Breaking in (to the information security field)

Much has been written about how to get started in InfoSec. Last week, I happened across this excellent post with guidance for college students interested in security. The fact is, most of his points are relevant for anyone, student or not, that feels like security is their calling. Of particular note that you really need to love this field to make a career of it without getting burned out in the first few months.

Landing an internship is a good start. I've worked with some brilliant interns from high school and college, but internships are usually only available to students. Most security industry internships are not only paid, but paid quite well compared to many entry-level part-time jobs. Like most internships, you stand a pretty good chance of finding a job in the field if you excel at your work.

Brian Krebs has also sought advice from various high-profile folks in the industry. Most of their sentiments line up: Be curious. Learn. Tinker. Show it off. Crafting excellent write-ups shows potential employers that you're an effective communicator, and that you have the skill to really dig into and understand a topic. These traits matter through your entire career. Even now, with nearly half my life spent in the information security field, I still can't resist the urge to get my hands dirty in the lab. As for how to show off your findings and get involved with the community,  try setting up a blog, hanging out in /r/netsec and visiting local gatherings such as CitySec, ISACA, OWASP, yes, even 2600. If you get a chance, big security conferences can be a lot of fun, but I'd argue they're less useful for getting your foot in the door, and more useful for getting to know others in the field from all over the world.

It's worth reiterating how unfathomably broad the field of information security is. If you're looking to get started, it's best to pick one or two subjects to really focus on. Many of the "fun" topics make use of both offensive and defensive skills. You might need to Google some of the sub-topics, but to name a few I can arbitrarily think of off the top of my head:

• Network Security (Firewalls, IDS/IPS, WAF and penetration testing)
• Software Security (Fuzzing, OWASP Top 10, code review, malware analysis, vulnerability exploitation)
• Endpoint security (Desktop security, FDE, Group policies,  NAC, anti-virus)
• Cryptography (Implementation, design, analysis and cracking)
• Disaster Recovery (data backup/restoration/replication, RAID, UPS, hot-sites)
• Authentication, Authorization and Accounting (Passwords, tokens, logging)
• Security architecture and policy design
• Governance, Risk Management, Compliance, Legal and Regulatory matters (GRC)
• Physical and Operational security (surveillance, risk assessment, lock picking, social engineering)

Lots of security content: July 2013 BSD Magazine

Yes, you have to give them your e-mail address. And yes, like many publications, there are a bunch of advertisements. Every once in a while, BSDMag covers a lot of security-related topics, and this is one of those. Click below to get the latest issue.

 

A UNIX System! I know this!

I warned you all. I was going to do it.

When I was a kid that actually knew and used UNIX (AT&T and AIX at the time), I knew in my heart of hearts that there was no video-game-like flying graphical file manager for UNIX. A lot of us made fun of the computer scenes in Jurassic Park. Well, I was wrong. All of us were. Here's the 20+ year-old Fusion (fsn) file manager running on a 20-year old computer.

Olde-school DES Cracking

I like old computers. I like playing with different operating systems, including old ones. A year and a half ago, give or take, I received an SGI Indy from someone who was cleaning out the shed. This was a low-end machine from SGI, but a relatively high-end workstation by most standards of the era, meant for people doing 3D design and CAD work. This one was made in 1996, about a year before the product line was discontinued.

I've never used IRIX (Silicon Graphics' implementation of UNIX) before, but when the machine booted, I was presented with a graphical account chooser, not too different from what you might see on a modern computer (except lacking 20 years of graphical finesse). Of course, the first account I try to get into is root, because I would like to actually get this machine on the network. I cannot.  I try a few other accounts until I come across one without a password. Then, I checked out /etc/passwd and found that the hashes weren't even shadowed. You can see several accounts don't have passwords at all.

When you encounter password hashes like this, they're traditional salted DES passwords. I haven't actually cracked DES passwords since 1996 or so. By the time I got my first job in information security (early 2000), password shadowing was common practice, and better hashing algorithms were in place.

I had a Kali Linux VM running on my laptop already, so I scribbled the password hash on a piece of paper, then re-constructed a fake password file from this one line and set John The Ripper loose on it.

In the mean time,  I tried some tricks from the console to get the machine to boot up in single user mode, but I was faced with quite a bit of adversity. Official single user mode required the root password, and attempts to bypass the root password (like calling a shell for init) didn't work.

Trying to load a shell as a kernel, obviously, wouldn't work, but it didn't stop me from trying, thus causing a panic and crash.

A short while later, I heard a noise on my laptop, and saw this:

That password worked just fine, and I was on my merry way.

Humorously, a few folks also tried cracking the same password on their equipment. One ended up finding it in under 2 minutes with 4 threads on an i5-2400 desktop, Fritz smashed it in a mere 13 seconds on a 32-core VM. I should probably see how fast JTR would get it on the laptop natively, with 4 threads outside a VM, but I'm not going to bother with that.

Now I just need to get Fusion installed on this IRIX box so I can reproduce the cheesy scene from Jurassic Park.

Decoding VBScript Malware-infected HTML files

I have been running across malware like this lately.  It appears to be a local infection that appends some VBScript to HTML files on the webmaster's computer, spreading to the Internet when it's uploaded. Alternatively, it could be an infection on a Windows IIS server.

At any rate, WriteData is a hex string that goes on and on for a good couple of screen lengths, followed by some more VBScript to open a file handle, write binary data to it, then execute the dropped binary.

Since it appears this HTML file has been infected multiple times, I use uniq to get only one copy of the WriteData line. I split it with cut based on the double quotes to get only the hexadecimal part. I decided I'd try to use xxd to decode it. xxd can create or read hex dumps. I save xxd's output to svchost.exe (which is what the VBScript would have called it).

Finally, I use file to determine what kind of file svchost.exe is, presuming it'll be a Windows executable file.

No surprises there. I uploaded it to VirusTotal, and it looks like we have a ZBot (ZeuS) on our hands.

OpenBSD 5.3 Released

OpenBSD 5.3 was released on May 1.  (I told you I'm running behind!)

There are many enhancements and changes, including some much-needed tweaking to dhclient, making it a little less frustrating to use. While updating the nginx/MySQL/PHP-FPM how-to, I noticed that nginx is now defined in rc.conf like Apache has been for quite a while, so the setup procedure changed ever so slightly. The Apache/MySQL/PHP how-to remains basically unchanged, and it'll continue to be maintained so long as Apache is available in either the base distribution or from ports/packages.

xkcd on local administrator rights

Yes, I know, I'm running way behind, aren't I?
 
The thing is, authorization to your web-based accounts isn't why we recommend using an unprivileged account for your daily computing use. On Windows, OS X and most popular desktop distributions of Linux, the first account that's created has administrator-level access. Increasingly, privilege escalation tools such as sudo, UAC and keychain access have made it to where you have to authenticate in order to make dramatic changes to the system (such as install drivers) but this protection can often be disabled or wholly bypassed.

In any case, an administrator-level account on a computer can not only install drivers and software, but may unwittingly allow malware to set its hooks deep into the operating system. It's for this reason that people recommend setting up another user-level account without privileges to install software.

As for protecting your sensitive data inside that user-level account, full-disk encryption is the way to go. This feature ships standard (although it is disabled by default) with OS X, many popular Linux distribution, and even the premium and enterprise versions of Windows. FDE has its flaws, but it's better than nothing.