Blog
The “Less Than Zero Threat”
Interesting article (part 1 / part 2) by Alan Shimel on the concept of the “Less Than Zero Day Exploit”.
From the article:
Once a vulnerability is publicly announced, the zero-day clock starts ticking. The announcement is typically followed by some period of time before a patch is made available. This is the Zero-Day period. According to accepted wisdom, organizations face the greatest danger when an attack or exploit targeting the vulnerability is verified in the “wild.”
Some believe this is a flawed argument. As evidence, they point to “underground” vulnerabilities and exploits that are equally as dangerous and much more difficult to detect and protect against because they are “unknown.” At StillSecure we call this class Less-Than-Zero Threat. The chart below shows the relationship between the Less-Than-Zero threat and the Zero-Day threat and the level of risk they pose to the organization. It also takes into account such factors as responsible disclosure, patch deployment, etc.
The conclusion:
Zero-Day, Less-Than-Zero, patching, exploits…the world is a dangerous place. While our attention has been focused by some security vendors and the press on the Zero-Day attack, the Less-Then-Zero threat is also significant enough to warrant your attention and resources. The reason you don’t hear a lot about this type of attack is because the majority of vendors don’t have a silver bullet to sell you for solving the problem. There is still no substitute for good, old-fashioned, best practices in security.
I completely agree with Alan’s final statement. No product is a substitute for security best practices.
Malware Analysis: Tools of the Trade
Excellent information gathering by Lorna Hutcheson in this Internet Storm Center Handler’s Diary Entry. From the diary entry:
First I want to thank everyone who sent in tools for this endeavor. I hope that this list of tools continues to grow and everyone can get good use out of it. If you look at the diary entry that launched this endeavor, you will find the information that I’m looking to obtain about the tools. If you have some that need would be good to list here, please pass them along and I’ll update the list. Some folks sent in entries and checked the box not to have thier names mentioned, so there are no names by those submissions. If you want me to include your name, I’d love to, but you need to give me permission first when you submit the information. All information has been submitted as provided. If you have any additions, I’d be happy to add them!
The List:
1. Malcode Analyst Pack
• socketTool – manual TCP Client for probing functionality.
• MailPot – mail server capture pot
• fakeDNS – spoofs dns responses to controlled ip’s
• sniff_hit – HTTP, IRC, and DNS sniffer
• sclog – Shellcode research and analysis application
• IDCDumpFix – aids in quick RE of packed applications
• Shellcode2Exe – embeds multiple shellcode formats in exe husk
• GdiProcs – used to detect hidden processes
e. Is the source of the tool considered trustworthy?– as trustworthy as iDefense is 🙂
f. Screen Shots of the tool in action (optional)- there is a wmv of the shellcode logger usage on the site (link at bottom of page)
g. Links to additional resource information about the tool- N/A
2. RegMon, FileMon, Ethereal: Submitted by Ronan Rose
RegMon, FileMon and TCPView at www.sysinternals.com
- RegMon: monitors processes accessing the registry.
- FileMon: monitors processes accessing file system.
- TCPview: lets you see in real time what applications are listening on your ports.
- Ethereal: will give you a good view of what is happening on the network at a packet level.
- MSVPC: will allow you to set up a network on your PC. I have a 2.4 ghz, 60GB HD and 750 mb ram which allows me to run 3 VMs simultaneously in a LAN – server2003 to provide dns, ftp, smtp etc,
- Win2k client as Malware host and to run filemon and reg mon on, and redhat 7.2 vm to use ethereal
- In the case of malware with Regmon look for processes polling the “run” keys in the registry . You will need to exclude some processes from both tools (there is quiet alot happening under the bonnet in windows) to improve legability, but if you are still not finding your problem, remember that some malware can inject itself into legit processes, so drop any filters and start again.
- Filemon should show you any process that is systematically looking for information on your hard drive.
- TCPview lets you see in real time what applications are listening on your ports. Some of the newer malware claims to be able to defeat some of the file, registry, tcp view type apps with rootkits etc. When in doubt, check ethereal – if the network is still busy, then you are still infected!
g. Links to additional resource information about the tool-
3. Windows 2000 RAM dump parsing tools: Submitted by Harlan Carvey
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
4. Wireshark, formerly Ethereal
e. Is the source of the tool considered trustworthy? Yes, trustworthy, would run it on primary systems if needed. Open source, can compile from source code if desired. Having access to the full source code for scrutiny adds to the level of trust.
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool- Numerous links available on the Wireshark home page, www.wireshark.org
5. OllyDbg: Submitted by Vince Maes
-Analyzes complex code constructs such as call to jump to procedure
-Sets conditional, logging, memory and hardware breakpoints
-Traces execution and logs arguments of known functions.
-And lots more…
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
6. IDA Pro: Submitted by Vince Maes
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
7. Holodeck: Submitted by Vince Maes
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
WEBSITE LINKS:
1. Pedram’s site: http://pedram.redhive.com/ Submitted by Vince Maes
OSSEC version 0.9-3 (0.9 update 3) is available
OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, rootkit detection, time-based alerting and active response.
It runs on most operating systems, including Linux, OpenBSD, FreeBSD, MacOS, Solaris and Windows.
New in this release:
- Added support for Windows firewall logs
- Improved pix rules
- More named rules
- Fixed description with typos
- Fixed command line options for list_agent
- Changed logcollector behavior for checking file rotation
- Changed logcollector behavior for checking if the file has more data. We are now forcing an fgetc and looking for EOF (old method using stats was broken on some Windows versions)
- Fixed problem with Endianess on some platforms (specially Linux sparc)
- Fixed rotation issue for log files with a variable name
- Windows agent should not exit if syscheck is disabled
- Fixed alert level on e-mail messages
- Added more modsecurity rules
- Added support for HP-UX
- Added support for Microsoft FTP logs
- Added support for Microsoft Exchange logs (IIS SMTP)
- More rules for sendmail (rejected due to pre-greeting)
To download the new version:
http://www.ossec.net/en/downloads.html
More information at:
http://www.ossec.net