The number of websites spreading badware (spyware, malware, and deceptive adware) is rising in an alarming rate; in many cases, the websites are otherwise victims of malicious hacking. Badware is malicious application that tracks your online behavior and pumps that information back to insincere marketing groups so that they can assail you with targeted ads. stopbadware.org is an education nonprofit backed by Google, Lenovo, Sun Microsystems - "neighborhood watch" campaign aimed at fighting badware while providing reliable yet objective information about downloadable applications to help web users make better choices about what they download onto their computers.
In other had spybye.org which is a low interaction client honeypot developed by Niels Provos allows to determine whether a web site is malicious by a set of heuristics and scanning of content against the ClamAV engine. This tool is comes very handy for web masters to determine if their web pages are carrying browser exploits that can infect visiting users with malware. It functions as an HTTP proxy server and intercepts all browser requests. SpyBye uses a few simple rules to determine if embedded links on your web page are harmlesss, unknown or maybe even dangerous.
SpyBye operates as a proxy server and gets to see all the web fetches that your browser makes. It applies very simple rules to each URL that is fetched as a result of loading a web page. These rules allows us to classify a URL into three categories: harmless, unknown or dangerous. To try SpyBye, configure your browser to use www.spybye.org:8080 as proxy server and then go visit http://spybye.org/. If you see that a URL is being fetched that you would not expect, it's a good indication you have been compromised.
Wednesday, May 30, 2007
Monday, May 28, 2007
Sometimes in April
"In the end, we will remember not the words of our enemies, but the silence of our friends." -- Martin Luther King, Jr.
Sometimes in April - One of the emotional yet disquieting movies I have ever watched; based on true events of gruesome Rwanda genocide which compliments Terry George's Hotel Rwanda (Nominated for 3 Oscars - Another 12 wins & 26 nominations).
It happened in April 1994, arguably what happened within 100 days from April is one of the most heinous genocides in world history began in the African nation of Rwanda. Over the course of 3 months, close to 900,000 to one million people were slaughtered in a terrifying cleanse by Hutu majority against their Tutsi minority.
After watching both movies I was compelled to dig more about facts regarding the unfortunate event.
After the arrival of Belgian colonists in 1916, they separated Hutus and Tutsis in to distinct entities, and even produced identity cards classifying people according to their ethnicity. Belgians considered the Tutsis as superior to the Hutus and empowered them as well as given jobs and educational opportunities than Hutu's. Resentment started among majority, culminating series of riots in 1959 - more than 20,000 Tutsi's killed, many more fled to neighboring countries. Three years later Belgium relinquished power and granted independence and Hutus took their place.
From that point Tutsis were portrayed as the scapegoat for every disaster. Tutsis who fled to Uganda as refugees - supported by moderate Hutus formed Rwanda Patriotic Front (RPF) to overthrow the Hutu president `Habyarimana` and to secure their place in the homeland. After collapse of scattered peace accord things continued in disarray.
In April 1994, president Habyarimana's plane was shot down by a rocket resulting complete unrest and the consequence was both instant and catastrophic. Within hours of the president's death, presidential guard mobilized a militia group backed by radio propaganda, 8,000 Tutsis including moderate Hutus were slaughtered. By the early July nearly one million were butchered. Rwandans were largely left alone by the international community after the murder of 10 UN soldiers. In the movie, militia leader was talking to UN head regarding international community intervention - he said "In Rwanda we don't have Oil nor Diamonds why do you have to come down and involve?" Arguably in most places US-UN intervention backed by huge political interest. Classic example is Iraq; would US search for mass-destruction in Iraq if they're just another developing country with lower GNP? Norwegians intervened to mediate Sri Lankan conflict after inhaling oil from un-cleared Mannar Sea. Why do they find it difficult to differentiate freedom-fighters Vs. Terrorists? Isn't it amusing that there is no internationally recognized definition for Terrorism?
I will leave it for another post…anyways after 100 day massacre (from April to July), RPF captured Kigali (Capital of Rwanda) and declared ceasefire. As soon as it became RPF was victorious, an estimated 2 million Hutus fled to Republic of Congo (then Zaire). In Rwanda UN troops and iNGOs arrived to restore the normalcy. On july 19, new multi-ethnic government was formed and majority of cabinet posts were assigned to RPF members.
Long and arduous search for justice went on and on; about 500 people have been sentenced to death and more than 100,000 are still in prison but some of the ring leaders managed to escape. Still today many who lost their loved ones are still waiting for justice.
