Kishin Fatnani's IT Security Blog

See the face of a botnet master and his BMW

2012-01-12T05:31:00.000-08:00

Dancho Danchev exposes the master of Koobface (anagram of Facebook) botnet

See his blog post here :
http://ddanchev.blogspot.com/2012/01/whos-behind-koobface-botnet-osint.html

50% off on Check Point exam re-takes

2011-12-15T20:16:00.000-08:00

To encourage and support your certification goals, Check Point has implemented automatic 50%-off re-takes for the following exams at Pearson VUE

CCSA R71
CCSE R71
VSX
CCEPE
CCSA R75 (coming soon)
CCSE R75 (coming soon)

Note: All R70 exams will be retiring on 31 December, 2011

Inspecting HTTPS traffic on gateways

2011-11-15T22:34:00.000-08:00

INTRODUCTION

In the past, security devices inspecting application content for attack patterns, misuse or malware, had been blind to encrypted traffic and due to this encrypted protocols like Hypertext Transfer Protocol Secure (HTTPS) have been a safe method used by attackers to bypass security inspection. Though reverse proxies and Web Server modules have been there for long, but they only inspect incoming traffic i.e. connections made to protected web servers in the organization. Inspecting outgoing traffic or traffic of connections made by users to outside world servers, not protected by the device, had been on the wish lists. Devices these days come with the capability to inspect Secure Sockets Layer (SSL) based outgoing traffic, however there are some concerns enabling such kind of inspection. In this article we cover some basics of SSL, the challenges in inspecting SSL traffic, and also see how Check Point's HTTPS Inspection feature starting from R75.20 is able to inspect HTTPS traffic at the gateway. After reading this article you will know the pros and cons of enabling SSL inspection on a gateway.

Read further or download the entire document in PDF format below:
Inspecting HTTPS Traffic on Gateways

SPG - informal meeting

2011-05-27T05:58:00.000-07:00

Security Professional's Group (SPG) is having an informal bar meet on Sunday 29th May '11. If you are interested, send in your mobile no. to spg@ksecure.net

2011-03-31T08:52:00.000-07:00

New VSX courseware finally released.

Hackers meet at Nullcon 2, GOA

2011-02-26T08:08:00.000-08:00

Heard of Black Hat, White Hat and also Gray Hat but what does this Brown Hat??

Does it mean the chief of all the hats? or something else??

Had a great time at GOA and the second Nullcon conference in Feb 2011.

2.4 Million email account passwords leaked

2011-02-26T03:00:00.000-08:00

Have you ever entered your email account password on some sites like social networking, contact management, birthdates management or may be email marketing? Well the site you used could be legitimate, but how good is their security?? Are they collecting your password or redirecting to a login page on the email server?

Hackers have got 2.4 million email account passwords of gmail, hotmail, yahoo, live etc. The no. is expected to go up to 24 mil soon and as this is not likely to be the result of compromising all the providers at a go, hence it seems to be data from 3rd party sites in possession of the password. If you like to see if you are one of the victims, you can check your email id here - http://dhamaka.nullcon.net

Writing Snort Rules

2010-12-11T07:43:00.001-08:00

Writing Snort Rules
by Kishin Fatnani

Snort, as you would know, is a tool used to detect intrusions on a network. Though the tool can also be used for packet logging, sniffing or as an IPS, however in this article we will look more into the concept of rules by which Snort detects interesting traffic for us, basically the kind of traffic we are looking for, like a network attack, a policy violation or may be traffic from a network application or device that you are troubleshooting. For instance, if someone is doing XMAS port scan to our network using nmap with the -sX option, Snort will give us the following alert message.

[**] [1:2000546:6] ET SCAN NMAP -f -sX [**]

[Classification: Attempted Information Leak] [Priority: 2]

10/15-08:51:46.970325 192.168.0.111:62202 -> 192.168.0.1:132

TCP TTL:53 TOS:0x0 ID:28031 IpLen:20 DgmLen:40

**U*P**F Seq: 0xD70FB1F3 Ack: 0x0 Win: 0x800 TcpLen: 20 UrgPtr: 0x0

[Xref => http://www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/SCAN/SCAN_NMAP][Xref => http://doc.emergingthreats.net/2000546]

If the use of P2P or IM applications is against the corporate policy, Snort can detect their use on the network and provide alerts with messages similar to these:

To read the complete article, download the magazine from here:
http://hakin9.org/magazine/1576-hakin9-starterkit-snort-exposed

2010-12-06T08:04:00.000-08:00

Interest in information security or may be hacking seems to be really growing in India. Immediately after the first malware conference ended in Mumbai, another conference 'ClubHack' commenced in Pune. ClubHack is not new, it is India's first hacking convention and this was their 4th year. It's one of my favourite events and I make sure to attend every year, however this year I could just attend the technical briefings and missed the workshops and panel discussions.

