Archive for Jose Vicente Ortega

Finding a Needle in a Haystack

I am going to go out on a limb and assert that over 80% of IT shops do not take security seriously and even those who do are not proactive about it.

Whenever an anomaly hits the network, system admins and network engineers hit the logs in an attempt to figure what is going on.

Ideally you will have a centralized server running “syslog” gathering logs from all devices on the network that can put out logs.

Unfortunately, unless you’re “Neo” from the movie “Matrix” it will almost impossible to make sense, interpret or pick up patterns from the vast amount of data in these logs.

This is were a good Log Analyzer comes in. There are well known log analyzers out there for web traffic, including AWStats, Analog, WebLogExpert, Webalizer and WebTrends but something more comprehensive is needed when it comes to security.

Unmatched as a security log analysis tool, “Splunk” gathers data from traps, alerts, syslog and snmp as well as imported logs  and lets you graph and search it via a simple web interface. In addition to helping find threats and dangerous trends, it can generate nice reports of your findings.

On the commercial front Sawmill looks like a good product, but I will need to demo and review it.

[ad]

Reblog this post [with Zemanta]

Step by Step In Dealing With Conficker

This will turn out to be a “trojan horse” literally if actions are not taken to prevent it from spreading within the corporate network.

Below are step by step instructions on mitigating the risk of the threat that “Conficker”/”Downandup” poses.

Symptoms

============

Symptoms to help you determine if you are infected

  • Account lockout policies are being tripped
  • Automatic Updates, Background Intelligent Transfer Service, Windows Defender and Error Reporting Server Services are disabled
  • Errors related to SVCHOST
  • Domain Controllers are slow to respond to client requests
  • Network congestion
  • Various security related websites are not accessible including Windows Update.

For further details see the Microsoft Malware Protection Center write up for Win32/Conficker.b. or the Sekiur writeup here.

Solution

=========

Ideally you want to not only automate the removal of the “Conficker”/”Downandup” worm from a large number of computers but also take steps to minimize the risk of them being infected again.

The following script will attempt to remove the “Conficker”/”Downandup” worm and prevent further infection by taking the following steps:

  1. Install patch KB958644 for MS08-067 if not installed
  2. Attempt to remove the “Conficker”/”Downandup” worm
  3. Enable Hidden Setting
  4. Delete all scheduled tasks
  5. Stop and disable services. (lanmanserver, schedule)
  6. Run MSRT – Malicious Software Removal Tool
  7. Install Autorun hotfix if not installed
  8. Install KB950582 for vulnerability MS08-038
  9. Re-enable TCP Receive Window Auto-tuning on Windows Vista and Windows Server 2008
  10. Remove Hidden Setting
  11. Enable Automatic Updates, Background Intelligent Transfer and Error Reporting Services
  12. Restart
  13. Install patch KB958644 for MS08-067 and restart

You will need to download the following files and batch script and drop them into the NetLogon share.

  • Getver.exe – contained in ConfickerClean-v10.3.zip here ==>  and script to remove “Conficker”/”Downandup” locally here ==> .
  • SC.EXE – contained in ConfickerClean-v10.3.zip
  • REG.exe – contained in ConfickerClean-v10.3.zip
  • windows-kb890830-v2.6.exe – x86 version of MSRT, available here.
  • windows-kb890830-x64-v2.6.exe – x64 version of MSRT, available here.
  • sleep.exe – contained in ConfickerClean-v10.3.zip
  • Hotfix update for Windows 2000, Windows XP and Windows 2003, download all updates listed in http://support.microsoft.com/kb/953252, except the Itanium update as this script does not support Itanium.
  • Place all 3 updates in the Netlogon directory.
  • Security update MS08-038 for Windows Vista and Windows Server 2008 – http://www.microsoft.com/technet/security/Bulletin/MS08-038.mspx
    This vulnerability is not being exploited, however, to disable Autorun properly this needs to be applied as it contains a fix related to autorun, same as the one listed above in KB953252.

