Domain Name System (DNS) traffic is inherently timely. Responses from DNS servers are expected to change from one minute to the next. So many important application layer protocols leverage DNS, and it is so pervasively necessary for even basic Internet access, and it is such a simple behavior indicator, that it only makes sense to log the crap out of it. In minutiae.
Yet, it seems like DNS logging is still one of those everyone-rolls-their-own efforts. And fewer still log DNS from a sniffing sensor, instead trusting their DNS servers. I hate rolling my own, and I don’t trust DNS servers.
I’ve borrowed a healthy dozen or more security monitoring ideas from Sean Wilkerson, so while he was still on stage after a talk at DojoSec, I re-raised my DNS Logging plight. I’d hoped he knew of a tool, or could use the microphone, video stream, and audience to ask that someone create one. Actually, I didn’t hope, I specifically said “And hey, if anyone is listening, this needs to exist. If you can create, you are obligated.” or something along those lines.
I wasn’t looking for an analysis tool, or a log parser, or an IDS signature. I just wanted the equivalent of the many snarf programs in Dug Song’s dsniff package. It had to be lightweight, reliably parse all application traffic of the DNS protocol, and simply log it. Dsniff already does that for HTTP, NFS, SMTP, IRC, and many instant messenger protocols, and it can spoof DNS, but has nothing for passive DNS monitoring.
It worked! Sort of.
Christopher McBee was in the audience, and he knew that Python and Scapy would probably be capable. In twenty minutes, he had a working DNS logger. Awesome.
It didn’t log minutiae, but that wasn’t Scapy’s fault. It didn’t log TCP, and that is still Scapy’s fault.
Spurred by Christopher’s work, I dove into Python and finished it to my original spec, mostly.
> dnssnarf --help
usage:
dnssnarf [options]
Log DNS messages with Python and Scapy
options:
--version show program version number and exit
-h, --help show this help message and exit
-s, --syslogwrite to syslog
-f FACILITY, --facility=FACILITY Syslog facility. Defaults: 'user'-p PRIORITY, --priority=PRIORITY Syslog priority. Defaults: 'info'-i INTERFACE, --interface=INTERFACE listen on INTERFACE
-q, --quiet quiet output
-b BPF, --bpf=BPF BPF to apply to scapy sniffer. Default: 'port 53 and udp'
-n, --named named query log format
-d, --debug Print additional debugging information
It doesn’t understand TCP DNS, because Scapy doesn’t, and I am not smart enough to fix that.
Output looks like this by default:
Fri Dec 4 06:24:56 2009 UDP session: 44167 client: 192.168.1.1:59634 server: 69.63.185.11:53 query: login.facebook.com. class: IN type: A recurse: no
Fri Dec 4 06:24:56 2009 UDP session: 44167 client: 69.63.185.11:53 server: 192.168.1.1:59634 query: login.facebook.com. class: IN type: A recurse: no
Fri Dec 4 06:24:56 2009 UDP session: 44167 server: 69.63.185.11:53 client: 192.168.1.1:59634 response: 69.63.181.22 ok type: A ttl: 30L len: 4
So then I’m validating it against tcpdump. tcpdump already does what I want. And it isn’t Python. It’s fast. Silly us.
Here’s tcpdump with me running ‘host grantstavely.com’ in another window.
grantstavely:~ grant$ sudo tcpdump -i en1 -nn-tttt port 53
tcpdump: verbose output suppressed, use -v or -vvfor full protocol decode
listening on en1, link-type EN10MB (Ethernet), capture size 65535 bytes 2009-12-04 06:32:32.368184 IP 192.168.1.25.61686 >192.168.1.4.53: 50950+ A? grantstavely.com. (34)2009-12-04 06:32:32.373623 IP 192.168.1.4.53 >192.168.1.25.61686: 509501/0/0 A 75.101.142.201 (50)2009-12-04 06:32:32.374358 IP 192.168.1.25.64909 >192.168.1.4.53: 44029+ AAAA? grantstavely.com. (34)2009-12-04 06:32:32.376867 IP 192.168.1.4.53 >192.168.1.25.64909: 440290/0/0 (34)2009-12-04 06:32:32.377112 IP 192.168.1.25.57526 >192.168.1.4.53: 55171+ MX? grantstavely.com. (34)2009-12-04 06:32:32.394888 IP 192.168.1.4.53 >192.168.1.25.57526: 551718/0/0 MX smtp7.grantstavely.com. 10, MX smtp4.grantstavely.com. 10, MX smtp6.grantstavely.com. 10, MX smtp.grantstavely.com. 0, MX smtp8.grantstavely.com. 10, MX smtp2.grantstavely.com. 5, MX smtp3.grantstavely.com. 5, MX smtp5.grantstavely.com. 10(209)
Under my nose!
Actually, tcpdump isn’t showing us ~transaction ID numbers~, TTLs, or LENs, which is a bummer. So dnssnarf still has it’s uses after all.
Over the summer two friends and I brainstormed some ideas for a value-add URL
shortener. I know, I know.
It was going to do a bunch of security checks against URLs it was asked to
shorten, and when Chris had the original idea, nobody
else was doing anything like it. Aaron quickly scraped
together something that could shorten urls, and 301 them when they came in,
and call out to various security checks along the way. Meanwhile we wiki’d
together a huge list of features we wanted. Features current url shorteners
still lack.
We kinda lacked a revenue model though, or time to work on the project, or
funding.
Oh well.
I did make a logo for it, with Chris’s help.
Figure 1. trst.us.
I think doing it again I’d leave off the entire ‘us’ bit in the logo, it
throws the balance too much.
Dear Grant: If my calculations are correct, you will receive this file
immediately after you saw the DeLorean struck by lightning. First, let me
assure you that I’m allive and well. I’ve been living happily these past eight
months in the year 1995…
Testing antivirus software with EICAR[^eicar] deletions one virus at a time is effective but one dimensional. Successful deletion of a single EICAR string validates antivirus software for a given system, in a given directory, at the rate of one virus per unit of time. But single EICAR string deletions do nothing to stress secondary system alerting capabilities, validate rate limiting rules, enumerate directory level exclusions, validate reactive policy changes, and so on.
That later group all seem like fun, useful-to-have validation capabilities, so with them in mind, I wrote eicar based malware for a red team drill, leveraging EICAR to enumerate directory level antivirus exclusions.
The attack I wrote for the drill skipped system compromise.
The components of this attack were designed to replicate real world attacker techniques, while avoiding real world obfuscation techniques that would turn this drill into a receive alert & down the host drill.
A few simple subroutines
DNS command and control – Every few minutes, interrogate a public internet DNS server for an A record. This hostname was under my control, and returned a resource record pointing to 127.0.0.1. If this changes to anything else, proceed to…
EICAR antivirus directory level exclusion enumeration – start at the root of C:\ and interrogate every listing found. If it is a directory, drop an EICAR file in it. Immediately interrogate the EICAR file. If it still exists, push the directory name into the findings array.
After enumerating all of the directory level exclusions, choose one at random and download more reconnaissance tools from internet servers.
Why drill like this?
Each subroutine increases the time-to-response requirements. The DNS subroutine could run for days, the EICAR test will interrogate a full system in minutes, tools can be downloaded in seconds.
Each subroutine highlights disparate detection technologies, placement, logging, and so on. EICAR throws incident responder assumptions because it is very much an infrastructure testing tool and not malware.
spray-eicar
I’ve ripped out all the command and control and tool downloads. Sorry, it was rubbish anyway and you can do better.
But you can have the perl that can be compiled with perl2exe sort of tools, I’ve posted it on github as spray-eicar.
Weaponizing EICAR?
OK, maybe it isn’t actually weaponizing EICAR. What else could be done with this trick?
Enumerate file level antivirus exclusions: Find .exe file -> determine if it is an active process -> move it to $filename.bak -> drop EICAR -> undo.
DDOS secondary alerting systems: Execute spray-eicar enterprise wide on all desktops. Ouch. Can your antivirus product whitelist EICAR even if you want it to?
Stop at the first finding. Pull and run tools. Obviously.
Stop at the first subroutine and then propagate to enumerate policy homogeneity.
Bastardizing the Drake
equation, if only a fraction of
the people using twitter used it to send urls to each other, and only a
fraction of those urls were artificially shortened by a url shortener, and
only a fraction of those shortened urls were actually hyperlinks to Rick
Astley’s Never Gonna Give You Up, and only a fraction of those Rick Astley
hyperlinks were in fact not to Rick Astley videos, but instead phishing attack
hyperlinks to Mills On The Hill Fish and Tackle Shop in New Market, MD,
hosted on a RedHat 5 server at a local Mom and Pop ISP compromised and
hardened by multiple attackers over the years but now serving free embedded
javascript with every page inserting iframes from choose-your-own-nationalist-
conspiracy-theory-ok-chinese-attackers, and only a fraction of the twitter
users likely to find such links by searching for hashtags actually click on
them, the Internet as we know it would come to a screetching halt, please
can’t someone do something about these urls shorteners?
Sorry, skip the foolish advertising business model of free dull razor blades,
with every cut sponsored by Punch The Monkey and jump to the existing url
shortening sites that are trying to reduce the risk posed by our straw man.
Preview images sound cute, I’ve never used them. I could preview a thumbnailed
malicous pdf for you, would that help?
Auto-unshorteners sound neat too and I’ve seen twitter clients that use their
API’s to some success, but they are just that – secondary services that some
clients have.
New shorteners like safe.mn do more, but how much more? I
was able to validate that safe.mn refused to shorten an old link in my spam
quarantine, but not a new one.
How safe is safe enough? Does our straw man actually have a brain? How much
protection does the culture of associative trust so prevalent on twitter
reduce the risk that a given shortened url will actually be evil?
It won’t be the next link you get from a new follow consistent with their
posting history about that-thing-for-which-you-followed-them that gets you. It
will be the next #amazonfail meme. It will be thousands of opportunistic spam
accounts bubbling up a Trending Topic
with helpful links. Or it will be innocent meme followers, linking to their
blog hosted on the same server as Mills On The Hill Fish and Tackle Shop,
or, etc.
Hyperlinks never had any trustworthiness. URL shorteners seem like a great
opportunity to add trustworthiness. Is anyone going that direction? Safe.mn seems to be heading in the right direction, but
they make some bold claims.
I have no idea what I’m doing when approaching a cryptographic challenge. My
background is in art.
I approached the challenge naively unaware it even was a challenge. A
designer had been asked to put 1s and 0s on the cover of the report
because hey, it’s about computer stuff right? That’s what I thought at least.
I’ve been asked to do that sort of thing, and copy and pasting finger-mashed
1s and 0s is boring. I always made an effort to make my gibberish mean
something. At the least, I’d find Cicero’s lorem ipsum dolor sit amet et cetera ad nauseum.
I assumed something amusing would be there but didn’t bother much with it. It
was 5:30AM and the report made better coffee reading than the cover. When I
reached the end though, I found the major clue.
By two searches away from WikipediA, I meant, as others have noted that it was a one-hit google search at the time, for a geocaching clue.
Handy. Even handier is the ‘decrypt’ link on the geocaching site, yielding the
original text, le chiffre indéchiffrable. Seems like an obvious clue! As I
related in my tweet, that led me straight to the WikipediA article on the Vigenère cipher.
What is The Verizon Breach Report cover binary text? http://is.gd/hafb please be Clutch lyrics, please be Clutch lyrics, please be Clutch l-
At the office, I asked a few co-workers if they had noticed the clue on page
48, and showed them that the cover text was probably something. I had no
idea what, but hey presto, let’s give it a spin.
I threw the source 1s and 0s into Vim and got rid of all the newlines.
Nothing useful. Then I tossed the single long line into TextMate to play with
wrap points.
While shifting it around in Textmate I noticed a pattern.
Neat columns, but what does it mean? I didn’t know. I was getting tired of
moving the source text around though, and knew it was copy and pasted a few
times, because I was still going on the naive ‘it is nothing or it is funny’
approach. I selected the first line and searched-all in TextMate. Four hits on
lines 101, 201, etc… I did the same for the second and third lines. Sure
enough, only the first 100 lines were unique. Oh well that proves nothing, back to work.
Only the first 100 lines matter. Off to blue team, will have to resume
after lunch. Argh, obviously a Vigenère. http://is.gd/sz5k #vzbdir
After my morning meetings, I decided to keep at it through lunch. After
talking to my friend Ben, we agreed I should just
script out ascii one letter at a time whether that was what I was looking at
or not. All the easy to find online ascii-binary converters wouldn’t accept
it. I read up on perl’s pack() and threw this together.
#!/usr/bin/perl -w# bin-to-asciimy$binary_text= shift;
open (BINARY,$binary_text)ordie"Can't open input file: $!";foreachmy$line(){my$length= length($line);my$hex= pack("B$length",$line);print"$hex ";}
Whoa! Letters! Chris Eng got this far immediately with a shell one-liner: sick fu!.
I had no idea how to attack the Vigenère but given the clue on page 48, that’s
where I had to start. I read up on brute forcing Vigenère. Yikes. If it’s possible, I can probably find a tool to do it. I found lots, but the first hit was enough.
@alexhutton I just submitted my cipher
text solution. Never done any code breaking before, was a lot of fun!
#vzdbir (now back to work!)
I got a call an hour later.
I was the first to submit! I’d won!
Congratulate me at CharmSec this Wednesday, and I’ll
buy you a beer.
Update
I just used this old ascii <-> hex <->binary converter
I keep handy and noticed it would have converted the binary for me. I use it
for hex so much I forgot it handled binary. I didn’t need that perl script
after all. Doh.
Cleaned preference handling a bit, please reset and reload to use
Fixed display of international language selection to use a localized title
Darkened the darks a bit
Misc. css tweaking
Updated wikipedia discovery to regex better
Version .99 July 15, 2009
Fixed the alternate language select drop-down and made it an option
Version .983 July 10, 2009
Miscelaneous small css fixes adapting to changes made at Wikipedia
Simplified front page further
Made en.wikipedia closer resemble artile pages
Embracing helvetica, possibly renaming to helvetipedia soon
Version .982 June 22, 2009
Tweaked thumbnail picture padding to correct a hover issue (thanks sdfghrr)
Tweaked Encyclopedia Dramatica again
Version .98 June 2, 2009
Added a new about:config / cookie option to make customizing link colors more discoverable
Version .97 June 2, 2009
Resolved issues with preference handling in webkit
Added disabled preference to dynamically create jump-list of all alternate language versions of a given document on wikipedia (still under construction)
Version .96 May 21, 2009
Improved generic wiki support (including wikia.com wikis)
Version .95 May 18, 2009
Improved font selection changes and examples
Updated namespace
Fixed Auto-updating menu selection controls
Version .94 May 16, 2009
Reset font selection to allow greater user control
Tweaked javascript style, thanks iandalton
Updated css for multiple fixes
Version .93 May 14, 2009
Added checks to leave user configured items alone, thanks iandalton
Updated css for multiple fixes
Version .92 May 10, 2009 (Complete rewrite)
Simplepedia is now self-contained, and will not reach out to the author’s server for css
Document titles are no longer altered
Added generic mediaWiki detection, and removed specific site support, so that Simplepedia will just work on any MediaWiki you throw at it
Added proper search form submission detection using each pages built in search form
There was a table set out under a tree in front of the house, and a Democrat
and a Republican were having tea at it: the Economy was sitting between them,
fast asleep, and the other two were using it as a cushion, resting their
elbows on it, and talking over its head. ‘Very uncomfortable for the Economy,’
thought Alice; ‘only, as it’s asleep, I suppose it doesn’t mind.’
The table was a large one, but the three were all crowded together at one
corner of it: ‘No room! No room!’ they cried out when they saw Alice coming.
‘There’s PLENTY of room!’ said Alice indignantly, and she sat down in a
large arm-chair at one end of the table.
‘Have some wine,’ the Democrat said in an encouraging tone.
Alice looked all round the table, but there was nothing on it but tea. ‘I
don’t see any wine,’ she remarked.
‘There isn’t any,’ said the Democrat.
‘Then it wasn’t very civil of you to offer it,’ said Alice angrily.
‘It wasn’t very civil of you to sit down without being invited,’ said the
Democrat.
‘I didn’t know it was YOUR table,’ said Alice; ‘it’s laid for a great many
more than three.’
‘Your hair wants cutting,’ said the Republican. He had been looking at Alice
for some time with great curiosity, and this was his first speech.
‘You should learn not to make personal remarks,’ Alice said with some
severity; ‘it’s very rude.’
The Republican opened his eyes very wide on hearing this; but all he SAID
was, ‘Why is a raven like a writing-desk?’
‘Come, we shall have some fun now!’ thought Alice. ‘I’m glad they’ve begun
asking riddles.–I believe I can guess that,’ she added aloud.
‘Do you mean that you think you can find out the answer to it?’ said the
Democrat.
‘Exactly so,’ said Alice.
‘Then you should say what you mean,’ the Democrat went on.
‘I do,’ Alice hastily replied; ‘at least–at least I mean what I say–that’s
the same thing, you know.’
‘Not the same thing a bit!’ said the Republican. ‘You might just as well say
that “I see what I eat” is the same thing as “I eat what I see”!’
‘You might just as well say,’ added the Democrat, ‘that “I like what I get” is
the same thing as “I get what I like”!’
‘You might just as well say,’ added the Economy, who seemed to be talking in
its sleep, ‘that “I breathe when I sleep” is the same thing as “I sleep when I
breathe”!’
‘It IS the same thing with you,’ said the Republican, and here the
conversation dropped, and the party sat silent for a minute, while Alice
thought over all she could remember about ravens and writing-desks, which
wasn’t much.
The Republican was the first to break the silence. ‘What day of the month is
it?’ he said, turning to Alice: he had taken his watch out of his pocket, and
was looking at it uneasily, shaking it every now and then, and holding it to
his ear.
Alice considered a little, and then said ‘The fourth.’
‘Two days wrong!’ sighed the Republican. ‘I told you butter wouldn’t suit the
works!’ he added looking angrily at the Democrat.
‘It was the BEST butter,’ the Democrat meekly replied.
