Category Archives: Review

Are you embarrassed by your Web Application Security game? Here’s how to start rockin’!

The goal of this post is to provide an overview of an awesome OWASP project which is designed to find vulnerabilities in web applications called: Zed Attack Proxy (ZAP). I have known about ZAP for a while but just thought I do a quick write up.

ZAP was selected as the second top security tool of 2014 by ToolsWatch.org. The project is extremely well documented with a user guide, FAQs, tutorials, etc., all conveniently located on its wiki. Also, since there is already so much professional documentation available for this project, this post will not pay too much attention to its features and functionality, but rather on my experience with the tool and how I got it up and running.

ZAP can run on Windows, Linux and OS/X, and it can be downloaded from here. I downloaded ZAP on my Ubuntu 13 Desktop instance. Note that Java version 7 is required for both Windows and Linux. Also, ZAP comes included in several security distributions — a list can be found here.

After you have extracted the ZAP_2.3.1_Linux.tar.gz, you just need to run the zap.sh:

zap_sh_run

Soon after that, the application will auto-start. You may be prompted to generate an SSL certificate — which you will need in order to test secure applications — however, I skipped that initially since you can always come back to it.

The last step in the installation process is similar to BURP and that is to configure your browser to use ZAP as a proxy. The ZAP team has a nice guide here on how to do this for most common browsers. I set Firefox with ZAP proxy:

firefox_proxy

After completing the step above, you are done with the installation process and are ready to kick off a scan. Here is how the home page should look like.

Home_Page

The first thing I would like to call your attention to before setting up a scan is to please make sure you have explicit permission before you scan any site. It is best to deploy a dummy web application on your local machine and use that to scan and learn.

If you have questions about where to start in ZAP, the perfect place to start would be the awesome user guide that comes with the installation. It can be accessed from Help > OWASP ZAP User Guide:

User Guide

I believe everything that is found on ZAP’s online wiki can be located in this user guide, if not more. I think that is great because as you look through the home page and menu options, it can be a bit overwhelming. But you can find answers to what all of the buttons do from the user guide as well as from here and here.

Going back to the homepage, you will see the following option:

Quick Scan

This is probably the best place to start off with your first scan. Alternatively, you could visit your demo site using the browser on which you configured ZAP proxy, and as you navigate through the site, ZAP will begin to populate the structure on the left home-page panel:

SitesAfter you have the site structure similar to the above, you can take your test in several different directions — most of which can be viewed by simply right-clicking on any of the site’s pages:

Right Click Options

If you are fairly new to web application security (like I am) chances are that whichever direction you choose to take, you will have questions. Fortunately, there are YouTube videos that you can refer to here. One video in particular that you should check out is this as it can come in handy when you want ZAP to auto-authenticate to your site’s login fields.

This concludes the introduction of a feature-packed tool from a long list of tools that I plan to explore. This already looks to be the best of the bunch. Even if you just heard of web application security, and you are looking to try one, this is a must-have for you; and its free! I am really glad that I got the chance to play with this tool and now it is part of my toolkit.  I recommend that you check it out to begin rockin’ on your Web Application Security game!

Follow me on Twitter: @azeemnow 

This is Not a Sponsored Post.

Advertisements
Tagged , ,

Have Anti-Virus Software But Still Feel Vulnerable? Read How A Simple Web Filtering Software Can Help

“We may think one layer of security will protect us – for example, antivirus. Unfortunately for that approach, history has proven that, although single-focus solutions are useful in stopping specific attacks, the capabilities of advanced malware are so broad that such protections inevitably fail.” – Jerry Shenk, Layered Security: Why It Works.

Making use of layered security for personal use is of the utmost importance as I have covered a couple of times in the past: here, here, and here. Just as I have done in the past, I will use this post to share another tool that you can explore to support your personal layered security strategy.

My never-ending curiosity to explore and test new technologies can sometimes lead me to stumble upon genuinely impressive solutions. Fortunately for you, I believe this tool falls into that category.

