Confessions of a script kiddie and a l337 wannabe

Dear interviewer,

I do not know how to code. I only know a limited amount of Python and Ruby scripts. I can't figure out assembly language and C++. Shellcode scares me. Socket Programming, yeah, a little bit.

But there's a couple of tricks that I do know. I know how packets are made of and how they behave. The OSI layer and TCP-IP 3-way handshake is something close to my heart. I know how to leverage the MSF3 Framework for a goal-oriented penetration testing engagement. I know how to evade firewalls and overall detection using NMAP. I know how to craft my own packets using NPING. I know what a reflective DLL injection is. I know how to migrate an existing exploit from one running process to another. I know the difference between a compromised Windows XP and a clean one by just looking at a running Wireshark capture. I know how to maintain my connection. I know how clean my tracks.

I know how to go over a list of check boxes, namely SAS70 Type2 Audit (Now called Service Organization Control Reports), the legendary PCI-DSS, or HIPAA, or the ISO27001. I love the GAPP document by AICPA/CICA. Pretty straight forward.

Yes, I am a script kiddie. I do not breath and live codes. All I need to do is read and follow how to exploit a specific vulnerability. The l337 coders already made the codes, the payloads, and the guide how to attack. The difficult part is done and all I need to do is follow the guide from step 1. And yes I hate the command-line. Thank you Raphael for creating Armitage, makes MSF3 like child's play. Hail Mary see you tonight!

Thank you for hearing me vent by reading this blog. I am just frustrated because everyone is looking for "paper-certified" security researchers when I go over Dice.com, Monster.com and other job hunting websites.

Goodnight.

Meet Evan Kohlmann: The Terrorist Search Engine

Meet Evan Kohlmann "The Terrorist Search Engine"

http://nymag.com/news/features/69920/

However, despite having an unprecedented success rate inside the court as an "Expert Witness" in putting bad guys to jail, a lot of IT Security Experts are questioning his research and investigation methods.

One good question from a fellow IT Security Professional posted at Schneier on Security:

http://www.schneier.com/blog/archives/2010/12/open_source_dig.html#comments

@Clive "court recognized Expert Witnesses"

This is related to the profile on Kohlmann. There was the comment on "if his method is sound". Well what's an expert? Someone who knows what they are talking about. How can you tell they are an expert? They know more than me.

Kohlmann should be being challenged by the opposition lawyers as to his qualifications and knowledge. But what can a lawyer really know about any experts’ area? They usually just get the CV and "has testified in many trials of this nature" kinds of anecdotal assurance. While the opposition can try to challenge an expert's testimony they really can't try to impeach an expert, can they?

They are limited to putting their experts up to testify, to rebut the other side’s expert. So the jury has two sets of conflicting expert opinion. What's needed is an expert cross examining the witnessing expert to reveal those misstatements, lies, distortions, and 'reduction in detail' that technical people use to make complex ideas understandable by executives, lawyers, judges, and their juries.

In my opinion, every research and investigative methodology, framework, etc. in used by an expert for Computer Forensics purposes and presented in Court, should be heavily scrutinized no matter how effective and successful it is when it comes to putting bad guys to jail. Of course we value the credibility and integrity of the Expert based on his track record, but as technology progresses things are getting easier to be digitally manipulated, even worst, "hacked".

But Evan Kohlmann, I think this guy is legitimate. His obsession in tracking terrorist on the Internet for years is what made him an expert in this field of investigative IT research slash counter-terrorism. I think you can compare him to an 18 year-old teenager; obsessed in browsing Facebook, looking for new and old friends.

Defenders of the Cloud: Certificate of Cloud Security Knowledge (CCSK)

As Cloud Computing adoption rises, more and more experienced IT Security Professionals are suiting up for the challenge, upgrading their existing arsenal with new concepts and best practices in securing the various layers and components that makes up Cloud Computing.

Since I am in the IT Security and Cloud Computing industry, I am starting to notice the certification initials "CCSK" alongside their CISSP, CISA, CEH, Security+, PMP, ITIL and other noteworthy titles. This is a strong indication that IT Security Professionals do recognize the new challenges that Cloud Computing brings to the table.

The Certificate for Cloud Security Knowledge (CCSK) is pioneered by the Cloud Security Alliance (CSA) So far, the industry support for the first ever certificate in cloud security knowledge is showing accelerated growth garnering support and participation even from major companies.

As one of the members of the early adopters of the certification, the main reason why I want to be part of the initiative is to show my dedication and passion in the new technology and play my part in generating positive public perception on how individuals, small business and large enterprise can harness the power of the cloud without thinking of too many risks.

There is a gap that exists big between traditional Information Technology security concepts and Cloud Computing security concepts. The co-mingling of data from various customers in a centralized or shared server, is one of the major characteristics of Cloud Computing as defined by the National Institute of Science and Technology (NIST). This gap is what the Cloud Security Alliance aims to fill, by providing industry-standard best practices on how to adopt and implement Cloud Computing securely. Cloud Computing adoption is all about losing control in a gracious manner.

