Category Archives: General InfoSec

Inside an Average PHP Scan

Posted on by
Reply

I have been talking about PHP scans for a while now. They are so common that we get them on our HoneyPoint deployments all the time, often several times per day, depending on our location.

These scans follow traditional scanner patterns in that they grind through a list of specific urls that are known to have issues looking for a 200 response from the server.

Here is a quick list of a recent scan against one of our HoneyPoints:

/+webvpn+/index.html: 1 Time(s)
/PMA/main.php: 1 Time(s)
/admin/database/main.php: 1 Time(s)
/admin/datenbank/main.php: 1 Time(s)
/admin/db/main.php: 1 Time(s)
/admin/main.php: 2 Time(s)
/admin/myadmin/main.php: 1 Time(s)
/admin/mysql-admin/main.php: 1 Time(s)
/admin/mysql/main.php: 1 Time(s)
/admin/mysqladmin/main.php: 1 Time(s)
/admin/pMA/main.php: 1 Time(s)
/admin/padmin/main.php: 1 Time(s)
/admin/php-my-admin/main.php: 1 Time(s)
/admin/phpMyAdmin-2.2.3/main.php: 1 Time(s)
/admin/phpMyAdmin-2.2.6/main.php: 1 Time(s)
/admin/phpMyAdmin-2.5.1/main.php: 1 Time(s)
/admin/phpMyAdmin-2.5.4/main.php: 1 Time(s)
/admin/phpMyAdmin-2.5.6/main.php: 1 Time(s)
/admin/phpMyAdmin-2.6.0-pl1/main.php: 1 Time(s)
/admin/phpMyAdmin-2.6.0/main.php: 1 Time(s)
/admin/phpMyAdmin-2.6.2-rc1/main.php: 1 Time(s)
/admin/phpMyAdmin-2.6.3-pl1/main.php: 1 Time(s)
/admin/phpMyAdmin-2.6.3-rc1/main.php: 1 Time(s)
/admin/phpMyAdmin-2.6.3/main.php: 1 Time(s)
/admin/phpMyAdmin/main.php: 1 Time(s)
/admin/phpmyadmin/main.php: 1 Time(s)
/admin/phpmyadmin2/main.php: 1 Time(s)
/admin/sqladmin/main.php: 1 Time(s)
/admin/sqlweb/main.php: 1 Time(s)
/admin/sysadmin/main.php: 1 Time(s)
/admin/web/main.php: 1 Time(s)
/admin/webadmin/main.php: 1 Time(s)
/admin/webdb/main.php: 1 Time(s)
/admin/websql/main.php: 1 Time(s)
/board/index.php: 4 Time(s)
/database/main.php: 1 Time(s)
/datenbank/main.php: 1 Time(s)
/db/main.php: 1 Time(s)
/favicon.ico: 1 Time(s)
/forum/index.php: 4 Time(s)
/forums/index.php: 4 Time(s)
/myadmin/main.php: 1 Time(s)
/mysql-admin/main.php: 1 Time(s)
/mysql/main.php: 1 Time(s)
/mysqladmin/main.php: 1 Time(s)
/padmin/main.php: 1 Time(s)
/php-my-admin/main.php: 1 Time(s)
/phpMyAdmin-2.2.3/main.php: 1 Time(s)
/phpMyAdmin-2.2.6/main.php: 1 Time(s)
/phpMyAdmin-2.5.1/main.php: 1 Time(s)
/phpMyAdmin-2.5.4/main.php: 1 Time(s)
/phpMyAdmin-2.5.6/main.php: 1 Time(s)
/phpMyAdmin-2.6.0-pl1/main.php: 1 Time(s)
/phpMyAdmin-2.6.0/main.php: 1 Time(s)
/phpMyAdmin-2.6.2-rc1/main.php: 1 Time(s)
/phpMyAdmin-2.6.3-pl1/main.php: 1 Time(s)
/phpMyAdmin-2.6.3-rc1/main.php: 1 Time(s)
/phpMyAdmin-2.6.3/main.php: 1 Time(s)
/phpMyAdmin/main.php: 1 Time(s)
/phpbb/index.php: 4 Time(s)
/phpbb2/index.php: 4 Time(s)
/phpmyadmin/main.php: 1 Time(s)
/phpmyadmin2/main.php: 1 Time(s)
/robots.txt: 15 Time(s)
/sqlweb/main.php: 1 Time(s)
/web/main.php: 1 Time(s)
/webadmin/main.php: 1 Time(s)
/webdb/main.php: 1 Time(s)
/websql/main.php: 1 Time(s)
As you can see, the scanner requests some of the pages many times, usually with subtle differences in the method or url termination scheme. When we have faked the 200 responses for these pages, it simply catalogs the success and continues. Thus far, we have been unable to identify when/if the real human attacker returns to test and play with the finds, since there are just so many scans for these issues going on all the time. But, we continue to monitor and analyze, so hopefully soon we can identify a pattern of scans followed by verification and exploit.

