Detroit Dave's Raves

2019-11-04T14:09:00.001-05:00

It's been a LONG time since I've posted on here and I wanted to return. One of the recent things I have been working on is trying to "settle the argument" of the DoD's SSE role versus its ISSE role. Below is what I drafted.
Enjoy!
dw

Within the Army’s Acquisition community, there exists today a lack of clarity when defining and discussing the roles of a System Security Engineer (SSE) and an Information System Security Engineer (ISSE). This confusion is due in large part to there being some ambiguity in how the roles are defined in different publications used within this community. Additionally, it doesn’t help that the role names are so close to being identical.

Examination of the Official Verbiage

The logical starting point for this discussion is the examination of what is actually written in the different publications relevant to both System Security Engineering and Information System Security Engineering. This discussion will cover the relevant Department of the Army regulations, DoD’s guidance, and the descriptions of the roles as provided by NIST.

Army Guidance

The US Army defines the Information System Security Engineer (ISSE) as being “an individual or a group responsible for conducting information system security engineering activities, including [AR25-2] [DA PAM25-2-14]:

- System Architecture

- System Design

- System Development

- System Configuration

Furthermore, Army regulations require that the Program Manager (PM)/System Manager(SM) assign an Information System Security Engineer to all IS and PIT systems [AR-25-2][DA PAM25-2-14]. The ISSE should be “fully integrated into the systems engineering process.”

When discussing the Risk Management Framework (RMF) specifically, the US Army, in [DA PAM25-2-14] articulates the requirement to integrate system security engineering into existing processes. Unfortunately, this statement on its own has caused some confusion as to the ISSE versus SSE role within DoD and the US Army. There does exist some clarity, discussed later, when examining publications from both NIST and DoD directly.

The confusion between the SSE and ISSE role is never firmly answered amongst the multiple levels of regulations and guidance between Defense Acquisitions through US Army, DoD, and ultimately NIST. However, some clarity exists in the specific wording chosen in each document.

The ISSE role is specifically identified as being required in [DA PAM25-2-14].

DoD Guidance

In two tables within [DoD 8570-01M], Table C4.T7 and Table C10.T7, we find the following:

Table C4.T7. IAM Level III Functions

M-III.2. Ensure that protection and detection capabilities are acquired or developed using the IS security engineering approach and are consistent with DoD Component level IA architecture.

Where “IS” is prepended intentionally to “security engineering.” We also find the below, an even clearer articulation as to the name of the role/function.

Table C10.T7. IASAE Level III Functions

IASAE-III.18. Ensure that acquired or developed system(s) and network(s) employ Information Systems Security Engineering and are consistent with DoD Component level IA architecture.

NIST Guidance

Finally, we look at what the different NIST publications have to say. In [NIST SP800-37] we find a specific definition that, when examined, shows that there is a difference between SSE efforts and that of an ISSE. The first definition is:

Systems Security Engineering – Process that captures and refines security requirements and ensures their integration into information technology component products and information systems through purposeful security design or configuration.

Notice that the definition describes the integration of security requirements into IT products and information Systems. This is not synonymous with the integration of security requirements into a full system or system-of-systems. However, one must consider the target audience of this publication and its content, the Risk Management Framework. In broader scoped NIST publications, as shown below, this definition is expanded to be system-holistic and includes cybersecurity concerns, and not solely focused as the definition above.

Another NIST publication in which its audience and content must be considered is [NIST SP800-53A]. Two items within this publication should be considered when examining the relationship between the SSE and ISSE roles. In the “Target Audience” section, the document uses the term “information Security Engineers” and does not use the terms Information System Security Engineers nor System Security Engineers. Later in the document, when discussing control SA-8 (Security Engineering Principles), the assessment objective specifically states: “applies information system security engineering principles” which clearly references the specific role/function of ISSE efforts.

Finally, [NIST SP800-160 vol I] shows a clear delineation of the two roles. It should be noted that this publication is title: “Systems Security Engineering – Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems”. This is the first of two volumes of NIST’s System Security Engineer guidance.

[NIST SP800-160 vol I] describes Systems Security Engineering as focusing on “protection of stakeholder and system assets so as to exercise control over asset loss and the associated consequences” and the approach described within the publication “helps to reduce the susceptibility of systems to a variety of simple, complex, and hybrid threats including physical and cyber-attacks; structural failures; natural disasters; and errors of omission and commission”. As this shows, the publication specifically states that SSE efforts include but is not confined to cyber aspects. The publication further states that:

“Systems security engineering, as an integral part of systems engineering, helps to ensure that the appropriate security principles, concepts, methods, and practices are applied during the system life cycle to achieve stakeholder objectives for the protection of assets—across all forms of adversity characterized as disruptions, hazards, and threats.”

Again, this shows that NIST SP800-160 does not confine SSE to only the cybersecurity realm, which the publication specifically articulates a few sentences later:

“Systems security engineering leverages many security specialties and focus areas that contribute to systems security engineering activities and tasks. These security specialties and focus areas include, for example: computer security; communications security; transmission security; anti-tamper protection; electronic emissions security; physical security; information, software, and hardware assurance; and technology specialties such as biometrics and cryptography.”

Comparing the Guidance

It is obvious that there is no apparent agreement in ISSE and SSE definitions between the US Army, DoD, and NIST publications. However, as shown here, when the content and audience of each individual publication is considered, the difference between the two roles becomes clearly defined.

System Security Engineering – the processes of examining and applying security requirements holistically to a system or system of systems. These requirements are derived from multiple domains including cybersecurity, physical security, etc.

Information System Security Engineering – the process of examining and applying cybersecurity requirements to a system or system of systems. These requirements are primarily derived via the RMF process and are defined by NIST Controls [NIST SP800-53r4] and DISA’s Control Correlation Identifiers.

What is an ISSE?

Looking at some of the referenced definitions above, it becomes simple to state from a very high level the actions associated with the ISSE role. Specifically, recall that [AR25-2] [DA PAM25-2-14] identify four primary areas of the ISSE focus. These four areas are:

- System Architecture

- System Design

- System Development

- System Configuration

The word System has been defined within [ISO/IEC/IEEE 15288:2015] as:

- A set of interacting elements (i.e., system elements) organized to achieve one or more stated purposes.

In order to understand the role of the ISSE within the scope of the Risk Management Framework, we must refine the definition of System to the following:

- A set of interacting elements (i.e., system elements) organized to process Department of Defense (DoD) data and/or connect to a DoD Network.

With the appropriated scoped definition of System, we can further define these four target areas and the ISSE’s role within each.

System Architecture

According to [ISO/IEC/IEEE 15288:2015], System Architecture can be defined as “fundamental concepts or properties of a system in its environment embodied in its elements, relationships, and in the principles of its design and evolution”. In other words, a [normally] high-level description of a system and its internal and external interactions.

The ISSE role regarding system architecture is examine and evaluate the proposed interactions and environment of the system. The ISSE best serves the program by asking specific questions about these high level interactions, the operational environment, and potential alternatives.

An example of the ISSE function at this level be the examination of proposed wireless protocols, the spectrum management/saturation of the operational environment, and the feasibility of the sub-systems connecting via a proposed wireless protocol.

System Design

Design is defined by [ISO/IEC/IEEE 15288:2015] in two ways:

- Information, including specification of system elements and the relationships, that is sufficiently complete to support a compliant implementation of the architecture

- Provides the detailed implementation-level physical structure, behavior, temporal relationships, and other attributes of system elements

Typically overlooked by ISSEs, or even excluded by design leads, the system design area is a critical area where the expertise of the ISSE should be leveraged heavily. The ISSE should be examining the protocols, transmission mediums, and system instrumentation/performance requirements, at both the hardware and software levels. This examination should identify conflicts and potential cost drivers that may have alternatives.

An example of the ISSE function during this process would be that of examining proposed hardware items to verify their ability to support a required encryption schema in terms of both cycle time and system power. Another example would be the examination of the physical design to ensure that cyber-physical requirements can be sufficiently and appropriately satisfied.

System Development

Development refers to the process, life cycle, or framework that is utilized within the program in order to implement the system architecture and design into a given system or system of systems.

The role of the ISSE during System Development really involves the entire lifecycle of the program and will vary depending upon the specific process, framework, or lifecycle used to develop the system/system of systems.

The primary role of the ISSE with this domain is to insure that the appropriate inject points exist in each phase of the development in order to ensure that cybersecurity requirements and affects are account for at the appropriate juncture.

System Configuration

Configuration refers to the specific items and details that are the realization of the architecture, design, and development processes. This phase has the lowest level of granularity and is intended to manage a system/system of systems from development through disposal. Items are tracked specifically by manufacturer information and serial number. Changes to the system, to include item replacements are both approved prior to action and documented.

The ISSE typically does not play a direct role in maintaining a system’s configuration. However, the ISSE should be involved in all cyber-related configuration changes and updates. This involvement requires that the ISSE provide expertise in the potential and known impacts of a given potential change to the system.

What is an SSE?

As stated above, the SSE role is one that applies security requirements holistically to a system. These requirements come from both security-based engineering domains such as cyber and physical, and from non-security-based engineering domains such as human factors engineering (Ergonomics) and Reliability, Availability, and Maintainability (RAM) Engineering.

Traditionally and by best practice, the SSE comes from the Systems Engineering field and has a broad understanding of many engineering disciplines. This means that an ISSE with additional engineering experience can most likely fill the role of an SSE, the less-granular understanding of cybersecurity engineering makes the SSE a poor choice to fill the ISSE role.

Although not specified in the literature, it is generally safe to assume that, like the ISSE, the SSE provides engineering assistance in four domains:

- System Architecture

- System Design

- System Development

- System Configuration

The difference however, and an important one, is the definition of System as relates the SSE supporting these four areas. For that, we go back to the original definition as found in [ISO/IEC/IEEE 15288:2015]:

- A set of interacting elements (i.e., system elements) organized to achieve one or more stated purposes.

This means that the general actions of the SSE within these four areas are the same as the ISSE with the understanding that the SSE is not looking solely at Cybersecurity requirements but at many requirements from multiple security and non-security engineering disciplines.

[NIST SP 800-160 vol 1] goes into great, very granular, detail regarding the System Security Engineering process and the function of the System Security Engineer. There are numerous and specific tasks as well as an excellent framework (which makes prudent use of a closed-loop feedback) for this process.

Conclusion

The roles of the ISSE and SSE are separate, although at times complementary, functions within the system development life cycle. This should be obvious to the reader when considering the target audience, wording, and scope of the references cited herein.

Frameworks, Frameworks, Everywhere!!!...

2017-12-21T21:23:00.001-05:00

- but not a component to spare???

It seems recently that everywhere I turn, at work, on the interwebs, and in research, I see the word FRAMEWORK sticking out in bold text with neon arrows.

Two examples of this that really stick out in my mind at the moment are that of:
1) at work, someone has asked for a framework-based checklist to use in verifying that ALL security controls have been included in contracts, implemented by vendors, and verified by assessments. (umm...would one checklist really provide a strong feeling of security through ALL of these processes???)
2) in some recent research I've been doing (taking all of my free time), I've read over 30 papers regarding cyber security of part of the IoT world and they all mention...FRAMEWORKS. Except...and here's one aggravation, none of them really make any proposal to this end.

So these got me thinking, as cyber security peeps, are we asking the proper questions? I mean, are we asking ourselves the proper questions before we shout these questions and "solutions" to the world. Or are we, true to what seems to be the norm, making knee-jerk reactions and suggestions without thinking them through? Better yet, are we looking for any evidence that someone just may have already had the thought? I feel like smart-phone IDS's may fall into this bucket.

I've seen for a while now the presence of IDS's in the marketplace for my phone. Now, as someone who loves IDS's and has worked more than one day on more than one type, I wonder if anyone asked the simple question: "To what end?" Seriously, is the average user going to know what to do if their Android screen shows a popup stating "Possible Mirai Botnet Infection Detected." Or will they just click "OK" and forget about it within five minutes? I don't know but I don't think we can start counting on individual users to form some sort of Ad Hoc Security Operations Center.