K9 Web Protection is the software that I have been testing for some months now, and I must say, I’ve been truly pleased with its results. The software falls under the Web Filter category, which places a restriction on websites that you can visit. Web Filtering is used in two major cases. The first is to permit parents to control the sort of content accessible to their children, offering their kids a safe environment to learn and explore online. The second is for businesses who wish to prevent their employees from accessing websites that do not pertain to their jobs.

However, in addition to the above-mentioned, from my experience using this software on a daily basis, I have come across other benefits:

  • Real-time malware protection“helps identify and block illegal or undesirable content in real time, including malware-infected sites. You also benefit from the WebPulse cloud service, a growing community of more than 62 million users who provide more than six billion real-time Web content ratings per day.”
    • You can learn more about web filtering and intelligence here.
  • Automatic content ratings“New websites and web pages are created every minute, and no one person can possibly rate or categorize all of them. To ensure protection against new or previously unrated websites, Blue Coat’s patent-pending Dynamic Real-Time Rating™ (DRTR) technology automatically determines the category of an unrated web page, and allows or blocks it according to your specifications.”

Another advantage of the K9 Web Protection is that it is backed by Blue Coat (acquired by Symantec in 2016),  the leader in Web Security “with an impressive portfolio of integrated technologies serving as a trusted platform to deliver Cloud Generation Security to more than 15,000 customers worldwide.”

This solution is truly an “enterprise-class security software designed for home computers.” Also, did I mention that it’s free! “As part of the Blue Coat Community Outreach Program, K9 Web Protection is free for home use. You can also purchase a license to use K9 Web Protection for business, government, non-profit, or other use.”

I will do a quick overview of the installation and usage of the software, but you can find a well-documented quick start guide and user manual here:

Installation and Usage Overview:

installk9

  • The installation process should take a couple of minutes to complete as it is self-explanatory.
  • Upon completion, the application’s interface will open in your browser:

K9_Browser_admin_page

  • To view or modify any of the configurations, you will be prompted to enter the password you created during installation.
  • Here are some of the options and details you can access from the Setup page:

k9_block_categories.PNG

  • Web Categories to Block: choosing one of the available levels allows you to block selected categories of websites.
  • Time Restrictions: 3 options are available to block web access depending on the time of day. Unrestricted places no restrictions on web access. NightGuard blocks all web access during contiguous blocks of time every day. Custom enables you to choose days of the week and time periods to block all web access.
  • Web Site Exceptions: Allows you to create lists of websites to “always block” or “always allow.” Blocking Effects: “Bark When Blocked” plays a barking sound when a web page is blocked. Make sure the sound is enabled and not muted. Show Admin Options displays options on blocked web pages which enable administrators to view the blocked web page. Enable Time Out allows you to block all web access if too many web pages are blocked in a given period of time
  • URL Keywords: Allows you to enter keywords which, if found in a URL, cause a “block page” to display. Safe Search: “Redirect to K9 Safe Search” will redirect searches to various search engines through K9’s Safe Search. This provides a safer search experience than other search engines provide. Force Safe Search will prevent users from disabling Safe Search functionality provided by various websites.
  • Other Settings: “Update to Beta” enables you to get advance copies of new K9 Web Protection software undergoing development. Blue Coat distributes Beta versions so that K9 gets used in “real world” environments before being released as a final version. Please note that Beta versions might be incomplete and less stable than final versions. “Filter Secure Traffic” enables K9 to block secure websites (i.e. sites that use the HTTPS protocol).
  • Password/Email: Allows you to change your K9 administrator password or e-mail address.
  • K9 Update: Installs software updates if available.
  • View Activity Summary: This tab shows a summary of all “Web Activity” on your computer: To view more details, click the “Category” or “Requests” links. On these pages, you have the option of grouping the data by month or by day. To view Administrative Events details, click the “View All” link. (Some of these activities are as a result of automatic browser and toolbar updates, for example, and might display URL formats with which you are not familiar.) By selecting “Clear Logs”, all your activity data will be cleared; however, three days’ worth of administrative events will be retained.k9_activity_summary

As you can see from the above, the information provided here is extremely granular and it allows you to not only get an easy view of your browsing behavior but also the behaviors of the various system and application components. I have been using this solution in conjunction with other traditional protective mechanisms, such as anti-virus, and the benefits have been massive.

