Security Republic

Anti keylogging

Came across a Firefox add-on called Keyscrambler Personal. It is a free software that secures keystrokes entered into IE, Firefox and Flock browsers. Like my SANS forensic trainer said, this "warrants further investigation". Never take the vendor's/author's word until you verify it for yourself.
I installed a keylogger on my virtual machine. I capture my keystrokes entered into Firefox with Keyscrambler turned off. The Gmail URL I typed as well as my credentials are captured in the keylogger log. I enable Keyscrambler and enter my credentials at the Gmail login page again. This time, Keyscrambler prevents the keylogger from recording my keystrokes.

The high res version of this demo can be downloaded here.

RAT brute forcing dead?

Is Remote Administration Tool (RAT) brute forcing dead? I tried brute forcing RDP and VNC recently to no avail. Rdesktop and Medusa were rendered useless against security mechanisms built into Remote Desktop and VNC.

The high res version of this demo can be downloaded here.

Brute forcing (in 2006) used to be so easy. Tsgrinder was the tool of choice against systems with RDP enabled.

The high res version of this demo can be downloaded here.

Have M$ and VNC added mechanisms to make RAT logins more secure? Or is brute forcing no longer in vogue with hackers and pentesters to release updated versions of their tools?

Security lab

A lab is a must for any security professional to test out tools, configurations and hacks. My lab setup is made up of:

Linksys router
Linksys hub
Desktop (Windows+Vmware)
HP Compaq laptop (Windows+Vmware)
Thinkpad (Ubuntu)
Macbook (Mac OS X+Windows)

A simple setup comprising of old personal equipment, donations and 2nd hand purchases. I hope to expand this lab when budget permits and if more donations come in.

Nmap on Ubuntu

Quick and easy way of installing Nmap on Ubuntu 9.04.

commandrine@bridge:~$ sudo apt-get install nmap
[sudo] password for commandrine:
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
nmap
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 1187kB of archives.
After this operation, 4502kB of additional disk space will be used.
Get:1 http://sg.archive.ubuntu.com jaunty/main nmap 4.76-0ubuntu4 [1187kB]
Fetched 1187kB in 2s (571kB/s)
Selecting previously deselected package nmap.
(Reading database ... 102801 files and directories currently installed.)
Unpacking nmap (from .../nmap_4.76-0ubuntu4_i386.deb) ...
Processing triggers for man-db ...
Setting up nmap (4.76-0ubuntu4) ...

commandrine@bridge:~$

Run the following command to perform software upgrades.

commandrine@bridge:~$ sudo apt-get upgrade

Firewall hack

Ever encountered a system where the group policy prevents you from enabling the firewall? Sounds lame and ironic but it happened to me. I feel naked and insecure without a host-based firewall so I had to figure out how to crack the policy and turn on the firewall.
Hack to enable Windows Firewall. Here are the instructions.

Click "Start" then "Run". Type in "regedit".
Back up your registry by clicking "File" then "Export".
Drill down to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\" and delete the key "EnableFirewall".
Drill down to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\" and delete the key "EnableFirewall".
Reboot Windows, login and turn on Windows Firewall.

Viola!!!

Nouseragent

Paros Proxy is a pretty nifty proxy tool for application security testing. I use it frequently to intercept interactions (ie. requests and responses) between my browser and sites I want to scrutinise. What I didn't realise was that Paros would attach its name to the User-Agent header when submitting my browser's requests. This is not desirable if you want to avoid hackers being alerted to your interactions with their compromised site.
To counter this, the User-Agent header has to be modified before sending out the request traffic. The permanent solution is to instruct Paros to stop adding its name into the header by adding the switch "-nouseragent" after the Paros command.
Thanks to w01f for this tip.

Innocent???

U-Toys is one of my toy suppliers. I recently bought my Green Lantern action figure from them. I didn't know their website address so I decided to google it. Hmmmmmm? My Firefox plugin, Finjan SecureBrowsing, flagged malicious activity on this site.

Better play it safe. I fired up my Virtual Machine and proceeded to the site. Pop-ups blocked by Firefox but either wise nothing suspicious happening.

