This week is no better than the last. Hopefully I’ll be able to get these posts back on track shortly.

Here is the list:

Virtualized rootkits – Part 1 / Virtualized rootkits – Part 2 – Interesting articles on virtualized rootkits (a rather hot topic pre- and post-Blackhat)

There has been a lot of buzz around the topic of virtualized rootkits. Joanna Rutkowska has been working on a new version of Blue-Pill, her proof of concept invisible rootkit, while a team made by three prominent security experts (Thomas Ptacek, Nate Lawson, Peter Ferrie) challenged her that there is not an “invisible” rootkit, and that they were going to present at BlackHat conference various techniques to detect Blue-Pill. Federico Biancuzzi interviewed both sides to learn more.

Why IDS will be around – So IDS isn’t dead now? 🙂

OK, here’s the post I promised on why I agree that IDS is not dead and won’t be for a while. What it all essentially comes down to is reality. In theory, the way anyone’s network should be designed is in the fashion of the Core-Distribution-Access methodology.

Event Processing – Normalization – This is a very good article on event normalization and what it is exactly.

The process of taking raw input events and extracting individual fields is called normalization. Sometimes there are other processes which are classified as normalization. I am not going to discuss them right here, but for example normalizing numerical values to fall in a predefined range is generally referred to as normalization as well.

Harvard Business Review: Excellent Data Breach Case Study… – I love seeing stories like these – great info for presentations 😉

I read the Harvard Business Review frequently and find that the quality of writing and insight it provides is excellent. This month’s (September 2007) edition is no exception as it features a timely data breach case study written by Eric McNulty titled “Boss, I think Someone Stole Out Customer Data.”

Pixy – New & Free Open-source XSS and SQL Injection Scanner for PHP Programs – Another tool to add to your belt.

Pixy is a Java program that performs automatic scans of PHP source code, aimed at the detection of XSS and SQL injection vulnerabilities. Pixy takes a PHP program as input, and creates a report that lists possible vulnerable points in the program, together with additional information for understanding the vulnerability.

Analyzing a Suspect WMF File – Great article Didier!

My analysis will show that this WMF file doesn’t contain shellcode. I use a tool I discovered recently, the 010 Editor, a professional hex editor with binary templates. Binary templates allow you to define the structure of a binary file with a C-like scripting language. A binary file parsed with a template is much easier to understand, as you will see. Unfortunately, I found no free alternative for this tool.

Studnets Accidentally E-mailed Personal Information On Thousands of UIUC Students – Sigh….

University of Illinois, Urbana-Champaign officials are apologizing to students after an e-mail to 700 College of Engineering students about a new Lego Robotics class was found to contain the personal information of 5,247 students. The e-mail contained a spreadsheet that a staff member used to gather e-mail address. Along with e-mail address, the spreadsheet contained other personal information including name, major, gender, race and ethnicity, class, date admitted, spring 2007 grade point average, and cumulative GPA as well as local address and phone number. The mistake was identified almost immediately after the 7:51am was sent out. By 10:08am the University issued another e-mail to the student that received the spreadsheet asking them to delete the file and the original e-mail message. UIUC officials are meeting to discuss how to best notify the affected students.

Finding Sensitive Data as a Consultant with Nessus – Good post Ron. I’d like to see more of these that focus on using Nessus from a consultants perspective.

There are many consultants that use Nessus to scan a customer network for vulnerabilities and report a laundry list of security issues which need to be fixed. Another valuable service that can be performed by a consultant is to audit where sensitive data resides in an organization and what sort of access can be gained to it. This blog entry discusses what can be accomplished with the Nessus scanner and what additional types of data analysis can be performed with the sensitive content checks available with the Nessus Direct Feed.

Man what a week so far. It’s been so busy that I don’t have a moment to breath.

Here is the list:

CSFA Test Vouchers – You still have to make your way there but the promise of free vouchers might make it worth your while.

NewsCyberSecurity Institute will be giving away five vouchers for the CyberSecurity Forensic Analyst certification. The vouchers will be good through 2008.

Publication of Hachoir project version 1.0 – Something to check out.

Hachoir is a framework for binary file manipulation: file format recognition, metadata extraction, searching files in any binary stream (forensics), viewing file content with human representation, etc. It’s composed of many components…

UT Determines Stolen Laptop Contained Student Information – Could encryption have helped here? I think so.

While investigating the theft of a laptop stolen from the University of Toledo’s student recreation center in late June, campus police discover that the laptop contained the names and Social Security numbers on at least 30 students and an unknown number of staff members. The university began sending out letters to students and staff letting them know how to protect themselves against Identity Theft. The laptop was stolen from the office of Judith Campbell, the assistant director of the recreation center. According to Ms. Campbell, the office was locked but the door often does not always close. In addition, campus lifeguards often use Ms. Campbell’s office as a shortcut to the stairwell.

Side-Channel Detection Attacks Against Unauthorized Hypervisors – Good articles with some good visual references to drive the point home. I really enjoyed the use of Sesame Street characters 🙂

Your goal as a modern computer system is to stay as close to Oscar the Register as possible. Your goal as a modern computer system is to stay the hell away from Ernie the DRAM cell, as much as possible. Ernie is slow. That’s what Cache Monster is for.

Solaris PCI Audits and other Updates – Some additional checks to ensure your compliant between audits.

Tenable Network Security has released a Solaris audit policy for PCI 1.1 configurations. We’ve also released a new SuSE Linux best practices audit policy and have updated several others. These are all available to Tenable Direct Feed and Security Center customers through the Tenable Support Portal.

