Mozilla Firefox about:config

Mozilla Firefox permet la configuration de beaucoup de paramètres qui ne sont pas tous disponibles via son interface usager. Pour y parvenir, on entre about:config dans l’addresse. Mais que veulent dire toutes les paramètres et valeurs associées? Pour répondre à cette question, on peut consulter cet article sur Mozillazine.org.

Here is a reference to the entries in about:config, where all user preferences in Mozilla Firefox can be viewed and modified.

Mesurer la sécurité – Security measures

Voici quelques références qui aident dans les mesures en sécurité informatique.

Refs related to the measurement of security (KPIs, KRIs, KCIs)

1. NIST SP800-55: Perf. Measurement Guide for Infosec (see Appendix A for examples)
2. NIST SP800-53: Assessing Security Controls, Building Effective Security Assessment Plans
3. NIST SP800-40: Section 3 – Security Metrics for Patch & Vulnerability Mgmt
4. NIST Maturity Levels: High-level security program maturity
5. ISO 27004:2009:  IT Security Techniques – Infosec Mgmt – Measurement – top-down & bottom-up approach to security metrics, in line with other 27K standards
6. ISO 21827:2008: IT Security techniques – Systems Security Engineering- Capability Maturity Model (SSE-CMM)
7. Security Metrics: Replacing Fear, Uncertainty and doubt book
8. DOD’s Measuring Security:  published in 2009, compares NIST, ISO, ISACA… refers to other sources:

• NIST and ISO guidelines/standards mentioned above
• ISACA’s Developing metrics for effective Infosec Governance
• ISACA’s How can security be measured?
• securitymetrics.org‘s Metrics Catalog – eventually takes you to https://www.metricscenter.net/

Tenable Security Center et sqlite

Le produit Tenable Security Center utilise une BD sqlite. Voici quelques commande qui aident à extraire de l’information de la BD de Security Center, en utilisant la commande sqlite3…

Tenable Security Center uses an sqlite database. Here’s a few commands to help extract data out of database files.

# cd /opt/sc4
# /opt/sc4/support/bin/sqlite3 application.db “.tables”
AcceptRiskRules                   AppStyle
AdminDashboardTab                 AppStyleAttribute
AdminPreferences                  AppStyleFamily
AdminUser                         AppStyleFamilyMapping
AppAuditFile                      AppWindowsCredential
AppAuditFilePlugins               AssetTemplate
AppCredential                     AssetTemplateClause
AppDashboardComponent             AssetTemplateClauseGroup
AppDashboardTab                   Configuration
AppDataTimestamps                 CorrelatedRepositoryLCE
AppKerberosCredential             Email
AppPolicy                         LCE
AppPolicyAuditFile                LCESilo
AppPolicyDisabledPlugins          LCETypes
AppPolicyEnabledPlugins           OrgLCE
AppPolicyFamily                   OrgRepository
AppPolicyPluginPrefs              Organization
AppPolicyTemplate                 PassiveScanner
AppPolicyTemplateAuditFile        PassiveScannerRepository
AppPolicyTemplateDisabledPlugins  RecastRiskRules
AppPolicyTemplateEnabledPlugins   Repository
AppPolicyTemplateFamily           Scanner
AppPolicyTemplatePluginPrefs      UserAuth
AppReportTemplate                 Zone
AppRole                           ZoneOrganization
AppSNMPCredential                 ZoneScanner
AppSSHCredential                  sc4Schema
AppSchedule
# /opt/sc4/support/bin/sqlite3 jobqueue.db “.tables”
JobQueue   sc4Schema
# /opt/sc4/support/bin/sqlite3 application.db “SELECT * FROM Configuration”
[...]
# /opt/sc4/support/bin/sqlite3 application.db “.schema”
[...]
CREATE TABLE [Configuration] (
[type] INTEGER,
[name] VARCHAR NOT NULL,
[value] VARCHAR NOT NULL,
[visible] BOOLEAN NOT NULL DEFAULT ‘true’
, [editable] BOOLEAN NOT NULL DEFAULT ‘true’);
CREATE TABLE [CorrelatedRepositoryLCE] (
[repID] INTEGER NOT NULL,
[lceID] INTEGER NOT NULL
);
[...]