Note that some/many of these scans will immediately exploit the vulnerability in PHP and use it to drop a bot-net client onto the machine. Of course, this immediately compromises the system and adds it to the scanning army. In those cases, the waiting for the return of the human attacker would not apply.

So, what does all of this mean? We wanted to give you some more insight into the wide scale PHP scans and what they look like. If you have not checked your own web site for these known vulnerabilities, it would likely be very wise to do so. It can be done quite easily by hand, using a simple Perl script or any of the publicly available web scanner tools.

Cisco Movie!!!

Posted on by
Reply

I also got to work with the folks at Cisco, Trend and RSA on a movie this week! I got to shoot a quick info session about Man in the Browser (MitB) attacks and then got to do a little play acting. The trailer should be available soon here.

If you want to see the whole thing come out to this event. I think you will dig it!

Hats off to Radigan, Flanagan and the others who hooked me up with this. It was very cool to be involved and I look forward to our big premier!  😉

Data Visualization Tools in Security

Posted on by
Reply

I have been playing with a few data visualization tools and doing some on the fly firewall log analysis. Mostly just basic plots and stuff so far.

These tools make analysis a pretty cool process. I can see where it would be useful with a very large data set.

I have been reading a new book about it, stay tuned for a review. In the meantime, there are a lot of data visualization tools out there, but I have been playing with the InspireData from Inspiration Software.  Check them out if you want to see what I am talking about.

Have you tried using visualization tools for log analysis? If so, leave me a comment about your experiences and the tools you use.

Book Review: Security Power Tools

Posted on by
Reply

Authors: Burns, Granick, Manzuik, Guersch, Killion, Beauchesne, Moret, Sobrier, Lynn, Markham, Iezzoni, Biondi

Publisher: O’Reilly

$59.99

Rating: 4 out of 5 stars (****)

If you are tired of reading some Harry Potter or some such thing, and decide to devour 780+ pages of information security how-to, this is a pretty good candidate.

The book covers everything from legal and ethical issues to pretty deep knowledge of the tools and techniques used to do infosec work. It won’t make you an expert, but it is a much friendlier manual than the included docs for a whole lot of tools.

My favorite section is chapter 10, which covers the art and science of shell code, custom exploits and some great tools for making this often tough job a whole lot easier. The diagrams and code examples in this chapter alone make the book worth the money for the reference shelf, and you would get all of the rest too!

All in all, the book is easy to read, the examples are clear and easily understood. The graphics are clean and crisp, which makes it much simpler to follow along on your own systems. Basically, as with most O’Reilly books, the layout and design is excellent.

Check it out if you are getting tired of wizards and such. The ROI is likely higher and you might even learn a new skill or two to help you in the day. In the end, that should be the measure of a good security book – right?

Noel Brings Reminder to Review DR/BC Plans

Posted on by
Reply

For those folks on the east coast, Hurricane Noel should probably figure into your weekend plans. The storm is looking like a near miss for much of the eastern seaboard, but should be a strong reminder for folks to review their Disaster Recovery and Business Continuity plans for currency.

If you look in your policies folders and don’t see a DR/BC plan, now might be a good time to form a task group for making them. Given the wacky weather patterns lately, they might prove to be handy in the future. At the very least, you can rest a little easier just knowing they are there.

For those folks wondering what I am talking about, click here for more info on the storm.

If you want to do more reading on DR/BC policies, check out this wikipedia article.

