Kudos to my bank

Brian Krebs has detailed many many occurrences of small business losing money to bank fraud; typically due to accounts being hacked from a trojan or other malware.  If you read through the articles, you'll find many mitigations to help ensure you do not lose money.

So, I was a little surprised when I received a flyer tucked into my bank account.  It contained the following bullet points:

• Maintain current anti-virus software, firewalls and malware removal tools on computers that access the internet.
• Update and "patch" your software regularly to make certain you are protected from the latest threats.
• Use unique, difficult passwords that contain a mix of letters and numbers with upper and lower-case letters.
• Never open suspicious emails or click on links within emails from unknown senders.
• Watch the URL in browser's address bar as you go to websites.  Criminals can redirect you to a counterfeit website that looks like the real thing.
• Frequently reconcile your bank accounts in order to detect suspicious account activity.
• Consider dedicating a computer specifically for online banking; one that is never used for email or web browsing.

That's a pretty good list.  I'm sure you could add to it.  I wonder if they've read Brian's site?

IPv6 deployment guides have been released by NIST

I really wasn't planning on posting anything until the new year, but this story in the SANS NewsBites prompted me to post this up.  NIST has posted a final version of its "Guidelines for the Secure Deployment of IPv6."

This has ramifications in a bunch of checklists that DoD auditors will be looking at.  From experience though, I know of many checks in the Application Security and Development checklist where this will have impact.  Specifically, you can look at: V-16781, V-6164, V-6165, V-19706, V-19707, V-19708, V-19709, V-16829, and mentioned in V-16822 and V-16836.

Merry Christmas

I saw this on Roger's blog....pretty funny.

Garfield.....Merry Christmas

This video reminds me of the legendary Dead Parrot Skit

I saw this linked on AndyITGuy's site.  Hysterical.  I've been a big Monty Python fan for a while, and this video reminded me of the Dead Parrot skit.  I hope you enjoy.

It's been a while

I looked at my last post, and was a little surprised to see that it was dated in November.  Yeesh.  It has been a very busy month and change for me.  There have been multiple trips to a particular client in order to help them ramp up security of their IP.  And, of course, the write-up of those trips.  Then, I had to write up the test results from a classified enclave....always fun when you have to write up the findings when you did not actually test the system.  It's very hard to write mitigations and rationales when you haven't seen the system and what makes it up.  And, to top it all off, I had data and a laptop dropped off on my desk from a test that occurred a couple of weeks ago.  I've only skimmed through the data, and it is incomplete at best.  From what I can gather the test was more of a dog-and-pony-show for some high up brass.

I've updated a couple of previous posts with recent pertinent information.

There may be some interesting news concerning content on the site in the coming weeks.  Hopefully I can keep my musings to a minimum and get some actual content up.

Enjoy any holiday break you might take.

Open Source Forensics

This is more a mental note than anything else.  I wrote down the address the other day, but when I looked through my news feed, I couldn't find where I saw the original announcement.  Anyway, a resource for open source forensics has been developed.


http://www2.opensourceforensics.org

I will probably compose a post on my "essential" tools at some point.

If only this were not a dream

Ovaldi initialize error

When auditing systems that run a Microsoft operating system, I use Ovaldi to find patch management issues.  (I understand it will run on *nix-based systems, but I've never tried it.)  I have it scripted out in a large script that performs other host-based scanning and configuration gathering.  Very occasionally, I'll see in my results directory that Oval did not run for a particular server.  (Typically, it is servers where I find missing results.  Rarely, I see the problem on workstations.) 

Today, I was looking through Oval documentation when I came across the following at
 http://sourceforge.net/apps/mediawiki/ovaldi/index.php?title=Installation:

Also, on some Windows systems, the OVAL Interpreter may fail with the following error message when executed.

“The application failed to initialize properly (0xc0150002). Click OK to terminate the application.”

This error message occurs when the run-time components of Visual Studio, that are required to run an application developed with Visual Studio, are not installed. If you receive this error message while executing the OVAL Interpreter, please install the VC++ redistributable package that can be obtained at the following link.

http://www.microsoft.com/downloads/details.aspx?familyid=A5C84275-3B97-4AB7-A40D-3802B2AF5FC2&displaylang=en

The VC++ redistributable package will install the required run-time components.

As a third-party auditor, I do not add the VC++ redistributable package as I do not want to introduce potentially new vulnerabilities to the system.  And, I do not want to break anything else.

Uptick in webmail spam messages

Lately, I've been receiving more and more SPAM in my inbox, and the message usually contains a single URL.  Most likely, that URL leads to a site that is heavily poisoned or makes an attempt at stealing personal information.  It's happened to some of my friends just recently and they've asked for help.  (What they've done about the issue, I do not know.)

In my limited analysis, it appears that their email accounts have been hacked, and someone/thing is using the accounts to pump out spam.  I haven't been able to do a root cause analysis, so I don't know if it is the machine that they are logging on to that is infected, or if there is another vector.  The latest article I've seen on the problem is listed here:

Hacked web mail accounts used to send spam

My response (when asked by my friends) has been to fully scan the computer with anti-virus software that has current definition files to ensure that there is nothing obvious on the system.  Secondly, change the password to the webmail account from a computer that is known to be free from malware.  From the friends that have taken this advice, I've heard good results.  But, short of fully analyzing a machine, I really don't know what's there.

Is there more to it that this?  Is there a bigger problem?  If you have any answers, leave them in the comments.

SCAP-based process

It's been a while since I posted anything.  For one, we were waiting for the fiscal year to end to see what proposals we would be awarded.  Two, after weeks of slowness, I just got back from a big audit.  It was interesting because it was as if they did not want us there.  We were holed up in a back conference room, our contacts went out of their way to ignore us, and we found lots of different machines/technologies/platforms that we were not expecting.  (At least, they didn't tell us about them before we got there.)  I know, shocking.  I don't know if it is because they don't want to pay for more work, or they are just ignorant about their network.  Granted, there was virtually no documentation, and we STILL do not have a network diagram.

While working this contract, we are working on updating our testing process.  I don't think it is a secret that DISA is getting out of the business of producing Gold Disks.  Personally, I think they want to get out of the tool development process all together.  I foresee DISA maintaining the STIGS and requirements, but I do not see them developing tools to test those requirements.  To that end, we've been working on how we will test those controls in the future; and we're looking at SCAP-based products.  We'll see how this goes.