must be CALEA-compliant by 14 May 2007. This means a lot of companies, of all sizes, are scrambling to deploy processes and tools to collect information in accordance with the law, as well as filing the right reports with the FCC . If you're affected by CALEA I don't think you'll learn much from this post. However, those who do not work for ISPs might like to know a little bit about what is happening. (Note: I am not perso...

We know how many words a picture is worth. The figure at left, from Boxed In by Information Security magazine, shows why Unified Threat Management appliances are going to replace all the middleboxes in the modern enterprise. At some point the UTM will be the firewall, so the gold UTM box above will also disappear. In some places even the firewall will disappear and all network security functions will collapse into switches and/or routers . I'd like to show one other diagram from the story. Figures like these, showing which products and their "features," are another reason UTM will replace point product middleboxes. "Hey, I read in this magazine that product X checks 7 boxes, but product Y only checks 3. Let's look at product X." These are the sorts of figures that people who are not security experts and are not interested in or capable of assessing security products like. Just because I think this is going to happen (or is happening -- look at wh...

Disclaimer: I'm going to single out a book by Cisco employees that talks about a Cisco product. I have no personal feelings about Cisco. I have friends there. I've done work for Cisco. Since I think Cisco is eventually going to own all network security functions in their switches , I may even work for Cisco one day. This post is for all product vendors who approach understanding and defending the network in the ways described here. Wherever you read "Cisco" feel free to add products that share the characteristics I outline below. Once again I found myself hanging in the sky last week. Trips to and from the West Coast gave me the opportunity to read Security Threat Mitigation and Response: Understanding Cisco Security MARS by Dale Tesch and Greg Abelar. This is mainly another Cisco marketing book, like Self-Defending Networks: The Next Generation of Network Security by Duane DeCapite. While I have a few thoughts on the book, I would much rather address the u...

I mentioned the power of Wireshark display filters when analyzing 802.11 last year. Now I read Ephemeral Diffie Hellman support - NOT ! by the Unsniff guys and they tell me that they cannot decode SSL traffic which uses the ephemeral Diffie-Hellman cipher suite. I wonder what that looks like in traffic? Thanks to Wireshark display filters, I can find a suitable packet. Here's a matching packet. You could use syntax like this with Tshark: tshark -V -n -r capture -R "ssl.handshake.ciphersuite == 0x39" ...edited... Secure Socket Layer TLSv1 Record Layer: Handshake Protocol: Server Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 74 Handshake Protocol: Server Hello Handshake Type: Server Hello (2) Length: 70 Version: TLS 1.0 (0x0301) Random gmt_unix_time: Jan 26, 2007 19:32:44.000000000 random_bytes: 76744E818415307EA6F7C14FAF4BA640F67834C1263E5065... Session ID Length: 32 Session ID (32 b...

In my 2005 book Extrusion Detection (p. 27) I defined the term pervasive network awarenesss (PNA): A truly defensible network permits security administrators to achieve pervasive network awareness. Pervasive network awareness is the ability to collect the network-based information -- from the viewpoint of any node on the network -- required to make decisions. Today while perusing Webcasts at Gigamon University , I listened to a Gigamon presentation on a "data access network" (so-called "DAN") built as the Interop SpyNet , shown earlier. This is exactly an implementation of PNA. The Interop network and security admins can monitor the InteropNet and see traffic anywhere they like. This Interop Blog post provides a portal into discussions of the SpyNet, including history showing the idea stretches back to 1996. This shows that PNA is a good idea, and like many good ideas, not even new! At some point I would like to see a SpyNet in person. I will be in Aus...

I came across this press release from Solera Networks on their open source DataEcho application. DataEcho is a Windows program that captures live traffic or reads traces in Libpcap format. It's best used for interpreting Web traffic, as shown in this screen capture of a visit to www.bejtlich.net recorded in Wireshark and fed to DataEcho. My Web site doesn't render that well because it uses CSS, but you can see how DataEcho breaks down the Web traffic. This is a similar view from Wireshark, sorted on the last column. Besides DataEcho, I found a SourceForge project page for a Solera-related " tEthereal Network Forensic Console ", which says: Management Console to reconstruct emails, web sessions, VOIP sessions, FTP, and all known supported Internet Protocols for Network Forensics. ***UPDATE*** Project release scheduled. That looks interesting, but no files are available. I have been exchanging emails with Solera CEO Terry Haas, so I hope to find out more about th...