Things You Need to Know about Bot Net Attacks

Posted on by
Reply

Bot nets are one of the most common forms of compromise on the Internet today. Bot networks grew out of the explosion of home and user systems and the common availability of high speed Internet connections. Basically, they are little more than systems that attackers have compromised and put under their control that use some type of mechanism to get new tasks or commands and report their results.

Mostly, bot infected computers are home systems that attackers often use for scanning other systems, sending spam or performing other illicit activities. Often, the controller of the bot systems will rent or sell the bot services to others. No matter if they use the systems themselves, or sell their services – usually the master is after one thing, MONEY.

That’s right. They make money from the illicit use of YOUR system, if it belongs to a bot network. They use your hardware and your bandwidth, and they receive the returns. Even worse, if your system would be used in a serious crime, there may be criminal and civil penalties for YOU. While case law continues to grow on this, it appears there may be some capability for some victims of the bot net to come back at you for failing to adequately protect your system – which ultimately caused them damage.

So, the big question is – how do home users protect themselves from bot infections and the other issues associated with them? Primarily, they do by following this advice:

  1. Ensure that your computer has a firewall and anti-virus at all times. Make sure the firewall is engaged and that the anti-virus software is up to date.
  2. Keep your computer current on patches. Turn on the auto-update capabilities of the operating system and make sure you patch your applications if they have available update mechanisms as well. This is a lot like safe sex in that failure to be safe even once can have long term implications on your security.
  3. Consider using a browser that is somewhat hardened or hardening your browser. There are a ton of browsers out there, and a ton of tools for hardening the common ones. Check them out and make sure your browsing tools are protecting you against attack. Don’t use default installs of IE or FireFox – configure them for higher protections, if at all possible.
  4. Consider other security tools and mechanisms. You need spyware tools and other security mechanisms if you travel. Spend some time reading about mobile security and apply what you can to your life.
  5. If in doubt, rebuild your system. THIS IS CRITICAL – there are simply some things that can be done to a computer that impact the long term security of it. If you have doubts about your system’s security – rebuild it and protect it from the start. If you know you have an infection or problem – backup your critical data and rebuild. It is much easier than most other solutions.

Take these steps and some basic vigilance and apply them to your computing experience. Bot nets will continue to be a primary threat to Internet users, but being smart about them and aware of the defenses makes you less likely to be a victim.

WatchDog Content Moving to StateOfSecurity.com

Posted on by
Reply

If you are a regular WatchDog product user, then you may already know this, but on November 1, 2007 MSI will move all WatchDog content to this blog and begin to phase out the WatchDog client program.

This is being done to simplify the use and access to the information and to enable users to easily leverage our threat intelligence offerings via RSS and other popular mechanisms without using our locked-in client.

The same information that WatchDog has brought to you for years will continue, but hosted here instead of through the WatchDog client. It will also be stored in the emerging threats category – thus making it easy to subscribe or filter on.

We hope you continue to benefit from our work and insights, and please, let us know how you like the WatchDog content and if we can do something better or more helpful with the data.

Do It Yourself Identity Theft Protection

Posted on by
3

By now you have probably heard the commercials. The CEO of the company gives you their social security number to prove that they have his identity locked down. He is so confident in their process that he is willing to give the world his name, information and SSN.

I probably get asked twice a week about this service, so I decided to take a look at it a bit closer. What I found was a pretty easy manipulation of the credit management system in the US combined with some customer service and consumer offloading of tedious work. What does that mean? It means that you can outsource your identity theft protection to them or you could save $10 a month and do it yourself – IF YOU REMAIN VIGILANT.

How does it work? It works like this. Inside the US credit reporting system, there exists a  mechanism called “fraud alert”. This mechanism can be placed on any account, at any time, by the consumer. The purpose of the mechanism was originally to give people who have already been a victim of identity theft a tool for ensuring that no further damage would occur. The mechanism works like this:

  1. The consumer, or someone with their power of attorney, contacts the major credit reporting agencies and requests a “fraud alert” be placed on their account.
  2. The credit agency places the “fraud alert” on the appropriate credit file. There is no charge for this, it is required by law.
  3. The credit agency MUST contact the consumer prior to approving any change, addition or new activity on the consumer’s account. Failure to do so is a violation by the credit agency of federal lending laws.
  4. The consumer must either approve or disapprove the addition or change. If they disapprove, the creditor should refuse the account activity – THUS STOPPING THE FRAUD.
  5. ** PAY ATTENTION TO THIS ONE ** The credit reporting agency removes the “fraud alert” after 90 days from the date of placement. The consumer, or their legal agent, may renew the “fraud alert” at any time after that 90 day period.

