You are browsing the archive for Preaching.

The story of a possible prank

September 25, 2015 in Preaching

In 2011 a security researcher pulled – what I believe – a prank on a well-known org. He made them publish a paper with an appendix containing a non-sensical data. I reported this to the org in 2012 as soon as I discovered it. I was actually flabbergasted at that time that someone could be that bold to pull the org’s leg this way (risking both author’s and org’s credibility), but it was still 2 months before the infamous Nmap Guide made it to the news and trolling security orgs became a norm.

I forgot about it for a long time, but recently it came back to me & I checked the web site of the org to see if they pulled the paper – the paper is still there – 3+ years after I reported it – the goofy appendix is of course there as well.

I must emphasize that I do not have a proof that it is a prank, but the non-sensical information included in the paper cannot be a result of a typo, or an accident; it looks like someone deliberately made stuff up. Of course, if it is just a result of the author’s ignorance or it was the intern who wrote that it would make it for even more lulz.

I don’t want to mention the gore details for many reasons. Thanks for understanding.

I do want to mention though 2 interesting side-effects of this paper being published:

  • The information was copied to other blogs (not too many, but always).
  • Based on the information in this paper someone created IDS signatures – talk about quality & tests

You may be wondering why I am posting such a vague info at all.

It’s simple: question everything you read.

I personally make tones of mistakes. I sometimes read some of my older posts and I find bugs. Not only typos, but actual logical bugs that make me really ashamed. I don’t like to be wrong, I really don’t, but if I am the only finding out then what about the poor guys who believed it then and believe it now?

There is a certain responsibility of a writer, a researcher to ensure the quality of the writing is at the appropriate level. But it is impossible if there is no feedback. Especially the critical one.

To certain extent I can understand frustration of HC when he insists on receiving feedback from readers. Seeing people retweeting, but not reading can be certainly disheartening. In my opinion expectations of a blog writer should be very low here, and it keeps me sane writing & babbling anytime I feel like – at certain level I don’t even care – these are more my notes that I feel may be interesting to share, less my interest or a will to change the world (we all die; I am great at parties :) ).


But if there is one thing that I care about is accuracy. If I make a mistake and no one tells me, it really sucks. And the fact is that most of people don’t even bother to read in-depth anymore. Everything is ‘just in time’ – you only read stuff when you need it. I do it all the time. Skimming is a necessity. And this is fine, as long as the stuff you read is correct.

But it rarely is 100%.

So if you read this – please read whatever you read with an assumption that what you read may not be 100% right. It is especially important with materials endorsed by orgs. Like everyone who made their hands dirty & sinned by publishing – they sometimes publish bad quality stuff. Only these who don’t do anything make no mistakes at all.

Keep your eyes open.

Are you a Canon or Nikon?

August 16, 2015 in Incident Response, Preaching

In a world of photographers there is a very common question exchanged between the peers which goes something along the lines of:

Are you a Canon or a Nikon user?

Sometimes it goes beyond that and includes other brands: Fuji, Sony, Leica, etc., but the strong association with brand is err… a canon itself, at least in a photographic world.

The ability to love, or at least stick to one brand has benefits – you get really familiar with the brand, things fit, loyal customers can leverage the long-term relationship in many ways and sometimes it simply makes sense to be really good at one thing.

The world of security adapted this principle and applies it one by one to various security controls.

There are just a few of antivirus companies that matter and everyone can quickly associate themselves with one of them.

The very same goes for firewalls.

And DLP solutions.

And old-school forensics tools.

Even sandboxes seem to be there already.


IR solutions are IMHO still not there.

The differences between a good IR solution and a less-good IR solution are slowly emerging though.