For instance, sometimes, while surfing the internet, I would see a certain URL get blocked or a visit history to a certain category in a website without a recollection of visiting that website. However, after investigations, I found that some components of a software installed on my computer or an extension in my browser is the reason behind that activity.

“The malware ecosystem has changed drastically in the past 10 years, to the point that the old precautions are just no longer enough” – Malwarebytes LABS. I have been using K9 Web Protection on many of my personal computers because I have been impressed with it, so I thought to share it here. I believe it provides that extra layer of protection that we can all appreciate in a world where cyber threats are on the rise. In addition, I believe this solution is a wonderful option for those that are less familiar with common cyber threat vectors (i.e. parents) and can easily fall for phishing emails or click on an adware as they browse the internet.

As we have known for some time, “there is no single solution for the information security problems we face today. A combination of many different kinds of security tools is required to protect you from modern threats…” and I believe K9 Web Protection is among the best tools we have today, so you should definitely equip yourself with it if you are going to create a safe web environment for yourself, your kids, your employees, and everyone around you!

 

This is Not a Sponsored Post.

 

 

Tagged , , ,

BlackLight Forensics Software

BlackBag BlackLight

I had no idea just how tightly BlackLight would grab my attention and then keep its hold. Yet, here I am. While I’ve heard positive feedback from people in the information security community regarding BlackBag’s forensic software products, I have not had the opportunity to use one of their products on my own. Thus, I was thrilled to review BlackBag’s BlackLight product.

For those who are not familiar, BlackBag’s BlackLight is a piece of comprehensive forensics analysis software that supports all major platforms, including Windows, Android, iPhone, iPad, and Mac. In addition to analysis, it can logically acquire Android and iPhone/iPad devices. You can also run the software on both Windows and Mac OS X.

In this particular review, I used the latest version of BlackLight (2016 release 3). I decided to use it on Mac. The main reason I chose Mac was that most of the analysis that I have performed thus far has been with the traditional Windows Forensic Recovery of Evidence Device (FRED) and I figured this would be a great opportunity to try something different.

Installing BlackLight on Mac was a breeze. I simply downloaded the installation file from BlackBag’s website and entered the license key upon initial file execution. The single installation file took care of all of the dependencies needed for the software, which I was glad to see.

BlackLight Actionable Intel

BlackLight Actionable Intel

Here were the configurations for my Mac: MacBook Pro running Sierra OS version 10.12.2. The hardware included Intel Core i7 with 2.5 GHz with 16GB memory and a standard hard disk drive.

With the review, I wanted to make a use-case in which I would perform basic processing and analysis of a traditional disk image using BlackLight running on Mac. Without any real experience with BlackLight, I focused on usability and intuitiveness.

Processing

For this review, used a 15GB physical image of Windows XP SP3 E01 Disk. I processed this image through BlackLight with all of the ingestion options available in the software and to my surprise, it took under 10 minutes to complete.

What was even more impressive was that it had a very little performance impact on my system. In fact, as the image was being processed in the background, I continued to perform normal operations such as browsing the web and using Open Office software with no problem. Continue reading at forensicfocus.com by clicking here!

Tagged , ,

Advanced Forensic Toolkit (FTK) Course Review

For a few years, I had been using Access Data’s FTK (Forensic Toolkit) software without any formal training. I had managed to work my way through the fundamentals on my own, but I always sensed that there was much on which I was missing out.

emailvisualization

FTK  Email Analysis Visualization

It was only after I recently attended the Advance FTK class offered by AccessData (Syntricate) that I realized the enormity of what had been right under my nose the whole time.

You can read my complete review of this course at Forensic Focus or by clicking here.