I don't know if we need yet another Framework, or another Model, nor even another Paradigm. What I do know is that we need to apply common sense the advice we are giving our management. We need to further flesh out our ideas, do the research, and play our own devil's advocate to our suggestion. And all of this should be done BEFORE we open our mouths to our management and customers.

In short, I think we continue to over-complicate our own lives and efforts. Instead, let's get back to some of the basics...
   - Defense in Depth
   - Examine RoI
   - Perform a realistic Risk Assessment
   - Compose a realistic Threat Model
   - Learn new things Every Day!!!
   - Have FUN!!!

Helmet Schedules - NFL and Big10

2017-08-28T11:51:00.002-04:00

Not a geek/nerd thing...but still important. Below links are for the 2017 Helmet Schedules for both the NFL and the BIG10. I created the NFL one. The BIG10 schedule came from fbschedules.com and looks a little nicer than mine with their formatting.

GO LIONS!!!
GO BLUE!!!

NFL 2017 Helmet Schedule
Big10 2017 Helmet Schedule

Python and Firefox bookmarks on Windows

2016-07-05T20:15:00.001-04:00

I'm working today on the creating a python program to reorganize my Firefox bookmarks. My previous post was about the PowerShell code I created to do this and since I haven't touched Python in a little bit, I figured what better way to relearn python than to write a program that requires database interaction.

While I am still working on this program I had an interesting error that drove me bonkers for 20 minutes or so. Unfortunately, I had actually found the answer within one or two google search results...but I didn't believe it could be that simple and kept searching.

The error I received when using a SELECT statement just to test the db connection:

sqlite3.DatabaseError: file is encrypted or is not a database

The FIX was very simple, and found at: https://deshmukhsuraj.wordpress.com/2015/02/07/windows-python-users-update-your-sqlite3/

The short of it is:
- Download the proper file for your architecture from: http://www.sqlite.org/download.html
- Unblock and Unzip
- Copy the sqlite3.dll from the unzipped directory into your C:\python27\DLLs

I made a backup copy of the original sqlite3.dll in the folder. However, without any restarting or reloading of my dev tool, it worked as advertised.

Powersell to organize FireFox bookmarks

2016-07-03T13:05:00.001-04:00

FireFox bookmarks are stored in the user's profile directory, in a sqlite database name "places.sqlite". As I keep working more on different things to do with PowerShell, I was at first annoyed that the scripts I had already written for simple file maintenance and organization couldn't be used as is with organizing the enormous amounts of bookmarks that I have. I searched around the interwebs and found a few decent examples but still wanted to roll my own.

Below is the current script as is. I only tested this on my version of FF, 47.0. However, this is a rather simplistic script and, following a best practice to backup data first, making a copy of the places.sqlite file will allow one to "roll back" to the original state.

One last note: I started this intending to make use of "System.Data.Sqlite" library. This was not hard to implement but was lengthier than I wanted. I then went to PSSqlite and found it to be a little easier to use.

#*******************************************************
#** File: Organize-FireFoxBM.ps1
#** Author: Dave Werden
#** General Notes:
#** - add 'COLLATE nocase' to end of search queries for
#**   case-insensitive searches. Similar to 'LIKE'
#**
#** - FK <= 8 is standard FF Folders
#** - Position == 0 is root level
#*******************************************************

#Need to check for pssqlite module before executing script
if(!(Get-Module pssqlite)) {
    Import-Module pssqlite
}

#*******************************************************
#** Bookmarks are stored in a profile folder in a
#** sqlite file: places.sqlite
#*******************************************************

#firefox profile folder
$profFFBasePath = "$($env:APPDATA)\Mozilla\Firefox\"
$profINIFile = "$($profFFBasePath)\profiles.ini"
$profFFProfPath = "$($profFFBasePath)\Profiles\"

#get firefox default profile name (folder name)
$profName = gc $profINIFile | select-string "Path" | split-string -separator "/" | select-string "default"

#set var for full path to default profile folder where the bookmarks are located and go there
$profBookMarksPath = $($profFFProfPath + "\" + $profName)
cd $profBookMarksPath

#*******************************************************
#** Need a sqlite provider
#** sqlite provider DL'd from https://psqlite.codeplex.com/
#** unzipped to system PS modules folder...had to unblock DLLs
#*******************************************************

$database = ".\places.sqlite"

#*******************************************************
## query strings - Data pulls only
#*******************************************************

#This query will return the ID, URL, GUID, Title, and Parent Folder of all bookmars
$sqlQueryBMs = "SELECT moz_places.id, moz_places.URL, moz_places.GUID, moz_bookmarks.title, moz_bookmarks.id, moz_bookmarks.parent
                FROM moz_places, moz_bookmarks
                WHERE moz_bookmarks.fk = moz_places.id"

#*******************************************************
## query strings - Data inserts only
## Trigger needed to be inplace before inserting folders
#*******************************************************

#I hand-jammed this in for my own organization plan...
#could do this with an array and a loop/LINQ
#could also..maybe will...add subfolders using this method
$sqlInserts = 'insert into moz_bookmarks (type, parent, title,dateAdded) VALUES (2,2,"BMs_Temp",CURRENT_TIMESTAMP),
                (2,2,"My_Family",CURRENT_TIMESTAMP),
                (2,2,"My_Job",CURRENT_TIMESTAMP),
                (2,2,"My_Money",CURRENT_TIMESTAMP),
                (2,2,"My_Radio",CURRENT_TIMESTAMP),
                (2,2,"My_Searches",CURRENT_TIMESTAMP),
                (2,2,"My_Coding",CURRENT_TIMESTAMP),
                (2,2,"My_Hobbies",CURRENT_TIMESTAMP)'

#Entries into moz_bookmarks need a GUID
#This will add a GUID to any newly created folder
#need to fix trigger to create more firefox-centric guids!
$sqlCreateTrigger = "CREATE TRIGGER AutoGenerateGUID
                    AFTER INSERT ON moz_bookmarks
                    FOR EACH ROW
                    WHEN (NEW.guid IS NULL)
                    BEGIN
                       UPDATE moz_bookmarks SET guid = (select hex( randomblob(4)) || hex( randomblob(2)) ||
                                  substr( hex( randomblob(2)), 2) ) WHERE rowid = NEW.rowid;
                    END"

#*******************************************************
## query strings - Data mods only
#*******************************************************

#Steps
#   1. What taxonomy do I use to sort bookmarks
#   2a. Pull all Bookmarks from original folders and move to target folders
#       i. Based upon keyword search of URL (and/or Title?)
#       ii. DO NOT pull from target folders
#   2b. Pull all Bookmarks from original folders and move to a single temp Folder
#       i. Would probably make it easier to:
#            1) Find Dups
#            2) Clean up/Identify 'straglers' after all move operations completed
#
#Choice: 2b
#
#   3. Automated Cleanup of empty folders

#first, modify bookmarks to have parent id of our temp folder
$sqlMoveAllToTemp = 'UPDATE moz_bookmarks set parent = (Select id from moz_bookmarks where title = "BMs_Temp")
                     where fk > 4
                     AND parent < (Select id from moz_bookmarks where title = "BMs_Temp")'

#Taxonomy...arrays of keywords :-)
$keywordsFamily = @("werden","ancestry","family","DNA","genealogy","worden")
$keywordsJob = @("compsec","embed","FCA","NGC","jobsearch","usajobs")
$keywordsMoney = @("bank","finance","money","account","loan","finance","credit","checking","savings")
$keywordsRadio = @("RF","frequency","shortwave","QR","CW","Morse","HF","UHF","VHF")
$keywordsSearches = @("google")
$keywordsCoding = @("python","perl","linux","database","php","coding","code","scripting","visual studio","netbeans","java")
$keywordsHobbies = @("jeep","wrangler","fish","guitar","Audible","audio book")

foreach ($word in $keywordsHobbies)
{
    $sqlUpdate = "UPDATE moz_bookmarks
                    SET parent = (SELECT id from moz_bookmarks WHERE title = `"My_Hobbies`") WHERE moz_bookmarks.title like `"%$($word)%`" COLLATE nocase;"
    Invoke-SqliteQuery -DataSource $database -QueryTimeout 10 -Query $sqlUpdate -SqlParameters @{ word = $word }
}

foreach ($word in $keywordsSearches)
{
    $sqlUpdate = "UPDATE moz_bookmarks
                    SET parent = (SELECT id from moz_bookmarks WHERE title = `"My_Searches`") WHERE moz_bookmarks.title like `"%$($word)%`" COLLATE nocase;"
    Invoke-SqliteQuery -DataSource $database -QueryTimeout 10 -Query $sqlUpdate -SqlParameters @{ word = $word }
}

foreach ($word in $keywordsMoney)
{
    $sqlUpdate = "UPDATE moz_bookmarks
                    SET parent = (SELECT id from moz_bookmarks WHERE title = `"My_Money`") WHERE moz_bookmarks.title like `"%$($word)%`" COLLATE nocase;"
    Invoke-SqliteQuery -DataSource $database -QueryTimeout 10 -Query $sqlUpdate -SqlParameters @{ word = $word }
}

foreach ($word in $keywordsJob)
{
    $sqlUpdate = "UPDATE moz_bookmarks
                    SET parent = (SELECT id from moz_bookmarks WHERE title = `"My_Job`") WHERE moz_bookmarks.title like `"%$($word)%`" COLLATE nocase;"
    Invoke-SqliteQuery -DataSource $database -QueryTimeout 10 -Query $sqlUpdate -SqlParameters @{ word = $word }
}

foreach ($word in $keywordsCoding)
{
    $sqlUpdate = "UPDATE moz_bookmarks
                    SET parent = (SELECT id from moz_bookmarks WHERE title = `"My_Coding`") WHERE moz_bookmarks.title like `"%$($word)%`" COLLATE nocase;"
    Invoke-SqliteQuery -DataSource $database -QueryTimeout 10 -Query $sqlUpdate -SqlParameters @{ word = $word }
}

foreach ($word in $keywordsRadio)
{
    $sqlUpdate = "UPDATE moz_bookmarks
                    SET parent = (SELECT id from moz_bookmarks WHERE title = `"My_Radio`") WHERE moz_bookmarks.title like `"%$($word)%`" COLLATE nocase;"
    Invoke-SqliteQuery -DataSource $database -QueryTimeout 10 -Query $sqlUpdate -SqlParameters @{ word = $word }
}

foreach ($word in $keywordsFamily)
{
    $sqlUpdate = "UPDATE moz_bookmarks
                    SET parent = (SELECT id from moz_bookmarks WHERE title = `"My_Family`") WHERE moz_bookmarks.title like `"%$($word)%`" COLLATE nocase;"
    Invoke-SqliteQuery -DataSource $database -QueryTimeout 10 -Query $sqlUpdate -SqlParameters @{ word = $word }
}

#*******************************************************
## Uncomment below to Execute other Queries from above
#*******************************************************

#Invoke-SqliteQuery -DataSource $database -QueryTimeout 10 -Query $sqlInserts

#Invoke-SqliteQuery -DataSource $database -QueryTimeout 10 -Query $sqlCreateTrigger

#Invoke-SqliteQuery -DataSource $database -QueryTimeout 10 -Query $sqlMoveAllToTemp

#*******************************************************
## Clean up
#*******************************************************

#drop the trigger...get original db back to original triggerless state
$sqlDeleteTrigger = "DROP TRIGGER AutoGenerateGUID"

Invoke-SqliteQuery -DataSource $database -QueryTimeout 10 -Query $sqlDeleteTrigger

Outlook Folders and Powerhsell

2016-04-23T21:10:00.001-04:00

I spend a LOT of time drafting procedures and monitoring penetration tests for my employer. This means I don't get a lot of time, even at home, for being a nerd and breaking things. I have been able to spend a bit more time in PowerShell. For some reason, I find that I am constantly having to "reorganize" my Outlook folders at work. Since I deal with a large number of people, groups, projects, AND spam, I have both a large number of Rules as well as a LARGE number of folders.