Nouvelle version de Burp Suite Professional

Comme d’habitude, Dafydd Stuttard aka Portswigger fait des miracles avec Burp. La dernière version facilite les tests de “cross-site request forgery”. Les versions précédentes permettent la bonne gestion des réponses en transit (streaming), une recherche “grep” améliorée, un déverminage du traçage de (jetons de) sessions. Plus de détails ici.

As always, Dafydd Stuttard aka Portswigger is doing miracles with Burp. The latest version simplifies “cross-site request forgery” testing. Other previous versions allow better management of streamed HTTP responses, a better “grep” keyword matching, a session tracking debugger, etc.  More details can be found in his Release Notes.

Comment assurer que votre PC soit à jour “complètement”

Malheureusement, Microsoft ne s’occupe pas de vous avertir des logiciels qui sont passés date sur votre PC. Heureusement, il y a Secunia Personal Software Inspector, un logiciel gratuit que je recommande fortement. On doit toutefois avoir les droits administratifs pour s’en servir mais ça ne nous empêche pas d’augmenter nos privilèges temporairement via UAC ou runas.

Unfortunately, Microsoft won’t let you know of outdated non-Microsoft software on your PC. Fortunately, there is the free Secunia Personal Software Inspector.

Mise à jour Metasploit

Aujourd’hui une nouvelle mise à jour de Metasploit, incluant une intégration avec John the Ripper, un dépassement de pile dans Excel, un utilitaire de crackage de mots de passe Outlook Web (OWA) et quelques autres modules d’exploitation, post-exploitation et auxiliaires.

Today a new update of Metasploit was made available, including an integration with John the ripper, an Excel buffer overflow, an Outlook Web (OWA) password cracker and more (Exploits, Auxiliaries, Post-Exploitation) modules.

Configuration de Acrobat Reader

Même si la mise à jour régulière de Adobe Reader est importante, sa configuration l’est aussi. Ceci fût démontré plusieurs fois par Didier Stevens et surtout, par les documents PDF malicieux attachés qu’on reçoit fréquemment par courriel. Malheureusement, Adobe veut que ses usagers utilisent les fonctions évoluées (par défaut) sans vraiment considérer l’impact que ça peut représenter pour eux. Il devient donc nécessaire pour les entreprises de penser au déploiement de configurations vers leurs postes de travail Windows en utilisant des GPO ou d’autres mécanismes. J’inclus ici des références intéressantes à ce sujet:

• http://help.adobe.com/en_US/Acrobat/9.0/Professional/WS8084ADD0-83CB-43fe-B3CC-0D9AF9224C8C.w.html
• http://blogs.adobe.com/adobereader/2010/04/didier_stevens_launch_function.html
• http://forums.adobe.com/thread/621375

Autres:

• http://www.adobe.com/content/dotcom/en/products/acrobat/technical-resources.html#deployment
• http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/reader/pdfs/gpo_ad_8.pdf

Par exemple, la différence entre une mauvaise configuration de Adobe Reader X et une meilleure ressemblerait à ceci dans le registre Windows:
Changements:
“bEnhancedSecurityInBrowser”=dword:00000001
“bEnhancedSecurityStandalone”=dword:00000001
“bValidateOnOpen”=dword:00000001
“aLastPrefsPanel”=”TrustedResources”
“bEnableJS”=dword:00000000
Ajouts:
“bAllowOpenFile”=dword:00000000

Even though updating all Adobe applications is important, configuring them properly is also very important, as proven multiple times by Didier Stevens and malicious email attachments we sometimes receive. Unfortunately, Adobe seems to want its users to use as many features as possible by default, beyond simple PDF reading.
It may become necessary for Enterprises to think about deploying Adobe Reader configuration tweaks via GPO (or other means). I’ve included above some references that may help (with post-deployment tweaking):

Installer OpenSSH sur un système Windows distant via Meterpreter

Voici un bon article qui montre comment on peut installer un serveur SSH sur un pivot Windows distant via Metasploit/Meterpreter.

