Back from vacation

So, as I mentioned in the previous post, I'm back from vacation.  I read a good book, and took some time to flesh out where I seem to be headed.  Vacation gave me a chance to look at the big picture and work out some of the issues I see in various career paths.  I really don't know where the government job is headed; I know where it is supposed to be headed.  But I fear what the company is doing is not enough, and I think we are losing out on contracts we should be winning  A year from now, will the company still be here? I suspect "yes" but I'm not sure our division will.  At least, if it is, I'm not sure that it will look anything like it does now.

So, I've been putting in extra hours with my own company.  I've joined a different Chamber of Commerce, one that is more local; and I hope to derive more business from the people I know.  I prefer to run my own business, as it gives me more pleasure.  Sure, there are more pressures, but I'm pushing to build the client base such that I can be more reliant on my own business.

Tomorrow, it will be back to the grind.  At least I have a clearer head. And we'll see where this all goes.

A mini-review of Ninja Hacking by Wilhelm and Andress

I have just come off a vacation where I tried to disconnect from being overly technical.  Typically, on my breaks I read technical books to enhance something I know or I read something in-depth to learn a new skill.  This past week, I wanted something relevant, but not overly technical.  I saw an ad for "Ninja Hacking:  Unconventional Penetration Testing Tactics and Techniques" by Thomas Wilhelm and Jason Andreas, and decided this fit the bill perfectly.

To start off, let me say that the book is aptly named.  The use of the word "ninja" is not just used as the adjective to describe a good coder or pen tester; all of the concepts in the book relate to the ancient ninja of feudal Japan.  The point of the book is to introduce concepts of penetration testing with the arts and practices of the ninja.

So, here is what I liked:  First, the book devotes the first two chapters to the history of the ninja in Japan.  I can honestly say that prior to reading those two chapters, my concept of ninjas was what Hollywood depicts in movies.  The first two chapters shed light on what the ninjas were really like, how they operated, why they were necessary, and what tools the ninjas had at their disposal.  Succeeding chapters took those tools and applied them to how penetration testers should think differently to accomplish their goal.  I really liked the discussion on strategies and tactics.  Some of the examples given to disrupt a system administrator were:  call them at 2 A.M. with a trouble ticket, send them an email from HR with an issue about their insurance, or leave a note on their car that they have parked in the wrong space.  Good stuff.  All of those are activities that will have someone thinking differently when they should be paying attention.

Also, the chapters might have discussed various tools and methodologies, but not at a low level.  For example, the chapter on discovering weak points in area defenses had a discussion on sniffing network traffic.  In the discussion Kissmet and Wireshark were both discussed, but only to introduce the tools to the reader (if they did not know of them) and provide the reader with the resources to learn more about them.  Each chapter had a page of end notes that included links to tools, articles, and other references for further study.

A couple of issues I found:  the title of the book includes "unconventional penetration testing tactics..." and to me, penetration testing refers to systems, networks and applications.  I understand that a target may be a building or a person.  Many of the chapters discussed the latter, buildings and people and did not necessarily apply to computers.  There was a section of the book that discussed torture; and while interesting, is not something I'll be employing.  There was a section in the chapter on discovering weak points called "Gates, Guns, and Guards."  While these are valid security concerns, I don't think they come up in your average day-to-day penetration test.  However, the authors extrapolated the scenarios to the logical (cyber?) world and created successful analogies in how to employ the tactics to the computer or network. 

Overall, I enjoyed the book.  It opened me up to thinking of different ways to conduct penetration tests and employ some tactics I would not have thought of.  I really enjoyed that the book was not overly technical such that I read through and jot down areas for further exploration.  And, I liked the chapters on the history of the ninja as I could dispel some of the Hollywood myths and legends for what the ninja truly were.

Does your email address password need to be changed?

I was going through my newsfeed today when I happened upon a post from Naked Security. The post discussed a site set up by Daniel Grzelak where you could check your email to see if it had been posted as a result of the various recent break-ins.

From the Naked Security Post:

Daniel doesn't store your email address after you've looked it up - so he can't spam you even if he wanted to, which he doesn't - and he's not accumulating a list of email addresses which spammers might like to break in and steal. And he doesn't keep any of the stolen databases on his server, so he's not offering a handy-to-hack repository for unlawfully-acquired loot, either.

To check your email address, go to:  https://shouldichangemypassword.com.

New HP-UX and Android STIGs released

DISA has released a draft version of the Android 2.2 and HP-UX 11.23 STIGs.

A meeting for the Android STIG has been set for June 30, 2011.

Using a .audit file with Nessus to scan a host

I've created this post because I couldn't find detailed directions.  Here's what took me down this path.  Auditing Windows 7 machines is a laborious task; there is no easy way to do it without sitting down with the DISA checklist and going through each check one by one.  As we move to SCAP-based tools, we should be able automate this; either by using OVAL and an XCCDf file, or using Retina and the XCCDF wizard.  I've started playing around with both of those methods, and I'm not 100% there yet.  I get them to run, but the results are not exactly what I expect.

One of my co-workers asked me about i2a, a utility put out by Tennable that converts .inf files to .audit files to use with Nessus.  (By the way, as I understand it, i2a only works with the professional version.  Audit files work with both the professional and free versions.)  If you look in the Windows 7 STIG, the templates folder contains .inf files. 