I found an older script for the listing of Outlook Folders. Being that I wanted a quick, easy visual of what the structure looked like in order to tweak my rule set...and get rid of the unnecessary stuff, I thought that this script would be perfect. While it didn't go as deep in the recursion as I needed, it was an excellent starting point and required very little modification to get the output I wanted and to go as many levels down as needed.

The original script, by Kent Finkle, can be found at:
https://gallery.technet.microsoft.com/office/b1295e6f-6d16-4df4-b644-f3c7e4031a69#content

The changes that I made to Kent's script, in addition to getting a full recursion:
- added some visual help with the tree view
- added to Folder name a count of how many items are in that folder

The Output resembles the below. I should note that my account is an MS Exchange account and I have not tested this against an IMAP/POP3 PST file.

-MyUsername@MyEmployer.com
---| MyUsername@MyEmployer.com Items: (1)
-----| Deleted ItemsItems: (24)
-----| InboxItems: (932)
-------| ___AttachmentsItems: (0)
-----| OutboxItems: (0)
-----| Sent ItemsItems: (2799)

The script as modified:
$comments = @'
Script name: Get-Subfolders.ps1 Created on: Friday, August 17, 2007
Author: Kent Finkle Purpose: How can I use Windows Powershell to
Write a Script That Accesses All the Subfolders in My Outlook Inbox?

******************
Modified: 22 April 2016
Author: Dave Werden
Comments: Updated Kent's Script to provide tree-like structure ouput
'@

#-----------------------------------------------------
function GetSubfolders($Parent) {
    #spacers used to provide visual of different levels
    #each call to function means we've gone a level deeper
    $spacers = $spacers + "--"

    $folders = $Parent.Folders
    Write-Host($spacers + "| " + $folder.Name + " with Items: (" +   $folder.Items.Count + ")")

    foreach ($folder in $folders) {
       $Subfolder = $Parent.Folders.Item($folder.Name)
       GetSubfolders($Subfolder)
    }
}
#-----------------------------------------------------

# 6 is always the 'inbox'
#...try enumerating through a range of numbers and see
# what pops up :-)
$olFolderInbox = 6

$o = new-object -comobject outlook.application

$n = $o.GetNamespace("MAPI")

$spacers = "-"

foreach ($folder in $n.Folders) {
    Write-Host($spacers + $folder.Name)
    GetSubfolders($folder)
}
#-----------------------------------------------------
#End Script

I think I mentioned above but to reiterate, I have only tried this against my own work and personal Outlook accounts. The iteration through the OST works fine, the attempt at home...not so much. But hey, it gives me something more to work and learn. :-)

UPDATE: I was able to get this working just fine at home with PST files (yes, multiple). The trick was that I was running Outlook as a standard user and trying to execute the PS code from an elevated ISE instance. Some quick googling found me the problem.

For anyone one else:
The initial error I received:
new-object: ..... Exception from HRESULT: 0x80080005 (CO_E_SERVER_EXEC_FAILURE) .....

When you get this error with Microsoft Office components that you're trying to automate, the problem is that you are trying to interact from two different security levels. Running the script as a normal user works just fine. Now...I want to see about up and down grading user account perms within a PS script. I know that there are some elevation techniques and token impersonation scripts already out there...but it sounds fun to me. :-)
End UPDATE

What I may do is work this into a module for different functions such as getting/setting rules and whatnot. The ultimate goal, in my free time, is to tweak and mess with the com interface to applications and what potential pentesting values are there. ;-)

Some Antenna Measurements

2015-12-06T22:55:00.001-05:00

I have been so swamped with work and family things...and some revisiting of old hobbies such as electronics and HAM Radio. So this post has really nothing to do with security, at the moment. I have been playing with some SDR's and researching some techniques and attacks from that standpoint.

Anyway, I'm having some pains with getting one of my quad-band radios to work and decided that I am going to just homebrew a new antenna. Since I needed the measurements, I figured I'd use Excel to handle the math.

The first chart is the measurements (based on the center frequency for each band) for the Driver and Radials for a Ground Plane antenna. I've double-checked most of the math, somewhat randomly, and I'm 99% certain is accurate.

This chart is the measurements for a J-Pole antenna, based again on center frequency for each band. When I have more time I will be updating this with a better explanation and a generic drawing of a J-Pole antenna and how the different A, B, C, D measurements play a role. Suffice to say, the J-Pole antenna looks really cool to me and I think it would be awesome to build!

Unfortunately, I forgot to record where I got the bottom picture from so I'll have to find the appropriate site/person to credit when I get a minute.

Windows 10 Update - Flickering pain

2015-08-30T22:51:00.002-04:00

So I decided it would be a great idea to upgrade on my home machines to Windows 10. I had already updated my laptop and had had NO issues with it. Not so smoothly with my desktop.

What ended up happening was that as soon as I logged in, the screen would start to flicker, a lot, as in almost to the point of inducing migraines! After a few minutes digging, I found the below solution, and link.

Step 1: Open Task Manager. You can do this by hitting ctrl+alt+delete and selecting Task Manager from the list that appears
Step 2: In the top left corner, hit “File” and select “run new task” from the drop down menu.
Step 3: Type “msconfig” into the box.
Step 4: A new box will open. In this new box, select the Service tab.
Step 5: Scroll through the list and search for “problem reports and solutions control panel support” and “windows error report service.”
Step 6: Disable the two items by clicking the checked box beside them. The check should disappear.
Step 7: Click Apply, then click OK.
Step 8: You may be prompted to restart your computer. This is not necessary, but definitely recommended.
If your computer uses Norton Antivirus, upon restart, it will probably be a good idea to update the Norton program (hopefully the program will prompt you to update). If you do not use Norton, you still might want to run an antivirus scan and even perhaps an anti malware scan.
After that, your PC should be in good shape. Enjoy Windows 10! And remember, if you don’t like it, I’ve read that for a month you have the option to revert back to your old OS. If you want to, a quick internet search will bring up an easy step by step process (but remember to always back up your info before switching an OS!!).
Hope everything starts working again! Have a good night!

https://social.technet.microsoft.com/Forums/en-US/087c7f87-69e1-45eb-83d1-e92dfa497e99/windows-10-flashing-screen-after-upgrade-from-windows-7?forum=onlineservices

Hope this helps anyone else who may be facing the same strange MS crap!

Peace out, YO!

Moving on in life, career

2015-07-31T08:34:00.000-04:00

I had really thought that I would already be in bed sound asleep tonight after a busy day. Unfortunately, it is the 3rd of July, which comes directly after the 2nd of July, and directly before the 4th of July, which I am certain any 2nd grader could have told everyone. Anyway, it's around this time of year that at basically any time of the day or night, even here in West Bloomfield, that those wonderful mortar rounds start going...I mean fireworks. Fireworks to most people, and even to me sometimes...but also mortar, rocket, IED, etc. exploding all around. So...until I am not so...amped...up, I figured I'd watch a movie and write some stuff here. :-)

New Job, New Home, New Peoples, Old Family, Old Friends, Old Home!
In the last month we, my family and I, packed up house and trucks and headed north. Hopefully it's our next to last final one before we find some land and build a perfect Michigan Palace...and no, I don't meet a double-wide in Warren. OK...maybe a bad joke so a I'll add a heartfelt apology to the people in Warren, in trailers or otherwise.

Anyway, back to the move for a quick second. I learned a few very important lessons with this move, in both career terms and in taking care of our 'stuff.' I'll be happy to share these in a minute but first I think I might mention the reason for the move.

In August of 2014 we packed up our lives in Augusta, GA and headed for the 'DC Life,' with my job in Alexandria, contracting still for the Army (Northrop Grumman) as a Cyber Operator on the Army's Red Team. Now, I don't care what organization you are with or who you fantasize is the best 'Red Team' and techs. I will tell you that I'd be more than happy to go 'fist to cuffs' with anyone who doesn't agree that the Cyber Operators on the Army's Red Team have been the best, have trained some of the best', and have proven this time and again. Anyway, I digress.

Although we moved there in August of 2014 and I felt like I was a part of the team from the get-go, it was also a contract re-bid year for what I assume is at least 80% the DoD. This meant that a lot of good people on the team received some very good offers to move on. So, I still loved the time I spent there and there really are some excellent operators sitting there now. But with the composition changing so much and some frustration my wife was having with her own job as a teacher, she said she was ready to go.

I came across, on a whimsical look at indeed.com, a posting for a CyberSecurity guy/gal...and it was in Auburn Hills, MI with Fiat Chrysler Automobiles.I applied, interviewed, felt I blew it but they still flew me up for a panel interview which I knew I blew. Then I got THE Offer. The kind of offer a mid-career techie like me loves to get. Small team, individual's with particular areas of focus, such as Vehicular Network Penetration Testing (MINE!!!), great money (for a guy who's not really greedy anyway, AND the FULL relocation package with free realtors, movers, packers, etc. Oh, and the benefits are OUTSTANDING. Most importantly, the people I am working with directly and tangentially are pretty AWESOME.

So, I have been at FCA for two weeks now and am having a blast. About my only complaint is that I need to get a corporate leash (at least I got to pick a Droid) :-) Seriously though I love it. I have been inundated with new project assignments, taking over other projects, and just digging chest-deep into new protocols and tactics!

Describing SSH to your mother

2015-03-12T14:55:00.001-04:00

I was recently asked how I would describe SSH to the person's mother. Assuming that English is her native tongue, I gave the first explanation that came to mind. This explanation involved the use of puzzle pieces and colorful napkins. I originally didn't plan to to rehash that here. Instead, I thought I would refresh myself on the protocol (SSH 2.0) and write it up...so it's maybe fresher in my mind as it has admittedly been quite a while since I have gotten into the nuts and bolts of SSH. I think I will do a little of both. :-) To keep it simple (I hope) I will first discuss SSH from the more nerdy side of life and will break the discussion into

The Players:
CLIENT
SERVER
Switch 1 (just be cognizant that my discussion here involves communication between the CLIENT and SERVER using Switch 1)

Initial Session Setup
First, the same old three-way handshake.

CLIENT sends the SYN packet to SERVER
SERVER sends the SYN,ACK packet to CLIENT
CLIENT sends the final ACK packet of the handshake to SERVER

Figure 1: TCP Handshake

[RFC4523:4.2]
Protocol Version Exchange
Once the initial TCP-Handshake is accomplished, both Hosts announce to each other what protocol version they are running. This is known as the identification string and has the following format:

SSH-protoversion-softwareversion SP comments CR LF

Figure 2: SSH Protocol Version Exchange

There are a few variations of these strings and these [variations] are based upon the version of the client and the server. The identification string is "usually" sent first by the server (SERVER in this example). This string sent by the server should be the only bit of information sent by the server until the client (CLIENT) verifies the version of the protocol that the client is using. A full discussion of this can be found in the RFC itself, but here's a quick breakdown:

     SSH = should be obvious...but if not...try Basic Protocol Help first. :-)
     -protoversion = If this doesn't say 2.0 from the server, I'd avoid connecting...just sayin'
     -softwareversion = No real concrete value. Basically, if it conforms to the applicable RFC's, it's fair game.
        SP = literally, a SPACE character (ASCII 32)...NOT A NULL!!! This is ONLY needed if there are comments
     comments - the identification string has a max length of 255. This section can be arbitrary but it is usually used by the server (again, SERVER in this case) to initiate the Diffie-Hellman key exchange.

