Network forensics puzzle #5

Puzzle #5 is out. I'm going to get started on figuring it out.

"An error occured in avast! engine: Invalid argument"

This annoying message popped up after I ran the update in avast! in Ubuntu yesterday. avast! crashes every time I attempt to launch it after that. Did some googling and someone suggested deleting a file called "400.vps" in the ".avast" folder. I did just that and avast! was able to launch again. However, the same error occurs immediately after the virus definition update is performed. There is an error with the signature file. Hmmmmmm. What happened to quality control nowadays?

Update: I resolved the update issue. Run the following command.

commandrine@bridge:/$ sudo sysctl -w kernel.shmmax=128000000
kernel.shmmax = 128000000
commandrine@bridge:/$

I combined this command and the avast! update command together in this script to simplify matters. You no longer need to launch the avast! GUI to start the update. Download it here.

Justified

Adobe Reader is officially the most exploited software. My decision to remove Adobe Reader from my machines years ago is now fully justified and not a choice out of paranoia. In 2nd place is Microsoft Word which is also not installed on any of my systems at home.
A case of security by obscurity? Why do soldiers wear camouflage when they can be killed by weapons of mass destruction?

Kon-Boot

I have demonstrated password reset and cracking of Windows passwords before. I won't even bother demonstrating resetting of Mac OS X passwords because it is so trivial. Lame Apple ships a password reset utility with their Mac OS X installer DVD. DUH!!!
Kon-Boot is a powerful tool that gives you root privileges on Linux and administrator rights on Windows without needing to crack or know the admin password.
In my demo, I burnt Kon-Boot as a bootable disc and booted up my Linux system with it. Kon-Boot modifies my Linux kernel and permits me to gain root access just by entering "kon-usr". I run the "whoami" command to prove that I am logged in as root without entering the root password.

The high res version of this demo can be downloaded here.

Information overload

I always preach about the dangers of revealing too much information. I like this article because it provides a simple example to reinforce my point. Discretion is the key.
Researchers develop a Proof-of-concept attack that uncovers the identity of web surfers based on their social networking activities.

The economics of malware

Interesting read about the driving force behind malware writing and distribution.
Whilst we are on the topic of malware... malicious PDF installs backdoor on victim’s system and dials home to Singapore hosted server*. Nice!!!
Anyone wants to call Alan to give him the bad news?

* First came across this cool story on werew01f's blog.

Network forensics puzzle #4

Puzzle #4 is out. I've been pre-occupied and exhausted by work thus the delay in posting my answers for puzzle #3.
The answers for the first 2 answers were straight forward enough.
1) 00:25:00:fe:07:c4
2) AppleTV/2.4

The search terms (ie. questions 3 and 8) were a bit tedious to find manually by combing through Wireshark but easier in NetworkMiner. Alternatively, searching using "ngrep" on Ubuntu was pretty painless. The 2 movies that Ann clicked on are also listed in NetworkMiner.
3) h, ha, hac, hack
4) Hackers
6) Sneakers
8) iknowyourewatchingme

Answers to questions 5 and 7 courtesy of NetworkMiner.
5) http://a227.v.phobos.apple.com/us/r1000/008/Video/62/bd/1b/mzm.plqacyqb..640×278.h264lc.d2.p.m4v
7) $9.99

HTTP session reconstruction

Been wanting to attempt to reconstruct HTTP sessions captured in Pcap files. Stumbled across this tool called "PyFlag". They have this amazing script to automatically download, install and set up "PyFlag" on Ubuntu. It was painless to get up and running. I managed to load Pcap files to "PyFlag" for analysis but wasn't able to reconstruct the HTTP sessions.
I researched for other tools and found "Unsniff". Worked like a charm!!!

Latency

Antivir is a powerful AV with its heuristic detection of malware. I gave up on it because of the ridiculous time it took to update. I replaced it with Microsoft's "Security Essentials".

Network forensics puzzle #3

New network forensics puzzle is out. Inline with contest rules, I can't post my answers till the deadline is over.

Cookie manipulation

I demonstrated cookie hijacking previously but never elaborated about how the stolen cookie can be used.
To make use of stolen cookie information, the session must still be active for cookie manipulation to be successful. Here I manually add cookies using the "Web Developer" Firefox addon to successfully access an active Gmail session.

The high res version of this demo can be downloaded here.