Quick and easy way to block attackers / advertisers etc.

So, tired of xss / csrf / clickjacking etc? How about blocking the scumbags with your hosts file? I know, that would take too long right? What if someone else did all the heavy lifting? Check out this site, they distribute a hosts.txt and also provide directions for how to get it up and running in your OS of choice

Block scumbags with local DNS file!

IPv6 0day

I've been on a soapbox for the last 3 years telling people that tell me "We're not running IPv6" that they are and they don't realize it. Essentially your systems in their default state are trying to pull addresses but nobody is offering them. The moment I connect to your network and start sending Router Advertisements (RA) your systems will accept them will be part of my IPv6 network. As you can imagine at this point they will be susceptible to any IPv6 exploits. I've discovered a few of my own, but here is a really nice article about one that went public today.


SLAAC IPv6 Attack

Moral of the story is InfoSec Rule 1.a(1) If you're not using a service disable it.

Tuning trunks to ESX servers

You'll be hard pressed to find a network these days that doesn't have a VMware server (ESX/ESXi) connected. While this is a common scenario there seems to be some misunderstanding on the way that a vSwitch handles frames and their tags.

First off:
The vSwitch does not support untagged frames. This means, that VLAN 1 and all of the traffic that gets passed along will only be dropped.

Second:
The vSwitch does not support DTP, so set the port to no-negotiate.

Third:
It's best practice to manually prune the link to only carry required VLAN's.
This can be done with the switchport allowed command.

For example, on the physical switch port:
* interface GigabitEthernet1/1
* description VMware ESX - Trunk A - NIC 0 – Port Description
* switchport trunk encapsulation dot1q – ESX only supports dot1q and not ISL
* switchport trunk allowed vlan 100,200 – Allowed VLANs
* switchport mode trunk – Enables Trunk
* switchport nonegotiate – ESX does not support DTP dynamic trunking protocol. When configuring trunk port, set it to nonegotiate.
* spanning-tree portfast trunk – Enables PortFast on the interface when it is in trunk mode.

ATM skimmers

I typically don't may too much attention to ATM machines and recent scams. I rarely use ATM and when I do I'm fairly selective, but it's only a few times a year so when articles are published I'm likely to skim by them. That said, I've found an excellent repository of information about ATM card skimming. Kerbs has a series of articles that I thought I'd link to just in case anyone who follows me is interested.

ATM card skimming articles.

So what the heck is a darknet?

I was contacted by a former student last night asking to explain the concept of a darknet. Prior to contacting me he had read several descriptions online but none of them made any sense. Well since I took a few minutes to create my own explanation for one person I might as well put it here.

Let's look at it from an operational perspective opposed to a regular definition.

1)You want to study malware and wormlike / scanning activity

2)So you allocate a block of network space, say 4.16.5.0/24 to your "dark net"

3)On your router create a static route, 4.16.5.0/24 --> 1.1.1.1 (this being the IP of your analysis box.

Done.

Ok, so what just happened? The idea, is that a darknet, or dark IP range, is a range that has no services in it, therefore there should be no incoming traffic, and if there is incoming traffic it must be bad. To test this theory all traffic for the non-existing subnet of legitament address space is being pushed to an analysis machine. Here you would log the connection attempts to get a better understanding of which ports are trying to be reached.

How is this effective? well ideally you would want to combine several darknets and aggregate the data from all of them to build stats & trends on which servies are being targeted.

That's it!

Hopefully that helps, Arbor Networks collects data and publishes stats publicly. If your IP block were discovered it would obviously not be effective, so if you work for security company you would want to get ahold of address space that is not adjacent to production IPs.

So another question: Couldn't you just look at incoming traffic to your prouction network?

Not really, your production network has legitamate services and an identity, it's not actually "Dark". You may be receiving targeted reconnaissance, or other attacks. Useful to know about, but not useful for research of trends of malware that are not targeting a specific victim.

Hope that helps!

Beating wireshark into shape on OSX

I've gotten emails from several past students regarding wireshark operations on OSX. Similar to the experiences in the classroom, when installing Wireshark into OSX you must also FOLLOW ALL OF THE DIRECTIONS ;).

If you are experiencing the following error:
“Insecure Startup Item disabled. – “/Library/StartupItems/ChmodBPF” has not been started because it does not have the proper security settings.

Pretty simple fix, just change the ownership of the ChmodBPF script to that of root in the wheel group.