     - a few other quick notes:
        -protoversion = must contain only printable US-ASCII characters with the exception of the minus sign and spaces
        -softwareversion = "used to trigger compatibility extensions and to indicate the capabilities of an implementation" (RFC4253)
        -comments = this should be used to provide helpful information to the user(s).
        - There can be multiple lines sent by the client or server as long as:
            - ONLY the first line starts with "SSH"
            - each line MUST end with a Carriage Return(CR, ASCII 13) and Line Feed(LF ASCII 10)

[RFC4253:8]
Diffie-Hellman Key Exchange
SSH makes use of Diffie-Hellman to complete the key exchange between the CLIENT and SERVER. I am not going to get into Diffie-Hellman here other than to quickly cover its role in the SSH process. Suffice to say that it has been around for a few days, since 1971 I believe, and is a very creative way to perform the key exchange.

Figure 3: DH Key Exchange

Encrypted Traffic
Once the protocol is agreed upon and the key exchange is completed, the traffic is then encrypted. The key used for encryption can be changed during the conversation.

Figure 4: Encrypted SSH Traffic and Session Teardown

Misc Notes
It is germane to note that the RFC defines additional, individual, items that can be used:
- The servery key_algorithm, the encryption_algorithm, and the mac_algorithm are required by the RFC to be a match between the Servers options and the FIRST matching option from the Client's list.
- MAC: Message Authentication Code, if its usage is agreed upon then each binary packet except the first will contain the MAC as the last field in the payload.
- compression: compression can be used when agreed upon by both the server and client. The RFC provides an interesting discussion in packet size and compression and how this may/may not affect network traffic.
- Key Change: a key change may be initiated by either side by sending a SSH_MSG_KEXINIT. The RFC does stipulate that the roles MUST NOT be changed, regardless of who initiates the key change process.

Now, back to telling your mother about SSH.

The Players:
Yourself (Client)
Your Mom(Server)
Puzzle Pieces
Different Color Napkins

Initial Session Setup
You know that you need to give your mother some puzzle pieces. However, the wind is blowing fiercely, the rain is pellting you both, and you must pass the pieces to your mother over a large crater between the both of you. So...
You call out to your mother: "Yo!"
Your Mom hollers back: "Yo, I can hear you!"
To which you holler: "I can hear you!"

Protocol Version Exchange
You mother lets you know that she can work with pieces from the 5000pc puzzle depicting the 1984 Detroit Tigers.
You have pieces for this puzzle and therefore let her know that this will work well for you.

Diffie-Hellman Key Exchange
Your mother now lets you know that she can use the puzzle pieces from your left and right jeans pockets and from your left coat pockets.
Your mother also lets you know that she can accept the pieces wrapped in Blue, Maize, or Orange.
You let your mother know that you do, in fact, have puzzle pieces in your left jeans pocket and in your left and right coat pockets.
You also let her know that you have the ability to use Maize or Orange colored Napkins.
Because you first mentioned the left jeans pocket and your mother can use this, these are the pieces you will be passing to your mother. Likewise, because you first listed the Maize colored napkins, the pieces will be wrapped with said napkins, as will any response from your mother.

Encrypted Traffic

Completing this puzzle is important to you. As such, you've contacted your mother, agreed upon which type of pieces are needed, and how to protect said pieces from the wind and rain. After you've agreed upon the pieces and the protection, there is no need for you to yell across the hole between the two of you.

So, I hope that this post will make sense to me in a year, and to anyone else who may read it. I left out some of the more technical things on purpose, especially the under-workings of the Diffie-Hellman protocol.

Kali (Debian) error when updating/upgrading

2014-12-23T21:54:00.001-05:00

It has been a good bit since I've had time to write anything here, and one of the things keeping me busy is my attempts to prepare to take the OSCP. What an incredibly fun course, albeit a little frustrating at times. One of the things that has really been driving me nuts, with more than just OSCP work, is that of time being wasted on oddball problems.

My most recent pain in the rear came tonight when I finally decided it was time to figure out why my msfupdate wasn't actually performing an update. Each time I ran it over the last month, I noted the failure and kept pushing on with whatever target I was going after. Tonight, much to my chagrin, has been all but wasted on WAITING for 115 updates to download and be applied to my Kali VM. This was after I found a solution to the error I was getting when I attempted to run apt-get upgrade -f:

...
dpkg: error: parsing file '/var/lib/dpkg/available' near line 14392 package 'libpurple-bin':

which returned an error code of (2). After my looking and searching around, I learned the following:

libpurple-bin is part(all?) of pidgin, the Instant Messenger program...that I do not use on that particular Kali VM
the actual line, 14392, of /var/lib/dpkg/available ended up containing garbage
in the same directory, unknown to me until I looked, was available-old, which had the same date/time stamp as 'available' but a different size (smaller)

So, with some quick copy commands, I made the following changes:

mv /var/lib/dpkg/available /var/lib/dpkg/available_ERR_Line_14932.orig
cp /var/lib/dpkg/available-old /var/lib/dpkg/available

I then was able to re-run apt-get upgrade -f, and after approximately 30 more minutes, it was time to reboot the VM and see if it all works, AND if my MSF was newer than September 2014. Success!

In trying to find the problem, I noticed that there were a LOT of posts with related errors dealing with /var/lib/dpkg/status, or in a few cases, the entire /var/lib/dpkg directory. Before doing what one forum poster did, which was accidentally removing the entire directory, I'd suggest the following for anyone who faces this annoying error:

first, check to see if the system already has a backup of whatever dpkg file is giving you pains
if there isn't a backup of the last working file you need, you can try to fix the issue by copying said file from either the latest installation media or from another VM of the same flavor

After getting a "good" copy of the file in place, I'd suggest at a minimum running these few commands:

sudo dpkg --configure -a
apt-get clean
apt-get update -f
apt-get upgrade -f

Hope this helps the next nerd to have this issue! Now, back to PHP reverse shells! :-)

Awesome Bash Vulnerability

2014-09-25T13:26:00.000-04:00

I know that this has been posted by a number of people including Doug Burks from SecurityOnion. Just thought I'd share the links. The vulnerability itself...nice...from an attack perspective.

http://blog.securityonion.net/2014/09/bash-vulnerability.html
http://blog.securityonion.net/2014/09/bash-vulnerability-part-2.html

Augusta's HORRIBLE drivers and Network Insiders

2014-06-17T15:01:00.002-04:00

I have been having this thought circling my overly-active...for about a week now.

I was driving home from the VA hospital last week, taking one of my normal, short routes to get home. One particular stretch of the road I was on has three traffic lights all within [about] a half-mile total. These lights are, naturally!!!, timed so as to make you stop at each of the three. However, there is one exception to the stopping rule: the "I don't care/I'm more important than anyone else on the road/It's my right/" attitude. At least this is what I personally believe is [at the least] a large portion of their attitude about red lights and what red lights mean.

To put it simply, as I pulled up to stop at the first of the three traffic lights, there was a fellow going the opposite direction as me who just had to make a left turn, despite the light having already been changed from Yellow to Red. Yup, this ignorant/selfish/lazy/stupid person ran the red light. However, that's not even the worst part about the bad HORRIBLE drivers around this town?

Granted, Augusta, GA certainly has [much] bigger problems then schmucks running red lights. However, the interesting, (and absolutely FRUSTRATING) fact here in Augusta is that at least ~90% of the red lights get run...this is my perception at least. This poses an additional need to be extra-vigilant, always watching ALL of the other lanes at an intersection and waiting at least five or ten seconds before entering the intersection (if you're the first car in your lane).

The driver running the light isn't really doing anything out of the ordinary, based upon the "normal" behavior of drivers in this area
But they are still breaking the law, trying to sneak by the rules and sneak by any cops (if the cops would even pull them over)

Have more cops (and make them write the tickets)
Have the cops learn what to watch for, especially in terms of that one 1987 Oldsmobile Cutlass that starts gunning it while still being 100' from the signal

By now, my three (if I have even that many) followers may be wondering: What in the world does the poor driving habits of people in Augusta, GA have to do with anything network related? The simple answer is: "Nothing."...Directly that is. But some certain things stuck out the other day that reminded me of a common network problem, so let me see if I can tie these two things together.

Can we think of all of the cars on the road in the city of Augusta, GA as representing user/machine activities on a network. For instance, one car could be used to represent a user transfering a file while another car could represent standard AD replication between multiple DC's. If you can think along these lines, then I believe it will be easy for you to make the same leap that I did.

When I was thinking about all of these cars in the turn lane, I came to the conclussion that they could be placed into two distinct catagories, despite any number of small, and large, differences in either the vehicle(s) or the driver(s). These two catagories are: safe drivers, and unsafe drivers. Now, think about what they are doing: they are making a turn, the same turn, roughly going the same direction (although the tires of each car may not follow the exact arc of another).

Now, and my brain did this auto-magically so I might be wrong, but it's not a far leap to translate the drivers of each car into "Users." As the drivers are all driving, the "Users" are all..."using"...a network, a resource, a device, etc. This is the point in my thinking were I came to draw a correlation from the drivers making the turn to one of the biggest problems we face in network security: The Insider! So who is the insider in my analogy and can this do ANYTHING for me, or others, in terms of finding that insider?

Who is the insider in my turning cars analogy: It's easy....it's the baby in the backseat! ...just kidding. The insider is represented in this analogy by the idiot jerk, or even JERKS, who run the red light instead of waiting for the next green light. Those that made the green, and even yellow, lights are the users performing "normal," authorized activity on the network. Maybe that driver who forces the yellow and it changes while they are still in their turn, that driver could possibly be lumped in with the jerks who just run the red light. Your call there, because I honestly don't know that it matters to my overall thinking here.

So I have told you all about the poor driving in Augusta, GA and about how I easily correlated that into network activity, especially the inside threat. Now what? Here is where my head started to hurt the other day. I wonder if an algorithm could be defined to identify those who are GOING to run the red light, before they run it...or as soon as they put more pressure on the gas pedal? If this could be done then I believe an algorithm can be created to better identify an insider threat...maybe not as early as when they are just "thinking about it" or testing their access, but at least as early as the start of that first file transfer or copying action. Thinking about this has led me to some other thoughts regarding protection from the insider (and detection?).

Budgeting for your company's security may be a difficult or even non-existent task due to financial constraints/availability. However, I wonder about some of the bigger equations and books that throw around terms like Risk, Mitigation, Return On Investment, etc. Do we not already have at least 50% of the needed functionality to start working towards identifying and/or stopping insider threats/breaches? Do we not already have at least 50% of the tools needed to turn those terms into action...to put our brain where are mouths are, so to speak?

Some questions/thoughts:

Can you baseline your network in terms of:

The average time window that each user is logged in?

If so, then why not block them out of all times outside of that window? Sure you may have someone stay later than usual on rare occasions, but in that instance they could conceivably call the help desk for a short logon time extension.

The average number of bytes each user sends [somewhere]?

Then users could be grouped and rules utilized for abnormal data sends.
For example, you baseline and find that ten of your users send less than 10MB of data via SMTP between 9:00a and 12:00p. A rule firing for 10.01MB of data transfered, or maybe even using a calculated tolerance (say, 10%?) would alert those monitoring said rules

Do we really have any excuses left to not start making better usage of access controls

Windows Group Policies and ACL granularity have improved a lot in the last couple of years

Would it be that hard to create a security group for only those allowed to access a particular file

AND apply time limits
If it's an Office doc, the Directory Rights Management provides even more help here

*NIX systems support finer grained access controls

Implementing a two-person rule

I envision something akin to the User Access Control prompt needing the credentials of an administrative user

As two-person rule, the credentials would have to be of someone else who is already authorized to access the material

Is user training really effective against the insider?

NO! Absolutely NOT!

I cannot be the first one to have any of these thoughts or to present any of these questions. I wouldn't be surprised if these thoughts and questions hadn't been floating around the security nerd cubicles for the past 20 years. I wonder though, are we, people in general, getting more and more complacent about what we do, what we see our office mates do?

Military Leave Scam (Facebook/Phishing)

2014-05-31T00:41:00.001-04:00

[edit: I am removing the photographs on the outside chance that they are not really the pictures of the piece of trash who is pulling this scam].

