FOSDEM 2016

Last weekend I visited FOSDEM in Brussels. I've been going to FOSDEM since the first time it got organized and saw it evolve over the years. As a security professional I regret the fact there is no security track anymore but a couple of talks still got my curiosity.

What do code reviews at Microsoft and in Open Source Projects have in common?
The first talk I attended was given by Alberto Bacchelli who did a very interesting study on code reviews. He started out with the fact that regardless of the tool the common factors are that code review is informal, tool-based and asynchronous.

In the good ol' days we had something like code inspection, a process that took forever and it evolved into code review. The main research question of Alberto was "Why do we do code review?". He approached Microsoft Research and started out with observations, interviews, surveys of management and developers and the top reason seems to be to improve the code quality rather than finding bugs as one would expect.

When Alberto reviewed the submitted comments in MS Codeflow, the system Microsoft uses to do its code review, he used a clustering method. The interesting observation that came out of this analysis is that the comments were focused around low level defects and not discussing any design.

To make the comparison with the FOSS world Alberto chose Gromacs and conQAT. Two projects I am not familiar with. Alberto's observation was that in both cases the majority where non-functional changes and the same pattern was observed at Microsoft. Personally I think that is very interesting.

Currently Alberto is busy with studies in the field of software analytics. This is data science applied to software code. He takes data sources like IDE logs, versioning system logs,  issue track logs and review data. He classifies the data, looks for patterns and clusters it. The current questions he tries to find an answer to are:

1. Who is the optimal person to review my code?
2. How many times do you have multiple changes in one iteration?
3. Are there parts that are more likely to contain bugs, how can we focus on the risky things?

This last question is from a security perspective a very interesting question.

Rspamd
Rspamd is an open source spam filtering system developed by Vsevolod Stakhov. The origins of rspamd is the Vsevolod's frustration managing a big cluster of spamassin machines that couldn't handle the load. He wrote rspamd in C and uses an event-driven model with the possibility to make LUA rules.

Vsevolod argues that there are basically two kinds of spam:

• fraud: Nigerian fraud, phishing, ...
• advertisement: classic Viagra, social networks, ...

Rspamd has 3 main filtering methods. You have the classic policies such as SPF, DKIM and DMARC. A second filtering technique is static content matching using patterns and the third technique he implemented is based on statistics and machine learning.

The second part of the talk was rather technical on how Vsevolod implemented his ideas. I really liked the talk but was a bit disappointed when he said that there are issues to find package maintainers for the major Linux distro's. It looks a promising piece of software but in a commercial environment you are often required to work with standard packages and can't tell management the spam filter is going down because you need to recompile the new version.

Systemtap

The next talk I attended was systemtap. The presentor, Frank Ch. Eigler, is a rather funny character on stage. The idea of virtual patching has been around for a while but I haven't seen implementations in real life. Frank's idea finds its origins in dtrace and (scripted) dgb.

systemtap is also an event-driven system and implemented with a kernel module. The logic is:

1. study the vulnerability
2. analyze the conditions of the vulnerability
3. draft an algorithm to make the hostile data safe or reject it
4. express the algorithm in a script
5. run the script

I liked the idea but unless you really deep understand the system it seems impossible for most production environments and making hostile data safe is in my opinion not a good idea, reject it is better. From an incident response point of view is reject and alert the correct option.

The evil side in my head was wondering how we could use such a system as a rootkit.

How to run a telco on free software
This talk given by Dave Neary was eye-opening. Although my previous employer was an ISP there is still a big difference between an ISP and a telco.

Dave started out with the history of telco's in the Western world. According to him there are 2 major revolutions in the telco world. The first being the addition of data where it used to be a voice-only story and the second revolution is the change in medium where we used to have copper wire we now have fibre, mobile, satelite, etc.

During his talk Dave explained OpenNFV. NFV stands for network function virtualization. Examples of NFV are loadbalancers, firewalls and intrusion detection devices. The OpenNFV standard is based on devops principles and it was interesting to see the projects Dave mentioned.

Here is a list in random order:

• kvm
• opendaylight
• puppet
• openstack
• foreman
• openshift
• ceph
• libvirt
• xen
• opencontrail
• onos
• openvswitch
• dpdk
• opendataplane
• openflow 

 It was interesting to see how our world is evolving and from a security standpoint. All these technologies will bring challenges and opportunities for infosec people.

How to make friends and make them click on links

Introduction

A while ago I had some fun with the attacker of a hacked e-mail account.

I will call the victim Mary so I can guarantee her anonymity. I know Mary for a couple of years now and as most people you exchange email addresses at some point.

The initial message

Mary's Yahoo account was hacked and I got contacted by the attacker with the following message in French

Hello,

Can you reply to this address I have something important to tell you but I want you to be discreet.

Kiss

Social Engineering the Attacker

This didn't match our style of communication but it came from her account so I replied with the simple phrase "No Problem" and "Or you can call me, I am at the office.".