Tagged ,

Forensic Timeline with Autopsy and More

The process of timeline creation is extremely critical in forensic because it provides you with a holistic view of the system in question and gets you one step closer to answering those key questions. There are multiple ways that you can create a system’s timeline. However, the one I recently came to know is Autopsy’s Timeline Analysis module and here is my first experience with it.

Autopsy can be downloaded from here. The installation is simple – no dongle required!

Welcome Screen

Welcome Screen

To test the timeline module, I used one of my test windows 7 machines. And to create some activity, I browsed the known-bad-URLs and downloaded some potentially malicious files. Also, installed AVG AntiVirus Free edition as a basic detection mechanism. However, to my surprise, AVG was able to detect and block most of the executables that I tried to run.

AVG DetectionsSince I had to run some executable to create the lab, so instead of making exceptions in AVG – I decided to uninstall it. I figured it would be interesting to see how the evidence of software uninstall will be presented.

I went back and ran the following three executables: sydzcr22.exe, b.exe, b01.exe. 

In addition, I added the total of two new accounts on this machine. First, one (admin01) I created using the windows “Manage Accounts” interface and the second (admin02) via command prompt. Both accounts have administrative privileges.

Account Management

Lastly, I made a logical image of the target system and created a new case in Autopsy. Here is a guide on how to create a case and add evidence in Autopsy.

This is how the output after the initial processing is completed looks like:

Initial Processing

As you will notice from the screenshot above, a lot of the common places that you would want to look in an image are readily available in a nice, organized manner. The first thing I did was perform keyword searches for the three executables that I ran earlier (sydzcr22.exe, b.exe, b01.exe) just to confirm their presence.  

Keyword Search

The keyword search was pretty fast and it found all the three exe files that I had browsed and installed. In the screenshot we can see the exes’ browsed URL, date, and the location on the disk where that piece of evidence is locatedindex.dat. I searched the Temporary Internet Files but was only able to find one B01.exe but not others; not sure why.

 B01The second thing I wanted to look for is the installation of the AVG antivirus and then the removal. Let’s see what we find.

The first place I looked at was the “Installed Programs” menu option:

Installed Programs

I do not see any instance of AVG here. But regardless, I guess this is a handy feature to have quick access to in order to see the installed applications at the time the image was acquired. I see the AVG2015 folder under Program Data directory but not much more:

AVG2015 Directory Folder

So with this, now we get to the reason why we started this project – timeline! The process for generating a timeline is pretty simple. You go to Tools and the Timeline. You see a status bar and at least for my image (120G) it took  around 2-3 minutes and I had my timeline opened in the second window:

 Generating TimelineTimeline Window

Graph Legend

Graph Legend

As you will notice in the second screenshot above, there are some anomalies in the time range. You can easily modify the scope by using the scale on the top left, the start and end (not shown in the screenshot) options towards the middle of the screen as well as using the graph itself to zoom into the date of interest. From all of these options, the one that I liked the most is right-clicking on the time range of your interest and select the “Zoom into Time Range” options. In my option this is faster and easier than messing with the scales:

Zoom into Time Range

As you continue to zoom in you will get to the month timeframe where you can see which date of the month had what amount of events:

Zoom In To MonthLastly, when you zoom into one specific day of the month you can see the events by the hour:

Zoom In To TimeSo getting back to finding AVG activity, I first see the web activity

AVG Web Download

In the screenshot above, please take a note of the “Text Filter” option; which comes handy in narrowing down results. In fact, if you don’t narrow down the results the system will not be able to display the events and instead will give the following message:

5000Max

However, it seems like if you change the “Visualization Mode” from “Count” to “Details” you are able to overcome the above limitation. However, the output is in a different format:

Details Visualization Mode

Notice above that when you hover over any of the events, you receive the option for further details by the symbols of “+” and “-“. However, after spending some time going through the information presented above, I did not get close to finding answers to the original questions. This is not to say that information here is not valuable, it just did not come handy in answering our particular questions.

So my next step was to extract windows event logs from the image and review them. And pretty quickly we find the following entries:

AVG Installation Completed Successfully

AVG Installation Completed Successfully

AVG Installation Successful Without Errors

AVG Installation Successful Without Errors

Similarly, we find log entries for removal:

AVG Successful Removal Without Errors

AVG Successful Removal Without Errors

AVG Removal Completed Successfully

AVG Removal Completed Successfully

With the information presented from our target system’s event logs, we are now able to see both the successful installation and later the removal of the AVG anti-virus software. It would have been nice to see some of the event log information in our timeline.

On a side note, while looking through application logs, I found two application crash events; one for our b.exe and the second for sydzcr22.exe – both of which we attempted to install from the browser earlier in the lab.

b.exe Application Crash

b.exe Application Crash

The last question that we wanted to answer was the evidence of account creation for admin01 and admin02. Both of which we created earlier – one using Windows Account Management interface and the second via command prompt. Here is the windows log event for the first one:

Admin01 Account Here is the evidence of the second account creation:

Admin02 Account

Based on the above to account creation logs, we cannot tell which account was created via windows interface vs command prompt. The only difference that we see is that one account has its password set (which is the account we created through command prompt and had to give it a password but without this knowledge we cannot tell the difference). Also, the account created from the command prompt (admin02) does not have the “Display Name” set; maybe this could be an identifier.

On a separate note, if we go back to our timeline and see the events around the time frame of the above windows events we see the following activity.

Admin01 Created

Admin02 Created

If you look at that first entry, it refers to the following default account display picture:

Account Picture

Around the same time we see security logs getting updated:

Security Log

This is all the information that I can pick out from our timeline that I think is there to indicate the creation of an account. However, what’s interesting is that in our timeline we do not see any entry to command prompt – which we used to create the second account and if there was an entry for it, it could be used as another hint.

Anyway, at this point, I was not sure how to go about getting user account artifacts so I reached out to the people of DFIR community via Twitter and as always got wonderful feedback. One of the suggestions was to perform shellbag analysis. This was a great suggestion however, this was not going to work in our situation. The reason being, shellbag analysis requires two artifacts for each account: ntuser.dat and usrclass.dat. These two artifacts are created the first time the user interactively logs on at the computer; establishing a user account on the computer does not create a profile for that user. In our case, we did not login using either of the (admino1, admin02) accounts after we created them, hence there aren’t any profile files like there are for our main (dfir) account:

ntuserSome of the other suggestions included examining memory of the target system (which we did not acquire) and reviewing windows command line history (which is not saved by default on the disk running Win7-32 but again could have pulled from memory).

So the last thing I wanted to check out before closing out this lab was to do a quick comparison with traditional log2timeline. So I ran l2t against the same disk image and here is the outcome of our super timeline:

SuperTimeLine

There is a lot that is going on here but the key things to look at is when the two accounts are created and what happens to them. The first account (admin01 – created via GUI) is underlined in red and the second account (admin02 – created via cmd) is underlined in blue. The section marked in green shows the launch of command prompt. It is obvious that the first account was created right after the creation of few security event logs however, the second account was created right after the launch of windows command prompt (there is some delay in seconds but that was due to me confirming the cmd line syntax before executing).

The last thing I want to point out from our super timeline – which correlates with our earlier finding during the manual review of event logs and is the small section in the screenshot above highlighted in yellow. You will notice that for the first account, admin01 there is an account name right next to the SAM ID of the same name. However, for the second account we just see the SAM ID but no account name.

This concludes my exploration of Autopsy and its timeline feature. The goal here was not to simply go through the different menu options of this powerful tool but rather run it against a made up scenario. And even the scenario itself is something that I made up as I went along in the process; so to be honest, I am not sure how some of the other (even commercial) tools would handle this scenario. In the end, the whole post became another CDR entry where we almost went through all the three stages to an extent. Anyway, it took me some time to gather all the screenshots and do this write up from the time when I actually did the lab; so I am sure numerous updates have been made to the tool since then. Overall, I am very pleased with the tool and the capabilities that it provides; hard to believe its free! When I did the lab, the timeline feature was fairly a new addition to the tool but we can surely expect some awesome updates to it. Definitely, an awesome, powerful and fast tool to have in your toolbox – check it out!

Acknowledgements for responding to the original Twitter question:

—-

(Here is the update on user account creation analysis done by @b!n@ry – Great job!; instead of looking for usrclass.dat for the new accounts created, you would look into the account you suspect created those two new accounts! Ref: 1 and 2. Also the net.exe and net1.exe prefetch files proved to be extremely valuable). #NoteToSelf! :)

Tagged , ,

Zotero Review

Browser extension: Zotero

The most difficult part of the research process is keeping track of all of your sources. The traditional methods have been that you print all the pages that you visit, or copy and paste the text from the web sources into a Word document. However, the problem with those methods is not only are they troublesome but also the chance of misplacing them is greater. Moreover, when you are done with your paper and you have to create a citation for each of your sources one-by-one is not only time consuming but also increases factor of human error.

Zotero is a free Mozilla Firefox add-on which makes it easy to organize your sources and searches. It does that by saving the snapshot of the pages and saving the links. The best feature of the add-on is that it automatically creates the citation for your saved sources in both APA and MLA format. In addition, since it is fully compatible with both Microsoft Office and Open Office; you can directory copy your citation into that software.

Another great feature that I like is that you are able to sync your files with Zotero’s online server. This provides not only sense of security that your files are backed up, but also if you log-in from an alternative computer you can still view all your saved sources. In addition, Zotero allows you to share your source with other people. For that, all you have to do is create a new group, place the files that you want to share and sync. You can send an invitation to your group to as many people as you want and they can all view and make changes to your document. This makes group collaboration much easier.

Personally, I’ve been just introduced to Zotero and I love all the user-friendly features that it has to offer. Whenever I am surfing the internet and I come across an article of news that I could use later I simply open Zotero add-on and save a snapshot. In addition, Zotero’s highlight feature comes very convenient t as well. It allows me to highlight text right from the snapshot so that when I come back to that article I know exactly why I saved it in the original place.

Zotero is still an underdevelopment project. It has a dedicated link on its homepage which allows enthusiastic individuals to contribute their new ideas or making improvements. For a new user, they have great support page which comprehensively explains all the great features of Zotero.

The only thing that I am on the lookout for is Zotero coming onto different browser platforms. Currently, it is only supported by Mozilla Firefox but that holds a certain disadvantage against it. In addition, I have noticed in occasional events that the sync features take longer than usual. This could be due to their storage or the format that they are using.

Overall, I think Zotero is a great free tool for everyone who wants to efficiently save time and sources. I most favorite feature of Zotero is highlight and share. I am sure that the few glitches that Zotero currently has will soon disappear.

Tagged

Layered Security For Home User – Part 1

Most who work in information security are familiar with the term layered security (also known as layered defense) which in a nutshell mean that you employ multiple solutions/components to protect your assets. This idea has been pushed at the enterprise level for years and has been significantly effective at deterring attacks. And with the latest advancements in the end-point-monitoring (EPM) solutions, enterprises now have the capability to both monitor and control what happens on all of the workstations in the environment.

But if you move away from enterprise security to securing the average home user, most users tend to rely solely on the anti-virus solutions. Now, I am not going to get into the debate over how effective or ineffective anti-virus solutions are – but if you are interested in reading rants over this topic feel free to do so. However, what I will say is that just having anti-virus software (especially now) definitely does not meet the layered security concept.

So, how do we get layered security for home computers? Well, the market is not shy from a variety of different solutions that will promise to compliment your existing anti-virus while providing you the benefit of added security. And in my opinion, some of these products can actually be beneficial such as malware, spyware, and email protection but most of these features are already built-in to latest anti-virus solutions – you may just not know it. So, the question still stands, how do we get layered security for home computers? Well, let me answer this by explaining a recent event where I had the opportunity to test a theory first hand…

Continue with part 2

Tagged , ,
Advertisements
Advertisements