I don't normally "dime" people out on non-life threatening things, but this has really got me ticked off as it's someone who messed with MY family!

An older scam appears to be resurfacing....the Soldier that needs help going on leave to be with you. A cousin of mine was hit with this and luckily she started to question everything he was saying and the pics he sent.

The scam is, in some version, a long-distance relationship with an supposed Officer in [pick your branch]. He really wants to take leave to come and spend time with you, but he is on a "secret/underground/important" mission and can't get free (time off) unless he has a replacement. So, he needs you to send an email to some General/Colonel stating that you REALLY need him to allow your boyfriend to come home for leave for some emergency. Plus, he also needs money and after you write his leadership, you'll get a "bill" of charges for his leave to come see you.

The guy that tried to scam my cousin is: https://www.facebook.com/eric.mcdaniel.9615?fref=ts. He claims to be a USMA graduate, a CAPT in the 23rd Artillery Division (which isn't real). Says he is stationed at Red River Army Depot (but lives in California???), in this non-existent unit, sent my cousin a crack-head DoD ID card (looks more Chuck-E-Cheese), claims to be from Poland, Virginia, and/or England. Even worse, claims to be a hero/veteran. Pictures he sent her looked like UK/Aus/NZ uniform, although even those pics were wrong!

Also, his "official" Army email is an AOL address, which is NOT how the US Military does things, and his unit/CO email address is u.sarmytransitdepartment@usa.com, again, NOT a valid military address, at least to my knowledge.

One of the last correspondences (see below) that she got from him/his "unit" detailed the following:
"He is a Captain, 23rd Artillery Special Ops located in TX based out of Red River Army Depot. Leave to be his house or my house. Was told he just needed a darn good reason from family. Says has almost 20 years in. Army saying they need pay for flight and replacement officer. Underground mission was mentioned once."

This guy is a SCHMUCK!!! ...to put it nicely.

Since there is already a lot of information on the web about this type of scam, I am not going to go into much detail. However, I would like to post some pics of the emails and pictures that my cousin received from this loser!

Emails from "his Unit Leadership"

[Edit: Picture Removed]

Of all the pictures he sent my cousin, one is my absolute favorite. He tried so hard to convince my cousin that this format was an alternate DEERs card!!! What a TOOL!!!!!!

[Update: More info]

Just wanted to add here that, after I read the records of my cousin's email and IM exchanges with this uber-tool, I am even more convinced that he needs, at least, a very large and long-lasting blanket party. In multiple messages he claimed to have "lost more men" during the previous night's "dangerous mission" outside of RRAD. It was obvious just part of his scam to try to get my cousin to worry about him and to try to get her to speed up the "leave payment" that his "unit" required. Jeez, I wouldn't mind whoopin' this boy one or two times!!!!

Annual Simulator Training

2014-05-05T22:33:00.000-04:00

I watched an interested episode of Nova with the family the other night. It detailed issues with cruise ships and their sinking and compared similarities between disasters such as the recent Italian ship in which the Captain hit a BIG rock, the Titanic, and the Oceanos. A large part of the comparisons dealt mainly with the ships and the Captains. However, part of the episode dealt with crew training.

In the aviation world, at least in the US, pilots are apparently required to take annual simulator training. Maritime crews and Captains are not. Neither are Network Security professionals. Wait. What's this about annual simulator training for nerds?

It's simple really...at least in my head; I admit that I may be foggy after having a Cinqo de Mayo dinner with the family at Chili's. But I think it makes sense, at least some sort of annual event for all types of network security folks, not just DoD exercises or SANS training courses....or even the rush to submit CPEs for your CISSP at the end of the cycle. I may be putting the majority of us nerds into the same container as I am personally, but here's my points:

1. I am frequently moving from one project to the next. Although some may have solutions in the same domain (pun intended!) as others, there is no one-size-fits-all, at least I haven't found it yet. In the last 12 months, for example, I have had to work out solutions using: flash, php, perl, python, bash, batch, PowerShell, new exploits and old exploits, etc, etc. Have you not had to do the same? I'm certainly not complaining, although it can be frustrating on job interviews if you haven't touched perl in 12 months and you get a specific question only to have the answer stuck on the tip of the tongue. :-(

2. What's old is new and what's new is old. While base methodologies and languages haven't changed a whole lot over the last decade, it's safe to say that solutions using said methodologies and languages, or some combination thereof, have certainly changed. Do you use the same type (or even the exact same) script for some task you've been doing over the last decade. I care to venture the answer is no...or at least I think it should be. For example, what I used to like to do in Perl or Batch/Bash scripts, I now like to do in PowerShell (and Perl and Batch/Bash). Some GUI tools even catch my fancy every once in a while. :-)

3. Who's the bad guy? He's not the same one he was decade ago. Probably not even the same he was a year ago (or it could be a she, to be fair!). Does the adversary (being he, she, or them) use the same ~~tactics, techniques, and procedures~~...tools and methodologies as a year ago. Sure, beaconing will always be beaconing...but even this has changed over the years in terms of ports, protocols, services, encryption, data, etc, etc, etc.

4. Certification providers and requirerers (not sure that's a real world) have moved towards a demand for recertifying, annual training requirements, or a combination thereof. That's all fine and dandy and usually not that complex to satisfy. But, is it REALLY satisfying? If you took a SANS course last year just to learn something new and/or satisfy some CPE/CMU/C?? requirement, could you sit down today and perform even half of the tasks you learned. No...I don't think most people can unless that training was already a part of their job function or they found a way to incorporate it as such! Fact is our training and our knowledge, in any field really, is perishable. If you don't use it, you WILL lose it and that's the cold hard fact of the matter.

I have at least 15 different and specific skills/languages/tools listed on my resume. I can even talk to all of them to some extent. However, there is a number of them that I need to use the manpage for to refresh myself because of the perishability of the skills (and sometimes because the ever-so-slight differences between some scripting languages). I mention this not as a focal point of this post, but just a way to maybe bring the point home a little bit more, that we computer security nerds live a world that is as horizontal as it is vertical and our tools are as perishable as mayonnaise on the back porch on a hot summer day.

This brings me to the thought of "Annual Simulator Training" for computer security nerds. If we had, regardless of industry or threat, or better yet, tailored to industry and threat, an annual training on a simulator, wouldn't this in fact allow us time to re-learn, re-master, re-visit the tools we don't get to use often enough, or in ways that are challenging enough. I am sure that one of the two people who read this blog has already thought "Doesn't the DoD or USCYBER already do an annual training/simulation event?" The answer would be yes. However, the number of players in the "big" simulation is not a realistic sampling of the network security nerds inside the DoD/USCYBER complex itself. Not to mention, it's training only for this finite number of participants.

There are options available now in terms of simulation environments for network protection, detection, response, analysis, etc. But they are targeted to specific customers (read: If you have enough cash or credit, you can have a simulation network that works 50% of the time...if you're lucky!!!). Furthermore, as with the Captains and crews of marine vessels, there is no one specific requirement for annual simulation training in our field. True that there are the requirements of CPEs/CMUs and the opportunities that some individuals get based solely on there employment location and/or provider. However, I would argue that the private sector is as important as the government and public sectors in terms of how we are equipped to protect and defend. And if the level of importance is the same across the board, at least to all US interests (private, public, and governmental), then the training exercises and environments should be further extended to support annual simulation training for all of us network defenders and penetration testers! Furthermore, if these training capabilities were extended, this would allow for federal support/mandate of an annual simulation training environment.

Now, before anyone shoots me for thinking that I want the federal government to be "all up in our business," let me say this: I don't want them in our business, I want them to better support our business. I think in doing so, we all benefit regardless of sector. Furthermore, it might help stop some of the hair-brained, half-cocked, knee-jerk reactions that I see in terms of policy shifts and requirements development (why should baselines shift every time some CISO or some Colonel gets wind of some "new" threat?).

OK. I'm going to stop here and take a giant leap off of my soap box! Hope you enjoyed this episode (psychotic episode???) and stay tuned for a word from our sponsors. :-)

Zend Framework 2 configured on Ubuntu 12.04

2014-02-10T21:22:00.000-05:00

Setting Up the Zend Framework 2 Skeleton App on Ubuntu 12.04

I recall a class I took a few years ago during my first semester in the software engineering Master's program at the University of Michigan. This particular class stays with me as the instructor had a "guest speaker" who was on the development team for the Zend Framework. At the time I chose to use a different framework (and language) so I filed the usage of the Zend Framework for a rainy day. I think that day has come...but in a good way.

Recently I had been working on a PHP-based web application. I would like to say that it is finished...but unfortunately I need to do a few more housekeeping things with it and write a few more pages. This project though got me thinking, the first time a year ago, and then again three months ago that I would like to migrate it to a purer MVC-based application than what it is right now. There were multiple catastrophic failures while I was writing and backing up code along with the "customer" in this case changing requirements multiple times. So while I started initially with an MVC pattern, the current state of the application is much more ad hoc than I had wanted. Which is what got me started thinkning again the ZendFramework and what led indirectly to this blog entry.

I figured that it shouldn't be too hard to install a well-known framework on my Ubuntu VM or my craptastic Windows 8 host...right? Turns out that it was a little more complex than I anticipated. Between Windows 8 and Ubuntu 12.04 I would say that the required workload is about the same. Since I prefer Ubuntu, I want to focus on that, especially since I built this VM specifically for development projects. So without any more fluff or garbage from me...

I found an install guide on the zendframework.com website. While the guide was good, and offered multiple options, it certainly wasn't exact...or maybe the right word is "complete."
The first option in the guide is that of using composer. However, unless you know to add the right flags to ignore stabilty, so I am going to skip over the usage of composer for this install and instead, clone the git repository of the framework and go from there. I do have some screenshots as well as some video (I am going to make my first attempt at a YouTube instructional video for this effort) that I will load/link here on a future update of this post.

The steps that worked for me (using a base, updated install of Ubuntu 12.04 iso):

1. Clone the Skeleton Application repository from github:
sudo git clone https://github.com/zendframework/ZendSkeletonApplication.git /var/www/zf2-skeletonApp

2. cd into new directory: cd /var/www/zf2-skeletonApp

3. Now here is where we'll use the composer inside the framework to install:
sudo php composer.phar self-update
sudo php composer.phar install

When the above two commands are run and completed, which can take a few minutes, you will most likely get a block of messages like the below that describe additional functionality you can add to you Zend Framework.

Loading composer repositories with package information Installing dependencies (including require-dev) - Installing zendframework/zendframework (2.2.5) Downloading: 100%
zendframework/zendframework suggests installing ext-intl (ext/intl for i18n features (included in default builds of PHP)) zendframework/zendframework suggests installing doctrine/annotations (Doctrine Annotations >=1.0 for annotation features) zendframework/zendframework suggests installing ircmaxell/random-lib (Fallback random byte generator for Zend\Math\Rand if OpenSSL/Mcrypt extensions are unavailable) zendframework/zendframework suggests installing ocramius/proxy-manager (ProxyManager to handle lazy initialization of services) zendframework/zendframework suggests installing zendframework/zendpdf (ZendPdf for creating PDF representations of barcodes) zendframework/zendframework suggests installing zendframework/zendservice-recaptcha (ZendService\ReCaptcha for rendering ReCaptchas in Zend\Captcha and/or Zend\Form) Writing lock file Generating autoload files

4. Set up required VirtualHost - Depending on your setup, you will need to modify one or more of the below:
    - /etc/http/httpd.conf
    - /etc/http/extra/httpd-vhosts.conf
    - /etc/apache2/apache2.conf

On Ubuntu (and other Debian based systems that package apache under /etc/apache2), the virtual host setup can be a little tricky. To start with, create a file with the name of the file being the same as your hostname. So, since I have called my virtual host zf2-skeletonApp, I have created:
/etc/apache2/sites-available/zf2-skeletonApp.localhost with the following content:

ServerName zf2-skeletonApp.localhost
    DocumentRoot /var/www/zf2-skeletonApp/public
    SetEnv APPLICATION_ENV "development"

        DirectoryIndex index.php
        AllowOverride All
        Order allow,deny
        Allow from all


Take note of ServerName, DocumentRoot, and Directory. ServerName is the NamedVirtualHost value that apache2 will look for when the site is requested. DocumentRoot and Directory both contain the full paths to the 'public' directory of the zf2-skeletonApp. This is where the Zend Framework will serve the default index.php.

