Monitoring Social Media

Web search has lots of power when it comes to Social Media monitoring, there are lots of free tools and search engines that can help you in that area. Combine the search results with rss feed, and you will get an easy way for tracking the social media. This can be very useful in watch-and-warning teams and security monitoring activities.

Monitor blogs, comments, news, tags, forums,...

Social Mention(blogs,comments)

http://www.socialmention.com/

Boardtracker (forums)

http://www.boardtracker.com/

Yacktrack (comments on defined URL)

http://yacktrack.com/home

Backtype (comments, people)

http://www.backtype.com/

Technorati (blogs):

http://technorati.com/

Google Alert (web, news, ..)

http://www.google.com/alerts

Startpr (blogs, photos, videos, social networks)

http://startpr.com/

Omgili (forums)

http://www.omgili.com/

Serph (forums, social networks, blogs, news,...)

http://serph.com/

Keotag (tags)

http://www.keotag.com/

Twitter (social messages)

http://search.twitter.com/

Search for People:

http://www.pipl.com

Twitter Monitor

http://monitter.com/

Tattler, Open Source Topic Monitoring Tool

Other tools:

Topsy

Techrigy

Scoopler

SamePoint

Wink

Spock
Social Mention
WhosTalkin
OneRiot
Kosmix
YackTrack
Keotag
Twoogle
KnowEm Username Check
Firefox Super Search Add-On

Updated:

A comprehensive list is now available on http://wiki.kenburbary.com/social-meda-monitoring-wiki/

Default Password List

http://www.phenoelit-us.org/dpl/dpl.html

http://www.cirt.net/passwords

http://www.searchlores.org/defpasslist1.htm

http://www.governmentsecurity.org/articles/DefaultLoginsandPasswordsforNetworkedDevices.php

http://www.redoracle.com/index.php?option=com_password&task=rlist

Free Security Assessment Tools

Security System Analyzer :
OVAL-compatible product
Fully support of open security standards and initiatives (CVE, OVAL, CCE, CPE, CWE, CAPEC, CVSS, CRF)
Perform a deep inventory audit on installed software and applications
Scan and map vulnerabilities using non-intrusive techniques based on schemas
Detect and identify missed patches and hotfixes
Define a patch management deployment strategy using CVSS scores

http://www.security-database.com/ssa.php

MS Baseline Security Analyzer:
Vulnerability assessment scan tool for MS products

http://technet.microsoft.com/en-us/security/cc184924.aspx

Secunia Personal Software Inspector:

Scan all the software installed on your PC, and advise you to update un-patched software.
http://secunia.com/vulnerability_scanning/personal/


Microsoft Security Assessment Tool:

MSAT consists of over 200 questions covering infrastructure, applications, operations, and people.
The questions and the recommendations that the tool offers are based on standards such as ISO 17799 and NIST-800.x, MS trustworth computing group and other external resources.
http://technet.microsoft.com/en-us/security/cc185712.aspx

Application Pen-Testing time Estimator:

http://www.coffeeandsecurity.com/resources/tools/tamapper.aspx

Anti-Virus Comparison

There is always a debate about these kind of tests, but these 2 reports worth reading.

According to the av-comparatives AVIRA and ESET NOD32 are the best engines in terms of detection rates and overall performance.
http://www.av-comparatives.org/seiten/ergebnisse/summary2008.pdf


In a different report, AVIRA also scored higher than others
http://www.anti-malware-test.com/?q=node/39

Exploits archives

When doing pen-testing, the below sites are good enough for getting the exploits you may need:

http://www.milw0rm.com/

http://www2.packetstormsecurity.org/

http://secunia.com/

http://www.securiteam.com/

http://securitydot.net/

http://securityvulns.com/

http://inj3ct0r.com/

Virtual honeynet, network setup

I have seen lots of questions about networking a virtual honeynet, here is my setup.

I am using a host machine with 3 VMs: Honeywall, Honeypot, and a management station.

The IPs on the diagram are based on a test setup, the honeypot IP should be changed to a real IP if it will be placed on the internet, no more changes are needed (in terms of IPs).

Fully patched Internet Explorer is Vulnerable, 0-Day again...

A remote exploit targeting fully patched IE (several versions) is available in the wild, the vulnerability is rated as critical.

VeriSign's iDefense security division reports that attack code was up for sale at prices of up to $15,000 through underground forums.

http://www.vupen.com/english/advisories/2008/3391

The exploit is available on http://milw0rm.com/exploits/7403

Real example of the exploit: http://milw0rm.com/sploits/2008-iesploit.tar.gz

Analysis by HD Moore:

http://www.breakingpointsystems.com/community/blog/patch-tuesdays-and-drive-by-sundays

Microsoft Official Advisory:

http://www.microsoft.com/technet/security/advisory/961051.mspx

http://blogs.technet.com/msrc/archive/2008/12/11/microsoft-security-advisory-961051-updated.aspx

Snort Signatures:

http://www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_IE_0Day

List of sites exploiting this vulnrability:

http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081210

Workaround:

http://www.securiteam.com/windowsntfocus/6N00F1FHFE.html
http://blogs.technet.com/swi/archive/2008/12/12/Clarification-on-the-various-workarounds-from-the-recent-IE-advisory.aspx#workarounds

The exploit is spreading:

http://blogs.technet.com/mmpc/archive/2008/12/11/limited-exploitation-of-microsoft-security-advisory-961051.aspx

Technical Analysis of real exploit:
http://securitylabs.websense.com/content/Blogs/3263.aspx

The big picture:

Hackers are using mass SQL-Injection attacks to infect legitimate sites with malicious IFrame and JavaScript that may redirect the user to a malicious site with the IE exploit, so visitors to those trusted sites will be infected, the exploit will drop different flavors of malware on the client PC.

