Long Tail Analysis of Windows Event Logs

This is a demo from a portion of lecture and lab from SEC511: Continuous Monitoring and Security Operations.

Link to T510-security.evtx.

Here are the PowerShell commands:

# Black text on white background (thank you @MarkBaggett)
PS C:\> cmd /c "color f0"

# Pull all security events (Requires administrator PowerShell)
PS C:\> Get-WinEvent -LogName security

# Pull all security events, search for date, count lines  (Requires administrator PowerShell)
PS C:\> Get-WinEvent -LogName security| findstr "1/19/2015"| Measure-Object

# List all events in the file T510-security.evtx
PS C:\> Get-WinEvent -Path .\T510-security.evtx

# Show event 4624 from T510-security.evtx, format list output
PS C:\> Get-WinEvent -FilterHashtable @{Path=".\T510-security.evtx"; ID=4624}| fl

# Perform long tail analysis of T510-security.evtx
PS C:\> Get-WinEvent -Path .\T510-security.evtx| Group-Object id -NoElement| sort count

Announcing: SEC511: Continuous Monitoring and Security Operations

I am happy to announce that the first beta for SANS SEC511: Continuous Monitoring and Security Operations has been scheduled for June 16-21 in Washington DC. Seth Misenar and I wrote the class, and it's proven to be a very timely (and necessary) topic!

I will teaching the first beta.

Note: This course is eligible for special beta pricing. Please enter discount code SEC511-BETA1 when registering to take advantage of the special beta price of $2450.

Flyer for SANS Course SEC528: SANS CompTIA Advanced Security Practitioner (CASP) Certification course

Flyer for my new SANS Course SEC528: SANS Training Program for the CompTIA Advanced Security Practitioner (CASP) Certification, beta class scheduled the week of July 22nd in Washington DC.

Special Beta pricing of $1995, plus $250 additional off when you use the code CASP_528B1. 

Hope to see you in DC!

Links from SANS Special Webcast: How to Prepare for the CompTIA CASP Exam

Here are the links for my SANS Special Webcast: How to Prepare for the CompTIA CASP Exam

SEC528: SANS Training Program for the CompTIA Advanced Security Practitioner Certification, beta class scheduled the week of July 22nd in Washington DC.

My previous webcast, Passing the CompTIA CASP: Discussing Sample Exam Questions

Updated DoD 8570.

Sample questions from SANS Security 528

• 30 Sample CompTIA CASP questions, in VCE format
• 30 Sample CompTIA CASP questions, in PDF Format
• 30 Sample CompTIA CASP questions with Answers, in PDF Format

A set of CompTIA CASP sample questions, from CompTIA. Another set from Darril Gibson

CompTIA CASP Exam Objectives

CompTIA CASP added to DoD 8570

CompTIA's CASP exam has been added to DoD 8570 for the following roles: IAT Level III, IAM Level II, and IASAE Levels I and II.

The beta run of my brand-new course: SEC528: SANS Training Program for the CompTIA® New Advanced Security Practitioner Certification™ has been scheduled in Washington DC the week of July 22nd.

It's a 5-day course, with a great beta discount. Hope to see you there!

SANS Webcast: Passing the CompTIA CASP Exam

I'll be conducting a webcast on September 7th called Passing the CompTIA CASP Exam.

If you miss the live webcast, an archive will be posted shortly thereafter.

My slide deck is posted here.

As I posted previously:

It is based on the new CompTIA Advanced Security Practitioner (CASP) certification, which is the first in CompTIA's "Mastery Series of Exams". 

I passed the CASP a few months ago, and was throughly impressed. It seems designed to be a more technical alternative to the CISSP. CompTIA has stated that is targeted for IA Technical Level III and IA  Management Level II of the US DoD Directive 8570. The CASP exam was also recently ISO certified.

'The CASP is the result of our being advised over a couple of years that the Department of Defense was looking for a more technical security exam to include in the “IA Technical Level III” job classification, for those military and military contractors who are in information assurance roles.  The job classification that I referred to is in the Dept. of Defense “8570” directive that requires certification of all information assurance personnel.