Learn more about the Cloud Security Alliance Certificate in Cloud Security Knowledge (CSA-CCSK) here:

Cloud Security Alliance

http://cloudsecurityalliance.org/

Other noteworthy links:

CloudAudit

http://cloudaudit.org/

NIST Cloud Computing Group

http://csrc.nist.gov/groups/SNS/cloud-computing/

RTP Packet inspection without hurting the quality of the voice

Nice, I would like to try this solution, deep packet inspection on RTP streams coming in (and out) of your enterprise network without degrading the quality of the voice:

Overview:

Attackers can spoof the firewall and SBC into determining that the RTP stream is safe to relay. Passing the attacks through the RTP stream is called Vunneling. The alternative is to inspect the RTP packets which can slow down the transmission and distorts the voice.

The Salare solution , vPurity software, relies on a number of techniques to solve the Vunneling problem. Network Behavior Analysis (NBA) is employed by Salare. The passive NBA technique is well known for producing many false positive and false negative alerts. Salare's Active NBA virtually eliminates false positives. This is accomplished by introducing stimulus events and observing the reaction or non-reaction This provides accurate and precise recognition of the traffic types passing through the network.

The Salare technique inserts distortion in the packet that destroys embedded data and executable transmissions; this distortion is not perceptible by the listener. The insertion does not impact the quality of the voice conversation.

Complete article and links here:
http://tinyurl.com/2gxrwv6

Making the Cloud Trustworthy

Yet another Cloud Security initiative, http://www.trusted-cloud.com/ is an initiative by pioneer computer networking company Novell.

"Mission Statement: To Promote Education, Research and Certification of Secure and Interoperable Identity in the Cloud

The Trusted Cloud Initiative will help cloud providers develop industry-recommended, secure and interoperable identity, access and compliance management configurations, and practices. We well develop reference models, education, certification criteria and a cloud provider self-certification toolset in 2010. This will be developed in a vendor-neutral manner, inclusive of all CSA members and affiliates who wish to participate."

Trusted Cloud focuses on the notion that eventually it will be us users and the industry itself, that will make the Cloud more secure and trustworthy. We need to start trusting the Cloud, we need to start educating users what to and what not to expect when they join the bandwagon of Cloud Computing, we need to reiterate to users that the Cloud is not the solution for the recession, and finally, we need to let them know that Cloud Computing services, may it be Software-as-a-Service (SaaS), Platform-as-A-Service (PaaS) and Infrastructure-as-a-Service (IaaS) is now a mature and capable platform that promotes business and IT objectives alignment. Trusting the Cloud is a win-win situation, but of course with a few caveats.

We just don't have the solid security framework yet to manage and implement effective IT controls. Which is what the guys at http://www.cloudaudit.org/ and http://cloudsecurityalliance.org/ is working on. It might be early, but I would like to thank these guys for driving the Cloud Computing community to the right path of security with a common sense in mind, and not completely reliant on well-known IT controls and "best practices" which does not really scale and apply well to Cloud Computing.

Onwards,
Ron

Jolicloud OS for pen tests works, at least for me

Yet another lightweight, built-for-the-web OS, Jolicloud OS works well with my pen testing ways, at least for me. Why does it work for me you ask?

It detects my netbook's native Wi-Fi card out of the box. And I love that feature alone.

After playing around with the standard apps that comes with it, the next logical step is for me to install my security apps, and being a Gnome-based Linux distro, this is super-easy to accomplish.

Fire up the Terminal app located at the Accessories menu and apt-get install away:

sudo apt-get install wireshark

sudo apt-get install zenmap

And to install Metasploit, you need a couple of things to do, which is beautifully covered step-by-step by this guide:

http://www.metasploit.com/redmine/projects/framework/wiki/Install_Ubuntu

Why not use BT4 instead? Installing a persistent BT4 is a little bit cumbersome for script kiddies like me. BT4 is awesome, everything is in there, but most of the time I will only use a couple of the tools there. For a sniffer learning the hacker ways like me, that will be Wireshark, NMAP and Metasploit. And I would like to thank Carlos "dark0perator" Perez for this excellent piece of advice he gave on a previous episode of the multi-awarded Podcast Pauldotcom.com Security Weekly. If you want to learn the craft, don't use an all-in-one distro. Download and install Ubuntu, and work your way there. This has been my mantra for the past two years.

If I were to market the hacker ways to the public, I would pre-package these tools on social-networking centric, lightweight OS like the Jolicloud. My security apps icons are right next to my Facebook, Gmail, and Pidgin IM app, and that adds a little bit of a cool factor and a political statement that we are indeed in the age of point and click hacking.

Play safe kidz.

Asterisk Dialstring Injections

It's like an SQL Injection attack, trying this one now on my VoIPSec lab. Time to fix those Asterisk cookbooks guys! - Ron

[from_sip]

exten => _X.,1,Dial(SIP/${EXTEN}@testsip)

He writes: “And if ${EXTEN} = “000@testsip&SIP/333” what turns out to happen then is similar to SQL injection   ”He is exactly right. Many VoIP protocols, including IAX2 and SIP, has a very large allowed character set in the dialed extension, a character set that allows characters that are used as separators to the dial() and the queue() applications, as well as within the dialstring that these applications send to the channel drivers in Asterisk. A user can change the dial options and dial something we should not be able to dial in your system. This article describes the issue in more detail and gives you some help on how to avoid this causing trouble in your Asterisk server.

complete technical details here:  http://www.voip-forum.com/?p=241&preview=true