Zango sues PC Tools, therapy suggested

Denial is a powerful tool in the arsenal of companies who refuse to accept who they are. Much like individuals in denial, the illusions of grandeur or the premise of being something they are not is pervasive. These situations often require therapy, so let's begin.
Such is the case with Zango, who this week decided to sue PC Tools for $35 million dollars, based on the pretense that their "software" isn't spyware and is thus being wrongly removed by PC Tools' Spyware Doctor.
Here's where reality sets in: Hey Zango! YOU ARE SPYWARE! YOU'VE ALWAYS BEEN SPYWARE! Rebrand yourselves all you wish. Change the name of the company. Deny the reality of the situation all you want. It won't change the simple truth.
Let's review from a technical perspective, shall we?
From BleedingEdge Threats (Bleeding Edge Snort) we find the harsh reality of the situation. Consider a few fine signature examples from Matt Jonkman and team. There are no less the 25!
Posted as recently as April 23, 2007 we find:
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE MALWARE Zango Spyware (tbrequest data post)"; flow: to_server,established; uricontent:"/tbrequest"; nocase; uricontent:"&q="; nocase; pcre:"/\/tbrequest\d+\.php/Ui"; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/
adware.180search.html; classtype: trojan-activity; sid: 2003610; rev:1;)
We'll cover the fundamentals here. flow:to_server, established means that we're monitoring traffic as leaves to report back to your server. Not unlike spyware, yes? And if I'm not mistaken, a tbRequest.add to a PHP platform is a POST. What might we be posting? User profiles perhaps, so you can invade their privacy and feed them BS? I think so.
Why not take a look at the reference URL as well:
securityresponse.symantec.com
Why would our friends at Symantec label you a medium risk as adware and eradicate you in their defintions? Hmm...I can hear your crack legal team warming up the machinations of litgation once more. Oh wait, they sued you (or at least Hotbar) a few years back. Nevermind.
But let's get back on track.
Instead of spending $35 million to sue PC Tools, keep you hard earned money and spend a bit of time working on corporate moral and an enterprise wide reality check. Embrace who you are. Accept that you are part of the "series of tubes" that is the Internet, and that you are knowingly filling those tubes. I'd go so for as to suggest hiring corporate counselors (not the legal kind) to aid your staff in accepting reality. I'd even go so far as invite Senator Ted Stevens to come for a day to rally the troops thus: "The Internet is not something you just dump something on. It's not a big truck. It's a series of tubes. And if you don't understand those tubes can be filled and if they are filled, when you put your message in, it gets in line and it's going to be delayed by anyone that puts into that tube enormous amounts of material, enormous amounts of material".
Just face the truth and we'll all be better for it. Soul searching serves us well. But when that fails, rename yourselves again. I suggest TheBestDamnSpyware.com. Best of luck in your endeavor.

MySQL installation for Aanval

I was recently asked if Aanval could be installed with a MySQL 5.0 database. Most often I've deployed on 4.x, but recently my teammate rebuilt one of our databases with quite a few sensors populating it, and it's working well with no issues. No scientific, benchmark comparisons to offer, but performance has been excellent. ISSA members can read up on Aanval and BleedingEdge Threats in March's toolsmith in ISSA Journal.

Job hunters beware - "Please, pay Your attention!"

Sunday mornings are always fun for a bit of analysis, and my inbox greeted me readily. According to the little joyfest I received this morning, "because of our system has great changes, you have to install Monster.com certificated utility (click here) to be able to use monster.com database."
Not only have the content writers at Monster lost their mastery of written English ("Monster.com company greets you Russ McRee.") but they've got a new tool a wasn't aware of, namely servicetool2.exe.
All kidding aside, this is an interesting binary. Upon execution, the original file is cleaned up, and a directory called wsnpoem is dropped in system32 along with ntos.exe. This is now ancient history by malware standards (November 2006) but it remains worthy of few comments.
1) A fantastic writeup on the original binary can be found at Secure Science Corporation: http://ip.securescience.net/advisories/pubMalwareCaseStudy.pdf
2) The attributes remain consistent with the SSC write-up including audio.dll and video.dll as dropped in the wsnpoem directory, so there's really nothing new to contribute here with the following exception.
This Trojan hit the street sometime in October/November 2006. Given its behavioral attributes, it is, and should be considered high risk...it'll steal you blind.
Do you think the AV vendor coverage has improved since SSC and Michael Ligh so capably analyzed it? Negative, Ghostrider. Symantec, McAfee, and Microsoft still don't identify it.
Others identify it rather generically, but most don't see it at all.
There's a simple lesson here. Antivirus coverage is essential, but often buys you very little in the face of emerging threats. Obviously, you can't depend on AV alone, and user awareness is worth its weight in gold. If your users don't "Click here", the bad guys don't own the machine.
Oh, were it so easy...all the users I help protect behave perfectly in the computing environment...