The CASP is targeted at the lead security professional in the enterprise environment who has years of experience with security considerations specific to large multi-location organizations.  The U.S. military refers to that environment as the “enclave”, which means the same thing as the enterprise in the corporate environment.'

Source: CASP – The Evolution of Technical Security Certifications? (ethicalhacker.net)

Teensy talk at SANSFIRE SANS360

I'm reposting some information from a previous post, for a SANS360 talk tonight at SANSFIRE 2012. 
My paper is available here. The Arduino sketches used in my talk are here.
Here are the resources I used to launch the Teensy attack:

• Where to buy Teensy: http://www.pjrc.com/teensy/
• I bought the USB enclosures from Mouser Electronics.
• I bought the USB Type A Male to Mini 5-Pin Adapters from Amazon.
• Microsoft TechNet Prevent Installation of Removable Devices article.
• NirSoft's USBDeview may be downloaded here.

Here are some excellent Teensy articles:

• Adrian Crenshaw's Plug and Prey. Lots of great information there, plus Adrian discusses mitigation options in depth.
• DaberMania has some great Teensy articles here.
• AstroBaby's Teensy++2.0 and Metasploit.
• 0x80's Create your own malicious keyboard or mouse!

CISSP Study Guide, 2nd Edition

Just a quick note to say the CISSP Study Guide, 2nd Edition, will be out in a few weeks. More details to follow: stay tuned.

Here's the Amazon Link.

Here's the Syngress link.

Installing OpenWRT on a RouterBOARD 750GL

I have a project that requires a small Linux router/firewall, with a requirement of no wireless (due to physical security policies for the site). There are many third-party firmware options for wireless routers, with distributions such as dd-wrt and Open-WRT on APs from Linksys, Buffalo, etc. But the options for a simple wired router are more limited.

I found this excellent post: OpenWRT on Mikrotik Routerboard 411/750 on Wolfs Tech Blog, which indicated that OpenWRT is flashable onto a RouterBoard 750GL. I bought a pair from rOc-nOc.com. They were $59.95 each via Google Checkout, and shipping was fast.

I highly recommend rOc-nOc.com: great service!

The RouterBOARD 750GL has 5 gigabit ports, 64MB of SDRAM, 64MB NAND, and it literally fits in the palm of your hand.

RouterBOARDs ship with a proprietary RouterOS, but my project requires Linux.

I used the Wolfs Tech Blog post as my guide for installation, with help from this German post, with an assist from Google Translate. I ran into a few gotchas, so I thought I'd save someone else future grief and post my step-by-step instructions. Firmware installation can be tricky: there is no serial or display port on the 750GL: you need to "fly blind" and install over the network.

I used Xubuntu 12.4 as the OS for building OpenWRT, and as the TFTP/DHCP server to boot the RouterBoard via the network. I initially tried using a VMWare Workstation guest, but later encountered problems making the DHCP server work properly via a bridged interface. I ended up installing to USB, booted off the USB, and ran Xubuntu natively.

Install the required packages and Wireshark (which will be handy later):

$ sudo apt-get install subversion
$ sudo apt-get install g++ gawk libncurses5-dev zlib1g-dev git-core
$ sudo apt-get install dhcp3-server atftpd apache2
$ sudo apt-get install wireshark

Download the OpenWRT trunk code with Subversion and "make menuconfig":

$ cd
$ mkdir openwrt
$ cd openwrt
$ svn co svn://svn.openwrt.org/openwrt/trunk
$ cd trunk
$ make menuconfig

We need to compile twice. Once for the .tar.gz file, and once for the ramdisk.  Two steps because the .tar.gz file has has different requirements than the ramdisk, such as squashfs.

First the tar.gz file:

Choose:

• Target System: Atheros AR7xxx/AR9xxx 
• Subtarget: (Devices with NAND flash (mostly Mikrotik)) 
• Target Images: .tar.gz

Exit and type "make". It will take a long time to compile.