So, that said, you could save the $10 per month and contact the credit reporting agencies yourself. You simply call them and ask that the “fraud alert” be placed upon your own file. If you do that every 90 days, you will have protection from credit attacks caused by identity theft. The key is, you HAVE to do it every 90 days. Miss a day, and you have exposure…

Before you run to the phones, you should also know that having the “fraud alert” on your accounts can be a bit frustrating if you actually want to use your credit or open new loans, accounts, etc. Sometimes, creditors will simply refuse the accounts until the “fraud alert” is removed – regardless of your consent to open the account. Other than that, it is a pretty tight mechanism for protecting your information.

There has been a lot of media attention to the company in question that has made this service popular. They seem to be everywhere. Their marketing is certainly working – though I would estimate, mostly due to consumer fear. My guess is that it won’t be too long until the fears they seem to be playing to will lead to saturation and slower growth, but my friend Alex always told me “You can sell just about anything for $10 a month.”

So, at the end of the day, is this a service you buy or a task you manage yourself? Is it worth worrying about, or is it something you deal with if you have a problem? Only you can decide if you are capable of managing the work or if you would rather have someone do it for you. No matter what you decide, at least you know the facts. As with most security things, it is less magic and mystery and more of a common thing.

Should you decide to do it yourself, here are the contact numbers for the three primary credit reporting agencies and for the primary checking account verification house in the US (same thing applies)….

Equifax – 1-800-525-6285
Experian – 1-800-422-4879
Trans Union – 1-800-916-8800
Chex Systems (check fraud management) – 1-800-428-9623

Blast(s) From the Past

Posted on by
Reply

A few of my HoneyPoints delivered an interesting blast from the past to me this morning. Around 2pm Eastern yesterday, one of our IP ranges got hit by a scan with this signature on port 80:

GET /level/16/exec/-///pwd HTTP/1.0

The web connection was then followed by a series of connections on port 23, though the tool did not do anything more than banner grabbing on the telnet port.

While the scan was obviously an attempt to exploit the old Cisco HTTP vulnerability (circa 2001), I had not seen probes for those issues in quite some time. I also had not seen a tool that also connected on port 23 of the same host and did banner grabbing, so thus why this stood out above the usual noise.

This brought about a very interesting point that many of these old vulnerabilities are making comebacks. Scans for old web vulnerabilities like Unicode issues, Double Decode, Code Red and the ASN.1 worm continue to be among the most seen probes on the Internet. Other folks have talked about the idea that perhaps as more third world countries become more Internet connected, that technology may not be updated there as rapidly – which could cause the lifecycle of older vulnerabilities to either be reborn or at least, eek out a longer existence. Could ancient vulnerabilities like RDS and .HTR buffer overflows still be leveraged for Internet compromise? The possibility is high that some small percentage of systems is likely available as a vulnerable target.

Does this mean that vulnerabilities will have a lifecycle that approaches infinity? If there are still systems out there that are vulnerable, why would some attacker without general worries of discovery not just keep building a super-worm that continually crawls the net looking for every known web vulnerability to date? If incorporated and distributed through bot-net style approaches, this is likely pretty feasible – particularly if you can make the attack smart enough to adapt its vulnerability testing to the specifics of a target – much like a modern scanning tool.

How will some of these older vulnerabilities fair? It remains to be seen, but my bet is that blasts from the past are likely to keep on rolling in some diminutive way. Let’s just say that I think it will be a long time before we live in a Code Red free world.

More People Supporting Honeypots for Corporate Use

Posted on by
Reply

Got this off of the wire today. Pretty cool that other folks are beginning to weigh in on the power of honeypots in the corporate world.

Too bad this article doesn’t cover HoneyPoint. Hopefully, more folks will come to see the power of our solution. We just seem to need more marketing around our particular flavor of honey…   😉

Read the article here.