I copied the .inf file to the directory containing i2a. My command to create an .audit file was:

i2a-2.0.4 U_FSO_Win7_Analyze_only_V1R4.inf Win7.audit

This ran, and there were a few errors in the log file.  I believe that Nessus can not perform some of the checks in the .inf file, so they are flagged.

Next, I opened up Nessus.  Then, I created a new Policy:  Click on Policy, Add.
I gave my scan a name, Win7, checked my options, added my credentials, checked my plugins, then clicked on preferences.  Under preferences, I picked the Windows Compliance checks.  Then, I browsed for my Win7.audit file and added it as Policy File #1.

After this, it was as simple as setting up a new scan and using the policy I just created.  I'm going to start looking at the results to see how good a job Nessus does, and what needs to still be looked at manually.

Microsoft Active Directory STIG version 2, release 1 released

I received notification that an updated has been released for the Mircosoft Active Directory STIG has been released.  However, in looking at DISA's site, I still see a March 25th date.  I'll update this post when I find the current updates.

Draft Microsoft Office 2010 STIG version 1, Release 1 has been released

I was cruising DISA's site looking for other guidance when I saw that a draft version of the Microsoft Office 2010 STIG has been released; version 1, release 1. 

I notice in the overview document that the guide is based on Office 2010 installations within the Windows 7 operating system.

The comment matrix has also been posted for any comments to be made on the documents.

Review: How to Break Web Software by Andrews and Whittaker

I haven't had to travel much over the last couple of weeks, which has been good for me in that I get to work on my reading list a bit.  I picked up "How to Break Web Software" for a trip a little while ago, and never got to the book.  Not having to travel coupled with the long weekend gave me some time to read and digest this book.  Here are a couple of things that I really liked about this book:

• I really liked the table of regular expressions that is included in chapter 2.  To me, this is great because after I have retrieved source code, I can script out exactly what I'm looking for; especially hidden fields.
• I liked the fact that the CD contained some older software that is not easily found on the web.  While the functionality of some of these tools is rolled up into newer software, there are times that I want to perform just what these tools do, and nothing more.  HttpPrint is highly useful to me as there are plenty of times I get on site and the client either doesn't know what they have, or doesn't want me to know all that they have.  SSLDigger is great for letting the client know how strong their SSL is.
• The book includes its own vulnerable web application where you can practice some of these attacks.
• I liked the chapter on Web Services.  More and more, I'm running into web services, and while some of the more advanced tools cover the services, it is good to have a primer on the various technologies involved.

Overall, I enjoyed the book.  In my estimation, the material is basic, and gives a great jumping off point for someone getting into testing/breaking web applications.  With the tools, a reader can dive into the material, practice, and really start to get a foundation for breaking web applications.

DISA guidance with regard to cross-site tracing?

I've been doing some reading concerning different ways to test applications, and more specifically, web applications.  The last couple of books have mentioned cross-site tracing, and how to test to see if the server could be vulnerable.  We use WebInspect on many of our tests, and I know I have seen the vulnerability come up.  But that got me thinking:  where does DISA./DoD talk about configuring the web server to turn off TRACE?  I looked through the Apache STIG (both 1.3.x and 2.x) and the IIS STIG (both IIS 5 and 6.)  I did not find any mention of the TRACE verb and how the server should be configured in the DoD's eyes.  Further, I looked in the Application Security and Development STIG, and I did not see a finding/check in that STIG either.  (I did not expect to, since the finding really is a function of the server, and not the application.)

The closest the Application Security and Development STIG comes is a discussion in the finding for cross-site scripting.  There are three checks within the cross-site scripting finding that deal directly with cross-site scripting.  The fourth check specifically discusses the HttpOnly flag being set on cookies.  However, what makes cross-site tracing a bigger risk is that it has the ability to read/steal/reveal cookies even if the cookies have the HttpOnly flag set.

A great paper on the attack is here.

So, am I missing something in a STIG or checklist?  Or, is there really no guidance on web servers for the TRACE verb?

Sony Security Timeline

I don't have an iron in the fire, however I wanted to track how this story plays out; mostly so I could refer back to the timeline.  The poll on Slashdot the other week got me thinking about the various security issues Sony has faced over the past couple of years.  So, I briefly compiled this list.  I'll update it as it plays out. 

10/31/05 - Sony BMG copy protection rootkit scandal
Mark Russinovich's blog posting

2/9/11 - Sony Retweets the PS3 key
FuriousFanboys article

4/17/11 - Sony PlayStation Network hacked
Wikipedia article

5/20/11 - Phishing site found on a Sony Thailand server
F-Secure posting

5/22/11 - Sony BMG Greece hacked
Sophos posting

5/25/11 - SONY Ericsson Canadian e-commerce site
Sophos posting

6/2/11 - Sony Pictures
ISC posting

6/4/11 - Sony Europe
Zero Day posting

6/6/11 - Sony Computer Entertainment Development Network
The Epoch Times

6/9/11 - Sony Portugal
Naked Security

I must have missed a bunch, because this article mentions the 20th breach:
6/20/11 - Sony Pictures France
Forbes

7/5/11 - Sony Music Ireland
Naked Security


edit:  5/25/11 - add the Canada hack
6/3/11 - add Sony Pictures
6/6/11 - added Sony Europe
6/7/11 - added Sony Computer Entertainment Development Network
6/9/11 - added Sony Portugal
6/20/11 - added Sony Pictures France
7/5/11 - added Sony Music Ireland