Now you will proceed to create and push a Group Policy to the domain.

  1. Edit the <domain.com> values in the script.
  2. Rename it to .BAT and drop it in the \\%windir%\sysvol\sysvol\\scriptsfolder (aka, Netlogon share).
  3. Create a Startup Script policy and reference this batch file. This needs to be a Startup Script and not a Logon script, so that the script runs under the machine account.
  4. Link the GPO with the Startup Script to the OU and Groups where you want it to apply.

Note:

Its not recommend you use this on DC’s or critical servers, those should be cleaned manually so that the services disabled below do not need to be left disabled for an extended period of time.

FAQ:

Why disable the Server service?

This is due to Weak Passwords which the malware attempts to exploit. The password change will need to be accomplished via password policy for the domain, resetting any local and domain admin password to a complex password which includes at least 10 characters and contains, alpha-numeric characters and extended characters such as a question mark or exclamation point.

Why disable the Task Scheduler service?

This is because the malware creates several AT jobs that run every hour to reinfect the system.

Why install MS08-067?

This is the main attack vector of the malware.

Why disable Autorun?

This is because the malware drops a binary file called Autorun.inf on all removable drives.

[ad]

Sources:

All credit to Microsoft Support Engineering

Worm Uses Social Engineering

A new worm has hit the Internet and its taking its toll on computers worldwide. It has been reported that over 9 million computers have already been infected.

The worm called “Downandup”, “Conficker” or “Kido” by different anti-virus vendors uses the Microsoft vulnerability which I blogged about here (Worm Takes Advantage Of Microsoft Flaw) and here (Microsoft Releases Emergency Patch).

The worm mostly spreads across networks, turning off the system restore and deleting the restore points, blocks access to security website, download additional malware from the author, attempts to infect other computers by scanning network shares and scheduled a task to re-infect the computer if removed.

What is interesting is that it can also spread by USB memory keys or devices making use of social engineering which makes it more dangerous to the untrained eye. When a USB drive is inserted it shows a modified AutoPlay screen seen below which will install the worm when the users inadvertently clicks on it.

According to SANS Internet Storm Center, one of the reasons the worm is infecting so many machines is that “Conficker” uses multiple infection vectors:

  1. It exploits the MS08-067 vulnerability,
  2. It brute forces Administrator passwords on local networks and spreads through ADMIN$ shares and finally
  3. It infects removable devices and network shares by creating a special autorun.inf file and dropping its own DLL on the device.

Characteristics –

When executed, the worm copies itself using a random name to the %Sysdir% folder.

(Where %Sysdir% is the Windows system folder; e.g. C:\Windows\System32)

It modifies the following registry key to create a randomly-named service on the affected syetem:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{random}\Parameters\”ServiceDll” = “Path to worm”
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{random}\”ImagePath” = %SystemRoot%\system32\svchost.exe -k netsvcs

Attempts connections to one or more of the following websites to obtain the public ip address of the affected computer.

  • hxxp://www.getmyip.org
  • hxxp://getmyip.co.uk
  • hxxp://checkip.dyndns.org
  • hxxp://whatsmyipaddress.com

Attempts to download a malware file from the remote website: (Rogue Russian site is up but not serving file anymore)

  • hxxp://trafficconverter.biz/[Removed]antispyware/[Removed].exe

Starts a HTTP server on a random port on the infected machine to host a copy of the worm.

Continuously scans the subnet of the infected host for vulnerable machines and executes the exploit. If the exploit is successful, the remote computer will then connect back to the http server and download a copy of the worm.

Later variants of w32/Conficker.worm are using scheduled tasks and Autorun.inf file to replicate on to non vulnerable systems or to reinfect previously infected systems after they have been cleaned.

Suggestions –

  1. Disable AutoPlay in your environment.
  2. Run a good security suite.
  3. Keep your computer updated with the latest patches.
  4. Be PROACTIVE and look for the worm in your environment.