Sometimes in April - One of the emotional yet disquieting movies I have ever watched; based on true events of gruesome Rwanda genocide which compliments Terry George's Hotel Rwanda (Nominated for 3 Oscars - Another 12 wins & 26 nominations).
It happened in April 1994, arguably what happened within 100 days from April is one of the most heinous genocides in world history began in the African nation of Rwanda. Over the course of 3 months, close to 900,000 to one million people were slaughtered in a terrifying cleanse by Hutu majority against their Tutsi minority.
After watching both movies I was compelled to dig more about facts regarding the unfortunate event.
After the arrival of Belgian colonists in 1916, they separated Hutus and Tutsis in to distinct entities, and even produced identity cards classifying people according to their ethnicity. Belgians considered the Tutsis as superior to the Hutus and empowered them as well as given jobs and educational opportunities than Hutu's. Resentment started among majority, culminating series of riots in 1959 - more than 20,000 Tutsi's killed, many more fled to neighboring countries. Three years later Belgium relinquished power and granted independence and Hutus took their place.
From that point Tutsis were portrayed as the scapegoat for every disaster. Tutsis who fled to Uganda as refugees - supported by moderate Hutus formed Rwanda Patriotic Front (RPF) to overthrow the Hutu president `Habyarimana` and to secure their place in the homeland. After collapse of scattered peace accord things continued in disarray.
In April 1994, president Habyarimana's plane was shot down by a rocket resulting complete unrest and the consequence was both instant and catastrophic. Within hours of the president's death, presidential guard mobilized a militia group backed by radio propaganda, 8,000 Tutsis including moderate Hutus were slaughtered. By the early July nearly one million were butchered. Rwandans were largely left alone by the international community after the murder of 10 UN soldiers. In the movie, militia leader was talking to UN head regarding international community intervention - he said "In Rwanda we don't have Oil nor Diamonds why do you have to come down and involve?" Arguably in most places US-UN intervention backed by huge political interest. Classic example is Iraq; would US search for mass-destruction in Iraq if they're just another developing country with lower GNP? Norwegians intervened to mediate Sri Lankan conflict after inhaling oil from un-cleared Mannar Sea. Why do they find it difficult to differentiate freedom-fighters Vs. Terrorists? Isn't it amusing that there is no internationally recognized definition for Terrorism?
I will leave it for another post…anyways after 100 day massacre (from April to July), RPF captured Kigali (Capital of Rwanda) and declared ceasefire. As soon as it became RPF was victorious, an estimated 2 million Hutus fled to Republic of Congo (then Zaire). In Rwanda UN troops and iNGOs arrived to restore the normalcy. On july 19, new multi-ethnic government was formed and majority of cabinet posts were assigned to RPF members.
Long and arduous search for justice went on and on; about 500 people have been sentenced to death and more than 100,000 are still in prison but some of the ring leaders managed to escape. Still today many who lost their loved ones are still waiting for justice.
Friday, May 11, 2007
Run any Linux flavor from a USB Flash without Re-booting Windows
My favorite bootable Linux live-systems are KNOPPIX and BlackTrack, both pretty handy and I would recommend to any Security aficionado. Both primarily designed to be used as a live CD, but to run from hard disk or USB flash disk is a quite a messy task.
I really wanted to carry a secure OS where I can whack in to any public computer and run all my SecTools. It is always handy whenever you travel without your laptop; imagine you could carry your operating system, files, e-mail, personal settings, and favorites in your pocket - all you need to do is just whack the USB in a Windows/Linux PC and run your favorite Linux in another Window!
Let's fold the sleeves; it's pretty straight forward. All you need to do is download Qemu and a copy your favorite Linux CD (ISO) Image. Qemu is a generic and open source machine emulator and virtualizer. You can find all supported CPUs here. Extract the downloaded .zip file to a folder on your flash drive and copy your favorite Linux ISO image to the same. Typically an ISO image is big as 700MB, so you may need minimum of 1GB flash drive. But don't be disheartened if you got a 128MB one, try Damn Small Linux - everything is in a 50MB ISO. Once you have the ISO image it's only a mouse click away, run the StartLinux.bat file - you will be surprised.
I found the booting up process is bit slow and also found a driver allowing a Qemu to run x86 code in a Virtual Machine. It's called Qemu Accelerator. That's bonus and surely will speed up your Linux on XP experience. Extract all files in tar.gz file in to your Qemu folder and right click on the kqemu.ini file and select Install. Once you install the accelerator as a windows service, make sure you start it by ` net start kqemu` prior to running StartLinux.bat.
