UPDATE: Part 4 – Definitions and Rules and Part 5 - SSL VPN are now available. It's been quite a while since I wrote the initial two Sophos UTM posts. I recently upgraded from a really old, re-purposed HP box to a slightly-less-old Dell Precision 670 courtesy of steiner, and I took the opportunity to document the setup process. This post assumes you have followed the ... READ MORE
Blog
Decrypting SSL Traffic with Wireshark
I recently was involved in an responding to an incident and one thing that was key to our investigation was decrypting SSL traffic. The attacker got a web shell on one of the servers and was mucking around with that. All of the traffic was over HTTPS, but we fortunately had the key. This allowed us to decrypt the traffic and view all of the commands issued. It was quite ... READ MORE
CTF – Malware Analysis Walkthrough
RSM hosted a capture the flag tournament for high school students at Mount Union back in April. This is the walkthrough for the forensics 400 CTF challenge. ("It should have been posted earlier, but it fell through the cracks." -patchwork). In my first walk-through I spent a lot of time talking about how I meant for the problem to be able to be solved without much prior ... READ MORE
Pillage Exchange
A while back I wrote a post detailing a technique for pillaging .pst files. A .pst is a "personal storage folder" created by Microsoft Outlook containing email messages, contacts, appointments, and other information, and may be stored locally or on a centralized server. The approach I detailed in that post involved dropping a small binary on the machine hosting the .pst ... READ MORE
Find Sensitive Data with Bulk Extractor
Bulk Extractor is a great tool for searching a file system for sensitive data. Bulk extractor ignores the file system and scans it linearly. This, in combination with parallel processing, makes the tool very fast. It will have an issue with fragmented files, but typically, files aren't fragmented. Follow the directions here for installation. Using BEViewer, the ... READ MORE
Intro to IMINT
*All images were obtained from Google maps and are to be used for educational reason only* I used to play Eye Spy all the time when I was younger. It made car rides go faster, gave me and my friends something to do while waiting in the ice cream line, and as I recently discovered, the game also provided me with a bit of career prep. Imagery Intelligence (IMINT) is ... READ MORE
Real World Malware Analysis Part 4: Dynamic Analysis
Last time we used Malwr.com to automate a lot of our analysis, but the process was not without a few sticking points. Malware analysis typically falls into two categories, static and dynamic. These two really go hand-in-hand, and while it is possible to alternate between them, today we will focus on dynamic analysis. Remember to properly set up your lab environment! We are ... READ MORE
Crouton – Chromebooks as a Pentesting Platform
I had the opportunity to pick up a Chromebook (Acer C720) on the cheap(er) this past weekend. A local high school was getting rid of those machines that had previously belonged to graduating seniors who had chosen not to buy them outright at the end of the year. I had never had much of a chance to play around in ChromeOS until now, so I was excited to get my hands dirty. I have ... READ MORE
Physical Penetration Tests – SOPs and Planning
This post describes some of the factors that a team should take into account while planning and executing a physical penetration test. As a disclaimer, some may find the heavy use of military jargon alarming. Such language is not intended to suggest or encourage an adversarial relationship between the security professionals and their clients; rather, it’s the simple result ... READ MORE
Collecting Volatile Data with AWK
On a recent forensics case, a coworker and I noticed some interesting logs on a Linux web server. TCPDump showed some strange traffic from a handful of IPs, but the access logs were not showing any visits from the offending addresses. The traffic was encrypted so it wasn't possible to see what was being sent, so we needed to do some additional digging. A lot is required to take ... READ MORE