When complete, type the following:

$ cp ~/openwrt/trunk/bin/ar71xx/openwrt-ar71xx-nand-vmlinux-initramfs.elf /var/www
$ cp ~/openwrt/trunk/bin/ar71xx/openwrt-ar71xx-nand-rootfs.tar.gz /var/www

This prepares them for the "wget2nand" flashing step, coming up later.

Next the ramdisk:

$ cd ~/openwrt/trunk
$ make clean
$ make menuconfig

Choose:

• Target System: Atheros AR7xxx/AR9xxx 
• Subtarget: (Devices with NAND flash (mostly Mikrotik)) 
• Target Images: ramdisk

Exit and type "make". 

When complete copy the ramdisk to /srv/tftp:

$ cp ~/openwrt/trunk/bin/ar71xx/openwrt-ar71xx-nand-vmlinux-initramfs.elf /srv/tftp/

Configure atftpd and isc-dhcp-server. I used 192.168.1.3 as the TFTP server address, and assigned 192.168.1.99 to the RouterBoard. Avoid 192.168.1.1 (the default OpenWRT IP address).

Edit /etc/network/interfaces, use 192.168.1.3 as a static IP address:

auto eth0
iface eth0 inet static
address 192.168.1.3
netmask 255.255.255.0

Edit /etc/default/atftpd, changes in bold:

USE_INETD=false
OPTIONS="--bind-address 192.168.1.3 --tftpd-timeout 300 --retry-timeout 5 --mcast-port 1758 --mcast-addr 239.239.239.0-255 --mcast-ttl 1 --maxthread 100 --verbose=5 /srv/tftp"

Locate the first MAC address printed on the bottom of the RouterBOARD 750GL:

Edit /etc/dhcp/dhcpd.conf, and use the first listed MAC address as the hardware ethernet address:

authoritative;
allow booting;
allow bootp;
one-lease-per-client true;

subnet 192.168.1.0 netmask 255.255.255.0 {
  option routers 192.168.1.254;
  option subnet-mask 255.255.255.0;
  option broadcast-address 192.168.1.255;
  ignore client-updates;
}

group {
  host routerboard {
    hardware ethernet 00:0c:42:aa:bb:cc;
    next-server 192.168.1.3;
    fixed-address 192.168.1.99;
    filename "openwrt-ar71xx-nand-vmlinux-initramfs.elf";
  }
}

Now restart networking, atftpd and isc-dhcp-server:

$ sudo /etc/init.d/networking restart
$ sudo /etc/init.d/atftpd restart
$ sudo /etc/init.d/isc-dhcp-server restart

Run Wireshark, sniffing on eth0, to watch network traffic.

Boot the RouterBOARD 750GL via TFTP:

• Connect an ethernet cable between port 1 on the RouterBOARD 750GL and the TFTP server.
• Other ports won't work 
• Press the small "RES" button and plug in the power cable. 
• The "PWR" and "ACT" lights will illuminate. Then "ACT" will flash, and finally stop. 
• Now release the "RES" button. 
• The 750GL should request a DHCP address, receive 192.168.1.99, download openwrt-ar71xx-nand-vmlinux-initramfs.elf via TFTP, and boot OpenWRT. 

Use Wireshark to ensure everything's working; look for the TFTP "DATA Packet" packets to verify the ramdisk download.

The device will boot OpenWRT and use IP address 192.168.1.1.

Swap the cable to a different port to access OpenWRT. I used port 2 (port 1 won't work). Then telnet to the device:

$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to openwrt.lan.
Escape character is '^]'.
 === IMPORTANT ============================
  Use 'passwd' to set your login password
  this will disable telnet and enable SSH
 ------------------------------------------


BusyBox v1.19.4 (2012-05-10 11:17:53 PDT) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 ATTITUDE ADJUSTMENT (Bleeding Edge, r31673)
 -----------------------------------------------------
  * 1/4 oz Vodka      Pour all ingredients into mixing
  * 1/4 oz Gin        tin with ice, strain into glass.
  * 1/4 oz Amaretto
  * 1/4 oz Triple sec
  * 1/4 oz Peach schnapps
  * 1/4 oz Sour mix
  * 1 splash Cranberry juice
 -----------------------------------------------------
root@OpenWrt:/# 

Now that the 750GL has booted to ramdisk, the last step is flashing OpenWRT to make it permanent.