6. So that we don't forget to do it later, let's make sure that the site is enabled and that the ReWrite mod is enabled.
   - to enable the site, use the following command:
sudo a2ensite zf2-skeletonApp.localhost (Note the full name of the site used in the command). Another item that should be noted is: if you already have a file of the same name at /etc/apache2/sites-enabled, the a2ensite command will fail. The reason for this is that the a2ensite command creates a link of the available site at the sites/enabled/ location

- You could run the command to enable the Rewrite mod without checking to see if it's already enabled. However, you should spend a minute and drive around your apache2 file structure a little bit and what better chance than this one. :-) Check the listing of the files in /etc/apache2/mods-rewrite/ ls -la /etc/apache2/mods-rewrite Now, to enable the Rewrite mod, use the following commnad. sudo a2enmod rewrite

7. Now it's time to update /etc/hosts so that your hostname will resolve (loopback address is perfectly fine for this) - 127.0.0.1 zf2-skeletonApp.localhost zf2-skeletonApp

8. One final restart your web server sudo /etc/init.d/apache2 restart

9. Check your work by attempting to open the zf2-skeletonApp.localhost site in your browser firefox http://zf2-skeletonApp.localhost &

10. If everything was successful you should be looking at the welcome page (zf2-skeletonApp/public/index.html). - If you get the default apache2 install page, or some other page, then you missed a step.

I'll soon be updating this with some screenshots and hopefully a video of the full process.

Desktop Packet Reference Tool

2013-12-04T23:33:00.000-05:00

A long while ago, I started working on a Windows app for helping people learn about packets. Unfortunately, life has had a crazy way of getting "in the way" and after at least a year, I have finally found some time to get back to working on this app.

Initially I was creating this more as a Snort rule generator and tester to help people learn more about creating Snort rules, and how they have changed over each version. The tabs for each packet type was an afterthought at the time. However, I decided it would be more fun for me to focus on the different protocols and not mess around with creating a tool that, quite frankly, already exists within Snort.

I think I will have this, and two other big projects done by Christmas. I did want to put a couple screenshots out there in case anyone with an interest runs across this blog and has changes/additions to suggest, or even complaints. Just remember, this is a fun thing for me and I hope that people will be able to utilize it once it is finished.

The application opens with this view:

The above just shows the initial view when the application is opened. I haven't changed the title yet, which is why it still reads "IDS Rule Builder." The user can select any of the visible tabs and see the standard view of the packet for the selected protocol. As of now, once a field on a tab is selected, that is the information that will stay visible on that tab view until a different field is selected. This means that a user can select IP Version, for example, switch over to the TCP Packet tab and select the "Source Port" and then switch between these two tabs without having the selected information cleared.

And here is a view of the application after the user selects "IP Version" under the "IP Packet" tab. The "Byte Offset" text is sort of a favorite of mine. I believe that anyone who has ever tried to follow Mike Poor on audio when he discusses tcpdump filters and byte offsets will appreciate having a tool like this to visualize and reinforce what Poor is saying. :-)

Anyway, this is just a preview as I still have a LOT of the information text strings to build and add in. I am toying with the idea of using some fashion of highlighting the selected field once selected but not sure if that's necessary. I do think I will get this done prior to Christmas (along with the other two projects) and once it's complete I will put the project, source, and executables up on bitbucket publicly.

Hope everyone had a wonderful and safe Thanksgiving and that their Christmas festivities are fun and safe as well! :-)

dw

Sitting the GWAPT exam - Updating my certs

2013-11-14T00:43:00.000-05:00

Four months ago I enrolled in the SANS On-Demand course for SANS542, Web Application Penetration Testing. I chose this course as I love pen testing, I understand and enjoy working with web technologies (My Master's project was web services), and the course looked exciting as Kevin Johnson, the creator of SamuraiWTF, was the "instructor" for the course.

I was initially able to find some time both at work and home to devout to listening to the audio and reading the books. However, I found my workload quickly increasing, causing me to back-burner my study efforts on SANS542. About three weeks ago, I realized that while I was being sent to Vegas for a work trip, that the exam availability would expire prior to my return. I had asked SANS for a few days of extension and was, to no surprise, told no. So I scheduled my exam for the afternoon of the last Friday that I would be in Vegas.

Had I known that by the time for the test had arrived, that I would have been two hellish days into a flu that lasted for almost six, I would have scheduled the exam for earlier. Apart from being disgustingly sick I was also swamped with work and thus had a grand total of 12 hours to prepare for the exam.

So, with little preparation and the flu, I drove on and sat the exam. I ended up using the full two hour time limit as I had to dig through the books for some obscure answers on some tools I don't use very often. However, I am pleased to say that I finished the exam with a passing score of 91.43%. Had I not already had some solid experience in web app pentesting, I am certain that would not have passed this exam at all. I felt the exact same way after I sat and passed the GREM and I do think that SANS did a good thing in making the test shorter in total number of questions as well as time.

It is my belief that by using this new testing format that the number of honestly unqualified people "earning" GIAC certs will decrease, despite the "watering down" of these and others, such as CISSP, from different branches of the US.

I will stop ranting now, before I get too high on my soapbox. The confidence I have in my technical abilities has really increased by quite a few external sources over the last few weeks. So much so that my passing of the GWAPT has me considering seriously a number of different options for my next challenge, including the GSE.

So I am now in a position to decide what I want to do next. For the GSE, I still need SANS504 (Which I've been told is one I could probably sit cold and still ace it. However, there are still at least five other SANS courses I would like to take, as well as the OSCP, the SNORT-CP, MCITP, and two software engineering certs offered by IEEE.

Not bragging...I think it's somewhat funny how many certs I currently hold. Anytime we are allowed to use tuition reimbursement funds for courses, we are required to pick courses that prep for certifications as well as having to sit and pass said certs.

What I currently hold:
Sec+
CISSP
MCP
ArcSight Admin
ArcSight Analyst
GSEC
GCIA
GPEN
GREM
GCNA
GWAPT

PowerShell and Nessus

2013-10-24T22:06:00.001-04:00

Wouldn't it be nice if every PT tool spat out their results in the exact same format? I'd be happy if Nessus, nmap, MetaSploit, and Nikto all use the exact same format for output. Whether this means they only use CSV's and keep the same order for the "header" rows or using the same elements and tree for XML output. However, reality is slight skewed...I mean different. :-) Recently I worked on a PT mission and it was my responsibility to compile the Nessus results and then to parse them for certain items. This was the easy part. The fun part came when I needed an easy way to convert the CVE numbers in the CSV output to that of what the Army uses: IAVMs/IAVAs. Easy right?

I thought so, figuring it to be just a "simple" find & replace operation. But, and this is where reality came in to perspective, it did take a little work in getting some powershell scripts to work, stripping out what I wanted into multiple output files (still CSV's, intentionally) and then convert the CVE numbers in ALL of those output files.

You may be asking "Dave, why didn't you just convert the CVEs first then strip out the results you wanted?" Good question. The answer is, to me, very simple: I would rather my find and replace operation only have to do absolutely what it must in terms of processing lines/words of a file as opposed to processing the entirety of ALL of my output files. In this case I had five seperate output files, totaling only 105MB. This isn't a big amount when one considers the computing power available today. The parsed output files numbers six and weighed in at a glaringly heavy 18.8MB...might call this a feather-weight contender.

Since the find and replace operation runs line by line, at least the way I wrote it, this 18.8MB is a much better number to run through. I should also mention that this particular pentest was very small in scope and size, consisting of five Class 'C' blocks, with a grand total of less than 500 live hosts between them. That said, I think any PT'er with even only a few PT's under the belt could recognize the small size of the original Nessus output files (105MB).

Below is what I wrote to work for my needs on this particular mission. I am in the process of turning this into a module that is dynamic, allowing the user to select the same, or some combination, of what I hard-coded, as well as the proper directories for the original Nessus output CSV's and the final output of the script.
#Parse-Nessus.ps1
#
# Ingredients:
#   1) Directory of Nessus output files
#      - In CSV format
#   2) User has ability to read and write to appropriate directories
#   3) User is able to read/modify the original and output files
#   4) IF you want to convert CVE's to IAVA/IAVM numbers, the mapping can be found at:
#       - http://iase.disa.mil/stigs/downloads/xls/iavm-to-cve(u).xls
#          - This file has a lot of other information in it. I found it easier to strip out just the CVE and IAVA columns and store into a new CSV file labled:
#          - ReplacementList.csv
#   5) I also found a great script to start with...had to modify it for me, but the link is:
#       - http://tangodude.wordpress.com/2013/04/15/powershell-multiple-find-replace-in-files-with-lookup-list/
#
# Comments: The big problem here is that the list from DISA doesn't seem to have all of the CVE numbers so there is still a little manual work that has to be done

#In order to strip out just the CVE and IAVA numbers from the xls spreadsheet, we need to convert it from an XLS document to a CSV document:
$xlCSV=6
$Excelfilename = "C:\users\UserOne\Desktop\iavm-to-cve(u).xls"
$CSVfilename = "C:\users\UserOne\Desktop\TempListing.csv"
$OutCSVfilename = "C:\users\UserOne\Desktop\ReplacementList.csv"
#create an Excel object
$TempExcel = New-Object -comobject Excel.Application
#we don't need to actually open Excel
$TempExcel.Visible = $False
#we don't need macro or other alerts
$TempExcel.displayalerts=$False
#Open the downloaded XLS file with the Excel
$TempWorkbook = $Excel.Workbooks.Open($ExcelFileName)
#Now save the opened file with the new filename and as an CSV file
$TempWorkbook.SaveAs($CSVfilename, $xlCSV)
#Close the Excel object
$TempExcel.Quit()
#Just in case, Really close the Excel object :-)
if(ps excel){kill -name excel}

#we don't need to keep the converted CSV file.
del $CSVfilename

#we will be reading this CSV file into a hash table but first, let's parse out the info we really want
#Where the Nessus CSV files are located
$CSVSourceDir = "C:\Users\dwerd_000\Desktop\nessus"
#Get ONLY the CSV files you want. In this example, the files have names like scan1.csv, scan2.csv, so the -like "sc*.csv" will select only our scan output files
$DataFiles = Get-ChildItem $CSVSourceDir -force | Where { $_.Name -like "sc*.csv" } | Foreach-Object -process { $_.FullName }
#If you want to know how many files were stored in the DataFiles object
[int] $DataFilesCount = $DataFiles.Count
#Again, this is just for verifying the number of CSV files
Write-Output "Discovered $DataFilesCount CSV Data files in $CSVSourceDir "

#Now that we have the needed files in the DataFiles object, it's time to strip out the data that we want.
#First, declare some vars for the output files. Here you can see the items I was most interested in.
#One small note of caution: create the directory structure that you want to use.
$outFileHighs = "C:\Users\UserOne\Desktop\nessus\Parsed\NessusResults_ALL_Highs.csv"
$outFileAdobeReader = "C:\Users\UserOne\Desktop\nessus\Parsed\NessusResults_ALL_Adobe_Reader.csv"
$outfileShockwave = "C:\Users\UserOne\Desktop\nessus\Parsed\NessusResults_ALL_Adobe_Shockwave.csv"
$outFileFlash = "C:\Users\UserOne\Desktop\nessus\Parsed\NessusResults_ALL_Adobe_Flash.csv"
$outFileRCE = "C:\Users\UserOne\Desktop\nessus\Parsed\NessusResults_ALL_Remote_Code_Execution.csv"
$outFileOracleJava = "C:\Users\UserOne\Desktop\nessus\Parsed\NessusResults_ALL_Oracle_Java.csv"

