September 30, 2012

Speed at which a patch can be pushed to all clients is important..

How fast is an security patch converted into an exploit ?  F-secure's @TimoHirvonen did a study and came with this example to document a time-to-exploit timeline.

  •  2012-08-14: Security update available for Adode Flash player, patches vulnerability CVE-2012-1535.
     (Security update available for Adobe Flash Player)
  â€¢  2012-08-15: Microsoft Office Word documents with embedded Flash exploit for CVE-2012-1535 seen in the wild.
     (CVE-2012-1535: Adobe Flash being exploited in the wildCVE-2012-1535 - 7 samples and info)
  â€¢  2012-08-17: Exploit is added to Metasploit Framework — a public, open-source tool for developing and executing exploits.
     (Adobe Flash Player Exploit CVE-2012-1535 Now Available for Metasploit)

Took just one day for it to be converted into an exploit. In other words, it is not enough to release a patch. What matters now is how fast can all the clients can be updated after a patch is released.

The tale of two plugins..

In the browser world, Java and Adobe look very similar. Not only are they similar in the kind of stuff they allow embedded applets/flash_Code to do, but also in the way its exploited to get out of the security container which anonymous code should never be able to do. So here are couple of interesting news items you should know more about...

Adobe revokes certificates: Some tools found in the wild were found to be signed with Adobe's signature which should have never leaked Adobe's infrastructure. Adobe had no option but to initiate the process to revoke the impacted signatures and are conducting forensics to understand what really happened and what else is exposed.

More Java holes reported:  A number of readers alerted ISC of news reports stating that new "full sandbox escape" vulnerabilities had been reported to Oracle. At this point, there are no details available as to the nature of these vulnerabilities, and there is no evidence that any of these vulnerabilities are exploited. However, it is widely known that Oracle is working on a substantial backlog of these vulnerabilities. It is still recommended to use Java "with caution". 

Incorrect implementation of HTTPS in the login page

If you had asked me a few years ago about how should a website owner protect a login page, I'd probably have said that they should make sure credentials are never sent over unencrpted channel. Now thanks to a little more knowledge and a few 'duh' moments I've come to realize that there is one another aspect of login page which goes un-noticed.

While most websites today do enforce that credentials are sent over HTTPS, they do not verify that the login page itself is not in the clear. In fact many of them have a "login/password" form in the clean on many unencrypted pages. For those who understand the risk of javascript injection can tell you as a matter of fact that the forms can be modified by a MiTM (man in the middle) device to do lots of interesting things... including, sending your password to an attackers server. Hence getting the password over encrypted channel wouldn't protect much.

A key point to note here is that this requires an active attack on the user instead of just being a passive listenner, but thats something which has become only easier over time.

IDS world has changed a lot in the last decade

Its been a while since I last played with snort and even longer since I touched tripwire which was at one point the most popular host based intrusion detection tool out there. A lot has changed since then.

From a quick glance at the various tools I found below, its clear that just alerting based on signatures isn't enough. This is not surprising since I can see how lot of false positives can lead to a configuration which could produce false negatives. Whats needed is a set of tools which can help investigate false positives quickly using visual notification or automated secondary scripts which could pull data from various sources to put a confidence number on each alert.

  • Security onion - Security Onion is a Linux distro for IDS (Intrusion Detection) and NSM (Network Security Monitoring). It's based on Xubuntu 10.04 and contains Snort, Suricata, Sguil, Squert, Snorby, Bro, NetworkMiner, Xplico, and many other security tools. The easy-to-use Setup wizard allows you to build an army of distributed sensors for your enterprise in minutes!
  • Suricata - The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine
  • Sguil - Sguil's main component is an intuitive GUI that provides access to realtime events, session data, and raw packet captures.
  • Squert - Squert is a web application that is used to query and view event data stored in a Sguil database (typically IDS alert data).
  • SnorbySnorby is a ruby on rails web application for network security monitoring that interfaces with current popular intrusion detection systems (Snort, Suricata and Sagan).
  • NetworkMinerNetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows that can detect the OS, hostname and open ports of network hosts through packet sniffing or by parsing a PCAP file. NetworkMiner can also extract transmitted files from network traff
  • XplicoThe goal of Xplico is extract from an internet traffic capture the applications data contained.
  • Configuring Security Onion - A SANS paper which goes into the process of setting up Security onion.

Honeymap: A live map of attacks on honeynet endpoints






Honeymap is a real-time world map which visualizes attacks captured by honeypots of the Honeynet Project. Red markers on the map represent attackers, yellow markers are targets (honeypot sensors). Not terribly useful in its current form, but a very interesting way to watch attacks to see if infected systems for a particular type of attack is geo-specific.

Incorrect implementation of HTTPS in the login page

If you had asked me a few years ago about how should a website owner protect a login page, I'd probably have said that they should make sure credentials are never sent over unencrpted channel. Now thanks to a little more knowledge and a few 'duh' moments I've come to realize that there is one another aspect of login page which goes un-noticed.

While most websites today do enforce that credentials are sent over HTTPS, they do not verify that the login page itself is not in the clear. In fact many of them have a "login/password" form in the clean on many unencrypted pages. For those who understand the risk of javascript injection can tell you as a matter of fact that the forms can be modified by a MiTM (man in the middle) device to do lots of interesting things... including, sending your password to an attackers server. Hence getting the password over encrypted channel wouldn't protect much.

A key point to note here is that this requires an active attack on the user instead of just being a passive listenner, but thats something which has become only easier over time.

IDS world has changed a lot in the last decade

Its been a while since I last played with snort and even longer since I touched tripwire which was at one point the most popular host based intrusion detection tool out there. A lot has changed since then.

From a quick glance at the various tools I found below, its clear that just alerting based on signatures isn't enough. This is not surprising since I can see how lot of false positives can lead to a configuration which could produce false negatives. Whats needed is a set of tools which can help investigate false positives quickly using visual notification or automated secondary scripts which could pull data from various sources to put a confidence number on each alert.

  • Security onion - Security Onion is a Linux distro for IDS (Intrusion Detection) and NSM (Network Security Monitoring). It's based on Xubuntu 10.04 and contains Snort, Suricata, Sguil, Squert, Snorby, Bro, NetworkMiner, Xplico, and many other security tools. The easy-to-use Setup wizard allows you to build an army of distributed sensors for your enterprise in minutes!
  • Suricata - The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine
  • Sguil - Sguil's main component is an intuitive GUI that provides access to realtime events, session data, and raw packet captures.
  • Squert - Squert is a web application that is used to query and view event data stored in a Sguil database (typically IDS alert data).
  • SnorbySnorby is a ruby on rails web application for network security monitoring that interfaces with current popular intrusion detection systems (Snort, Suricata and Sagan).
  • NetworkMinerNetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows that can detect the OS, hostname and open ports of network hosts through packet sniffing or by parsing a PCAP file. NetworkMiner can also extract transmitted files from network traff
  • XplicoThe goal of Xplico is extract from an internet traffic capture the applications data contained.
  • Configuring Security Onion - A SANS paper which goes into the process of setting up Security onion.