To accomplish this:
cd /Library/StartupItems
sudo chown -R root:wheel ChmodBPF

Firesheep

Very cool new firefox plugin for sniffing credentials over HTTP for common online services such as twitter, facebook, and others that use HTTP logins STILL IN 2010.. Long overdue :)

I know that everyone reading this can decode HTTP logins, but this is a cool way to do it within a plugin!

Works over wifi, supports session hijacking (cookie theft).

Supports OSX! (win& linux too)

Might be worth checking out!

http://codebutler.com/firesheep

Everquest 2 & Nvidia 3D Vision solved

I picked up an Nvidia 3D Vision headset about a month ago, and it's been very, very cool. The only problem is that while enjoy playing almost all video games, my favorite game (Everquest 2) did not seem to function properly with EQ2. The mouse pointer was in 3D but nothing else. I had searched the web, and even called tech support and nobody could tell me what the issue was. Latest drivers, game is patched, still no 3D. Well I was messing around with the settings today and there is a LETTERBOX function, which basically adds a strip of black to the top and bottom of the screen. This improves performance because the video card does not need to redraw, animate, anti-alias all of those extra pixels, and that area is full of spells, stats, and effects anyhow, so why not.

Well, after playing with various setting today I discovered that if you remove the letterbox completely that the 3D effects work perfect. This is great, because I shelled out quite a bit of cash for a new 3D card (GTX 480), a 3D monitor, and 3D glasses, so it was kind of miserable that it did not want to work with my favorite game. Anyhow, it's working now, just in time for a Double XP weekend :)

RAID 0 Good, SSD is great, but what about RAID 0 with SSD?

I had been putting off SSD for a while now, based on the high price, and the fact that most technologies need a bit of time to mature before they are worthwhile. Well, I finally broke down about two weeks ago and got my first SSD. I chose the OCZ Agility 2 based on performance / price combination. This model seems to be the best bang for the buck. Well, after adding it to my Alienware Aurora, which was already RAID 0 on WD 7200 RPM drives, I copied Everquest 2 to the new drive and launched it. Let me preface this by saying I had read many impressive reviews and my expectations were very high, however the SSD did not disapoint. My load times between zones were just great! When playing from a single 7200rpm drive on a different system a few nights later I realized what I must do next, and that was build a new box with 2 Agilty2 SSD's in RAID 0 .


Well the box has been built, I could try to describe it, but let my benchmarks speak for themselves. This is on an Asus P6T with onboard IHCR10 raid controller (nothing fancy).

BGP Looking glasses

I cover BGP in my migration course, however you don't really get the right feel for it in the small lab environment. I like to direct my students to various BGP looking glasses on the web to view what real tables look like. There is a site that contains a list of HTTP based data as well as live routers with public telnet access, this is much more interesting :).

Give it a shot, scroll down to category 2 and try to telnet into these devices. The "show ip bgp ?" command should get you started!

BGP Looking Glasses

Metasploit: The missing manual

While it would be difficult to find someone to disagree that the Metasploit Framework is one of the most powerful "hacking tools" of all time, it would be just as difficult to find someone that claimed to be a master of it. Metasploit has so many capabilities, it seems that nearly every class I take touches upon metasploit in someway that I hadn't seen before. Whether it's MITM attacks, or pattern creation used during buffer overflows, or token masquerading, etc. The problem has always been a source of useful documentation. I read the docs, I bought the Syngress Metasploit book (almost useless), and I follow the mailing-list which has been the most helpful until now. Well, the Metasploit Unleashed Class is online, it's provided by Hackers for Charity, and they ask for a $4 donation, which everyone should be more than happy to give. This is an awesome compilation of knowledge that would have been impossible to gather on your own.

Metasploit Unleashed

Lockpicking

In all of my security classes we discuss the importance of physical security, I never get much resistance from students here, everyone seems to nod and agree. Outside of the classroom however, there are too many scenarios to count (Car dealerships, Sports arenas, hospitals, schools, etc) where network equipment is behind a locked door, in what used to be a broom closet. Not much thought is given to the locks. Well, at Defcon this year I brought the wifey by lockpicking village (her 3rd defcon, but 1st attempt at lockpicking) and long-story-short she took to lock picking like a duck to water.

One of the guys doing presentations has a website with excellent videos that I wanted to share. Also, if you make it out to Defcon be sure to stop by the lockpicking village!

Lockpicking Videos

Update those ASA's guys..

To all of my past ASA students, and even those of you who aren't if you are running 5580's there were several ASA vulnerabilies posted last week. As you know the vulnerabilites have been there since the code shipped, but now the bad guys know about it and can DoS your firewalls with single malformed packets..

http://nvd.nist.gov/download/nvd-rss.xml


Also, some of the latest adobe exploits effect the Mac community now :(. When people tell me that Apple sucks, I generally just laugh internally and don't make an argument, the less people using it the better, as far as security through obscurity is concerned, looks like they are starting to become more of a target unfortunately.