Thanks to nikns in #snort-gui for pointing me towards this 23rd Chaos Communication Congress talk on an alternative to Wireshark created by Andreas Bogk and Hannes Mehnert. This blog post explains the rationale behind this new tool, still in its infancy and nowhere nearly feature-complete as Wireshark. Two implementations exist. Here is a screenshot of GUI-sniffer: Here is a screenshot of Network Night Vision : These applications are written in the Dylan programming language, which is new to me. There's a lang/dylan FreeBSD port, but as you can see I just tried running the Windows binaries. The authors have written a paper (.pdf) that describes the project in detail. From the first part of the paper: The security industry is in a paradox situation: many security appliances and analysis tools, be it IDS systems, virus scanners, firewalls or others, suffer from the same weaknesses as the systems they try to protect. What makes them vulnerable is the vast amount of structur...

If you're a protocol junkie like me, you probably enjoy investigating a variety of network traffic types. I don't encounter multicast traffic too often, so the following caught my eye. I'm using Iperf for some simple testing, and I notice it has a multicast option. Here's how I used it. In the following scenario, I have two hosts (cel433 and cel600) on the same segment. This is important because the router(s) in this test network are not configured to support multicast. I set up cel433 as a Iperf server listening on multicast address 224.0.55.55. cel433:/root# iperf -s -u -B 224.0.55.55 -i 1 ------------------------------------------------------------ Server listening on UDP port 5001 Binding to local address 224.0.55.55 Joining multicast group 224.0.55.55 Receiving 1470 byte datagrams UDP buffer size: 41.1 KByte (default) Now I generate multicast traffic from cel600. cel600:/root# iperf -c 224.0.55.55 -u -T 32 -t 3 -i 1 -------------------------------------------...

I just wrote about Web Browsing with Tor . You might wonder if there's an easy way to switch to using Tor while running Firefox. I looked at the Torbutton extension, but then I found SwitchProxy . I like SwitchProxy because can you configure multiple proxies and decide when to use them. If you click on the thumb image above you'll see me accessing a Hidden Service using Tor while I have Privoxy and Tor working together. Notice the URL -- http://6sxoyfb3h2nvok2d.onion/ I can just as easily switch to my production proxy, or even import a list of anonymous proxies and have SwitchProxy cycle through them every X seconds.

A task I'm going to blog shortly recommends that I install Privoxy . I encounted some troubles using FreeBSD so I thought I would document them. First I installed the package. orr:/root# pkg_add -vr privoxy ...edited... Running pre-install for privoxy-3.0.3_4.. extract: Package name is privoxy-3.0.3_4 extract: CWD to /usr/local extract: /usr/local/man/man1/privoxy.1.gz extract: /usr/local/sbin/privoxy extract: /usr/local/etc/privoxy/config extract: /usr/local/etc/privoxy/default.action extract: /usr/local/etc/privoxy/default.filter extract: /usr/local/etc/privoxy/trust ...edited... *********************************************************** ** Before running privoxy you must modify the file ** ** /usr/local/etc/privoxy/config ** ** ** ** Start privoxy with: ** ** /usr/local/sbin/privoxy /usr/local/etc/privoxy/config ** ** ...

In my Installing Privoxy post I said I needed to install Privoxy for a certain task. I decided to use Privoxy with Tor to facilitate anonymous Web browsing. First I installed Tor via package. orr:/root# pkg_add -vr tor ...edited... Package 'tor-0.1.1.23' depends on 'tsocks-1.8.b5_3' with 'net/tsocks' origin. ...edited... extract: Package name is tsocks-1.8.b5_3 extract: CWD to /usr/local extract: /usr/local/man/man1/tsocks.1.gz extract: /usr/local/man/man5/tsocks.conf.5.gz extract: /usr/local/man/man8/tsocks.8.gz extract: /usr/local/bin/tsocks extract: /usr/local/etc/tsocks.conf.sample extract: /usr/local/lib/libtsocks.so.1 extract: /usr/local/lib/libtsocks.so extract: /usr/local/share/examples/tsocks/tsocks.conf.complex.example extract: /usr/local/share/examples/tsocks/tsocks.conf.simple.example extract: /usr/local/share/examples/tsocks/README ...edited... Package 'tor-0.1.1.23' depends on 'libevent-1.2' with 'devel/libevent' origin. ...

While reading a book on Nagios, I learned of net-mgmt/mbrowse , pictured above. It's not fancy -- just a graphical SNMP v1 MIB browser.

Ten days ago I had the privilege of attending a day of product training for NetWitness . NetWitness is a real network forensics tool produced by a company of the same name. Anyone who's read my books or attended my training knows I am a big fan of open source tools. NetWitness, however, is built to facilitate investigating network traffic. It's important to differentiate between packet collectors, protocol analyzers, and network forensics tools. Dumpcap is the prototypical packet collector. Simpler than Tcpdump and much simpler than Tshark , all Dumpcap does is record packets. It's especially suited for this role, however, because it offers native trace rotation capabilities. Tcpdump, Tshark, and Wireshark are all protocol analyzers. Yes, Tcpdump is a protocol analyzer, although it is not as robust as Tshark or Wireshark. Protocol analyzers are suited for packet-centric inspection. For example, I used Wireshark extensively while learning about 802.11 traffic. ...

This note is intended for students in my TCP/IP Weapons School class at USENIX Security 2006 . These are the tools that will be discussed. Remember, this is a class on TCP/IP -- tools are not the primary focus. However, I needed something to generate interesting traffic. Nemesis Arping Arpdig Arpwatch Arp-sk Dsniff suite Ettercap Yersinia Fragroute Sing Gnetcat Packit Gont attacks ICMPshell The traces we will analyze are available at www.taosecurity.com/taosecurity_tws_v1_traces.zip . You will need to have Ethereal , Wireshark , or a similar protocol analyzer installed to review the traces. Tcpdump might be somewhat limited for this class but you can at least inspect packets with it.

Ok, this is a little weird. Thanks to SecurityMonkey I just tried the SPI Dynamics JavaScript Scanner . From that page: Imagine visiting a blog on a social site like MySpace.com or checking your email on a portal like Yahoo’s Webmail. While you are reading the Web page JavaScript code is downloaded and executed by your Web browser. It scans your entire home network, detects and determines your Linksys router model number, and then sends commands to the router to turn on wireless networking and turn off all encryption. Now imagine that this happens to 1 million people across the United States in less than 24 hours. This scenario is no longer one of fiction. I recommend reading the white paper (.pdf). I tried out the proof of concept on Windows 2000 as a non-admin user running the latest Firefox. Here's what I got. Now all three hosts exist, but due to known issues none are correctly detected. Still, this is a cool idea. Note that I ran the page while using a Web proxy, s...

If you're a packet monkey like me, you probably use tools like Argus and Tcpreplay . Carter Bullard is preparing to release Argus 3.0 soon, which includes a lot of community feedback . You can try the latest release candidates here . I helped testing by providing access to a box running FreeBSD 6.1 amd64. Similarly, Aaron Turner just released a new beta version of Tcpreplay. I ran into a problem with Tcpedit on FreeBSD 6.1 i386 when running 'make'. Try downloading and testing these beta versions and provide feedback to the authors. Thank you!

Fyodor of Nmap fame has posted the results of his 2006 survey of security tools. Fyodor posted the results at his new site SecTools.org . On page 4 you'll find Sguil listed as number 85 out of 100. Unfortunately, BASE beat out Sguil at number 82. Another personal regret is seeing Argus listed after BASE at number 83. The next time Fyodor asks for suvery participation, I will have to respond! Although the top 100 results are useful, some of the sub-categorization makes little sense. Sguil is listed in the Traffic Monitoring Tools subsection, along with Solar Winds and Nagios (?!?). The Intrusion Detection category lists BASE but not Sguil, along with Fragroute and Fragrouter (?!?). Bizarre. Regardless, I recommend security pros familiarize themselves with all of the tools in the top 100. It makes for great discussions during job interviews, either as the employer or prospective employee.

Sometimes you have to make the best of a bad situation, with no warning. Good-bye Ethereal , hello Wireshark . Gerald Combs, original author and primary Ethereal developer, left his job at Network Integration Services, Inc. and joined CACE Technologies . Unfortunately, NIS owns the Ethereal trademark, and Mr. Combs wasn't able to take it with him. He also lost administrative rights to the servers hosting Ethereal.com, so he can't post news of the name change there. So, nearly eight years after the first public release , Ethereal is dead. Long live Wireshark -- especially with 1.0 expected very soon.