Monthly Archives: September 2015

Security Vs. Virtualization

Recently, I wrote an article for Network Computing about the challenges of achieving visibility in the virtualized data center.

Security professionals crave data. Application logs, packet captures, audit trails; we’re vampiric in our need for information about what’s occurring in our organizations. Seeking omniscience, we believe that more data will help us detect intrusions, feeding the inner control freak that still believes prevention is within our grasp. We want to see it all, but the ugly reality is that most of us fight the feeling that we’re flying blind.

In the past, we begged for SPAN ports from the network team, frustrated with packet loss. Then we bought expensive security appliances that used prevention techniques and promised line-rate performance, but were often disappointed when they didn’t “fail open,” creating additional points of failure and impacting our credibility with infrastructure teams.

So we upgraded to taps and network packet brokers, hoping this would offer increased flexibility and insight for our security tools while easing fears of unplanned outages. We even created full network visibility layers in the infrastructure, thinking we were finally ahead of the game.

Then we came face-to-face with the nemesis of visibility: virtualization. It became clear that security architecture would need to evolve in order to keep up.

You can read and comment on the rest of the article here.

Tagged , , , , , , ,

Is Your Security Architecture Default-Open or Default-Closed?

One of the most significant failures I see in organizations is an essential misalignment between Operations and Security over the default network state. Is it default-open or default-closed? And I’m talking about more than the configuration of fail-open or fail-closed on your security controls.

Every organization must make a philosophical choice regarding its default security state and the risk it’s willing to accept. For example, you may want to take a draconian approach, i.e. shooting first, asking questions later. This means you generally validate an event as benign before resuming normal operations after receiving notification of an incident.

But what if the security control detecting the incident negatively impacts operations through enforcement? If your business uptime is too critical to risk unnecessary outages, you may decide to continue operating until a determination is made that an event is actually malicious.

Both choices can be valid, depending upon your risk appetite. But you must make a choice, socializing that decision within your organization. Otherwise, you’re left with confusion and conflict over how to proceed during an incident.

baby_meme

Tagged , , , , ,

Malware Analysis and Incident Response Tools for the Frugal and Lazy

I confess: I covet and hoard security tools. But I’m also frugal and impatient, so often look for something free and/or quick. And yes, that frequently means using an online, hosted service. Before the security-purists get their panties in a wad, I’d like to offer this disclaimer: you may mock me for taking shortcuts, but it’s not always about having the best tool, but the one that gets the job done.

Here’s a list that I frequently update. You’ll notice that sometimes I have the same tool in more than one section, but this is because it has multiple functions. If you know of others and would like to contribute or if you think the tool is outdated or bad, please let me know and I’ll adjust the list accordingly.

Many thanks to @grecs for his additions and helping me to organize it. Also to Lenny Zeltzer, author of the REMnux malware analysis and reverse engineering distro, who I’ve borrowed shamelessly from. You’ll find many of these tools and others on his own lists, so I encourage you to check his posts on this topic as well.

Online Network Analysis Tools

Network-Tools.com offers several online services, including domain lookup, IP lookup, whois, traceroute, URL decode/encode, HTTP headers and SPAM blocking list.

Robtex Swiss Army Knife Internet Tool

CentralOps Online Network tools offers domain and other advanced internet utilities from a web interface.

Shadowserver Whois and DNS lookups check ASN and BGP information. To utilize this service, you need to run whois against the Shadowserver whois system or DNS queries against their DNS system.

Netcraft provides passive reconnaissance information about a web site using an online analysis tool or with a browser extension.

Online Malware Sandboxes & Analysis Tools

Malwr: Malware analysis service based on Cuckoo sandbox.

Comodo Instant Malware Analysis and file analysis with report.

Eureka! is an automated malware analysis service that uses a binary unpacking strategy based on statistical bigram analysis and coarse-grained execution tracing.

Joe Sandbox Document Analyzer checks PDF, DOC, PPT, XLS, DOCX, PPTX, XLSX, RTF files for malware.