Updates on RAPIER 3.1

February's toolsmith in ISSA Journal covers RAPIER 3.1, the Rapid Assessment & Potential Incident Examination Report from Joe Schwendt and Steve Mancini of Intel. See toolsmith if you're an ISSA member.
One of the minor issues that recently popped up around keeping the RAPIER 3.1 install current is changes to ClamAV, where the new installation forces a C:\Program Files\ClamAV hierarchy. This is, of course, problematic for RAPIER, which is designed to be portable and not hierarchy dependent.
The version here solves the issue, so long as you have the Visual Studio 2005 dll's.
Email me a holisticinfosec at gmail dot com, if you need files or have questions.

toolsmith

Starting with October's issue of the ISSA Journal, I've been contributing a monthly column called toolsmith. It's afforded me the opportunity to spend more time with excellent infosec tools, an effort I enjoy immensely.
I'd like to mention a few projects here that I've written on or will be soon that you should take a look at, if you haven't already.

1) IDS Policy Manager v.2 http://www.activework.org
"IDS Policy Manager was written to manage SNORT® IDS sensors in a distributed environment."
2) RPIER http://sourceforge.net/projects/rpier
"Intel(R) Regimented Potential Incident Examination Report (RPIER) is a 1st handlers tool used to obtain volatile information from Windows OS computer systems."
3) Helix 1.8 http://www.e-fense.com/helix/
"Helix focuses on Incident Response & Forensics tools. It is meant to be used by individuals who have a sound understanding of Incident Response and Forensic techniques."
4) BackTrack v.2 http://www.remote-exploit.org/index.php/BackTrack
" BackTrack is the result of the merging of two Innovative Penetration Testing live Linux distributions - Whax and Auditor. BackTrack has been dubbed as the best Security Live CD."

Consider giving each of these a try at your leisure, and if you're an ISSA member you can download the column relevant to each.

...and break the cycle they did.

I was more than pleased to see Microsoft step out of the monthly patch cycle to release MS06-055. Hopefully, this rare event will reoccur as necessary.
Microsoft patch statistics continue to bode poorly for IE. According to the Symantec Internet Security Threat Report, Trends for January 06 - June 06, "Microsoft had the longest exposure-to-patch time in the browser industry...it took Microsoft an average of nine days to issue a bug fix, while Apple published a patch within five days, Opera within two days and Mozilla within one day." In my previous post, where I mentioned three days for Mozilla to patch, I was obviously overstated their average.
To be fair, MS is making strides on the OS front. Again, from Symantec's report, "Microsoft, however, leads the ranking in the operating system segment: The exposure time of a Windows security issue was 13 days; Sun had the longest patch release time with 89 days followed by HP with 53 days. Apple took an average of 37 days. Red Hat matched Microsoft's time of 13 days."
So, two up, one down for MS...better, getting better.

It's time for MS to break their patch cycle.

At what point did Microsoft completely lose touch with reality?
No no...not when they thought the Internet was a passing fad, or when BG said we'd never need more the 640k RAM, or when they flip-flopped on a SQL backend for Exchange and kept the Jet db engine.
I'm talking about Black Tuesday, Patch Tuesday...Microsoft's "that time of the month."
Enough already. The MSIE VML vulnerability drives home three key points.
1) The shortcomings in MS product and code are likely to remain perpetual and inevitable.
2) Bright, capable, well intended engineers will release their own patches in the hope of filling the gap until the next Patch Tuesday. Kudos to the Zeroday Emergency Response Team: ZERT
3) MS needs to buck up, admit to the fact that they're far from perfect, work with the community to improve their code and react faster, and ultimately, BREAK THE 30 DAY PATCH CYCLE, when necessary. No 0-day vulns? Fine, but when one is made public, rally the troops, write the patch, and put it on the street.
The Mozilla group is a great example. Firefox has been far from perfect, no doubt. But have you ever seen a three week delay between when the vulnerability is publicized and when their fix is released? Try three days. That's how you do it.