‘Yes, but some crumbs must have got in as well,’ the Republican grumbled: ‘you
shouldn’t have put it in with the bread-knife.’
The Democrat took the watch and looked at it gloomily: then he dipped it into
his cup of tea, and looked at it again: but he could think of nothing better
to say than his first remark, ‘It was the BEST butter, you know.’
Alice had been looking over his shoulder with some curiosity. ‘What a funny
watch!’ she remarked. ‘It tells the day of the month, and doesn’t tell what
o’clock it is!’
‘Why should it?’ muttered the Republican. ‘Does YOUR watch tell you what
year it is?’
‘Of course not,’ Alice replied very readily: ‘but that’s because it stays the
same year for such a long time together.’
‘Which is just the case with MINE,’ said the Republican.
Alice felt dreadfully puzzled. The Republican’s remark seemed to have no sort
of meaning in it, and yet it was certainly English. ‘I don’t quite understand
you,’ she said, as politely as she could.
‘The Economy is asleep again,’ said the Republican, and he poured a little hot
tea upon its nose.
The Economy shook its head impatiently, and said, without opening its eyes,
‘Of course, of course; just what I was going to remark myself.’
‘Have you guessed the riddle yet?’ the Republican said, turning to Alice
again.
‘No, I give it up,’ Alice replied: ‘what’s the answer?’
‘I haven’t the slightest idea,’ said the Republican.
‘Nor I,’ said the Democrat.
Alice sighed wearily. ‘I think you might do something better with the time,’
she said, ‘than waste it in asking riddles that have no answers.’
‘If you knew Time as well as I do,’ said the Republican, ‘you wouldn’t talk
about wasting IT. It’s HIM.’
‘I don’t know what you mean,’ said Alice.
‘Of course you don’t!’ the Republican said, tossing his head contemptuously.
‘I dare say you never even spoke to Time!’
‘Perhaps not,’ Alice cautiously replied: ‘but I know I have to beat time when
I learn music.’
‘Ah! that accounts for it,’ said the Republican. ‘He won’t stand beating. Now,
if you only kept on good terms with him, he’d do almost anything you liked
with the clock. For instance, suppose it were nine o’clock in the morning,
just time to begin lessons: you’d only have to whisper a hint to Time, and
round goes the clock in a twinkling! Half-past one, time for dinner!’
(‘I only wish it was,’ the Democrat said to itself in a whisper.)
‘That would be grand, certainly,’ said Alice thoughtfully: ‘but then–I
shouldn’t be hungry for it, you know.’
‘Not at first, perhaps,’ said the Republican: ‘but you could keep it to half-
past one as long as you liked.’
‘Is that the way YOU manage?’ Alice asked.
The Republican shook his head mournfully. ‘Not I!’ he replied. ‘We quarrelled
last November–just before HE went mad, you know–’ (pointing with his tea
spoon at the Democrat,) '–it was at the great concert given by the Queen of
Hearts, and I had to sing
“Twinkle, twinkle, little bat!
How I wonder what you’re at!”
You know the song, perhaps?’
‘I’ve heard something like it,’ said Alice.
‘It goes on, you know,’ the Republican continued, 'in this way:–
“Up above the world you fly,
Like a tea-tray in the sky.
Twinkle, twinkle–”’
Here the Economy shook itself, and began singing in its sleep ‘Twinkle,
twinkle, twinkle, twinkle–’ and went on so long that they had to pinch it to
make it stop.
‘Well, I’d hardly finished the first verse,’ said the Republican, ‘when the
Queen jumped up and bawled out, “He’s murdering the time! Off with his head!”’
‘How dreadfully savage!’ exclaimed Alice.
‘And ever since that,’ the Republican went on in a mournful tone, ‘he won’t do
a thing I ask! It’s always six o’clock now.’
A bright idea came into Alice’s head. ‘Is that the reason so many tea-things
are put out here?’ she asked.
‘Yes, that’s it,’ said the Republican with a sigh: ‘it’s always tea-time, and
we’ve no time to wash the things between whiles.’
‘Then you keep moving round, I suppose?’ said Alice.
‘Exactly so,’ said the Republican: ‘as the things get used up.’
‘But what happens when you come to the beginning again?’ Alice ventured to
ask.
‘Suppose we change the subject,’ the Democrat interrupted, yawning. ‘I’m
getting tired of this. I vote the young lady tells us a story.’
‘I’m afraid I don’t know one,’ said Alice, rather alarmed at the proposal.
‘Then the Economy shall!’ they both cried. ‘Wake up, Economy!’ And they
pinched it on both sides at once.
The Economy slowly opened his eyes. ‘I wasn’t asleep,’ he said in a hoarse,
feeble voice: ‘I heard every word you fellows were saying.’
‘Tell us a story!’ said the Democrat.
‘Yes, please do!’ pleaded Alice.
‘And be quick about it,’ added the Republican, ‘or you’ll be asleep again
before it’s done.’
‘Once upon a time there were three little sisters,’ the Economy began in a
great hurry; ‘and their names were Elsie, Lacie, and Tillie; and they lived at
the bottom of a well–’
‘What did they live on?’ said Alice, who always took a great interest in
questions of eating and drinking.
‘They lived on treacle,’ said the Economy, after thinking a minute or two.
‘They couldn’t have done that, you know,’ Alice gently remarked; ‘they’d have
been ill.’
‘So they were,’ said the Economy; ‘VERY ill.’
Alice tried to fancy to herself what such an extraordinary ways of living
would be like, but it puzzled her too much, so she went on: ‘But why did they
live at the bottom of a well?’
‘Take some more tea,’ the Democrat said to Alice, very earnestly.
‘I’ve had nothing yet,’ Alice replied in an offended tone, ‘so I can’t take
more.’
‘You mean you can’t take LESS,’ said the Republican: ‘it’s very easy to take
MORE than nothing.’
‘Nobody asked YOUR opinion,’ said Alice.
‘Who’s making personal remarks now?’ the Republican asked triumphantly.
Alice did not quite know what to say to this: so she helped herself to some
tea and bread-and-butter, and then turned to the Economy, and repeated her
question. ‘Why did they live at the bottom of a well?’
The Economy again took a minute or two to think about it, and then said, ‘It
was a treacle-well.’
‘There’s no such thing!’ Alice was beginning very angrily, but the Republican
and the Democrat went ‘Sh! sh!’ and the Economy sulkily remarked, ‘If you
can’t be civil, you’d better finish the story for yourself.’
‘No, please go on!’ Alice said very humbly; ‘I won’t interrupt again. I dare
say there may be ONE.’
‘One, indeed!’ said the Economy indignantly. However, he consented to go on.
‘And so these three little sisters–they were learning to draw, you know–’
‘What did they draw?’ said Alice, quite forgetting her promise.
‘Treacle,’ said the Economy, without considering at all this time.
‘I want a clean cup,’ interrupted the Republican: ‘let’s all move one place
on.’
He moved on as he spoke, and the Economy followed him: the Democrat moved into
the Economy’s place, and Alice rather unwillingly took the place of the
Democrat. The Republican was the only one who got any advantage from the
change: and Alice was a good deal worse off than before, as the Democrat had
just upset the milk-jug into his plate.
Alice did not wish to offend the Economy again, so she began very cautiously:
‘But I don’t understand. Where did they draw the treacle from?’
‘You can draw water out of a water-well,’ said the Republican; ‘so I should
think you could draw treacle out of a treacle-well–eh, stupid?’
‘But they were IN the well,’ Alice said to the Economy, not choosing to notice
this last remark.
‘Of course they were’, said the Economy; ‘–well in.’
This answer so confused poor Alice, that she let the Economy go on for some
time without interrupting it.
‘They were learning to draw,’ the Economy went on, yawning and rubbing its
eyes, for it was getting very sleepy; ‘and they drew all manner of things–
everything that begins with an W–’
‘Why with an W?’ said Alice.
‘Why not?’ said the Democrat.
Alice was silent.
The Economy had closed its eyes by this time, and was going off into a doze;
but, on being pinched by the Republican, it woke up again with a little
shriek, and went on: ‘–that begins with an W, such as war, and wealth, and
weasle, and whiners-- you know you say things are “war of wealth”–did you
ever see such a thing as a drawing of a wealth?’
‘Really, now you ask me,’ said Alice, very much confused, ‘I don’t think–’
‘Then you shouldn’t talk,’ said the Republican.
This piece of rudeness was more than Alice could bear: she got up in great
disgust, and walked off; the Economy fell asleep instantly, and neither of the
others took the least notice of her going, though she looked back once or
twice, half hoping that they would call after her: the last time she saw them,
they were trying to put the Economy into the teapot.
‘At any rate I’ll never go THERE again!’ said Alice as she picked her way
through the wood. ‘It’s the stupidest tea-party I ever was at in all my life!’
Just as she said this, she noticed that one of the trees had a door leading
right into it. ‘That’s very curious!’ she thought. ‘But everything’s curious
today. I think I may as well go in at once.’ And in she went.
Once more she found herself in the long hall, and close to the little glass
table. ‘Now, I’ll manage better this time,’ she said to herself, and began by
taking the little golden key, and unlocking the door that led into the garden.
Then she went to work nibbling at the mushroom (she had kept a piece of it in
her pocket) till she was about a foot high: then she walked down the little
passage: and THEN–she found herself at last in the beautiful garden, among
the bright flower-beds and the cool fountains.
Frequently, security analysts kick off tcpdump full packet captures on unix servers with tapped interfaces at trust zone perimeters which they leave running in the background. Often this is done in a hurry in order to catch something before it disappears, and just as often, the capture is left running for a few days, weeks, or even months at a time.
Unfortunately, this leaves dozens of tcpdump capture files strewn about home directories, all of them poorly named and all too often left running and forgotten. Which ones are junk? Which can be archived or deleted? What a mess!
And this is even more problematic for those of you practicing network security monitoring with daemonlogger or a similar rolling full packet capture daemon.
How can an analyst dig through hundreds of large pcap files for just the traffic they want? Whether it is 50Gb of accumulated network traffic that left a T1 connection over the past week, or that left an OC3 connection in the past 15 hours, it is too much to pull a file at a time, even with a guess where to start. These nsm daemons can easily generate a Gb of data every minute! Neither tcpdump -r nor daemonlogger -r accept wild cards. Hunting for an event one file at a time? No thanks.
Who wants to mess with ps, grep, and kill, much less the oft repeated -nn -s 1516 -i interface during incident handling?
A solution
I created a perl script to manage starting, monitoring, and stopping all packet captures - live or from active daemonlogger pcap files. I retrained all my analysts to use it. I updated my sensor monitoring scripts to start using it too.
I think this would be useful at ISP’s, .edu’s, and enterprise organizations so I refactored what my team and I have been using for the past year to make it significantly better. Time to release it!
Script the repetitive stuff, force the informative and useful stuff, and prevent mistakes.
>sudo capture -a grant -d'traffic to grantstavely.com'-e'host 205.134.166.178'
Password:
Started: grant_traffic.to.grantstavely.com_Tue.Feb17.2009-20.20.22.UTC_1234902022_.pcap
Monitoring captures
>sudo capture -l
grant Tue Feb 1715:20:22 2009 traffic to grantstavely com
will Tue Feb 1715:24:05 2009 irc traffic
philip Tue Feb 1715:24:41 2009 strange malware on 8081
Too many, I’m checking on my own captures only!
>sudo capture -lf grant
grant Tue Feb 1715:20:22 2009 traffic to grantstavely com
Need more detail?
>sudo capture -lv
Analyst: grant
Size (bytes): 720.00 KB
Started: Tue Feb 1715:20:56 2009
Last Modified: Tue Feb 1715:21:31 2009
Last Accessed: Tue Feb 1715:20:56 2009
Last Changed: Tue Feb 1715:21:31 2009
Description: traffic to grantstavely com
Expression: host75.101.142.201
Capture File:
/Users/grant/captures/grant_traffic.to.grantstavely.com_Tue.Feb17.2009-20.20.56.UTC_1234902056_.pcap
Stopping Captures
>sudo capture -svf grant
Analyst: grant
Size (bytes): 720.00 KB
Started: Tue Feb 1715:20:56 2009
Last Modified: Tue Feb 1715:21:31 2009
Last Accessed: Tue Feb 1715:20:56 2009
Last Changed: Tue Feb 1715:21:31 2009
Description: traffic to grantstavely com
Expression: host75.101.142.201
Capture File:
/Users/grant/captures/grant_traffic.to.grantstavely.com_Tue.Feb17.2009-20.20.56.UTC_1234902056_.pcap
Capture file info:
File name: grant_traffic.to.grantstavely.com_Tue.Feb17.2009-20.20.56.UTC_1234902056_.pcap
File type: Wireshark/tcpdump/... - libpcap
File encapsulation: Ethernet
Number of packets: 2778
File size: 1869006 bytes
Data size: 1824534 bytes
Capture duration: 12.070557 seconds
Start time: Tue Feb 1715:48:22 2009
End time: Tue Feb 1715:48:34 2009
Data rate: 151155.74 bytes/s
Data rate: 1209245.95 bits/s
Average packet size: 656.78 bytes
Daemonlogger Data
If you have a directory of daemonlogger pcaps, point capture at them with the same standard syntax and it will run through each file, gradually merging only the data you want into a single manageable pcap.
Note that capture maintains a soft link to the currently merged temp file using the name of the final target file so that you can start performing analysis right away.
> capture -ra grant -d'historical traffic to gs.com'-e'host 75.101.142.201'
Generating grant_historical.traffic.to.gs.com_Tue.Feb17.2009-21.12.57.UTC_1234905177_.past.pcap
Currently Processing: Tue Feb 17 05:23:45 2009
Or do both - start a new live capture and grab the same data from daemonlogger archived pcaps.
> capture -Ra grant -d'historical traffic to gs.com'-e'host 75.101.142.201'
Started: grant_historical.traffic.to.gs.com_Tue.Feb17.2009-21.12.57.UTC_1234905177_.pcap
Generating grant_historical.traffic.to.gs.com_Tue.Feb17.2009-21.12.57.UTC_1234905177_.past.pcap
Currently Processing: Tue Feb 17 05:23:45 2009
While running, the ‘Currently Processing’ line will maintain a listing of how far through daemonlogger data the process is. From another console, the same is available to other analysts
> capture -lv
Analyst: will
Size (bytes): 60.00 KB
Started: Tue Feb 1716:21:02 2009
Last Modified: Tue Feb 1716:21:15 2009
Last Accessed: Tue Feb 1716:21:03 2009
Last Changed: Tue Feb 1716:21:15 2009
Description: dns traffic
Expression: port 53
Capture File: /Users/grant/captures/will_dns.traffic_Tue.Feb17.2009-21.21.02.UTC_1234905662_.pcap
Analyst: grant
Size (bytes): 0 Bytes
Progress: Tue Feb 1710:03:01 2009
Description: historical traffic to gs com
Expression: host75.101.142.201
Capture File:
/Users/grant/captures/grant.processing.4958.1234882981_historical.traffic.to.gs.com_Tue.Feb17.2009-21.12.57.UTC_1234905177_.past.pcap
Additional uses
capture takes full advantage of syslog, so that you can validate what analysts did what, and when.
You could schedule regular e-mail to management to validate what captures are running, or were run, per user, per day, and so on.
If short on disk space, leave only individual long running captures going against specific hosts, add them to start with init.
capture has support for hashing completed capture files, use the hashes later to validate your data.
Use shell aliasing to create a quick start cap $1 $2 $3 alias which defaults to one of the operations cap normally requires -a, -d, and -e to perform
Requirements
You must have: perl, a few perl modules, and tcpdump. You also need capinfos and mergecap, both of which are part of most wireshark and tshark distributions.
I suggest that analysts run capture on systems using sudo.
capture has been tested and run successfully on linux, bsd, and MacOSX systems. You should review the source to configure the handful of options available before testing.
Future plans
Run through a directory of pcaps w/ mergecap
Integrate daemonlogger
Better privilege seperation
Built in man page
Functional option combinations and errors
FreeBSD and OSX support
More useful verbose output
More user testing
A ‘speed start’ no-flag syntax for starting captures rapidly
Proper SIGNAL handling to stop --read jobs
/etc/ file usage to replace script header configuration
Assumption defaults (friendly handler name interpreting, auto descriptions using bpf, etc)
Suggested alternate resources; web links, dns information, argus queries, ids urls, extensible whatever
A web front end
Just kidding about the web front end
Specific script targeted output
Capture monitor and alerting
Better facilitation of metrics
Threading to improve speed of daemonlogger filtering
A property developer in Nanjing, hoping to lure business and buzz, set up storefront facades with logos such as “Haagon-Bozs,” “Pizza Huh,” “Bucksstar Coffee,” “KFG” and “McDnoald’s.” Images of what became known as “Shanzhai Street” spread rapidly online.
Once a term used to suggest something cheap or inferior, shanzhai now suggests to many a certain Chinese cleverness and ingenuity. Shanzhai culture “is from the grass roots and for the grass roots,” says Han Haoyue, a media critic in Beijing, who sees it as a means of self-expression. “It gives people another choice and the possibility of resisting dominant cultural values.”
I love that they are using the scrambled letter approach – wonder if they got the idea from silly forwarded email. This has expanded from brick and mortar space to websites that mash brands like google, yahoo, and baidu into one logo / search site.
Brilliant co-opting!
Applying some McLuhan reasoning, I wonder how this changes customers perception of Shanzhai products.
In single blind taste tests, people told they are having their favorite brand name product may fail to notice discrepancies, or notice them and shrug them off (I lack a source for this). When all appropriate visual clues are included – a Strabuks cup with logo, band, and top for example, could Maxwell House drip coffee be passed off as a new flavor?
Cleo McDowell: Look… me and the McDonald’s people got this little misunderstanding. See, they’re McDonald’s… I’m McDowell’s. They got the Golden Arches, mine is the Golden Arcs. They got the Big Mac, I got the Big Mick. We both got two all-beef patties, special sauce, lettuce, cheese, pickles and onions, but their buns have sesame seeds. My buns have no seeds.