WARNING: the next steps will erase the existing RouterOS installation. Make sure to back up the OS, configuration and license first.

root@OpenWrt:/# wget2nand http://192.168.1.3
Connecting to 192.168.1.3 (192.168.1.3:80)
kernel               100% |*******************************|  2717k  0:00:00 ETA
Connecting to 192.168.1.3 (192.168.1.3:80)
rootfs.tgz           100% |*******************************|  1222k  0:00:00 ETA
Erasing filesystem...
Mounting /dev/mtdblock2 as new root and /dev/mtdblock1 as kernel partition
Copying kernel...
Preparing filesystem...
...
Cleaning up...
Image written, you can now reboot.  Remember to change the boot source to Boot from Nand

The 750GL should boot OpenWRT natively and respond to pings shortly.

USB Reloaded: the Teensy Attack

I'm posting this information in advance of my "USB Reloaded: the Teensy Attack" lightning talk, which I am delivering at SANS 2012 in Orlando. The talk is part of SANS360: Top Security Takeaways. The talk is scheduled for Tuesday, March 27, 2012 at 7:30 PM EDT and will be streamed live here.


Ten talks in 60 minutes, with 360 seconds per speaker. I can't wait!


My paper is available here. The Arduino sketches used in my talk are here.


Here are the resources I used to launch the Teensy attack:

• Where to buy Teensy: http://www.pjrc.com/teensy/
• I bought the USB enclosures from Mouser Electronics.
• I bought the USB Type A Male to Mini 5-Pin Adapters from Amazon.
• Microsoft TechNet Prevent Installation of Removable Devices article.
• NirSoft's USBDeview may be downloaded here.

Here are some excellent Teensy articles:

• Adrian Crenshaw's Plug and Prey. Lots of great information there, plus Adrian discusses mitigation options in depth.
• DaberMania has some great Teensy articles here.
• AstroBaby's Teensy++2.0 and Metasploit.
• 0x80's Create your own malicious keyboard or mouse!

Announcing SANS Security 528: SANS Training Program for the New CompTIA Advanced Security Practitioner Certification

I am happy to announce my brand-new SANS course: SANS Security 528, SANS Training Program for the New CompTIA Advanced Security Practitioner Certification.

It is based on the new CompTIA Advanced Security Practitioner (CASP) certification, which is the first in CompTIA's "Mastery Series of Exams".

I passed the CASP a few months ago, and was throughly impressed. It seems designed to be a more technical alternative to the CISSP. CompTIA has stated that is targeted for IA Technical Level III and IA  Management Level II of the US DoD Directive 8570. The CASP exam was also recently ISO certified.

The CASP is the result of our being advised over a couple of years that the Department of Defense was looking for a more technical security exam to include in the “IA Technical Level III” job classification, for those military and military contractors who are in information assurance roles.  The job classification that I referred to is in the Dept. of Defense “8570” directive that requires certification of all information assurance personnel.

The CASP is targeted at the lead security professional in the enterprise environment who has years of experience with security considerations specific to large multi-location organizations.  The U.S. military refers to that environment as the “enclave”, which means the same thing as the enterprise in the corporate environment.  

Source: CASP – The Evolution of Technical Security Certifications? (ethicalhacker.net)

CISSP® Study Guide sample chapter posted

Elsevier posted a sample chapter from CISSP Study Guide. Chapter 4, Domain 3: Cryptography: http://www.elsevierdirect.com/samplechapters/9781597495639/02~Chapter_4.pdf

Here's a small section:

Digital Signatures

Digital signatures are used to cryptographically sign documents. Digital signatures provide nonrepudiation, which includes authentication of the identity of the signer, and proof of the document’s integrity (proving the document did not change). This means the sender cannot later deny (or repudiate) signing the document.