#Now let's parse through the DataFiles. The ForEach loop will load each file, search for each wanted item,
ForEach ($DataFile in $DataFiles)
{
        #Again, some verbosity here for info/debugging purposes
        $FileInfo = Get-Item $DataFile
        $LogDate = $FileInfo.LastWriteTime
        Write-Output "Reading data from $DataFile ($LogDate ) "

        #Let the Parsing begin. Each parsing line appends the selected data line to the specified CSV file. The NoTypeInformation switch is personal preference...but I'd recommend using it.
        #Find all vulns for Adobe Reader that have an actual Risk value and the Risk value isn't "None"
        [array]$CSVData += Import-CSV $DataFile | where {$_.Description -Match "Adobe","Reader" -and $_.Risk -ne "None" } | select "Plugin ID", CVE, Risk, Host, Protocol, Port, Name, Description | Export-Csv $outFileAdobeReader -NoTypeInformation -Append

        #Find all high vulns
        [array]$CSVData2 += Import-Csv $DataFile | where {$_.risk -eq "high"} | select "Plugin ID", CVE, Risk, Host, Protocol, Port, Name, Description | Export-Csv $outFileHighs -NoTypeInformation -Append

        #Find all vulns for Shockware that have an actual Risk value and the Risk value isn't "None"
        [array]$CSVData3 += Import-Csv $DataFile | where {$_.Description -Match "Shockwave" -and $_.Risk -ne "None" } | select "Plugin ID", CVE, Risk, Host, Protocol, Port, Name, Description | Export-Csv $outfileShockwave -NoTypeInformation -Append

        #Find all vulns for Flash that have an actual Risk value and the Risk value isn't "None"
        [array]$CSVData4 += Import-Csv $DataFile | where {$_.Description -Match "Flash" -and $_.Risk -ne "None" } | select "Plugin ID", CVE, Risk, Host, Protocol, Port, Name, Description | Export-Csv $outFileFlash -NoTypeInformation -Append

        #Find all vulns for "Remote Code Execution" that have an actual Risk value and the Risk value isn't "None"
        [array]$CSVData5 += Import-Csv $DataFile | where {$_.Description -Match "Remote Code Execution" -and $_.Risk -ne "None"} | select "Plugin ID", CVE, Risk, Host, Protocol, Port, Name, Description | Export-Csv $outFileRCE -NoTypeInformation -Append

        #Find all vulns for Java that have an actual Risk value and the Risk value isn't "None"
        [array]$CSVData6 += Import-Csv $DataFile | where {$_.Description -Match "Java" -and $_.Name -Match "Java" -and $_.Name -notmatch "JavaScript" -and $_.Risk -ne "None" } | select "Plugin ID", CVE, Risk, Host, Name, Description | Export-Csv $outFileOracleJava -NoTypeInformation -Append

        #If you want to track how many lines are added to each file you can do something like this
        #[int] $CSVDataCount6 += $CSVData6.Count
        #Write-Output "Imported $CSVDataCount6 records"
}

#OK, so now that we have all of our files with the output we want, it's time to create the Hash table
#I manually removed the header row of the ReplacementList.csv file. You can do the same or modify the code that creates the file above
$HashTable = @(get-content C:\Users\UserOne\Desktop\nessus\ReplacementList.csv ) -replace ",","=" | convertfrom-stringdata

#The location of the parsed nessus values. By using a standard naming convention, I can again use a wildcard mask to load only the files I want
$ParsedFiles = "C:\users\UserOne\Desktop\nessus\Parsed\Nessus*.csv"

#Let's get the nessus csv files and run them through a ForEach loop.
#We load each file, using the FullName value (path and filename) into a var and then use
#an HashTable enumerator to make the changes.
gci $ParsedFiles |
ForEach-Object {
    $Content = gc -Path $_.FullName;
    foreach ($h in $HashTable.GetEnumerator()) {
        $old = $($h.Keys)
        $new = $($h.Values)
        $Content = $Content -Replace "$old", "$new"
    }
    Set-Content -Path $_.FullName -Value $Content
}

Powershell for Hashes and Timestamps

2013-10-09T02:21:00.002-04:00

I have recently been loving the functionality that PowerShell provides. I think it's Microsoft's best attempt at a *nix-like shell system. There is so much that I have been able to do just playing around with it that today, when needed, I was able to bang out two quick scripts. I figured I would post one here now (and maybe the second one after I clean it up...and maybe "module-ize" it).

I recently have been put through the wringer by first Dell (in regards to a failed hard drive on my primary laptop) and then Microsoft (in regards to my primary Live account being hacked and misused). Because of these issues, I have had to rebuild and set up my system from scratch. What I found while doing this was that I had somehow made a good number of "backup" copies of the source directory of a big project I have been working on. As I use BitBucket, this normally wouldn't be a problem...except for the fact that there was a good amount of changes I made while the last hard drive was failing, which caused multiple pushes to fail when the laptop froze up. This left me with a less than sure feeling of main and primary backup folders for the project. What to do?

I decided that the easiest thing would be to have a spreadsheet of the filepath, filename, the MD5 of each file, and the Last Write Time of each file. So, I moved all of the folders under one temporary one on my desktop. Now I just needed to get the meta-data I needed. PowerShell and the PowerShell Community Extensions to the rescue!

The PowerShell Community Extensions (PSCX, http://pscx.codeplex.com/) provides a useful Get-Hash function. This function can produce a number of different type of hashes depending on the switches applied by the user. Even better, this function accepts pipelined results and the pipelining of its own output, which comes in very handy.

To get to some code, using the PSCX Get-Hash function is as easy as:

Get-Hash MyFile.txt

The above will by default produce the MD5 hash of MyFile.txt and will output four data values:
- Path: the full path and name of the file
- Algorithm: the algorithm used. In the example above the output would be 'MD5'
- HashString: the hash string based on the algorithm used
- Hash: the system datatype of the HashString

For my purposes, I only care about the 1st and 3rd columns (Path, HashString). However, this is still not enough information. The below script is the solution that works for me. I think I am going to convert this to get rid of the hard coded values at some point in the very near future.

####################################################
# FileName: Get-HashesAndTimeStamps.ps1            #
# Author: Dave Werden                              #
# Date:   9 Oct 2013                               #
# NOTES:                                           #
# The four columns produced by the PSCX's Get-Hash #
# module are: Path, Algorithm,HashString,Hash      #
# Dependencies: The PSCX pack must be installed and#
# imported in order to make use of the Get-Hash   #
# module.                                         #
####################################################

#Hardcoded csv filepath and name
$outCSVFileTemp = "C:\users\dwerd_000\Desktop\SB_File_Hashes_Full.csv"
#Hardcoded location of files
$sbpath ="C:\users\dwerd_000\Desktop\ScoutNB_Collections\"
#create the collection of files
$sbfiles = gci $sbpath -Recurse | ? { !$_.PSIsContainer }

#process each file, getting the file hash and last write time for each
#ouput goes to file defined in outCSVFileTemp above
foreach ($sbfile in $sbfiles ) {

    #smarter to grab file's LastWriteTime value first in order to append to the Get-Hash object
    $sbfileTime = $sbfile.LastWriteTime.ToString("dd/MM/yyyy HH:mm:ss")
    Get-Hash $sbfile | Select-Object Path,HashString,@{Name='LastModified';Expression={$sbfileTime}} | Export-Csv $outCSVFileTemp -Append
}

To quickly explain what is going on here exactly:
$sbfiles is set to contain all of the files in the given path. This is done recursively and excludes folders themselves.
Next, a foreach loop is used to process each file by:
   - First grabbing the file's LastWriteTime property, using the given format and saving to $sbfileTime
   - Next (and this was the FUN part) the file object is cut-up using the Select-Object function where only the Path and HashString 'columns' are retained and third column (LastModified) is added and set to the value of $sbfileTime
   - The "new" object, consisting of Path, HashString, LastModified, columns/values is now exported to the $outCSVFileTemp.

By running this script, I am able to use one spreadsheet to identify the newest version of each file, as well as if multiple versions of the same file are the same or different. While there is probably a way to automate this in PowerShell, I still prefer to do these kinds of tasks semi-manually by using Excel's ability to filter/sort as well as the its ability to highlight duplicates (HashString, in this case). The only other action that I currently do manually but may add to this script is the splitting of the Path value into the full path to the lowest folder in one column and the filename by itself in a second column (not sure which way to go on this).

Anyway, it was a lot of fun to bang this out and to see that I ended up with a CSV file of exactly the data I needed and nothing else. The other PowerShell script I knocked out today was a (for now) hardcoded parser for finding specific items from one or more Nessus results file and creating an appropriately named CSV file for these found subsets. Maybe later this week or next I will post that up as well....actually, I am certain I will as I have not found a good PS or other tool to find and compile the subsets I need from Nessus in order to provide valid data for PT reports.

Network Security Monitoring Book

2013-07-22T15:55:00.001-04:00

Last week I happened to notice that Richard Bejtlich's new book, The Practice of Network Security Monitoring: Understanding Incident Detection and Response, was available for pre-sale form the No Starch website. After considering it for a short time, I decided that I would go ahead and make the pre-sale purchase, and that I would buy the hard copy so that I would get the free eBook with it. This afternoon I downloaded the eBook (all three formats of it) and the hard copy should be mailed to me next week sometime. But, I am not sure what I think about this yet.

I am actually in the middle of reading two books for book reviews. One book review is for the SIGSOFT quarterly publication and the other is for the SIGACT quarterly. I have really enjoyed doing these book reviews as it gives me (usually) a free copy of a new book and I get to share my opinion with any of the readers of these journals. It is these two current reviews that I am doing that makes me a little uncertain of my choice to go ahead and buy the Bejtlich book: do I have ANY time to actually read this book right now?

I hope so as I am looking forward to this book! Other than a general respect for Mr. Bejtlich's accomplishments and my understanding of his position on things that interest me, the book had one HUGE selling point for me: Doug Burk's SecuirtyOnion. I am a major fan of SecurityOnion and I think it's inclusion in this book is just awesome! It also looks as though the book goes beyond just the installation and configuration of SecurityOnion in that SecurityOnion seems to be the foundation of the book itself.

More about this book in the future...

As of now, the book is still available for pre-sale and has a 30% discount available:

http://nostarch.com/nsm

PowerShell for your Network Adapter

2013-05-02T16:57:00.001-04:00

Recently, I needed to buy a new computer for my development work. While I could have shopped around and bought either an earlier version of Windows, or just a good machine for a Linux distro. However, since the particular laptop I needed to replace was a Windows Vista box, I decided to stick with Windows and set my dev environment up the same way.

This is how I came to own a Windows 8 laptop. I now have a Windows 8 phone as well (thanks to T-Mobile NOT having a single Droid phone that I liked), and while it syncs well with my new laptop, it's a whole different domain of complaints. It is a complaint of my Windows 8 laptop that has caused me to right this long overdue entry to this blog: after my computer sleeps for some [apparently] arbitrary amount of time, my Wi-Fi adapter is disconnected and will not successfully reconnect. I should say that the adapater will not connect without disabling and then re-enabling the adapter. Since I am already playing around a bit with PowerShell, I figured, why not write a script that I can just run when needed. The following covers my efforts (successful efforts, of course!).

Before creating a PowerShell script, it is important to know if you can actually execute said script. As with almost everything else in Windows since the UAC was introduced, just logging in as an administrator doesn't automatically cause every process you start to have the same credentials. PowerShell scripts are no different, so here are a couple key points.

1. Your environment must allow for the running of the PowerShell scripts that you want to save and execute.
2. For writing and testing your scripts, I find it best to open PowerShell (either the command line or the ISE) with "Run as Administrator".