These are for example:

  • Ability to deploy and rapidly gain the best coverage within any organization, no matter what network topology they use
    • Whoever can deploy faster and cover more quicker, wins
  • Ability to fetch host’s volatile data is crucial
    • Whoever does it in real-time does it better than sweepers
  • Ability to fetch / monitor data from both kernel and userland
    • Whoever can do it for both lands, is a winner
  • Ability to sweep is still a very valuable add-on (they may detect campaigns AV doesn’t detect, web shells, etc.)
    • Whoever offers both sweeps and real-time analysis, wins
  • Ability to fetch data in the most forensically sound manner
    • Whoever does it and ends up with the least contaminated host wins
  • Ability to interact with the host’s volatile data (more precisely: with the actual object f.ex. processes)
    • Malware removal is often as easy as killing the process and removing the file – whoever allows analysts to do it on the spot, wins (old school IR relies on psexec, help from a dedicated desktop/server team or even user to remove these and not uncommon is a full system rebuild)
  • Ability to easily update
    • Whoever does it in a way that is ‘invisible’ to everyone involved, wins

Many of these are well-known and faced – for many years – by AV companies. Theirs are ones of the most prominent solutions deployed on endpoints today. It often boggles my mind that they have overslept the whole DFIR revolution that happened over last 5-10 years. It’s such a corporately-speaking “low-hanging-fruit”.

Adding IR capability to AV product is such a no-brainer. Someone, please explain :)

This is still a time of experiments in IR world and there is no pool of shortlisted winners yet.

It is NOT wise to change IR vendors often now.

Let these that are fighting for the market battle with each other, and winners will emerge.

If you have already purchased something from one vendor, do not rush on buying stuff from a new one.

The corporate world is currently divided into 4 IR buckets:

  • these who don’t know what they don’t know – these are destined to fail a.k.a. being epically pwned
  • these who know that they don’t know something – these are destined to fail, but at least are not surprised
  • these who know what they know – they may fail gracefully
  • these who know what they know, and potentially try to learn about the unknowns – a few lucky ones that have a (relatively) mature IR program implemented; they may still fail, but it will be a really graceful fail a.k.a. IR mission accomplished

If you see similarities with four stages of competence – this is not accidental.

Ignorance in this industry is omnipresent and mind you – it includes yours truly. We are all firefighting a lot. The complexity of the IT Security is beyond a reach of a single individual, single vendor, single brand. Full stop. I think this is the world where the dry, theoretical certificates like CISSP/CISM meet the juicy, technical SANS exams. You use knowledge from CISSP/CISM (security controls & their management) and apply your technical knowledge (choose the best security controls & proper IR/forensics) from SANS courses to defensively ‘pwn’ your company internally.

I guess it’s time to reveal the real purpose of this post.

You need many security controls. Choose one for each area that requires coverage, and stick to it. Do not flip them like burgers every 1/2/3 years. You want to invest once, deploy once, know it inside out and gain maximum coverage. The time to realistically deploy and fully understand each security control (to the level of ‘defensive pwnage’) is – in my personal opinion – 2-5 years. (there are many reasons for this taking so long: complicated network topology, legacy infrastructure, collisions/overlaps with other projects, ensuring business is affected in a minimal way, gradual deployment, staff changes, and then bugs, configuration issues, of the products themselves, etc. The other reason, especially for IR solutions is their immaturity. Many IR solutions are built in the garage, the only real field test they go through is when some company allows the IR vendor to put a foot in a door and give them access to the environment to test the waters. This is a real QA phase. If you are company doing the QA you will spend a lot of time troubleshooting. It’s ironic, because instead of being a customer, you are actually performing QA for the vendor. So, overall, it costs a lot of time and money to deploy ONE solution.

This is why I think the IR vendor change should be based not on budget or even merit, but on the coverage of the existing IR vendor (of course, if they suck, you need to change).

Only when you cover let’s say 98% of your endpoints – look at alternatives*.

*In case you are wondering why – think of it this way: imagine you have a coverage of 98% with your current vendor (in a large corporate 98% coverage means there are still a lot of endpoints not covered- close to a few thousands, actually, but it’s a risk management, after all). Assuming the IR vendor you use is not some snake-oil company by the time you see this 98% coverage you may be quite sure that most of your endpoints are clean. Only then you should have a confidence to look for gains on the financial or even usability side, let alone whistles and fireworks that other vendors offer, because you know that you are going to deploy the new guy to the environment that is already 98% IR-managed.

At least, this is what I believe is true.