Roy wants to send a digitally signed email to Rick. Roy writes the email, which is the plaintext. He then uses the SHA-1 hash function to generate a hash value of the plaintext. He then creates the digital signature by encrypting the hash with his RSA private key. Figure 4.13 shows this process. Roy then attaches the signature to his plaintext email and hits send.

Figure 4.13, Creating a digital signature

Rick receives Roy’s email and generates his own SHA-1 hash value of the plaintext email. Rick then decrypts the digital signature with Roy’s RSA public key, recovering the SHA-1 hash Roy generated. Rick then compares his SHA-1 hash with Roy’s. Figure 4.14 shows this process.

Figure 4.14, verifying a digital signature

If the two hashes match, Rick knows a number of things:

1. Roy must have sent the email (only Roy knows his private key). This authenticates Roy as the sender.
2. The email did not change. This proves the integrity of the email.

If the hashes match, Roy cannot later deny having signed the email. This is nonrepudiation. If the hashes do not match, Rick knows either Roy did not send it, or that the email’s integrity was violated.

I took many of the photos from this chapter at the National Cryptologic Museum in Fort Meade, Maryland. I highly recommend this museum, for old and young cryptographers alike.

Ben Rothke Reviews The CISSP® Study Guide

Ben Rothke reviews the CISSP® Study Guide:

Quoting from Ben's review:

The common wisdom is to choose two study guides when preparing for the CISSP exam.  For those that are serious about passing, the CISSP Study Guide should be one of them.

https://365.rsaconference.com/blogs/securityreading/2010/08/17/cissp-study-guide

The CISSP® Study Guide has been sent to the printer!!!

The final PDFs for the Syngress CISSP® Study Guide were completed today, and sent to the printer!! It's due out next month. You can pre-order on Amazon.

Security 560 in Brisbane, Australia

I'm in Brisbane, Australia teaching Security 560: Network Penetration Testing and Ethical Hacking this week. Having an awesome time so far. It will take me awhile to get used to saying "D M Zed."

Here's a link to my talk tonight: Look Out! Open Source Extrusion Detection

CISSP Study Guide due out August 6th

Just a quick note to say The CISSP Study Guide is due out on Syngress August 6th.  You can pre-order on Amazon. The Eleventh Hour CISSP is due out on August 29th.

Identifying Counterfeit Cisco Equipment

Waking Sleeping Dogs: Information Security Ethics, a paper I wrote for my SANS Technology Institute masters degree, has generated a lot of great comments and questions.

Many folks are asking how to identify counterfeit Cisco gear that may be their environment. Continue reading for how we did it.

Our biggest counterfeit problem was with SFPs and GBICs. Our investigation showed we received them from a number of sources (all Cisco registered resellers), including a Cisco Gold partner.

We initially detected them due to shoddy packaging: labels that smear, cheap boxes, etc. The Cisco logo used was several generations old. Cisco is usually diligent on labeling: the serial number on the device matches the number on the bag (or box).

The counterfeit gear had a label/serial number on the device, but no serial number on the bag or box.

Once we investigated, there was a clear pattern on the counterfeit gear, regarding bogus serial numbers.

A legit SFP looks like this:

DECKARD-C3750-1#show idprom interface gigabitEthernet 1/0/1

General SFP Information
------------------------------
Identifier : 0x03
Connector : 0x07
Transceiver : 0x00 0x00 0x00 0x01 0x20 0x40 0x0C 0x01
Encoding : 0x01
BR_Nominal : 0x0C
Vendor Name : CISCO-FINISAR
Vendor Part Number : FTRJ-8519-7D-CSC
Vendor Revision : 0x00 0x00 0x00 0x00
Vendor Serial Number : FNS0827A12H

The key is the serial number (bolded), which is in the standard Cisco format for SFPs: 3 letters, followed by 4 numbers, followed by 4 letters/numbers. The 1st 3 letters are the factory, the next 4 numbers are a date code, and the last 4 letters/numbers are a unique ID.