How about I try allowing the pop-ups? Lo and behold!!! A strange file mysteriously appears in my root directory. Submitted this executable file to VirusTotal and it was discovered to be a Trojan. Scary isn't it? Only 9 out of the 40 hosted AV engines detected it as malware. My hypothesis is that the hacker injected the banner ads into the website. The ads point to another site that drops the Trojan onto the victim's machine.

I ran through the same sequence again... this time on another machine with Antivir AV engine installed and updated. Antivir was able to block the malware from being injected using its heuristic scanner. Powerful!!! The Trojan's filename is randomly generated btw because the filename keeps changing when I repeat the injection multiple times.
I've contacted my toy supplier but he is unwilling to take down the site and doesn't know how to rectify the problem. I've offered my security consulting service in exchange for toys but was turned down. Out of goodwill, I offered a few remediation options but he rejected them.
Morale of the story? Be wary when surfing the dangerous web... you never know which site hosts malicious content no matter how innocent it looks.

File carving

File carving (aka carving) is defined as "the practice of searching an input for files or other kinds of objects based on content, rather than on metadata... for recovering files and fragments of files". The input from a digital forensic perspective is either an image of a disk or packet dumps.
Foremost is the tool of choice for forensic analyst wanting to recover evidence from disk images. tcpxtract is a tool designed for extracting files from captured network traffic. I installed tcpxtract onto my Ubuntu 8.10 system. I captured the packets of an FTP session where I transferred an image from one host to another. I ran tcpxtract against the pcap file to extract the said transferred image. Viola!!!

The high res version of this demo can be downloaded here.

Infected?

I've encountered systems that were so badly infected that the OS could not boot up properly. In most cases, I would recommend a full wipe before reinstalling the OS but there may be critical data still resident on that drive. That is where a rescue CD might be useful. F-Secure and Avira are 2 AV vendors that offer free rescue CDs for that purpose.
I tested the F-Secure rescue CD. You basically download their ISO file from their website, burn the ISO into a bootable CD and boot up the infected system from the CD. The bootable Linux OS has a built-in F-Secure AV engine that will prompt you to update its virus detection signatures*. Next, you choose the drive/partition to scan. It will start scanning the selected drive/partition and rename files detected as malware (by adding .virus).

* You need to have Internet connectivity to obtain the latest virus detection signatures.
The high res version of this demo can be downloaded here.

Dban

Dban is a utility that permits you to securely wipe the contents of entire hard drives. You can use it to wipe data off the corporate laptop that you are returning to your employer, a hard drive that you plan to dispose off or your hard drive that you plan to reinstall the OS on because it is infected with malware. You can download the CD, DVD, diskette or USB flash drive versions for whatever your needs.
Boot up using Dban. When you see the menu, type in "autonuke" at the boot prompt. This is the easiest mode to use. Once you've pressed "Enter" key, Dban goes about its business and does not require any further interaction from the user. Viola! Simple as ABC. Patience is required as wiping is not a speedy process. Time taken to wipe a whole drive varies depending on the wiping method selected and the size of the drive.

For advanced users, you may opt for other wiping methods by pressing on "F3". The DoD 5220.22-M method and the Gutmann* methods are quite time consuming.

Active computer forensic guru conducted independent research and arrives at the conclusion that a single drive wipe makes data impossible to recover.

* From personal experience, Dban took 2 days to wipe my 40GB hard drive using the Gutmann method.

TKIP vs AES

Almost everyone I know deploy wireless networks at home and I'm not surprised because wireless is convenient. What wasn't explained to them by vendors is that wireless is less secure and reliable as compared to wired connections.
Reliability isn't high on the list of priorities for home users but security should be. I just found out what the difference between TKIP and AES encryption options was. TKIP was offered as a short-term solution to improve upon the weak security offered by WEP. AES is the more robust and preferred choice. However, older hardware may not offer AES because it requires more resources for cryptographic computations thus some vendors make their equipment backward compatible with TKIP.
Utilise AES when using either WPA or WPA2 in your environment. However, AES is not supported by all hardware and users might still be forced to rely on TKIP. In light of hardware limitations, the workaround solution is to lower TKIP renewal timings to any value lower than 120 seconds.