Joe Sandbox File Analyzer checks behavior of potentially malicious executables.

Joe Sandbox URL Analyzer checks behavior of possibly malicious web sites.

ThreatTrack Security Public Malware Sandbox performs behavioral analysis on potential malware in a public sandbox.

XecScan Rapid APT Identification Service provides analysis of unknown files or suspicious documents. (hash search too)

adopstools scans Flash files, local or remote.

ThreatExpert is an automated threat analysis system designed to analyze and report the behavior of potential malware.

Comodo Valkyrie: A file verdict system. Different from traditional signature based malware detection techniques, Valkyries conducts several analyses using run-time behavior.

EUREKA Malware Analysis Internet Service

MalwareViz: Malware Visualizer displays the actions of a bad file by generating an image. More information can be found by simply clicking on different parts of the picture.

Payload Security: Submit PE or PDF/Office files for analysis with VxStream Sandbox.

VisualThreat (Android files) Mobile App Threat Reputation Report

totalhash: Malware analysis database.

Deepviz Malware Analyzer

MASTIFF Online, a free web service offered by KoreLogic Inc. as an extension of the MASTIFF static analysis framework.

Online File, URL, or System Scanning Tools

VirusTotal analyzes files and URLs enabling the identification of malicious content detected by antivirus engines and website scanners. See below for hash searching as well.

OPSWAT’s Metascan Online scans a file, hash or IP address for malware

Jotti enables users to scan suspicious files with several antivirus programs. See below for hash searching as well.

URLVoid allows users to scan a website address with multiple website reputation engines and domain blacklists to detect potentially dangerous websites.

IPVoid, brought to you by the same people as URLVoid, scans an IP address using multiple DNS-based blacklists to facilitate the detection of IP addresses involved in spamming activities.

Comodo Web Inspector checks a URL for malware.

Malware URL checks websites and IP addresses against known malware lists. See below for domain and IP block lists.

ESET provides an online antivirus scanning service for scanning your local system.

ThreatExpert Memory Scanner is a prototype product that provides a “post-mortem” diagnostic to detect a range of high-profile threats that may be active in different regions of a computer’s memory.

Composite Block List can check an IP to see if it’s on multiple block lists and it will tell you if blocked, then who blocked it or why.

AVG LinkScanner Drop Zone: Analyzes the URL in real time for reputation.

BrightCloud URL/IP Lookup: Presents historical reputation data about the website

Web Inspector: Examines the URL in real-time.

Cisco SenderBase: Presents historical reputation data about the website

Is It Hacked: Performs several of its own checks of the URL in real time and consults some blacklists

Norton Safe Web: Presents historical reputation data about the website

PhishTank: Looks up the URL in its database of known phishing websites

Malware Domain List: Looks up recently-reported malicious websites

MalwareURL: Looks up the URL in its historical list of malicious websites

McAfee TrustedSource: Presents historical reputation data about the website

MxToolbox: Queries multiple reputational sources for information about the IP or domain

Quttera ThreatSign: Scans the specified URL for the presence of malware

Reputation Authority: Shows reputation data on specified domain or IP address

Sucuri Site Check: Website and malware security scanner

Trend Micro Web Reputation: Presents historical reputation data about the website

Unmask Parasites: Looks up the URL in the Google Safe Browsing database. Checks for websites that are hacked and infected.

URL Blacklist: Looks up the URL in its database of suspicious sites

URL Query: Looks up the URL in its database of suspicious sites and examines the site’s content

vURL: Retrieves and displays the source code of the page; looks up its status in several blocklists

urlQuery: a service for detecting and analyzing web-based malware.

Analyzing Malicious Documents Cheat Sheet: An excellent guide from Lenny Zeltser, who is a digital forensics expert and malware analysis trainer for SANS.

Qualys FreeScan is a free vulnerability scanner and network security tool for business networks. FreeScan is limited to ten (10) unique security scans of Internet accessible assets.