The more MS waits, the more soft spots are found in their code, the more reason they offer consumers to turn to other product. They lost me long ago, but what of the millions more they stand to lose? Is it so naive to believe that, by opening up a bit, and avoiding the uber-monolith mentality, Microsoft could vastly improve its image and market share?
Case in point: I'm writing on the best piece of hardware I've ever met, a MacBook Pro.

Christopher Maxwell, botnet master, sentenced to 3 years +

I was in attendance at the four hour sentencing hearing for Christopher Maxwell, the botnet master. After extensive testimony from the investigating agent Dave Farquhar, as well as representatives from Northwest Hosptital, the DoD, and a California school district, Judge Pechman spoke at length and eloquently about her decision to send Mr. Maxwell to prison.
Where Asst. US Attorney Kathryn Warma sought 6 years imprisonment, the defense sought probation. The judge, after much thoughtful deliberation, gave him three years, followed by three years probation, and more that $250,000 in restitution to Northwest Hospital and DoD. He may well pay more to the school district too.
By any real standard, Mr. Maxwell's life is ruined, thanks to sadly flexible morals and the desire for easy cash.
It's a shame as, on one hand I felt bad for him, as I watched his family weep and pray, and noted his own readily visible emotions. He was indeed remorseful and accepted responsibility for his actions.
But my compassion began to fade as, in his own opportuntiy to speak to the judge, he suggested he might best serve time by speaking to high school students and other youth groups about his wrong doing.
To this I say, three years in the hole will offer a far better deterrent than Mr. Maxwell on a speaking tour, elevated to a status he is not worthy of.
Yes, his sole intention was propogating adware for pay, and even with root access to machines, he did no further damage and stole no information.
But botnets for dollars, or any other nefarious purpose, could have, quite simply in this case, cost someone their lives. Northwest Hospital continued to operate thanks to good disaster planning, but what if they hadn't? What if someone was misdiagnosed or issued the wrong medication as a function of Mr. Maxwell's criminal acts?
Both the Assistant US Attorney and Judge Pechman spoke directly of the need for deterrence. Yes, it may not help with our friends overseas, but maybe, just maybe, some script kiddie in a basement somewhere will now think twice before firing up an IRC server and letting loose with the malware.
To Asst. US Attorney Warma, Agent Dave Farquhar, and Judge Pechman I say, job well done.

Snort management scripts

In a recent thread on the Internet Storm Center I offered some scripts that I wrote entirely for convenience at the shell prompt. Save each as the # commented title, add them to your working directory, chmod a+x them, and use at will:

For Bleeding-Edge rules, I prefer the single bleeding-all.rules so I use this to update it rather than Oinkmaster:

#bleedingpig
cd /etc/snort/rules/
rm -f bleeding-all.rules
wget http://www.bleedingsnort.com/bleeding-all.rules
-----------------------
To fire Oinkmaster manually rather than cron:
#oink
oinkmaster.pl -C /etc/oinkmaster.conf -C /etc/autodisable.conf -o /etc/snort/rules
-----------------------
To kill the daemon:
#killpig
killall snort
-----------------------
To confirm Snort process state:
#pigps
ps aux | grep snort
-----------------------
To confirm Snort running cleanly after config or rule changes:
#pigchk
/usr/local/bin/snort -c /etc/snort/snort.conf -i eth1 -v
-----------------------
To start the daemon:
#pigd
/usr/local/bin/snort -c /etc/snort/snort.conf -i eth1 -g snort -D

RE: Hackers and Employment - What the heck's wrong with us?

Hackers and Employment - What the heck's wrong with us?

This essay describes a scenario that has long bothered me to no end.
What place does a hacker with obvious moral flexibilty have in our
enterprises? Certainly they may be talented and quite brilliant, but can
they truly be trusted?
An associate, whose views I respect greatly, said this regarding
Mitnick's books. "I'll check them out of the library and read them for
the value they hold. But I won't buy them, I simply can't fund the
depravity."
The essay's author is right. We willingly pay for the breakdown of
simple societal standards that not so long ago were the expected norm.
Is it too much to ask that our information be safe, our systems
unhindered by malware designed to rob us financially and strategically,
and that organizations will choose not to hire the morally flexible?
Sadly, we know it is too much to ask.
But, I for one, will continue in my quest to protect that information,
those systems, and the people who count on them, living by a solid moral
standard built on the premise of "first, do no harm."