Have fun!
I really wanted to carry a secure OS where I can whack in to any public computer and run all my SecTools. It is always handy whenever you travel without your laptop; imagine you could carry your operating system, files, e-mail, personal settings, and favorites in your pocket - all you need to do is just whack the USB in a Windows/Linux PC and run your favorite Linux in another Window!
Let's fold the sleeves; it's pretty straight forward. All you need to do is download Qemu and a copy your favorite Linux CD (ISO) Image. Qemu is a generic and open source machine emulator and virtualizer. You can find all supported CPUs here. Extract the downloaded .zip file to a folder on your flash drive and copy your favorite Linux ISO image to the same. Typically an ISO image is big as 700MB, so you may need minimum of 1GB flash drive. But don't be disheartened if you got a 128MB one, try Damn Small Linux - everything is in a 50MB ISO. Once you have the ISO image it's only a mouse click away, run the StartLinux.bat file - you will be surprised.
I found the booting up process is bit slow and also found a driver allowing a Qemu to run x86 code in a Virtual Machine. It's called Qemu Accelerator. That's bonus and surely will speed up your Linux on XP experience. Extract all files in tar.gz file in to your Qemu folder and right click on the kqemu.ini file and select Install. Once you install the accelerator as a windows service, make sure you start it by ` net start kqemu` prior to running StartLinux.bat.
Have fun!
Tuesday, May 8, 2007
It's a Boy!
I received a SMS from Duminda around 5ish in the morning saying "Thanuja gave a Birth to a Baby Boy." I jumped off the bed with excitement and called my friend to pass on my good wishes. During the last week I called him twice to confirm the expected date of confinement, when I rang I seldom felt any excitement yet ordinary as usual. That's him! He told me that both Thanuja and new born are doing well. I was so touched when he told me that I'm the first person to know about the great news! I was overwhelmed and went speechless for a moment....I deeply wanted to be there with him.
I first met him as a vendor in late `99 while I was working at Dialog, since then he became a trusted and close friend of mine. Duminda is a smart yet successful, witty IT/Telco salesman with a very good self esteem and a warm heart. He was always just phone call away whenever I need him....
We have already decided to spend lots of time in SL on our December trip, so I will be meeting all my (few) friends.....first time after being away for 2 years from loved ones.
I first met him as a vendor in late `99 while I was working at Dialog, since then he became a trusted and close friend of mine. Duminda is a smart yet successful, witty IT/Telco salesman with a very good self esteem and a warm heart. He was always just phone call away whenever I need him....
We have already decided to spend lots of time in SL on our December trip, so I will be meeting all my (few) friends.....first time after being away for 2 years from loved ones.
Monday, May 7, 2007
Finding needle in the haystack – Need for Intelligent Scanning
When it comes to growing Vulnerability Scanning space, predominantly there are two classes of scanning. There is the "noisily scan - everything and look for all possible static signatures/holes" otherwise "quietly find for relevant signatures/holes". Most adamant will always look for "aggressive" option in nmap rest want to be none-disruptive yet none intrusive methods, nevertheless today's most IDS/IPS scanners would easily spot for any kind of noise generated by traditional scanners. In any case it is healthy to be under the radar as much as possible without getting highlighted in logs with thousands of nmap port scans.
For example, after few requests when you learn that the host is an MS IIS server (by using httprint by telnet-ting to the server port directly and issuing the proper commands or running some other web server fingerprinting tools out in the space hmap, 404print, webserverfp etc.) Let's say for the moment by fool-proof fingerprinting method I have confirmed that the host is running IIS.
[In a different discussion I would like to further converse on Fingerprinting (reconnaissance stage in Ethical hacking lessons) coz many in the industry don't put their money on accuracy of fingerprinting.]
So do I really require running exploits that only affect Apache? Or let's say that the server does not support PHP, so do I need to scan for vulnerabilities related to PHP? Plausibly that is a something different above where most scanners are, as they usually aim for the noisy disruptive scans that request everything under the same. As I would prefer the second method, that it seriously reduces the time required performing the scan, and it significantly reduces the signatures probes against the server. But is there a reliable scanner/method can be trusted without missing the "reality check"? I did some extensive reading on this matter, according to an Article written by SPI Dynamics on Intelligent Engines - Next Generation Web Application Security they discuss about the how the combination of Intelligent Engine technology and Static checks would deliver most accurate results. Swift growth rate in the industry with the growing number of checks, vulnerability databases will have tens of thousands of static checks in a few years. With that many checks, application scans will simply take too long. Imagine your Nessus Scan with traditional application assessment static-check technology, running an automated test for vulnerability like Cross-site scripting could take up to three hours and yield results with many false positives. Using intelligent engine technology, that time can be reduced to 12 minutes with almost no false positives. Need for a new technology to revolutionize the process of finding vulnerabilities will not only speed up the web server security assessments but surely be able to perform more flexibly and more accurately by virtually eliminating false positives.
There are heaps of tools available freely and commercially - from nmap to nessus to Core Impact. But what matters is how effectively/quickly your IS Team want to mitigate risks identified by you? What will really happen to your fortnight/monthly scan results? Do you find the same in the next round? If yes, what action would you take? I know the question is somewhat political yet your hard work of finding holes in your infrastructure wouldn't bring any edge to you or your network. The model that I'm working on is (obviously gotta start from grass-root) focus on `new systems` rather than existing. At least to make sure new systems come in to production networks are fully tested. The idea is to screen all new systems in a lab environment to make sure box is `clean` to sit in production. So what happen after commissioning? How does these responses to new vulnerabilities? In the long running cyclic process; once you receive new Vulnerability updates (from CVE or SANS @RISK) - must quickly act and update your daily vulnerability columns according to your platforms and recent vulnerabilities and conduct a stealth scan to assess the risk. Once prioritized according to old school method you know how to get things patched. Keep in mind your job isn't finished until you finish your post-patch scan with "no more" holes. So if you have streamlined the process you wouldn't be noisy nor spending hours to find new vulnerabilities against recent CVE update - literally you will be spending less than 10 minutes with one system.
For example, after few requests when you learn that the host is an MS IIS server (by using httprint by telnet-ting to the server port directly and issuing the proper commands or running some other web server fingerprinting tools out in the space hmap, 404print, webserverfp etc.) Let's say for the moment by fool-proof fingerprinting method I have confirmed that the host is running IIS.
[In a different discussion I would like to further converse on Fingerprinting (reconnaissance stage in Ethical hacking lessons) coz many in the industry don't put their money on accuracy of fingerprinting.]
So do I really require running exploits that only affect Apache? Or let's say that the server does not support PHP, so do I need to scan for vulnerabilities related to PHP? Plausibly that is a something different above where most scanners are, as they usually aim for the noisy disruptive scans that request everything under the same. As I would prefer the second method, that it seriously reduces the time required performing the scan, and it significantly reduces the signatures probes against the server. But is there a reliable scanner/method can be trusted without missing the "reality check"? I did some extensive reading on this matter, according to an Article written by SPI Dynamics on Intelligent Engines - Next Generation Web Application Security they discuss about the how the combination of Intelligent Engine technology and Static checks would deliver most accurate results. Swift growth rate in the industry with the growing number of checks, vulnerability databases will have tens of thousands of static checks in a few years. With that many checks, application scans will simply take too long. Imagine your Nessus Scan with traditional application assessment static-check technology, running an automated test for vulnerability like Cross-site scripting could take up to three hours and yield results with many false positives. Using intelligent engine technology, that time can be reduced to 12 minutes with almost no false positives. Need for a new technology to revolutionize the process of finding vulnerabilities will not only speed up the web server security assessments but surely be able to perform more flexibly and more accurately by virtually eliminating false positives.
There are heaps of tools available freely and commercially - from nmap to nessus to Core Impact. But what matters is how effectively/quickly your IS Team want to mitigate risks identified by you? What will really happen to your fortnight/monthly scan results? Do you find the same in the next round? If yes, what action would you take? I know the question is somewhat political yet your hard work of finding holes in your infrastructure wouldn't bring any edge to you or your network. The model that I'm working on is (obviously gotta start from grass-root) focus on `new systems` rather than existing. At least to make sure new systems come in to production networks are fully tested. The idea is to screen all new systems in a lab environment to make sure box is `clean` to sit in production. So what happen after commissioning? How does these responses to new vulnerabilities? In the long running cyclic process; once you receive new Vulnerability updates (from CVE or SANS @RISK) - must quickly act and update your daily vulnerability columns according to your platforms and recent vulnerabilities and conduct a stealth scan to assess the risk. Once prioritized according to old school method you know how to get things patched. Keep in mind your job isn't finished until you finish your post-patch scan with "no more" holes. So if you have streamlined the process you wouldn't be noisy nor spending hours to find new vulnerabilities against recent CVE update - literally you will be spending less than 10 minutes with one system.
Subscribe to:
Posts (Atom)