Zscaler Zulu URL Risk Analyzer: Examines the URL using real-time and historical techniques

Hash Searches

VirusTotal allows users to perform term searches, including on MD5 hashes, based on submitted samples.

Jotti allows MD5 and SHA1 hash searches based on submitted samples.

Malware Hash Registry by Team Cymru offers a MD5 or SHA-1 hash lookup service for known malware via several interfaces, including Whois, DNS, HTTP, HTTPS, a Firefox add-on or the WinMHR application.

Domain & IP Reputation Lists

Malware Patrol provides block lists of malicious URLs, which can be used for anti-spam, anti-virus and web proxy systems.

Cisco SenderBase Reputation data about a domain, IP or network owner

Malware Domains offers domain block lists for DNS sinkholes.

Malware URL not only allows checking of websites and IP addresses against known malware lists as described above but also provides their database for import into local proxies.

ZeuS Tracker provides domain and IP block lists related to ZeuS.

Fortiguard Threat Research and Response can check an IP or URL’s reputation and content filtering category.

CLEAN-MX Realtime Database: Free; XML output available.

CYMRU Bogon List A bogon prefix is a route that should never appear in the Internet routing table. These are commonly found as the source addresses of DDoS attacks.

DShield Highly Predictive Blacklist: Free but registration required.

Google Safe Browsing API:  programmatic access; restrictions apply

hpHosts File:  limited automation on request.

Malc0de Database

MalwareDomainList.com Hosts List

OpenPhish: Phishing sites; free for non-commercial use

PhishTank Phish Archive: Free query database via API

ISITPHISHING is a free service from Vade Retro Technology that tests URLs, brand names or subnets using an automatic website exploration engine which, based on the community feeds & data, qualifies the phishing content websites.

Project Honey Pot’s Directory of Malicious IPs: Free, but registration required to view more than 25 IPs

Scumware.org

Shadowserver IP and URL Reports: Free, but registration and approval required

SRI Threat Intelligence Lists: Free, but re-distribution prohibited

ThreatStop: Paid, but free trial available

URL Blacklist: Commercial, but first download free

Additional tools for checking URLs, files, IP address lists for the appearance on a malware, or reputation/block list of some kind.

Malware Analysis and Malicious IP search are two custom Google searches created by Alexander Hanel. Malware Analysis searches over 155 URLS related to malware analysis, AV reports, and reverse engineering. Malicious IP searches CBL, projecthoneypot, team-cymru, shadowserver, scumware, and centralops.

Vulnerability Search is another custom Google search created by Corey Harrell (of Journey into Incident Response Blog). It searches specific websites related to software vulnerabilities and exploits, such as 1337day, Packetstorm Security, Full Disclosure, and others.

Cymon Open tracker of malware, phishing, botnets, spam, and more

Scumware.org in addition to IP and domain reputation, also searches for malware hashes. You’ll have to deal with a captcha though.

ISC Tools checks domain and IP information. It also aggregates blackhole/bogon/malware feeds and has links to many other tools as well.

Malc0de performs IP checks and offers other information.

OpenMalware: A database of malware.

Other Team Cymru Community Services  Darknet Project, IP to ASN Mapping, and Totalhash Malware Analysis.

viCheck.CA provides tools for searching their malware hash registry, decoding various file formats, parsing email headers, performing IP/Domain Whois lookups, and analyzing files for potential malware.

AlienVault Reputation Monitoring is a free service that allows users to receive alerts of when domains or IPs become compromised.

Web of Trust: Presents historical reputation data about the website; community-driven. Firefox add-on.

Shodan: a search engine that lets users find specific types of computers (routers, servers, etc.) connected to the internet using a variety of filters.

Punkspider: a global web application vulnerability search engine.

Email tools

MX Toolbox  MX record monitoring, DNS health, blacklist and SMTP diagnostics in one integrated tool.