3rd Party Patches while Microsoft waits

It's bad enough that they leave the front door wide open See: Video of IE Exploit (createTextRang) using the latest Metasploit code.
Then Microsoft has to wait until patch Tuesday to release a fix for the latest IE issue. "Fine", say the brave and intrepid. Just like the WMF hole, well patched by Ilfak Guilfanov, now eEye and Determina have released their own patches for the MS Internet Explorer (createTextRang) vulnerability. See: Security Watch: Zero-Day Attack Advances Unpatched.
Is there a new industry on the horizon? Perhaps not a pay-per-use model, given the short life cycle before Patch Tuesday, but perhaps corporate sponsorships from those who seek glory in the face of the evil empire. Seems unlike Microsoft to create a market they can't corner, but who knows.

SSL-Explorer: Browser-based Open Source SSL VPN Solution

I've been waiting for a solution like SSL-Explorer to come along.
SSL VPN is undoubtedly the VPN solution that many enterprises will be moving to. Yes, the cost for appliance based SSL VPN platforms has dropped dramatically with the SonicWALL SSL-VPN $200 coming in around $450 to $600. But if you want to roll you own, SSL-Explorer is the way to go. A single port-forward to a dedicated SSL-Explorer server and you're on your way.
From Nottigham, UK comes 3SP and SSL-Explorer, described as "the world's first open-source, browser-based SSL VPN solution. This unique remote access solution provides users and businesses alike with a means of securely accessing network resources from outside the network perimeter using only a standard web browser."
I've successfully deployed this solution in a development environment and found it easy to install, quick to configure, and popular with users.
May I suggest trying it for yourself here: SSL-Explorer.
SSL-Explorer can leverage Active Directory, and yet is licensed under the GNU General Public License and you can install it on Windows or Linux.
You can use the free version or opt for the supported, feature-rich SSL-Explore Xtra.
The feature list is long, just go check it out: SSL-Explorer.

Google Desktop's latest "enhancement"

Google announced it's latest "enhancement" to it's Google Desktop software on February 9th. I've by no means been a proponent of the sofware since its inception, and now this is truly ridiculous.
According to the Electronic Frontier Foundation "the new Search Across Computers feature will store copies of the user's Word documents, PDFs, spreadsheets and other text-based documents on Google's own servers, to enable searching from any one of the user's computers."
First the goverment wants access to Google search logs, now this.
In a nut shell, if you've installed this software and your Google account is compromised, your entire file system, on all the computers you've installed Google Desktop, is completelty available. A hacker's "one-stop-shop" if you will.
Worse still, "the government could then demand these personal files with only a subpoena rather than the search warrant it would need to seize the same things from your home or business, and in many cases you wouldn't even be notified in time to challenge it."
I can't say this enough, if you value your privacy and your personal security do not install this software under any circumstances.
More information:
http://www.eff.org/news/archives/2006_02.php#004400
http://www.viruslist.com/en/weblog?weblogid=179597544

2 remarkable LiveCDs

I've had recent occasion to utilize two very different, yet equally excellent LiveCDs.
The first is the ZoneCD from Public IP: http://www.publicip.net/zonecd/download.php
"The ZoneCD is a bootable CD with a collection of GNU/Linux software pre-configured to create a WiFi gateway with automatic hardware detection, and support for many graphics cards, sound cards and other peripherals. The gateway includes support for WiFi end-user authentication and web content filtering."
I recently deployed it as a temporary controller of sorts for use as a public hotspot where a splash page and "click to consent" is required. Truly excellent functionality.
The second LiveCD that impressed me to no end recently is e-fense's Helix 1.7, offering incident response, electronic discovery, and computer forensics.
"Helix has been modified very carefully to NOT touch the host computer in any way and it is forensically sound. Helix will not auto mount swap space, or auto mount any attached devices. Helix also has a special Windows autorun side for Incident Response and Forensics."
If you have a need for these features but no budget for commercial products like EnCase, consider downloading this iso immediately.

Why run IIS on Windows XP?

http://ingehenriksen.blogspot.com discovered a Microsoft IIS Remote Denial of Service (DoS) .DLL Url exploit on Friday the 16th.
This lends to the debate whether or not a webserver on a desktop PC is a good idea. Obviously, developers have a strong opinion here, so consider the following: run IIS as localhost only, use Windows Firewall to block all web ports, and disable SMTP and Front Page extensions. Disabling Front Page extensions will prevent the above exploit even if the Windows Firewall is off.