The briefings surely had enough of good quality stuff to make it worth travelling all the way to Pune. It was great to learn about Android issues from an expert who has developed the most popular Android app 'Antivirus Free'. The session on Firefox security was also an eye-opener making us understand how easy it was to write a malicious extension for the browser and even easier was their installation. Another interesting presentation was about cloud computing for forensics in which it was demonstrated how to make the time consuming tasks in forensic analysis quicker and that to at a highly reduced cost.

Rohit and his team have been doing a fabulous job of conducting the conference each year and regularly publishing the ClubHack Magazine.

2010-12-04T05:30:00.000-08:00

'Malcon' that is the name of the first ever malware conference which was held in Mumbai in Dec 2010. I was very excited when I heard about this conference and immediately decided to attend this. The number of people that showed up for this conference were beyond my expectation and surprised me a lot, though it can in no way be compared with the crowd I've seen at DefCon, however as a new comer it was a great success. The audience was a mix of students, security pros, government officials, teachers, cops and may be the real bad guys too. There were a couple of pre-conference workshops, of which I attended the malware analysis by Atul Alex. It was good to hear all the low level stuff like assembly instructions, opcodes, interrupts etc and see a demonstration of writing malware.

Atul Alex also presented a paper in the conference which was about taking over control of Symbian phones which was an eye opener. The other presentations were also quite good and so was the panel discussion at the end of the conference. One of the panelists was Alok Vijayant, Director NTRO who has been backing the organizers of most of the security conferences and encouraging the young Indian hackers. He believes that having the best protection is not just enough but we also need to have the capability to attack back. The conference has done a good job of making people aware of the malware capabilities and how it is created, there is also a threat of people getting the wrong message or misusing their skills. It is actually debatable whether such conferences will help the nation by spreading awareness and have better skills or creating more malware making it difficult for the entire world to cope with. Well I would hope for the better but it will have some kind of side effects too.

During the panel discussion, a teacher stood up and said that now she can give a Green signal to her students to GO AND HACK, though the panelists explained her the right way to go about it. There was another interesting question about reporting a vulnerability on some government website, if someone finds a vulnerability on a website that means he might be trying to attack the site or must have done something which he was not supposed to be doing, in that case will he be arrested for the misconduct or awarded for reporting the bug. An example of the EVM machines was given by the participant. Taking the case of downloading data using SQL injection, which was mentioned by the participant, the panelist answered that if he downloads the data then he is at fault so he can just report the SQL injection vulnerability. This seemed perfectly fine to me while i was there but then I thought if he was testing a DoS attack, it can be detected only if there is actually a denial of some service, unlike SQL injection where an alert message will prove that the vulnerability exists. What will happen in that case?

Well to end this note, I would just say Malcon was great, I enjoyed being there and I hope we see it happening every year and growing always. I also hope that the government always supports such events and hope Alok is always part of it.

New Check Point Provider-1 courseware

2010-11-26T01:50:00.001-08:00

Recently I got a chance to review the Check Point Provider-1 and VSX coursewares. see the acknowledgements in the image

Launch of Packet Master

2010-11-15T23:44:00.000-08:00

K-Secure successfully conducted its first batch of the latest training program 'Packet Master' that teaches how to analyze network packets and craft custom packets for security testing.

Hyderabad - 11&12 Dec 2010
Mumbai - 18&19 Dec 2010

Learn how to analyze and craft packets

2010-10-25T08:26:00.000-07:00

The skill of analyzing packets is the most essential skill required if you are a pentester / ethical hacker, a network or security administrator, intrusion analyst, forensic analyst, application security tester, researcher of vulnerabilities, or you deploy or audit firewalls and IDS, or you write custom IDS signatures. If you already acquire the skill to analyze packets, learning Scapy would just do wonders in doing your job much more efficiently and making your organizations more secure.

K-Secure's Packet Master training program would be a great help if you:

Want to audit or test your firewall rules
Do pentest on networks or applications
Like to test if your IDS signature / rule works
Wondered if your pentesting tools like nmap, arpspoof, hping etc. can give you more control and information

Web Attackers will have a tough time now!