MessageLabs Annual Security Report

- 90% of SPAM is coming from Botnets

- Complex web-based malware became widespread, resulting in malware being installed onto computers with no user interaction

-Targeted trojan attacks  rose in 2008

- The usage of online free file sharing services helped the spammers to upload and share malicious files using just a link, this file could be a small html page, with a Javascript  that redirect the victim to the spammer's website

- Also free webhosting services are being used inceasingly by spammers to host spam content 

check the report:

http://www.messagelabs.com/mlireport/MLIReport_Annual_2008_FINAL.pdf

50 Must-Have Open Source Tools for Security

http://itmanagement.earthweb.com/secu/article.php/3781306/

Web Based Malware Analysis

Working on a Javascript malware analysis, here are some useful tools that can help:
Rhino
http://www.mozilla.org/rhino/
Malzilla
http://malzilla.sourceforge.net/
Caffeine monkey
http://www.mozilla.org/js/spidermonkey/
FreShow
http://www.jimmyleo.com/work/FreShowStart.htm
DecryptJS:
http://www.ukhoneynet.org/tools/decrypt-js/


I came across this malicious JavaScript
AAA=Array(63/**/,0/**/,0/**/,0/**/,0/**/,0/**/,0/**/,0/**/,0/**/,0/**/,0/**/,0/**/,0/**/,0/**/,0/**/,42/**/,0/**/,22/**/,32/**/,47/**/,40/**/,50/**/,56/**/,60/**/,11/**/,0/**/,0/**/,0/**/,0/**/,0/**/,0/**/,54/**/,8/**/,27/**/,45/**/,43/**/,58/**/,41/**/,31/**/,26/**/,2/**/,4/**/,17/**/,59/**/,44/**/,20/**/,28/**/,18/**/,19/**/,16/**/,52/**/,46/**/,61/**/,33/**/,39/**/,15/**/,14/**/,9/**/,0/**/,0/**/,0/**/,0/**/,0/**/,0/**/,13/**/,23/**/,3/**/,25/**/,55/**/,10/**/,38/**/,62/**/,7/**/,24/**/,51/**/,29/**/,12/**/,5/**/,6/**/,35/**/,37/**/,48/**/,1/**/,36/**/,21/**/,57/**/,34/**/,53/**/,49/**/,30)
BBB="I7bHEVPGEK2a41oG8VWmWO6BWl@Btx2ZFd2HtnWO .. .. . . . . . ."
CCC=3536,DDD,EEE,FFF=''
YYY=ZZZ=XXX=0
for(EEE=4;EEE>0;EEE--)
{for(DDD=Math.min(CCC,1024);DDD>0;DDD--,CCC--)
{eval('XXX|=(AAA[BBB.charCodeAt(YYY++)-33]) < < ZZZ;');

Here are my notes:

- AAA variable is used as a key for encoding, if the attacker needs to change the code, he will just change the encoding key, this will help in the AV evading.
- String.fromCha'+'rCode(8^XXX&255) means String.fromCharCode(8^XXX&255)
- BBB.charCodeAt(YYY++)
this will get the unicode value of BBB character by character, starting form character 0-1024
- let us take the first part: I7bHEVPGEK2a41oG8VWmWO6BWl@
starting with position 0 increment by 1:
I7bHEVPGEK2a41oG8VWmWO6BWl@ ==> 73 55 98 72 69 86 80 71 69 75 50 97 52 49 111 71 56 86 87 109 87 79 54 66 87 108 64
deduct 33 from them all: 40 22 65 39 36 53 47 38 36 42 17 64 19 16 78 38 23 53 54 76 54 46 21 33 54 75 31

so look at a overall equation:
'XXX|=(AAA[BBB.charCodeAt(YYY++)-33]) < <>
"|" is bitwise OR, "<<" is shift left
- The code use bitwise OR and Shift Left for encoding
- There is an easier way to do this by using Malzilla, and the debug feature.
- Finally the code will try to connect to google-analyse.cn, and downloading a malicious executable file.


References:
http://rishida.net/scripts/uniview/conversion.php
http://www.eecs.umich.edu/~bartlett/jsops.html http://doc.sumy.ua/prog/jsm/ch13.htm#BitwiseOROperator

http://www.ukhoneynet.org/wp-content/uploads/2007/08/decryptjs.tgz