Sources:

http://www.nai.com
http://www.symantec.com
http://www.f-secure.com
http://isc.sans.org

    [ad]

    Keeping The Network Clean

    In today’s environment of mobile computing and the increasing integration of consumer electronics with the corporate network, it has become a necessity to plan accordingly in order to mitigate the risk this presents.

    Whether it be an iPhone or guest laptop connecting via wireless or using an unused network port, brings new challenges to network administrators who need, not only be aware of what is on their network but also prevent an un-managed device from infecting other devices on the network.

    The situation grows in complexity in higher education where the inherent open network environment becomes a juggling act balancing network security and open access. Students do not patch and fail to run current anti-virus.

    Network Access Control, which is more commonly referred to by the acronym NAC, is the most hyped term in networking today. It’s also one of the least understood.

    Network Access Control (NAC) is a computer networking solution that uses a set of protocols to define & implement a policy that describes how to secure access to a network nodes by devices when they initially attempt to access the network[citation needed]. NAC might integrate the automatic remediation process (fixing non-compliant nodes before allowing access) into the network systems, allowing the network infrastructure such as routers, switches and firewalls to work together with back office servers and end user computing equipment to ensure the information system is operating securely before interoperability is allowed.

    The idea behind Network Access Control (NAC) is to implement a set of pre-admission rules and post-admission controls over where users can go and what they can do. Kind of like an in-versed firewall framework on steroids.

    What’s important to understand is the Network Access Control (NAC) is not a device or appliance that is dropped in on the network, but rather a structure that needs to be deployed throughout the enterprise network.

    The goals that Network Access Control aims to address can be distilled into three categories.

    1. Identity Management – Which includes device registration, authentication and role based access.
    2. Endpoint Compliance – The ability to prevent devices that lack anti-virus, patches or host prevention software from accessing the corporate network to prevent putting other computers at risk.
    3. Policy Enforcement – Provides the ability to enforce company-specific policies in either block, notify or report mode and integration with other solutions to identify and disable unauthorized activities.

    Different vendors take different approaches in order to accomplish these goals, were policies are enforced on a pre-admission vs. a post-admission basis, software clients are installed on the users computer vs. scanning those computers in an effort to gather information to automate decision making at the time the policy is enforced, and finally out-of-band vs. in-line solutions.

    In 2005 I started experimenting with Network Access Control technology and came across an open-source solution called NetReg.

    NetReg is an in-line, pre-admission, client-less Network Access Control solutions. The system sits between the users and the network. Identity management is accomplished by authenticating the user through a website against an LDAP server and storing in a database the username, the IP address assigned and the devices MAC address.

    Endpoint compliance is achieved by 2 dynamic DHCP address pools; one for unregistered (unknown hosts) with non-routable IP addresses (network/Internet blocked) and the second for registered (known hosts) with routable IP addresses (network/Internet accessible). A bogus DNS server prevents users from accessing anything but certain websites where a user can download anti-virus and patches for remediation purposes.

    Nessus vulnerability scanning software periodically scans devices to determine if these should be quarantined until they have met the established acceptable use policy. If a computer in the unregistered network is found to be non-compliant, it is notified and only when appropriate action has been taken will the computer be assigned a valid routable IP address. If the computer has already been assigned a valid IP address then it is blocked.

    Some of the shortfalls of this approach were the inability to determine which patches were missing and firewalled clients are not checked.

    Netreg which was originally developed by Southwestern University at Georgetown branched out into several versions and currently the only one being maintained is by Carnegie Mellon here.

    Finally is important to note that there is no silver bullet when it comes to security and there are always ways to get around a system. A thought that came to mind was how these products deal with printers, VoIP phones, gaming consoles, etc, when it comes to registration and how by changing one’s MAC address to mimic a VoIP phone or printer vendor would bypass the authentication.

    In researching when writing this blog, I came across another open source solutions started in 2007 called PacketFence which I will take a closer look at.

    Major Commercial Solutions:

    Open Source Solutions:

    Sources:

    Wikipedia
    Gartner Market Scope for NAC 2008

    [ad]