Here's a counterfeit SFP:

BATTY-C3750-1#show idprom interface gigabitEthernet 1/0/1

General SFP Information

------------------------------

Identifier : 0x03
Connector : 0x07
Transceiver : 0x00 0x00 0x00 0x01 0x20 0x40 0x0C 0x00
Encoding : 0x01
BR_Nominal : 0x0C
Vendor Name : CISCO-FINISAR
Vendor Part Number : FTRJ-8519-7D-CSC
Vendor Revision : 0x20 0x20 0x20 0x20
Vendor Serial Number : H11F797

Note the serial number 'H11F797' is not in the standard (longer) format. This is very typical, and how we identified hundreds of bogus SFPs that were in production. The initial letter changes (we saw some begin with H, and P).

Also, in restrospect, we realized the counterfeit devices had a far higher failure rate than real Cisco. We shipped the questionable SFPs to Cisco Brand Protection Labs, and they verified all were counterfeit.

Here's a photo of an SFP that appears to be counterfeit:



Note the serial number. This photo was taken from a reseller located in Asia. This SFP is priced for $20 on that site (a real SFP from a legitimate Cisco reseller lists for hundreds). That seller has plenty of other "Cisco" equipment for sale at equally impressive discounts compared to legit gear:

• CISCO GBIC&SFP
• CISCO MODULE
• WIC CARD
• NETWORK MODULE(NM)
• VWIC CARD
• VIC CARD
• 1700 SERIES
• 1800 SERIES
• 2800 SERIES
• 2950 SERIES
• 2970 SERIES
• 3560 SERIES

All of this stuff ends up in secondary channels like Ebay. Some Cisco certified resellers get greedy, buy the counterfeit stuff for pennies on the dollar, and then resell it a 'great discount.' All of this violates their Cisco reseller agreement, but greed seems to win the day.

We got ours for 50% off Cisco list. These parts listed for $500 then (they are less now). We got a bargain price of $250: for a $20 knockoff.

SANS ISC Webhoneypot project

The SANS Internet Storm Center Webhoneypot project is now live.

I wrote back-end Perl scripts and regex classification system used by the Webhoneypot as part of my SANS Technical Institute Master of Science Degree in Information Security Engineering degree.

Xfiltr8 Extrusion Detection Live CD

Greetings from SANS Boston 2009.

I just posted the 1st public alpha version of the Xfiltr8 live CD to sourceforge: http://xfiltr8.sourceforge.net

Xfiltr8 is an open source Ubuntu-based live CD dedicated to networked extrusion detection.

The National Cryptologic Museum

I finally got a chance to visit the National Cryptologic Museum yesterday, on the way back to BWI to fly home after SANSFIRE and a few day's family vacation (including 2 Red Sox games at National's Park).

The museum was a real treat, far exceeding my expectations. The had all the classic crypto gear, including a set of Jefferson Disks, an original Confederate cipher disk, multiple Japanese Red, Jade, and Purple machines/analogues, American Sigaba, an original Hebern Machine and multiple Enigma Machines. I really enjoyed the VENONA exhibit.

A really nice touch were the 2 fully-functional Enigma Machines, freed of their cases, with pencil and paper next to each, with instructions on how to encode and decode a message.

With the wheels set to '414' (in honor of SANS Management 414), 'CISSP' encodes to 'DCNXK'. As you click each typewriter key, the wheels turn, and the ciphertext letter illuminates. To decode, turn the wheels back to '414', type 'DCNXK', and 'CISSP' illuminates.

I was also impressed with how kid-friendly the museum was. The kids were handed the pictured cipher disk, and a 'Cryptokids Challenge' score sheet, which included 14 numbered stations. As the kids reached each station, they were presented with a cipher disk setting, and ciphertext to convert back into plaintext. They both successfully decoded all 14 ciphertexts, and were presented with prizes for their handiwork.

The kids had a blast, and both declared the Cryptologic Museum 'the best museum in the DC area, tied with the Smithsonian National Air and Space Museum.' High praise from my young cryptanalysts!!