Installing OpenSSH on Windows via command shell.

Nessus via SOCKS via Meterpreter

Cet article montre comment se servir de Meterpreter et du module socks4 pour passer du traffic provenant de Nessus afin de balayer un réseau distant. C’est aussi un très bon exemple d’utilisation combiné de plusieurs composants de Metasploit.

Nessus Through SOCKS Through Meterpreter

Obtenir les “hashes” de mots de passe d’un DC

Le lien suivant offre une technique intéressante pour obtenir les hashes d’un controlleur de domaine Windows. La technique utilise la fonction Volume Shadow Copy pour obtenir les fichiers hive NTDS.DIT et SYSTEM. Cette technique apparaît plus fiable que les méthodes communes telles que fgdump2, pwdump, etc. L’outil en question est disponible ici. http://pauldotcom.com/2011/11/safely-dumping-hashes-from-liv.html

Here’s a nifty technique to dump hashes from a live Domain Controller – using Volume Shadow Copy to grab the NTDS.DIT and SYSTEM hive files. It would appear that this technique might be more reliable and less intrusive than some of the standard techniques like fgdump2, pwdump, etc. The tool in question is available here.
http://pauldotcom.com/2011/11/safely-dumping-hashes-from-liv.html

Rootkit Hunter sous Mac OS X

Voici comment installer, mettre à jour et exécuter rkhunter sous Mac OS-X…

Below you’ll find how to  install, update and execute rkhunter under Mac OS-X…

Télécharger Rootkit Hunter de Sourceforge (download link for rkhunter)

$ tar xvfz rkhunter-1.3.8.tar.gz

$ sudo ./installer.sh --layout default --install

$ sudo rkhunter --propupd

$ sudo rkhunter --update
 [ Rootkit Hunter version 1.3.8 ]
 Checking rkhunter data files...
 Checking file mirrors.dat                                  [ No update ]
 Checking file programs_bad.dat                             [ No update ]
 Checking file backdoorports.dat                            [ No update ]
 Checking file suspscan.dat                                 [ No update ]
 Checking file i18n/cn                                      [ No update ]
 Checking file i18n/de                                      [ No update ]
 Checking file i18n/en                                      [ No update ]
 Checking file i18n/zh                                      [ No update ]
 Checking file i18n/zh.utf8                                 [ No update ]

$ sudo rkhunter -c -sk
 [ Rootkit Hunter version 1.3.8 ]
Checking system commands...
[...]
Checking for rootkits...
Performing check of known rootkit files and directories
 55808 Trojan - Variant A                                 [ Not found ]
 ADM Worm                                                 [ Not found ]
 AjaKit Rootkit                                           [ Not found ]
 [...]
System checks summary
 =====================
File properties checks...
 Files checked: 90
 Suspect files: 3
Rootkit checks...
 Rootkits checked : 160
 Possible rootkits: 1 Rootkit names    : Dica-Kit Rootkit 
(NB: Don't mind the above, this is a known false-positive)
Applications checks...
 Applications checked: 6
 Suspect applications: 2
The system checks took: 2 minutes and 16 seconds
All results have been written to the log file (/var/log/rkhunter.log)
One or more warnings have been found while checking the system.
 Please check the log file (/var/log/rkhunter.log)

Samurai WTF 0.9.7 Release Notes

Je cherchais les “release notes” de Samurai WTF 0.97 et je les ai finalement trouvées en démarrant la distribution (Live CD) et en visionnant le fichier CHANGELOG. Les voici…

I was looking for the Samurai WTF 0.97 release notes and I finally found them by starting-up the Live CD and viewing the CHANGELOG file on the desktop. Here they are…

Samurai Web Testing Framework CHANGELOG

——————————————————–
v0.9.7 6/6/2011
——————————————————–
Added ZAP-Wave 0.2 — Justin Searle
Added Senenium IDE 1.0.11 — Justin Searle
Updated ZAP to 1.3.0  — Justin Searle
Added BeEF Ruby 0.4.2.5 — Justin Searle
Updated Wapiti to 2.2.1 — Justin Searle
Updated Watobo to 0.9.6 — Justin Searle
Updated Dom Inspector to 2.0.9 — Justin Searle
Updated FoxyProxy 2.22.6 — Justin Searle
Updated Firebug to 1.7.2 — Justin Searle
Updated HackBar to 1.6 — Justin Searle
Updated JavaScript Deobfuscator 1.5.7 — Justin Searle
Updated RefControl 0.8.15 — Justin Searle
Updated User Agent Switcher to 0.7.3 — Justin Searle
Updated View Dependencies to 0.3.3.2 — Justin Searle
Updated Wappalyzer to 1.13.2 — Justin Searle
Updated rubygems to 1.3.5 (from Lucid) — Justin Searle
Updated libc6 to 2.11.1 (from Lucid) — Justin Searle
Updated sqlite3 to 3.6.22 (from Lucid) — Justin Searle
Updated libsqlite3 to 3.6.22 (from Lucid) — Justin Searle
——————————————————–
v0.9.5 12/20/2010
——————————————————–
Updated the README — Kevin Johnson
Updated Wappalyzer — Kevin Johnson
Updated SQLMap and fixed the svn settings — Kevin Johnson
Updated w3af — Kevin
Updated Burp to 1.3.03 — Kevin Johnson
updated DVWA — Kevin Johnson
Updated Watobo — Kevin Johnson
Added Spanish keyboard layout — Kevin Johnson
Updated Metasploit — Kevin Johnson
Added SET 1.0 — Kevin Johnson
Updated SET — Kevin Johnson
Updated pywebfuzz — Kevin Johnson
Updated Web Application Fingerprinter — Kevin Johnson
Updated Nikto — Kevin Johnson
Updated Wapiti — Kevin Johnson
Added kernel headers to ease VMTools installs — Kevin Johnson
Patched Ubuntu as of 11-6-2010 — Kevin Johnson
Added UA-Tester — Kevin Johnson
Added wGlutton — Kevin Johnson
——————————————————–
v0.9 10/14/2010
——————————————————–
Updated patches for Ubuntu — Kevin Johnson / Justin Searle
Updated w3af from svn — Kevin Johnson
Updated sqlmap from svn — Kevin Johnson
Fixed sqlmap svn scripts — Kevin Johnson
Added YourOpenBook.org to Recon bookmarks — Tom Eston
Removed SwitchProxy — Kevin Johnson
Added and Configured Multiproxy — Kevin Johnson
Added FuzzDB — Kevin Johnson
Added pyWebFuzz — Kevin Johnson
Updated Laudanum — Kevin Johnson
Added MonkeyFist v1 — Frank DiMaggio
Added SET 0.6 deb file from Tim Medin — Kevin Johnson
Upgraded to jBroFuzz 2.3 — Kevin Johnson
Upgraded DirBuster to 0.12 — Frank DiMaggio
Added WebGoat and Tomcat6 — Justin Searle
Added Samurai Dojo — Justin Searle
Moved all vulnerable web apps to their own apache virtual server — Justin Searle
Created a persistant /etc/hosts file for vulnerable web apps — Justin Searle
Restricted the apache to only listen on loopback IP — Justin Searle
SSH is off by default and regens RSA/DSA keys each start — Justin Searle
Created a new index.html page for local host — Justin Searle
Fixed desktop install icon — Raul Siles
Updated all Firefox plugins — Justin Searle
Fixed menu entries and terminal profiles — Raul Siles
Fixed SVN menus — Raul Siles
General cleanup — Raul Siles
Added Zed Attack Proxy — Kevin Johnson
Installed Watabo — Kevin Johnson
——————————————————–
v0.8 03/05/2010
——————————————————–
Used Raul’s clean up script on 0.7 — Raul Siles
Fixed Menu for Exploitation — Kevin Johnson
Updated Patches for Ubuntu — Kevin Johnson
Updated sqlmap from svn — Kevin Johnson
Updated w3af from SVN — Kevin Johnson
Added DVWA — Kevin Johnson
Added Mutillidae — Kevin Johnson
Added a couple of vulnerable scripts from Sec542 — Kevin Johnson
Updated Header Spy — Kevin Johnson
Updated RefControl — Kevin Johnson
Updated BeEF to 0.4.0.0 — Kevin Johnson
Installed Metasploit — Kevin Johnson
Updated MetaSploit from SVN — Kevin Johnson
Added Wapiti from SVN — Kevin Johnson
Added WebApplicationFingerprinter — Kevin Johnson