Another Presentation: Logs for Information Assurance and Forensics @ USMA – Another presentation posted by Anton. Check it out.

Here is my old presentation “Logs for Information Assurance and Forensics” that I gave at USMA, West Point last year when I was giving a lecture there.

Rubik’s cube solved in 26 moves or fewer – You paid how much for your education and your biggest accomplishment to date is solving how quickly you can solve a Rubik’s cube? Give this guy the Nobel Prize!

Northeastern Computer Science PhD student Daniel Kunkle has proven that any configuration of a Rubik’s cube can be solved in 26 moves or fewer moves. The previous upper bound was 27.

A step-by-step guide to building a new SELinux policy module – For anyone who knew what SELinux conceptually was but was afraid to implement 🙂

A lot of people think that building a new SELinux policy is magic, but magic tricks never seem quite as difficult once you know how they’re done. This article explains how I build a policy module and gives you the step-by-step process for using the tools to build your own.

Vista IR – I still have yet to install Vista but I’m starting to think I should just so I don’t fall behind.

I recently started doing some testing of IR tools on Vista, using Vista Ultimate (32-bit) installed into a VMWare Workstation 6.0 virtual machine.

Part of my testing involved running some tools on Vista to see how they worked, and another part involved mounting the *.vmdk file for my Vista VM using the latest versions of VDK and VDKWin.

In laws are in town this week, which tends to cut down on computer time. On the plus side we did get some good work done in the garage this weekend as well as install a filter in the basement for the water (still a bit leaky but my father-in-law is going to take care of that Monday)

Here is the list:

The Magical “Human Security Layer” – I’d say the “Human Layer” is by far the most important, and most likely to be exploited, layer in your enterprise.

One thing that many managers overlook is that, while login banners are necessary from a legal point of view to show some amount of due diligence, the fact is many people ignore the same message that pops up every day. That doesn’t make the employees less responsible, just less effective.

How To Configure Apt Sources.List – For Complete Newbies – With more and more people switching to Ubuntu, it’s critical that you have the proper sources for updates (and cool stuff).

So you were playing with your Apt sources.list and somehow ruined it. No matter how hard you try you cannot get it back. Every time you try to install a package you get error messages. Now what?

Don’t despair … I’ve been there and found an easy answer: The Aptitude Source-O-Matic: http://www.ubuntu-nl.org/source-o-matic/

August SRT: Security Career Success – I haven’t had time to listen to this yet but I do plan on it.

We had an excellent panel together to talk about how you can build a successful security career, with Michael Santarcangelo, Mike Murray, Dan Sweet and Ron Vereggen. Any one of these gentlemen would be an outstanding career coach by themselves, but having them all together on one phone call made for an exceptionally enlightening session. I add a little flavor as someone who’s in the middle of a job search right now. There’s a lot of good information here, whether you’ve already got a career in security or are contemplating one.

BlackHat Encore Webinar Presentation – I’ll have to see if I can make it.

A lot of people were unable to make it to Black Hat this year and asked how else they might see the presentation RSnake and I gave, “Hacking Intranet Websites from the Outside (Take 2)–”Fun with and without JavaScript Malware”. So we decided to do an encore performance webinar style. This means wherever you are in the world (relatively speaking), you can participate and perhaps ask a question of either RSnake or myself live. If you already well-familiar with all the latest and greatest attack techniques discussed here, on RSnake’s blog, and elsewhere… you won’t see much “new”. But maybe if you have an hour to kill and want to see a few demos, why not… it’s free!

How to make a website harder to hack – Jeremiah brings up a good point. When speaking with a vendor about any proposed security solution make sure you ask them “What does your product do to protect me and my network.” If you want to see them sweat while doing it ask them to explain it without using any buzzwords 🙂

I mean, that’s what web application security is all about. We know websites will never be 100% secure just like software never be 100% bug free. We also know web application hacks are targeted. All we have to do is look at CardSystems, the U.N., MySpace, CNBC, UC Davis, Microsoft UK, Google, Dolphin Stadium, Circuit City, T-Mobile, and many other incidents to figure that out. Bad guys don’t hammer away at eComSiteA then mistakenly hack into WebBankB. It doesn’t work like that. The victim is the one they’re targeting in the browser URL bar. So instead we should approach website security in terms of time and difficulty just like they’ve done for decades in physical security–with burglary resistance, fire resistance, alarm systems, etc.

IR “Best Practices” – Harlan’s back….Harlan’s back!

So, I’ve been talking to a number of different folks recently, having discussions during my travels to and fro about incident response and computer forensics. Many times, the issue of “best practices” has come up and that got me thinking…with no specific standards body governing computer forensics or incident response, who decides what “best practices” are? Is it FIRST? After all, they have “IR” in their name, and it does stand for “incident response”. Is it the ACPO Guidelines that specify “best practices”?

TJX reports a loss due to cardholder data breach – Maybe we should send them a card….or maybe some flowers? That’s really too bad 🙂

TJX is back in the news and reporting over a hundred million dollar loss due to the massive cardholder data breach.

People continually ask why they got off so easy, but as the losses continue to pile up I’m sure the CEO is asking, “why weren’t we compliant?”

Immunity Debugger v1.0 (immdbg) Release – Download it Now! – Cool. This is a great tool. Glad to see there is a 1.0 release finally.

After almost a year of intensive development and internal use, Immunity (The guys who bought us CANVAS) has announced the public release of Immunity Debugger v1.0. The main objective for this tool was to combine the best of commandline based and GUI based debuggers.