About 10 minutes later I had a reply but interestingly it came from a mail.ru mailbox but the name was an exact copy of Mary's. The content of the email was:

Thanks for having replied to my email. I am currently in Portugal for important business. I am here for a couple of days and did not have the time to tell you about it. I got into a taxi and forgot my handbag that contained my phone, credit card, money and other stuff in that taxi. The only thing that I still got is a TransCard that I would like to put some money on. I would like you to buy for me some vouchers so that I can at least deal with the hotel costs and transport. If I can count on your help, I will instruct you what you need to do.

Kiss
Mary

Now this was funny because Mary would first of all contact her family and she doesn't do business trips abroad as far as I am aware. But I wanted to know more about my new friend. Let's call this person from this point Bob, just for clarity.

I contacted the real Mary and explained her what was up with her account and she got contacted already a couple of times that morning by her circle of family and friends.

I replied to Bob:

Hello Bob,

I fully understand you are going through some hard times but don't worry we got you your back. I am sorry but for the next couple of hours I will be in a meeting and will not be able to reply to you.

In my next email I asked Bob for detailed instructions since I am a good friend and will provide 500 EUR. This made Bob eager to reply. In his reply he explained me that he wanted me to by e-vouchers and send him the codes so he could do the rest.

Figuring out where Bob is

To figure out where Bob is I had set up a web page with a copy of an error 503 page. There was nothing wrong with the server of course, it responded with an HTTP 200 but the page looked like an Apache 503.

To "obfuscate" a bit the URL I made a bitly url and crafted my email for Bob:

Dear Mary,

As promised I bought a 500 EUR voucher at the store, I've uploaded it to a web server since I have sports tonight. Here is the url. If you need more money let me know.

Cheers,
Erik

The URL text showed in the mail as a regular URL ending in scan.jpg. The HREF of the a-tag was set to the bitly address.

Bob clicked a couple of hours later and was located in a Nigeria. He got back to me to tell me that something was wrong with my scan. This clearly illustrates to me that he only knows how to phish but lacked the technical knowledge to analyze my bait-mail

The clean up

It seemed the criminal had taken over her account and set up mail forwarding to the mary @ mail.ru account. Besides cleaning that up, Mary added two-factor authentication so that it will become harder to hack her account again.

The reason why Mary's account got hack was an easy to crack password. When she told me the original password it was clear that it was a word that appears in dictionary lists and the number at the end was a classic too. Now she has picked a more complicated password. A good thing was that the original password only gave access to her mailbox.

Is red a critical issue?

A couple of weeks ago I was giving a training and somebody made the remark that if something has the color red it is critical. The logic she used was parallel to the traffic lights but there is a problem with this. It starts with the idea that everybody can see colors and this is not the case.A good friend of mine is color blind for red and green and that is how I became aware of the issue.

When we are talking about a traffic light what color is lit actually, since we agreed upon the fact that the colors are in an order and it is thus actually the order of the light that matters and not the color. This is why color blind people are able to drive.

When we are talking about incident response this becomes an whole other issue since the color tag of an incident is pointless to a color blind person. If my friend would have a look at a dashboard tagging one incident red and another one green they would both be grey-ish. This means he has a 50% chance of starting to work on the incident with the least priority.

The solution is actually pretty simple, you use a defcon-type scale where 1 means it is your number one priority and the lower on the scale the incident is rated the less attention it will get. The classification of your incidents will influence greatly the value it gets on this scale.

That is not hacking ...

Lately I have been doing a couple of social engineering attacks . One of the attacks I did was fairly simple. I had access to a big screen showing me a nice typical Windows background.

When I checked out the back of the screen I found a USB port so as one does when something is in scope, you start having fun with it. I plugged in a USB keyboard and hit the Windows+R combination. A nice window popped up and I opened a notepad so I could write a nice little message to the system administrator with my contact details. I unplugged the keyboard and continued what I was doing.

Later in the afternoon when the message got enough attention I took the message down. It had had the attention of the managers and I was already looking with the infosec-team for solutions.

Funny enough one person from the IT staff came up to me and said that it wasn't a hack since it required physical access to the machine. I pointed out that to a threat agent it doesn't really matter how it gets done, the only thing that matters to a threat agent is that his or her job gets done.

AlienVault Open Threat eXchange Platform

Indicator Sharing

I am currently working on a ISAC and one of the nice things about an ISAC is that the organizations involved can share information about the attacks they encounter. I've been trying out AlienVault OTX during the month as a platform for public indicator sharing.

The reason why I did not set up my own platform , like a MISP instance, is that the ISAC right now needs to focus on building trust between the parties involved. The OTX allows me to demonstrate the value of indicator sharing in a very simple way.

The AlienVault OTX Platform

As a test case I decided to go with something everybody can experience when connected to the Internet, SSH scans. By experience I know that there are regular scans and the classic ports are TCP/22 and TCP/2222.