Locked version of LSB-base due to Ubuntu bug (Will fix when Ubuntu fixes it) — Kevin Johnson
Updated Remastersys and its repository — Kevin Johnson
Added SamuraiWTF Add-On collection to Firefox — Kevin Johnson
Added Fierce2 — Kevin Johnson
Added WebSecurify — Kevin Johnson
Fixed sshd hist key — Justin Searle
Updated w3af from SVN — Kevin Johnson
Updated sqlmap from SVN — Kevin Johnson
——————————————————–
v0.7 08/01/2009
——————————————————–
Installed Cewl from dijininja.org — Kevin Johnson
Updated Ubunutu patches as of July 23, 2009 — Frank DiMaggio
Updated w3af from SVN as of July 25, 2009 — Kevin Johnson
Fixed sqlninja.sh — Frank DiMaggio
Fixed sqlmap.sh to include the -h — Kevin Johnson for Tim Medin
Updated sqlmap to 0.7 — Frank DiMaggio and Kevin Johnson
Updated Firefox add-on Hackbar — Kevin Johnson
Updated Firefox add-on XSS Me — Kevin Johnson
Updated Firefox add-on Header Spy — Kevin Johnson
Updated Firefox add-on User Agent Switcher — Kevin Johnson
Updated jBroFuzz to 1.4 — Kevin Johnson
Upgrade nmap to 5.0 — Kevin Johnson
Installed Durzosploit from SVN as of July 18, 2009 — Kevin Johnson
Installed BrowserRider from SVN as of July 18, 2009 — Frank DiMaggio
Added Jason Wood’s username generator scripts — Kevin Johnson
Updated MaltegoCE to 2.02 — Frank DiMaggio
Added Laudanum Files — Kevin Johnson
Added GPScan.rb from dijininja.org — Kevin Johnson
Added HowTo videos from Pauldotcom — Kevin Johnson
——————————————————–
v0.6 05/16/2009
——————————————————–
Updated README — Kevin Johnson
Added Keyboard Layout to top menu — Kevin Johnson
Ubuntu Security updates as of May 15 — Kevin Johnson
Udated w3af from SVN as of May 15 — Kevin Johnson
Added BeEF module for quicktime detection — Kevin Johnson
Added BeEF module for unsafe activeX — Kevin Johnson
Added BeEF module to exploit CVE 2009_1169 — Kevin Johnson
Added BeEF module to exploit the Chrome DoS — Kevin Johnson
Added BeEF module for VM detection — Kevin Johnson
Removed extraneous Places menu options — Kevin Johnson
Upodated SQL Inject Me — Kevin Johnson
Updated Access Me — Kevin Johnson
Updated and moved nikto — Kevin Johnson
Increased max heap size on Java applications — Kevin Johnson
Removed HTTP_Print — Kevin Johnson
Fixed SQLMap — Kevin Johnson
Fixed SQLNinja — Kevin Johnson
Fixed the Moinmoin wiki — Justin Searle
——————————————————–
v0.5 05/01/2009
——————————————————–
Upgraded to Ubuntu 9.04 — Kevin Johnson
Upgraded w3af from SVN as of May 1, 2009 — Kevin Johnson
Upgraded XSS Me — Kevin Johnson
Upgraded Access Me — Kevin Johnson
Upgraded SQL Inject Me — Kevin Johnson
Upgraded Header Spy — Kevin Johnson
Installed sqlmap — Kevin Johnson
Installed SQLninja — Kevin Johnson
Added links to irongeek — Kevin Johnson
——————————————————–
v0.4.1 02/25/2009
——————————————————–
Upgraded W3af to SVN — Kevin Johnson
Upgraded BeEF — Kevin Johnson
Added modules to BeEF — Kevin Johnson
——————————————————–
v0.4 02/01/2009
——————————————————–
Upgraded Ubuntu — Kevin Johnson
Changed minor display settings — Kevin
Upgraded w3af to SVN version as of 02-01-09 — Kevin Johnson
Upgraded Burp Suite to 1.2 — Kevin Johnson
Added XSS Me — Kevin Johnson
Added SQL Inject Me — Kevin Johnson
Added Access Me — Kevin Johnson
——————————————————–
v0.3 10/12/2008
——————————————————–
Upgrade w3af to SVN version as of 10-11-08 — Kevin Johnson
Upgraded Grendel-Scan to 1.0 — Kevin Johnson
Added JBroFuzz — Kevin Johnson
Added Friends of SamuraiWTF Bookmarks — Kevin Johnson
Added Grendel-Scan to SwitchProxy — Kevin Johnson
——————————————————–
v0.2 09/29/2008
——————————————————–
Added sound effects — Larry Pesce
Changed domain name — Kevin Johnson
Fixed Paros — Kevin Johnson
Fixed ratproxy ssl support — Kevin Johnson
Fixed background — Kevin Johnson
——————————————————–
v0.1 08/10/2008
——————————————————–
Initial Developer Release

