ArcOSI 2.1 Released!

Just uploaded the newest version of ArcOSI Open Source Intelligence Utility for use with ArcSight ESM. I've added several new malware domain feeds and improved the code to handle connection errors, etc. I'm making time for this project now and will soon add support very soon for proxy and proxy-auth as this has been requested numerous times!

Thanks to everyone who has tested and just a reminder feel free to reach out directly if you have any issues, feedback or requests.

http://code.google.com/p/arcosi

-Greg

Look out

got Metasploit running on my iphone4 after a few tweaks..

Security B-Sides DFW Nov 6th

The very first B-Sides security conference in Dallas, TX is coming up Nov 6th and I will present early morning on mass exploitation using Metasploit a cucumber and an iPhone.

Please bring your friends and co-workers who are interested in Security as these conferences are completely free and typically loads of fun.

Hope to see you there, cheers.


http://www.securitybsides.org/BSidesDFW

Amun Honeypot with ArcSight CEF support

Playing around this weekend and created a CEF syslog output plugin for Amun honeypot, here is the sample output (dst IP scrubbed):

Sep 6 19:44:30 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=222.186.27.82,dst=76.78.17.74,msg=DCOM Vulnerability,dpt=135,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None

Now need to feed these into an ESM active list...

To be nice, I packaged up the CEF enabled Amun honeypot into a 200MB Ubuntu VM so you can try this out in your ArcSight lab or production. Follow the easy directions to re-IP and setup syslog out. You will be nabbing attackers and the latest malware in no time!

***update: I Googled the attacker IP's in the post above and found no mention of them in any open malicious IP lists, this highlights the effectiveness of using honeypots to gather the absolute latest intelligence on hosts attacking your perimeter (and others).

***update 2: VM boot issue fixed, sorry about that!

MIT Courseware: Learn to program in Python

Just wanted to share this excellent resource as I have been mentoring new security professionals and a majority of them have never written a script before. Open course ware is one of the greatest things to come out in recent years and I understand this is one of the best intro programing lectures:



http://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-00-introduction-to-computer-science-and-programming-fall-2008/lecture-videos/

ArcOSI - ArcSight Open Source Intelligence

Just in time for the ArcSight annual users conference I will be presenting on integrating Open Source Intelligence in ESM and have updated the original malwarefeed.py script with a version which can pull from multiple configurable sources!

If you want to give it a spin on your own environment now, download the python script version below and start streaming thousands of known malicious IP's right into ESM via CEF syslog.

http://code.google.com/p/arcosi/

usage: ./arcosi.py 127.0.0.1

New 13" Macbook Pro GPU Hash Cracking NTLM/MD5/SHA1

Wanted give some GPU cracking a go on my new 13" Macbook Pro. It's sporting a nice but rather weak Nvidia Geforce 330m.

If you want to try the same, you will need the CUDA libraries here, and CUDA Multiforcer for Intel Mac's located here.

Remember to check out Pyrit here for cracking WPA/WPA2 keys, it will also run on OSX...

./CUDA-Multiforcer -h NTLM -c charsets/charsetfull -f test_hash_files/Hashes-NTLM-Full.txt --min=4 --max=9

Benchmark:

Cryptohaze.com CUDA Multiforcer (multiple hash brute forcer)
by Bitweasil
Version 0.61 beta, length 0-14
Currently supported hash types: MD5 MD4 NTLM
Hash type: NTLM
CUDA Device Information:
Device 0: "GeForce 320M"
Number of cores: 48
Clock rate: 0.00 GHz
Charset loaded (96 characters)
Hashes loaded (7 hashes)
Launching kernel for password length 4
Done: 73.49% Step rate: 82.9M/s Search rate: 580.4M/sec

------------------------------------------

Compute done: Reference time 1.3 seconds
Stepping rate: 63.1M MD4/s
Search rate: 441.8M NTLM/s

Launching kernel for password length 5
Done: 25.36% Step rate: 80.4M/s Search rate: 562.6M/sec