Threat Intelligence and Other Miscellaneous Tools

ThreatPinch Lookup Creates informational tooltips when hovering oven an item of interest on any website. It helps speed up security investigations by automatically providing relevant information upon hovering over any IPv4 address, MD5 hash, SHA2 hash, and CVE title. It’s designed to be completely customizable and work with any rest API. Chrome and Firefox extensions.

ThreatConnect: Free and commercial options.

Threatminer Data mining for threat intelligence.

IBM X-Force Exchange  a threat intelligence sharing platform that you can use to research security threats, to aggregate intelligence, and to collaborate with peers.

Recorded Future: Free email of trending threat indicators.

Shadowserver has lots of threat intelligence, not just reputation lists.

The Exploit Database: From Offensive Security, the folks who gave us Kali Linux, the ultimate archive of Exploits, Shellcode, and Security Papers.

Google Hacking Database: Search the database or browse GHDB categories.

Privacy Rights Clearinghouse: Data breach database.

Breach Level Index: Data breach database.

AWStats: Free real-time log analyzer

AlienVault Open Threat Exchange

Tagged , , , , , ,

The VAR Quagmire

The topic of the Value Added Reseller (VAR) can elicit powerful emotions among information technology professionals. Some people find them to be valuable partners, others consider them parasites on the buttocks of humanity. Love them or hate them (I have felt both, sometimes for the same reseller), they are a fact of life in this industry.

Right now I’m feeling a little bitter about the whole construct, mostly because of a recent difficulty I had trying to obtain price quotes for an IDS refresh. As many do, I work for an organization that requires competitive bids for large purchases. Personally, I don’t have a problem with this requirement, because I would bargain with the Dalai Lama himself over a pint of yak milk if I thought I could get a better price. And I don’t even like Yak milk. I can’t really help myself, it’s the thrill of the hunt for me. But I recently struggled to obtain price quotes on the product in question because of the way the reselling process works.

Luckily, I’m acquainted with a former sales rep who explained the VAR rules to me. The whole thing left me pretty frustrated with the current system, wondering how anyone ever manages to work for a VAR without hanging themselves with an Ethernet cable. I’ve decided to include portions of what he told me below.

Today, deal registration is the key status a reseller company secures to achieve for a particular opportunity at a particular enterprise.  In order to obtain a “deal registration”, the reseller must bring a technology requirement and
revenue opportunity to the manufacturers attention which was previously nonexistent.  If the manufacturer has existing knowledge of the technology opportunity, which is often the case, the manufacturer will either award the deal registration to a preferred reseller, or allow no deal registration whatsoever.

So “deal registration” offers a competitive advantage, translating to:

 …8 to 10 additional percentage points from the standing partner discount,creating a price disparity “advantage” versus all other aspiring resellers, or in another model, deal registration reduces the discount extended to all of the aspiring resellers except the awarded, registered reseller, creating a price disparity “advantage” because the non-registered aspiring reseller costs are higher by comparison to the costs the registered.

Okay, this explains why obtaining a price quote from a VAR is difficult when they aren’t the incumbent.

In the absence of a deal registration, the lowest cost to a reseller is based on the tiered status of their partnership with the manufacturer. Silver partner, gold partner and platinum partner are examples of some of the designations often used to describe these tiers, with each ascending “rung on the ladder” providing a more advantageous reseller costs for the manufacturer’s products and services, for example, silver partnership tier might produce 25% off list price, gold at 30% off list price, platinum at 35% off list price, etc.)

If I am to unseat an incumbent reseller, I must have been awarded a “deal registration” by the manufacturer being considered.  If not, I am relegated to the role of providing the second or third quotation, really just a formality or courtesy to procurement departments who require multiple quotations in order to award a P.O.  Purchasing then awards to the “winning” bid, which, of course, will be the “registered” reseller 100% of the time.

What a racket. My take: The vendor has created an ecosystem which is a right old mess and they’re the only ones who come out on top.

%d bloggers like this: