two bits of news for tonight!
FIRST!
alright so instead of posting work that other people are doing and commenting/summarizing and otherwise butchering the quality. i’m actually gonna start to write my own stuff! well, i’ll probably also continue to repost that stuff too.
i’ll be naming the series as follows.
the security pirate’s guide to: live incident response, forensics and root cause analysis - how to use native system utilities to isolate and mitigate threats when you don’t have any specialized security technologies to assist you.
..i think the length of the title is what gives it its charm. i never got to write a long academic paper or thesis, so this is about as close as i’ll get.
essentially, this comes from years of having to attempt identification of root cause and attack vectors on compromised systems long after the fact (sometimes, years). when you don’t have a HIDS, NIDS, centralized log server, trusted-state hashes, change history or an understanding of the system’s normal use and operation. the only data you have to work with is what’s been stored on the system and is rightly considered suspect/inadmissable in court and the system tools/binaries already installed can be compromised to mislead or hide system artifacts from further analysis.
it really doesn’t get more disadvantaged to that, unless you’re trying to do this analysis through an OOB interface, such as a KVM with way skewed mouse precision or horrible lag on console input, while fending off a horde of the 28 Days Later type zombies.
unfortunately, this is something i find myself doing far too often. fortunately, i’m pretty decent at it and still able to tell with a high degree of certainty whether the box is rooted and needs to be nuked, then rebuilt, what apps/services were likely exploited, overall damage assessment, and then probably the most valuable - root cause and remedial activities.
anywho. i’ll get to this in the next week.
SECOND!
i’m also going to try and keep this blog steaming fresh with some sort of ‘oh shit’ security exploit/news/research of the moment that has drastic potential to affect, or spells impending doom to those security professionals charged with securing things.
i’m calling this section “how fucked am i today?”. inspired partially by a presentation given at this evening’s TASK talk by Roy Firestein where he reviewed a number of the various wonderful web crimeware kits in distribution today. kinda neat to see the c&c end of the platform, when typically all i’ll see is the damage and botnet infection.
if you haven’t been to TASK and you’re in the Toronto/GTA area, make some time and go. it’s the last wednesday of every month.