My favorite con of the year is less than a Month away, as you should know Defcon is the premiere hacking conference. Not the best on the east coast, or west, not the best in the US, but the best in the world! It follows Blackhat Las Vegas which is held at Caesars Palace just before the Defcon weekend (July 30-August 1). It will certainly be a great time this year, there are some really great looking talks. If any of my past students make it out, I'd like to buy a round of drinks so contact me if you're going!

Verizon blocking SMTP port 25

In an attempt to "protect you" as a Verizon customer you can no longer use traditional SMTP over port 25 with a "3rd party" email provider. In other words, if you have your own domain, use a "thick client" to access your email, or need to access email from ANYONE other than verizon.net it will now be "blocked for your protection". I discovered this, this morning while wasting about 90 minutes of my life trouble shooting services, firewalls, filtering, etc.

Their solution is:
1) Just use webmail
2) Just use verizon.net, scrap the other domain.
3) Buy a static IP, but first realize, this makes you a Verizon business customer, instead of residential, higher price, new contract, cancellation fees apply for moving from residential to business, not sure how their math worked on that one.
4) *Best* Send email on port 587 instead of 25, may require configuration changes on the server side, not bad if you run your own server but this may take some work as well.


This kind of reminds me of the time they blocked access to 4chan..


Kind of scary when you realize they can take away pieces of the internet at will.


Verizon blocks SMTP outbound (for your protection)

The H3C hardware looks pretty cool so far, but can it do Netflow?

In short, yes. Netflow was designed by Cisco, however many vendors support something similar, for instance Juniper uses Jflow, Foundry uses Sflow, and H3C/3com use something called NetStream.

NetStream supports version 5,8 and 9, which maps to NetFlow version 5,8 and 9 for the most part. While there are some differences in the H3C implementation, Plixer has overcome these inconsistencies and now supports NetStream in their awesome product Scrutinizer.

H3C also offers a monitoring module for the 7500E and 9500E switches, if you wanted to perform NetStream collection directly on the switch.

Is it metasploitable?

Good news to those of you who were looking for a "punching-bag" without the labors of building your own, the Metasploit crew has released Metasploitable which is a purpose-built virtual machine chock-full of vulnerabilities that can be exploited by MSF. It's built on Ubuntu 8.04 which is good news for those of you that have only been working against Windows servers this whole time, you can try out some different payloads.

Grab the torrent!

VMWare overhauls graphics performance in the latest build

If you've attended my hacking course in the past, you'll know that I like Mac's and you'll know why. While no operating system is perfect, OS X has been very good to me over the years. Fusion makes our lives a bit smoother by allowing to run Windows within OS X, so we can hang on to all of those apps that don't work in OS X (and without a reboot).

Well the latest Fusion update gives me support for all 8 CPUs on my MAC pro, even if you don't have 8 CPU's they clain 35% increase in application performance and 500% increase in 3D performance. As you may recall, 3.0 gave us the ability to run DirectX games within Windows 7 within our OS X. Yes the game would load, and it was fine for logging in to check the broker of a MMORPG, or some other brief activity but it's not something you'd want to spend a lot of time in. Well, with 3.1 I was able to launch TF2 via Steam within Windows 7, log into a server and quickly and smoothly make some kills. Very nice improvement. One thing to keep your eye on is the amount of RAM allocated to your virtual machine.

VMware also supports Unity, which is the ability to run a Windows application, in it's own window within OS X. In other words, the app, while running within the guest OS, appears in the host OS as though it's native.

There are many other new features as well, and it's a free upgrade if you're running 3.0 so go ahead an upgrade already!

It should also be noted that a similar upgrade is available for VMware Workstation (7.1) that boasts similar performance upgrades, based on optimizations for i3,i5, and i7 CPUs, also improved graphics support. Workstation costs approximately double what Fusion does, however you can deploy VM's to ESX from it with ease, and it supports snapshots, which are an essential feature for Malware Analysis. I've got both Workstation and Fusion and I'm very happy with each.

ASA 8.3, Firewall Technology update (another one)

In the new version of code for 8.3, you'll notice a few changes, perhaps most obviously the new memory requirements, the 5520s and 5540's for instance now require 4 GB of ram. Besides the new RAM requirements you'll find the following changes:

Wider support for IE8 (32& 64 / win 7, vista, xp) also officially support 10.6 OSX for SSL VPN.