Number 2 above is easy...at least I hope it is for anyone who has read to at least this point of this entry. :-) However, Number 1 may cause some heartache for someone. So, and without a big long description of using PowerShell itself, to determine if you can save and execute PowerShell scripts:

PS C:\Get-ExecutionPolicy
...should return either "RemoteSigned" or "Unrestricted"
I tend to prefer the Unrestricted option while I am working.

To change the execution policy:
PS C:\Set-ExecutionPolicy unrestricted

Now that this is out of the way, time for the hard and complicated stuff.

Before I continue though, I want to report that I happen to like PowerShell. I have been tinkering with it in my tiny bit of free time (when I should probably be doing more with helping test SecurityOnion -- an absolutely AWESOME product!!!). Until today, I have been approaching PS from a standpoint of what it can/can't do for a pentest, flow data, and remote execution (from an SA standpoint). Today, I needed something quick that would let me avoid having to open up multiple windows and go through the disable/enable motions. Below is the fruit of this strenuous labor.

#***********************************************************
#RenewWiFi.ps1
#author: me
#notes: this was way too easy #***********************************************************
#disable Wi-Fi adapter and DO NOT show the confirm window
Disable-NetAdapter -Name wi-fi -Confirm:$false

#Re-enable adaptor Enable-NetAdapter -Name wi-fi #***********************************************************

...and that's it. Really, an actual script file isn't even needed to do this...but it let's me double-click once and get back to something REALLY important, checking on my Detroit Tigers!!!

dw

UltraEdit macro to strip out specific values

2012-09-29T21:56:00.000-04:00

I absolutely LOVE UltraEdit...since the first day I used it. One of the many things that make this tool so valuable and almost irreplaceable is that of the ability to create your own macros, and the power those macros can have in processing almost any type of file.

I have been working on a project that has a LOT of little things that I have to add all over the place. Becuase of this, I want to create a file with each variable on its own line. The problem originally is that the variables are of variable length and the easiest place that they exist is in a ton of if/else statements. So, I created a macro that, based on copying the if/else block to a new UE document, would create that second file list.

Setup:
1. a document that you want to strip the individual variable names from.
   - This document needs to be named and saved.
2. a constant start and stop delimiter for each variable.
   - In my case, a dollar sign ($) starts my PHP variable name and a ' =' is directly after the variable name. However, with the power of regexs, you could have a set of acceptable start and stop delimiters, but I have no intention of covering that tonight.
3. a second document in UE that will hold the stripped-out variable.
   - This document needs to be named, saved, and directly on the right as listed in the tabs.

To create a new macro in UE, without using the record function, simply follow the mouseclicks here:
Macro->Edit Macro->New Macro
Then give it a name (and a hotkey if you'd like). Once you have done this and clicked OK, you should see the name of your macro in a dropdown bar at the top of the screen as well as the left-side window should be empty.

There are a lot of options in the right-side window that you can select and add to the left-side window. However, for the purposes of this post, simply copy and replace the below lines, and of course modifying for your own search type and expression, should work just fine for anyone.

UE Macro - StripVars
   InsertMode
    ColumnModeOn
    HexOff
    PerlReOn
    Find RegExp "\$posPl[a-zA-Z]*\ ="
    Copy
    NextDocument
    Paste
    Key END
    "
    "
    PreviousDocument
    "
    "

Some final comments:
- The ColumnModeOn is optional. It just happened to be on when I set this one up.
- PerlReOn: This indicates that the regular expression search on the next line will be using a Perl RegEx. There are other options that can be used instead of Perl RegExs
- The RegExp I am using here should be self-explanatory...but: what I am looking for are all words (only one each time this macro is run) that start with $posPl, has any number of alpha chars, and ends with a space followed by an equals sign. I happen to know that the variables I want are the only words that will match this patter and that this pattern will only match the variables I want.
- The reason to have both documentes already saved with the new doc to the right of the original is for the macro commands of NextDocument and PreviousDocument.

I will leave the figuring out of this macro, additions to such as saving after each stripping of the word and pasting in the new file, to anyone who wants to spend some freetime learning more of this AWESOME tool!!!

My thoughts on a new SSL protocol

2012-09-09T23:05:00.001-04:00

The prevalence of encrypted traffic on the internet, network LANs/WANs, indicates that more and more people, companies, and even governments are trying to be more proactive in the protection of data. This also makes it harder for network security analyst to sometimes tell the good traffic from the "bad" traffic. If the analyst has authorization and the tools to do so, they can peek at the traffic and see what's going in and out.

However, I don't know that the majority of traffic analysts are authorized or have the tools to tear down these sessions in order to peak into them. There are obviously concerns that span everything from legal to real-time session tear downs that affect the actual session itself. Another concern is cost...how much can an organization spend on appliances that will provide the mechanism to "peek" into the SSL traffic? I would assume that some serious cost-based analysis would have to happen for most organizations.

So, I wonder about the possibility of a new SSL protocol, or something similar. I haven't done any research to see what options have been explored by those smarter than I, so there is a strong possibility that what I am thinking about has already been tried and found wanting. But, here's what I am thinking:

An SSL protocol that utilizes a "secondary transmission" protocol. I am basically proposing that in addition to the normal session initiation, traffic, and ending, that an additional packet be sent that contains the name of the authenticated user and the resource(s) that they are accessing/downloading/uploading/modifying, as well as containing the sequence number of the previous SSL packet, a time of conversation value, and a flag to indicate if an anomaly (such as the username changing mid-conversation).

The transmission of this secondary packet should be based upon some psuedo-random algorithm that makes it harder for a malicious actor to spoof. Additionally, there should be a number of these packets sent and the totality should be based upon an algorithm using information specific to the SSL session itself.

As for the destination of this secondary packet I haven't decided on what I think is best. I am leaning towards a UDP based protocol that sends to the either the same host participating in the SSL conversation or to the localhosts logging (such as 514 syslog on a *nix machine).

Like I stated earlier, this thought may have already been analyzed and found wanting, but I wonder if there isn't something more in general that we can do with SSL to allow for it maintain the privacy it affords (the legal concern), the protection it facilitates, and the durability it needs WHILE supporting a mechanism for auditing its validity.

I would be very interested...after I finish some other stuff in my project queue to attempt to put this into practice. But first, I will definitely spend some time researching what has already, if at all, been attempted.

Passed the GREM exam

2012-09-09T22:13:00.000-04:00

I was going to actually post this almost two months ago...when I had actually sat and passed the GREM exam. However, I am kind of glad I didn't as I heard an interesting opinion the other day at lunch.

I don't want to incorrectly attribute a quote that I don't fully remember. That said, I do remember the "gist" of the comment and subsequent conversation: the SANS FOR610 class should be renamed to the "90% malware behavior analysis and 10% reversing malware course." Quite a mouthful, but not necessarily incorrect. I have spent a good deal of time thinking about this statement and the subsequent conversation, which also led me to think about my certifications (current and possible future ones).

Before anyone jumps on me (although I don't think any of the two people who actually read this thing will get upset about this) - I believe the above statement about a new name for SANS FOR610 is relatively accurate. However, I don't believe that this is a negative thing, which is how I believe the person making the statement was implying.

The reason I believe the statement is accurate is because, having attended a FOR610 session that Lenny Zeltser instructed, it is how the course was taught, at least in my own estimation. Furthermore, while I don't want to put words in Zelter's mouth, I do seem to recall that he favored behavioral analysis prior to doing any actual reversing. This happens to be an approach that I agree with completely. Which is why, although I agree with the "renaming" statement, I believe the course teaches an appropriate and effective approach to the reverse engineering of malware. The statement maker had also stated that using an old, free version of IDA and OllyDbg, was not actually reverse engineering. This is where I started to not agree with this person's assessment.

I should note that the individual making these statements is probably, at least, 500 times more experienced and intelligent than I. Point in fact, I could probably work for this person for quite awhile and still not learn all that he seems to know. However, I think sometimes people take these types of statements, when made by seasoned professionals such as this person, and automatically accept them with a high-level of acceptance. Too often I have seen brand new people to the field of network security take these types of statements as gospel truth and run with them. This is only a personal side concern of mine in that I wish the community of practice did more to spread the knowledge. I think that the blogs and twitter feeds and articles are all great, but I can't help but wonder if there's not more that can be done to help out in our own local communities. But that is not really the point of my thoughts here.

Back to my point here...what I think about the value and name of the GREM certification that is supported by the SANS FOR610 course.

Personally, I feel that the course, at least as it is taught by Zeltser, is rather effective and technically relevant. I also think that of the Certifications I have, I think that the GREM is probably one of the hardest to pass and definitely requires that person either have had some experience in reversing malware or a photographic memory. But I will get back to the certification topic in a minute. First, I wanted to give my impression and opinion of the FOR610 class.

My Opinion of SANS' FOR610
I can't speak highly enough of the efforts that Zeltser has obviously put into the development and upkeep of the course. Furthermore, while I agree with the "90% behavioral analysis and only 10% reverse engineering" statement, I don't think it's derogatory thought at all. Quite the opposite in fact. I think it's an accurate statement in fact...even if my recollection of what Zeltser said about this very thought is incorrect. Why do I think this? It's simple really: It's the best method to reverse engineer malware. Quite frankly, I think it is the best method to reverse engineer most software.

If an analyst were to just start off by throwing the executable into a debugger or decompiler, they might, might, be able to tear down the potentially bad executable and identify what it is doing (going to do). They might even be able to identify it's different branching options given whatever environmental conditions that the executable checks for. However, how many analysts out there are experienced enough to even look at the portions of the code that isn't actually stepped through by the debugger/decompiler? Having been around some others who have claimed to be "reversers", it became obvious that the same thing affected there ability to effectively reverse engineer the software: the shortest path, or, if you like, the path of least resistance. It appears that an assumption that is almost considered criminal NOT to make is the assumption that the code is going to execute the same with little variance. In this case, the analyst runs the risk of missing logical branches that execute only when certain tests are met (or not met even). While an if/else branch may be easy for an analyst to recognize and a jnz call for what it is, I believe that the possibility abounds for complacent and/or inexperienced analyst to miss crucial operations of the code when they don't at first spend some time examining the behavior of the potentially malicious executable. Thus, I adhere to a belief that the initial efforts to reverse any software, not even just malware, must start with a behavioral analysis. While the 90% metric may not apply to every effort, I think that to be effective AND reliable, an analyst should spend at least 50% on each side of the effort.

I do realize that the reverse engineering "purist" are probably all shaking their heads at this point. And if all analysts were able to take the time to examine each and every line of the executable in question, then I would be shaking my head with them. However, and I think most in the security domain would agree, there is a time factor with reversing malware. Now, while this time factor exists with probably all other types of reverse engineering software, I believe it to be a more crucial factor when one is attempting to reverse malware. Because time is a factor in identifying the actions of malware, I believe that the initial behavioral analysis compliments the need to meet a time demand and get potentially vital information out to the community of practice.

I don't know if I can, or should dig into this topic any more. The bottom line is that I agree with the idea that the FOR610 class leans more heavily towards the behavioral analysis than actual reversing of the code. However, I believe that it must be this way...much like I believe that reverse engineering malware should follow the same approximate breakdown of their efforts.

As I initially mentioned at the start of this post, the passing of the GREM exam as well as the above referenced conversation really got me thinking again about my own current certifications, which ones I wanted to bother keeping, and which ones I still have a personal desire to complete. Coincidentally, I have also had a few conversations with people aspiring to get into the network security realm and/or software engineering.

My own thoughts, and these conversations, have really kind of caused me to change my thinking a little bit. While I have always agreed that a resume and accompanying certs are helpful on job applications but that experience trumps all...I have started to wonder about the possibility of having too many certs. Or, at least the possibility that 'listing' too many certs can be detrimental to a person's job efforts. I don't know what I ultimately think about this...but I am starting to lean towards a desire to keep to myself whatever certs I have and to only provide the list of them when necessary. Which doesn't mean I am done getting some new certs though...there's still a few I want to get and I am 95% sure that I want to go for the GSE in the next year.