Is Firefoxforensics.com down? Missing? Replaced? Upgraded?

An anonymous commenter on this post mentioned that Firefoxforensics.com was down.  I've checked over the last couple of days, and the site can not be found by various browsers.  Whois says the domain is still good.  Has anyone heard if it is down for good?  Or, since Firefox is up to version 10, are there new tools replacing F3E?  I may have missed an announcement, if so, feel free to clue me in. 

Life Update

I know I haven't posted in a while.....

Firstly, I've been getting upset frustrated with DoD auditing in support of DIACAP, or whatever it is going to be called in the future.  After doing this auditing for close to four years, I see numerous problems with no clear-cut solution.  But, that is a post for another day.  I'll still post DoD IA posts, but expect to see more incident response / digital forensics posts.

While I started my post-college career in software development, specifically COBOL, I figured it was time to learn a scripting language.  Currently, I write many of my auditing tools using vbscript, however, it is not portable across multiple platforms.  After thinking about it for a while, I've decided to teach myself Python; so there could be some Python posts in the future.  Many of the open source DFIR tools that I've seen/used are either written in either Perl or Python, so it's high-time I learned one of those languages.

Finally, if there are (larger than normal) gaps in posting, it is because I am studying for my SANS GCIH re-certification.  Without realizing it, I took my GCFA class outside of the window where I could have used it for my GCIH re-certification credits.  Fortunately, I really like the material in the GCIH, and I put much of it into practice.  It's been fun to read the updated manuals and go through the DVD with new and updated software.

Ovaldi error message: missing MSVCP100.dll

I downloaded the new version of Ovaldi.exe the other day, version 5.10.1.1.  After ensuring that I had the correct definition file, I kicked off a scan on a Windows 7 machine.  Rather quickly, I received the following error message:

 

I would love to hear any ideas to solve this.  I don't see the DLL in the zipped up package, and I don't know if this is a DLL typical to Windows 7 machines.  Googling the DLL did not yield any obvious solutions.  For the time being, I rolled back to the 5.9.1 schema, but I would like to use a newer version.

February DISA and Mitre updates

I received an email the other day that DISA has released a draft of the Internet Explorer 9 STIG.  Comments need to be submitted by 21 February.

Further, while updating my Oval definitions today, I noticed two definition files I had not seen before:  XP Media Center Edition and XP Tablet PC edition.  They might have been there a while, but it is the first time I have seen them.  (And in reality, I have not come across those editions in the DoD world, yet.)

First Quarter 2012 STIG releases

Over the past couple of weeks, DISA has released their updates to various STIGs.  From what I have been able to compile, the following STIGs and benchmarks have been updated:

Windows 7 STIG Benchmark Version 1, Release 7 - Updated February 1, 2012
Draft IPSEC VPN Gateway STIG - Updated January 31, 2012
Draft IPSEC VPN Gateway STIG TIM Memo - Updated January 31, 2012
Draft IPSEC VPN Gateway STIG Comment Matrix - Updated January 31, 2012
IAVM to CVE Mapping Spreadsheet - Updated January 27, 2012
Microsoft Office 2007 STIG - Version 4, Release 6 - Updated January 26, 2012
Internet Explorer 7 STIG - Version 4, Release 5 - Updated January 26, 2012
Windows 2008 R2 DC STIG Benchmark Version 6, Release 3 - Updated January 25, 2012
Windows 2008 R2 MS STIG Benchmark Version 6, Release 3 - Updated January 25, 2012
Windows 2008 DC STIG Benchmark Version 6, Release 1.17 - Updated January 25, 2012
Windows 2008 MS STIG Benchmark Version 6, Release 1.17 - Updated January 25, 2012
Windows 2003 DC STIG Benchmark Version 6, Release 1.24 - Updated January 25, 2012
Windows 2003 MS STIG Benchmark Version 6, Release 1.24 - Updated January 25, 2012
Windows XP STIG Benchmark Version 6, Release 1.24 - Updated January 25, 2012
Windows Vista STIG Benchmark Version 6, Release 1.24 - Updated January 25, 2012
Network Firewall - Version 8, Release 9 - Updated January 25, 2012
Network IDS/IPS - Version 8, Release 9 - Updated January 25, 2012
Network Policy - Version 8, Release 9 - Updated January 25, 2012
Network Infrastructure Router L3 Switch - Version 8, Release 9 - Updated January 25, 2012
Network L2 Switch STIG Version 8 Release 9 - Updated January 25, 2012
Network Other Devices - Version 8, Release 9 - Updated January 25, 2012
RAS Remote Access Server STIG Version 2, Release 6 - Updated January 24, 2012
Remote Access Policy STIG Version 2, Release 6 - Updated January 24, 2012
Remote Access VPN STIG Version 2, Release 6 - Updated January 24, 2012
Remote Endpoint STIG Version 2, Release 6 - Updated January 24, 2012
Remote XenApp ICA Thin Client STIG Version 2, Release 6 - Updated January 24, 2012
JVAP Administrative STIG Version 3, Release 13 - Updated January 24, 2012
DoD Host Based Security System (HBSS) STIG - Version 3, Release 5 - Updated January 24, 2012
Windows 2008 R2 STIGS - Updated January 24, 2012
Windows 2008 STIGS - Updated January 24, 2012
Windows 2003 STIGS - Updated January 24, 2012
Windows 7 STIGS - Updated January 24, 2012
Windows Vista STIGS - Updated January 24, 2012
Windows XP STIGS - Updated January 24, 2012
Gold Disk (*PKI) - Updated January 23, 2012
zOS STIGS - Updated January 23, 2012
zOS STIGS (*PKI) - Updated January 23, 2012

Funny keyword search results

This cracked me up.  A friend of mine is doing a forensics analysis of a laptop that belonged to a software developer in a company.  He was told to do a search for suspected pornography on the machine, and to include the actual word "porn."  What came back in the search?

XPorNewer

Command Cyber Readiness Inspection

In the coming weeks I will be traveling to a base in order to help them prepare for a Command Cyber Readiness Inspection.  I have never participated in one of these, typically I am auditing a system for certification efforts.

As far as I understand, DISA picks the unit/system that is undergoing the inspection.  There are a series of checklists that they will use and that must be completely filled out.  It also appears that they will Retina scan the entire system.  In addition to helping the unit prepare by running a "pre-audit" we will be ensuring that documentation is complete and up-to-date.  Our only "true" deliverable will be a POAM so that the unit knows what they need to fix or update before the actual inspection takes place.

I would be interested in hearing more about the mechanics of a CCRI; who gets selected, why, etc.

Sharepoint 2010 and Apache STIGs have been released for January 2012

I received an email that DISA has released the Sharepoint 2010 and Apached Web 2.0 and 2.2 checklist for Windows and UNIX.  The requirements for both of these STIGS are effective immediately.

Tr3Secure Data Collection script

The other day, I saw a post on Corey's blog (Journey Into Incident Response) that was really cool.  He released a script that quickly grabs volatile information from a possibly compromised machine.  His post documents the why's, the tools, and the framework of the tool; so I'll let you read the post rather than summarize.

What I'll add is that this script does a lot of great things.  I pulled down the dependencies and started testing the script out on some of our test laptops.  The laptops that I've used have been a mix of Windows XP and Windows 7 machines with various amounts of RAM.  The script has run quickly, and efficiently formats the output for analysis after the fact.  Some of the tools I was familiar with, and there were some new tools there that I will give further study to.

I will be using this script (as I get more familiar with it) on machines that I receive when collection of volatile data is paramount.  Further, after learning some new tools, I will be incorporating some of the methodologies into DoD auditing.  Certainly, I see the potential to replace some of the WMI calls I use when grabbing information from machines we are auditing due to improved output.

Another plus I see in the usage of this script is that the script runs from a .bat file.  Most of my scripts have made heavy use of cscript/wscript; and I've found that cscript/wscript is not installed on all machines.  Batch files tend to run on all machines.

IAVM matched with CVE

I see that DISA has released a spreadsheet matching IAVMs to their corresponding CVE numbers.  This will be handy when you are matching patch findings with their CVE number.

You can find the spreadsheet here.