2010-06-01T19:35:00.000-07:00

The attackers have surely moved their focus on web applications but this team is now fully prepared to detect and analyze any intrustion happening through their web applications. They've acquired these skills by going through a specialized training from K-Secure.

Security Professionals' Group

2010-04-26T08:14:00.000-07:00

We're glad to have formed a group of professionals working in the area of information security. In our first meeting yesterday, which was conducted at K-Secure's office in Mumbai, we discussed on the Vulnerability Assessment services, where the members shared their experiences talking about what vulnerabilities are commonly found and the challenges they face in closing them. There was also a demonstration of tools which made it more interesting.

The meeting was supposed to be for a 1 hour duration but there was so much excitement that we wanted to go on and on but finally decided to wind up after about 10 hours.

We have lots and lots of plans for the future of the group, so if you are interested in joining this group, please email to spg@ksecure.net.

OWASP Top 10 - 2010 released

2010-04-21T04:17:00.000-07:00

Want to get started with application security? OWASP (The Open Web Application Security Project) has released the list of ten most critical web application security risks.

Top 10
------
A1: Injection
A2: Cross-Site Scripting (XSS)
A3: Broken Authentication and Session Management
A4: Insecure Direct Object References
A5: Cross-Site Request Forgery (CSRF)
A6: Security Misconfiguration (New)
A7: Insecure Cryptographic Storage
A8: Failure to Restrict URL Access
A9: Insufficient Transport Layer Protection
A10: Unvalidated Redirects and Forwards (New)

More on Top 10 is given here - OWASP Top 10

Facebook phishing through live chat with Ranbir Kapoor

2010-04-02T09:04:00.000-07:00

I was hooked on for a while to Ranbir's live chat for the Pepsi game on facebook today. At the end of the session, i observed some messages informing the users that Ranbir was still online and asked them to click on a link. Though the link looked legitimate, however, I did not want to trust it so I ran my tools to do some investigation. Soon I found that it was taking me to another URL which included the word 'hacking'. Now I was very sure that it wasnt a genuine message. Little more into it and there came a page which looked exactly like the login page of Facebook. It did not need any further investigation as it was very obvious that this was a phishing site and was looking for usernames and passwords.

GIAC recertification - taking exam is not the only option

2010-03-31T00:18:00.000-07:00

I have been taking GIAC exams every time any of my GIAC ceritifications was about to expire and I always wondered if they can come out with an alternate option like the CISSP's CPE approach. Well the time has come and GIAC has finally made a major shift and given some options to the certified professionals. In short they have this Certification Maintenance Unit (CMU) approach. You will need to have 36 CMUs to get recertified. The CMUs can be earned by publishing a technical research paper, completing information assurance related training, documented work experience or GIAC / SANS community participation. For more information you can check thier website - http://www.giac.org/certification-renewal/

Though you can escape the examination, however, you cannot escape the recertification fees of $399 which has to be paid irrespective of what option you choose for the recertification.

DVWA / XAMPP installation

2010-02-13T19:59:00.000-08:00

Workshop at Cert-In

2009-02-16T00:31:00.000-08:00

Cert-In had organized a one day Workshop on "Application Security : Latest Trends" which was conducted on 30th January, 2009. The objective of the workshop was to create awareness among Indian IT Infrastructure and user organisations on the latest trends in Application Security. Delegates were from Government, Corporate and critical sector organizations.
We were invited to present on Defense Mechanisms where I gave an overview of the various ways of protecting web applications with more focus on web application firewalls. My presentation is available here - WAS Defense Mechanisms

OWASP Mumbai Chapter meeting

2008-10-01T07:39:00.000-07:00

Pictures of OWASP Mumbai Chapter meeting on 22nd Sept 2008

Web Application Security Awareness Workshop

2008-07-18T00:14:00.000-07:00

K-Secure and Blueinfy conducted this workshop in Mumbai which was very much appreciated by the participants. The same workshop covering the following topics will be conducted on 5 Aug in Mumbai and 6 Aug in Pune

· Web Security and attacks on the rise
· Know your enemy
· Corporate at risk - real life cases
· Web application security fundamentals
· Web components and security
· Developing Security around SDLC
· Industry best practices for architects and designers
· Threat modeling and methodologies
· Attack vectors and overview
· Top 10 attacks like SQL injection, XSS etc.
· Exploitation and Impact on corporate
· Next generation attacks - Web 2.0
· Defense methodologies
· Securing web applications and site
· Secure coding
· Application layer firewalls
· Live hacks and attacks - Demos

Interested participants can contact at info@ksecure.net

Web site: www.ksecure.net