Licensing is now aggregate, that is if you have 100 SSL VPN licenses on your active, and 100 on standby (this is required, even though only the active can terminate connections) starting with 8.3, your active ASA will support the aggregate (200) number of licenses. If there was ever a failure, and one is shipped back to Cisco, the other will support the aggregate for 30 days. That should be plenty of time to replace your backup.

You'll now use "objects" which is your IP to name mapping (think names). You can now define a server once, Mailserver=192.168.168.50, and put that MailServer in several different ACLs and NAT rules, you can then change the mapping and it will follow within the other portions of the configuration. The goal is to move towards a more object-oriented configuration, so it's simpler to configure things and make changes system-wide.

There is a new technique, where you can do a reverse many-to-one NAT, called one-to-many NAT. The idea is that you can have a single host on the inside, that is now matching multiple IP's on the outside, perhaps two different service providers.

ACLs now use a concept called REAL-IP, the idea of REAL-IP is that when you build that ACL for the outside interface, for server 192.168.168.50 that's being mapped to 50.50.50.50, you would previously think about what the packet looks like when it arrives on the interface. So think, on the outside, the packet is destined for 50.50.50.50 (there's a static NAT to the inside host). Well, now you'll use the REAL-IP, or the actual IP of the box. While frustrating for some of the veteran users, the idea is to make it easier for the new guys coming in. They can now look at access from a higher level, and permit or deny access to a server, or host regardless of thinking about the static NAT configuration.

There is also a concept of global ACLs, if you're familiar with Modular Policy Framework, think of a Policy-map that is applied globally. So the global ACL is that you can permit or deny traffic universally, ignoring the interfaces. This is a concept available on competitors products, so Cisco wanted to support it. The traditional ACL implementation is still supported, the idea though is if you have a lot of interfaces and you want to allow access to a specific host on all of them, you can write that rule in a global ACL and not have to create the same entry on every interface. While some of this seems frustrating for the veterans, the end goal is to make our lives easier.

Smart-call-home (introduced in 8.2.2) dumps stats and config (sanitized) details to Cisco, and you can login and view details about your equipment. You can see if there are TAC advisories for your versions of code, if there are issues you can open a TAC case from there. Another fun aspect is that you're looking at spec's on the box (CPU, Memory, Interface) and can log those periodically so it's great for base-lining and if you have an issue TAC can easily see the history right there.

Upgrading to 8.3 will perform a config-conversion, meaning your CLI configuration will look completely different from how it looked prior to upgrade. There will also be a file in flash that's basically a text file that shows any errors that occured in the upgrade.(I performed an upgrade of a fairly complex configuration without any errors by the way). If you're a CLI user, it will feel like you're on a different planet, if you're an ASDM user, you may not be real sure what's different, as the look, feel,and terminology is almost identical.

Your existing config is backed-up to flash, and there is actually a downgrade command, so if you do hate it you can roll back. *note* if you do use the downgrade command, realize that you must specify the name of the file which you can find in flash. (Similar to the downgrade process that appeared when moving from 6.3 to 7.0).

As you may recall from any of my classes, you can perform a zero-downtime upgrade, by moving one ASA at a time to 8.3 from 8.2 and you can have a fail-over pair on different code, and the 8.3 is no different. This should not be used for a long period of time however, it's recommended that you move one then the other as soon as you can. While they can run side-by-side you may get a copy of the 8.3 config (completely different core commands) pushed on top of the 8.2.

You can upgrade without the memory upgrade, and the code will load, but it throws an error. As you can imagine you will be forfeiting support if you chose to do this, as when you call TAC with a problem, they're going to point this out first :)

VTP vs GVRP, the winner? Neither..

In a large network, keeping VLANs synchronized can be a challenge. Having automatic tools to ensure automatic and correct distribution of VLANs helps to reduce the chance of some of our human errors and typo's, and also just to make our lives easier :)

Two fairly well-known protocols that are capable of automatic propagation of VLAN information are: VTP and GVRP. Both protocols provide similar functionality:

1. VTP is a proprietary protocol from Cisco. Which is great for distributing VLAN information between switches, so-long as it's an all Cisco network, things are great.
2. GVRP is a standards based solution, but suffers from a less widespread support, some vendors such as Cisco do not support GVRP (only on the old CatOS)

Either can work find if you only have a single vendor of switch to manage, however in a mixed environment you will likely need a SNMP Manamagent utility that can synchronize between the two, as there doesn't seem to be a Layer-2-protcol based solution, so keep your eyes open for plug-in's for your management applications, or support within the application for VLAN synchronization.