Comment sélectionner une solution SIEM

Voici un très bon article sur la définition des besoins pour un système de gestion des journaux et information de sécurité.

Here’s a great article on how to select a SIEM solution.

Immunity El Jefe

Immunity, la compagnie derrière Canvas l’outil de tests de perméabilité, permet de centraliser la surveillance des processus Windows suspects avec leur solution de domaine public (opensource) appelée El Jefe. Cet outil semble très utile pour les environnements plus vulnérables aux attaques virales.

Immunity El Jefe
Immunity’s open source project, El Jefe (pronounced ‘ell-HEFF-ay’) is a Windows based process monitoring solution. El Jefe produces a unique view into how processes are created, what privileges they possess and what child processes they spawn. All of this information is stored, and categorized into a central logging server, which allows a user to quickly see any suspicious behavior that could indicate compromise or malware proliferation.

L’analyste vs les solutions de sécurité

Je suis 100% d’accord avec cet article de Symantec qui explique combien on met trop d’emphase sur les solutions techniques de sécurité (telles que IDS/IPS) et trop peu d’emphase  sur l’expertise nécessaire pour rendre ces solutions utiles pour l’entreprise.

This Symantec article articulates very well why it’s not about the IDS/IPS. It’s about the analyst.

Protection pour Mac OS

Voici un article qui mentionne quelques produits de protection disponibles pour Mac. Je viens d’installer Sophos AV for Mac Home Edition. Je suis présentement en train de faire un balayage et il a détecté des programmes potentiellement malicieux que j’ai téléchargé volontairement sur mon PC pour des analyses de vulnérabilité.
Il y a quelques mois, j’avais installé celui de Trend Micro (une compagnie dont j’ai beaucoup confiance) mais il faisait crasher le kernel. Je crois toutefois que c’était un produit qui venait d’être rendu disponible officiellement (GA).
Donc pour l’instant, je crois que je vais garder celui-ci (de Sophos). Je vais essayer de soumettre une mise à jour éventuellement…