There are two ways to interact with the platform, either through the API or the web interface. I chose the latter since I wanted to know if the platform is actually usable for small organizations with a limited amount of resources and knowledge about programming against an API. I must say I was amazed about how easy the good people of AlienVault made it.

When you open the platform you get a dashboard that looks like this:

 

Creating a new pulse

When you want to share information you create a pulse. You can either create one from a copy-paste or manually create the indicators.

 

The exctractor parses the values you paste and tries to detect what the data types are for the submitted data. Since I have only submitted IPv4 indicators I can't say I really tested it but except for one IP it was always spot on. The reason why it asked me to verify that IPv4 address is because it actually looks like a software version number.

When you create an indicator manually you select the type (IPv4,  domain, URL, FileHash-MD5, ...) and enter the value in the indicator field. This works more slowly but is of course more accurate. I tried to do things like double submits in a same pulse and indicate no type but it gently points out the error.

Sharing The Data

Once you have submitted your data the platform asks you how you want to share it.

You can set a TLP label to indicate how the data should be handled and if the data is public or private. I have only published public TLP Green data. One of the things missing I think is that you can't create groups between whom you can share your data.

The tags are handy since you can immediately create context to it. The data I've submitted for example is all SSH traffic so I tagged it with SSH.

You can also add references to a pulse, I haven't used since I credited my external sources in the description, which according to me is a rather logical thing to do.

The Indicator Summary

After you've submitted your pulse a summary is generated.

The first part of the summary is a handy abstract of the number of related pulses it found in the database, the number of indicators, the classification and how many people are subscribed to it.

A fun part for management is the country attribution but as we know a computer in China might be hacked by a Belgian who first connected to another system in Brazil. It doesn't indicate where the bad guy is, it just indicates where the connection comes from according to the GeoIP database of AlienVault.

The next part of the page are the indicators of compromise you just entered. But the last part is the interesting part.

The related pulses are the pulses already in the system that share some of the indicators. What I would have liked is to see how many indicators are shared. When you click on the pulse you get the actual pulse. It would have been nice if it indicated what the shared and non-shared indicators are but it is unfortunately not the case.

 

Data Quality

The worth of a system is as always the quality of the data you put into it. I've been a DBA in the past and quite often people where complaining about the CRM database containing "low quality" data. The irony was of course that usually they were the ones that had inputted it in the first place.

 

Public Data is Public

To give you a good idea of the data submitted you can actually see the public data without an account.

 

Dashboards

AlienVault is a commercial company and thus they need to do some marketing. One of the nice things to show to convince people about sharing data are the public dashboards:

• Top Threatshttps://www.blogger.com/blogger.g?blogID=4908217061576309761#editor/target=post;postID=752206544323507227;onPublishedMenu=posts;onClosedMenu=posts;postNum=1;src=postname
• Recent Threat

 

Reputation Monitor

As an incident responder it is part of the job but it remains a painful experience when somebody has to tell you that you are compromised. One of the resulting free services of the OTX platform is the reputation monitor where you can indicate what your IP addresses and domains are so OTX can notify you when it got some bad news for you.

Account Issues

In the beginning of November I had some issues with my account but with the help of Bill Smartt these issues were dealt with.

Conclusion

Although I have points of critic and I haven't shared them with AlienVault yet, I must say I am rather impressed by the platform. I will try to play with the API in the near future and do a follow up post when I am done.

My ex-colleague Koen Van Impe has written a nice piece on MISP and IBM's X-Force Exchange. If you are interested in the topic, definitely have a look at his guest post on the securityintelligence blog.

I just want to point out one last thing, data remains data, only you can provide the operational environment context and thus use the data coming from these platforms wisely.

If you are looking for the IOC's I publish you can find them at https://otx.alienvault.com/erik/

Uploading to Google Mail ... a random obeservation

Hello,

Last week I was investigating something related to Gmail. I needed to upload a picture from a web server.

When you create an e-mail and want to include an image you click on the little icon and tell it is located on the web server.

What I noticed is that when the image is called 1.gif, Google will try every character so it tried to find 1, 1.g, 1.gi and 1.gif.

I would have expected them to wait until I stopped typing but apparently not. Yes, sometimes browsing a log is interesting.

Facebook profile delete but not entirely it seems ...

In April 2015 I decided to get rid of my Facebook profile. I first downloaded a report to see what they had about me and then deleted the profile. One can assume that the good people that work there keep their promise and delete the profile.

I am currently working on a slides for a presentation about securing your Facebook account and setting up your privacy settings as restrictive as possible. Since I had no account I needed to make a temporary account, with a fake first and last name (I know against the EULA), and used the same e-mail address than the account deleted in April.

One can suppose that the 'old' data is gone but interestingly every friend Facebook proposes was in the friend list I had before.

I can only come to one conclusion and that is that they do not actually delete everything otherwise those friend proposals should have been random strangers (maybe living in the same town).