Big Data Security Analytics

If your an XYZ SIEM user today and your boss is asking you about big data what is our strategy.  You probably have RSA, HP and everyone trying to pitch you their new product which solves all problems.

Here is what you need to be doing to start migrating from just SIEM correlation to big data security analytics:

Download and install Elastic Search.  Point your XYZ SIEM to forward events to Elastic Search.

Use Kibana to search that data.

Thank me later.

Black Hole Exploit Kit 2 (BHEK) summary

This post is just to summarize some quick facts about the problematic BHEK v2.  Why problematic?  Well this version of exploit kit has risen the bar in sophistication and is harder to detect, defend and find.  It's currently driving many of us on the threat ops and intel side crazy so the sharing of information is paramount.

Here is a roundup of data and analysis on BHEKv2:

Great write-up via spider labs
http://blog.spiderlabs.com/2012/09/blackhole-exploit-kit-v2.html

Malware don't sleep (inside BHEK v2)
http://malware.dontneedcoffee.com/2012/09/behind-captcha-or-inside-blackhole.html

Excellent analysis by Malware Must Die!
http://malwaremustdie.blogspot.jp/2012/09/following-lead-of-suspected-blackhole2.html

Great analysis by Mila
http://contagiodump.blogspot.fr/2012/09/cve-2012-4681-samples-original-apt-and.html

Download BHEK v2 (partial pack)
http://contagio.deependresearch.org/files/Blackhole2files.zip

Snort signatures:

SOURCEFIRE SNORT
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"EXPLOIT-KIT Blackhole possible email Landing to 8 chr folder"; flow:to_server,established; content:"href=|22|http|3A 2F 2F|"; content:"/index.html|22|"; within:50; pcre:"/\x2f[a-z0-9]{8}\x2findex\.html\x22/msi"; metadata:policy balanced-ips drop, policy security-ips drop, service smtp; classtype:trojan-activity; sid:24171; rev:1; )
EMERGING THREATS
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Blackhole Landing to 8 chr folder plus index.html"; flow:established,to_server; content:"/index.htm"; fast_pattern:only; http_uri; urilen:20<>21; content:!"search"; nocase; http_uri; pcre:"/^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/index\.html?$/U"; classtype:bad-unknown; sid:2014521; rev:4;)


List of BHEKv2 compromised domains (from contagio):
arksylhet.com
badshahpromotions.co.uk
centroedusantaterezinha.org
chambe-aix.com
colombianfashion.com
curatatorie-sibiu.ro
davidicke.pl
domaister.com
dpwparking.com
ecoaction21.fr
estetiqueroman.ro
fengshuitonight.com
ferretsac.com
firetowerguard.com
groupe-cmb.com
hmlanding.com
innovahogar.es
jusprev.org.br
justwebdesign.co.za
karpar.gr
lehoapaper.com
muzee.org
nailtaxi.com
onewaytransportproducts.com
sloanegroup.com
sv.thanmadailuc.com
trends-und-freizeit.de
ukhs.dk
wnyportal.com
www.golfer360.de

Target Email URLS (from contagio):
http://arksylhet. com/A67iD4eo/index. html
http://arksylhet. com/QSpUShbL/index. html
http://badshahpromotions. co. uk/zpVjiR/index. html
http://centroedusantaterezinha. org/foRHmF8/index. html
http:///Wjn56cM6/index. html
http://chambe-aix. com/yCkWRN/index. html
http://chambe-aix. com/yYiD9SAs/index. html
http://colombianfashion. com/Mt1T26/index. html
http://curatatorie-sibiu. ro/fbwoGoYB/index. html
http://curatatorie-sibiu. ro/QeHis8s/index. html
http://davidicke. pl/0qaSfRv/index. html
http://davidicke. pl/mZbkMz/index. html
http://davidicke. pl/x1s0xB8z/index. html
http://domaister. com/LD2nAc/index. html
http://dpwparking. com/PYG35et/index. html
http://ecoaction21. fr/QBA8Re4S/index. html
http://estetiqueroman. ro/KD31RjXc/index. html
http://fengshuitonight. com/JTARZz/index. html
http://fengshuitonight. com/vRNXQq/index. html
http://ferretsac. com/wBbsvpF/index. html
http://ferretsac. com/wc4hACm/index. html
http://ferretsac. com/z7ShYa3/index. html
http://firetowerguard. com/AEuifWY/index. html
http://groupe-cmb. com/JWBpK7qd/index. html
http://groupe-cmb. com/ukKmLYf0/index. html
http://groupe-cmb. com/zc0XNMxZ/index. html
http://hmlanding. com/60QuVZQ/index. html
http://innovahogar. es/4oRnMr/index. html
http://innovahogar. es/V2dSnzdv/index. html
http://innovahogar. es/ZUCufHc/index. html
http://jusprev. org. br/aZhDGJ1e/index. html
http://justwebdesign. co. za/X1dWrR/index. html
http://karpar. gr/mMDBNKhE/index. html
http://karpar. gr/yoTkZUm0/index. html
http://karpar. gr/yUyj1crG/index. html
http://lehoapaper. com/hUvbnijs/index. html
http://muzee. org/AA9njNS/index. html
http://nailtaxi. com/yjgSuE/index. html
http://onewaytransportproducts. com/auVejpR/index. html
http://sloanegroup. com/1n70Gvt/index. html
http://sv. thanmadailuc. com/9vy1FW/index. html
http://sv. thanmadailuc. com/UotPEhM/index. html
http://sv. thanmadailuc. com/x4MSyKCz/index. html
http://trends-und-freizeit. de/4UDFo4/index. html
http://ukhs. dk/ZjUP5CCZ/index. html
http://wnyportal. com/cKodnh/index. html
http://justwebdesign. co. za/X1dWrR/index. html

Open-Source Centralized Log Management

With the rise of SIEM and IT operation data mining use-cases many organizations are investing or deciding on how to invest in centralized log management. I'm sure people wonder is there interesting open source alternatives or shall I even bother?

Well it depends, I think there are some great new options to test or keep an eye on, some fantastic mature commercial options and something in-between (Splunk).

So here are the latest a greatest open source options to commercial products such as:
Splunk, Qradar Log Manager , ArcSight Logger, Logrythem, etc.

enterprise-log-search-archive (ELSA)

Perl, MySQL and SOLR based solution which is said to be faster than Splunk at large data sets and seems to have a large following. There is currently no commercial backing or support and it looks that the web interface is highly usable but not rich with visualization options (a trait you will find common in the open source offerings).

http://code.google.com/p/enterprise-log-search-and-archive/
http://vimeo.com/39722091

Sentry

Python and Django based solution by the guys from DISQUS. Seems to be an interesting HTTP based approach and looks high performance. Lots of documentation available, great option for the Python hackers (like me).

http://sentry.readthedocs.org/en/latest/
https://www.wunki.org/posts/2012-01-19-centralized-logging-with-sentry.html

Graylog2

Looks to have the best interface of the group, this is a ROR and ruby based project by the smart folks at XING. Looks to be well maintained and feature rich. Would love to know how it scales.

http://graylog2.org/

LogStash

Java + ROR based streaming log aggregation. Looks very cool, it was created by an ex-google engineer now working at Loggly. Very actively maintained project with lots of documentation and some cool features. This one is definitely worth checking out.

http://logstash.net/
http://www.oscon.com/oscon2012/public/schedule/detail/26347

Logsandra

Another Python based project using Cassandra (NOSQL) backend database. Cool looking project but early stage and does not seem to have a mature UI.

https://github.com/thobbs/logsandra
http://my.safaribooksonline.com/book/databases/9781849515122/libraries-and-applications/ch10lvl1sec12

Scribe

Python based log aggregation tool used by Facebook. Does not seem to be actively maintained or updated in several years :(

https://github.com/facebook/scribe


Unfortunately I cannot speak to the performance, feature or overall quality these solutions. Perhaps when I have more time I can try them out and create some reviews. Enjoy!

ArcOSI is now Bad Harvest

ArcOSI has been officially re-named to Bad Harvest and has great new threat intelligence sources in the latest version available now... Get it!

PPTP VPN is Critically Vulnerable.

Moxie Marlinspike does it again. The eclectic hacker who previously brought you SSLStrip now has released (@ Defcon 20) a utility and advisory on cracking MSCHAPv2 which powers most PPTP VPN. Get the code here: https://github.com/moxie0/chapcrack Suggestion is to migrate to OpenVPN for a more secure VPN setup. Also if your bored read some of his excellent stories

What is a hacker?

Looking for a localhost cacheing nameserver?

Back in the day I would use dnscache and sometimes even bind for local network or localhost cacheing recursive DNS. I was hoping there was a newer, better, faster and easier to setup / maintain solution in 2012....

I found unbound. http://unbound.net/

If you have a server that does tons of DNS lookups (think SIEM), then this is a must.

Debian/Ubuntu:
apt-get install unbound

Redhat/Centos:
yum install unbound

It's secure and listens only on 127.0.0.1 by default. How cool is that?

Lastly don't forget to update resolv.conf...

echo "nameserver 127.0.0.1" > /etc/resolv.conf

thisimageilove

ArcOSI 30 released

Added new sources, some parsing fixes and the feature to specify a custom port via command line. Currently only the python code is release but will compile the windows binary later today.

Download @ code.google.com/p/arcosi

-Greg

A little about MS12-020

Great history on the vulnerability by the original Italian researcher: http://aluigi.org/adv/ms12-020_leak.txt
He sold the bug to ZDI with a DoS POC, they reported to MS and the bug is suspected to have leaked through a MAPP partner to Chinese entity and surfaced as the rdpclient.exe

Small companies: Firewall off all remote access to 3389
Enterprise: Scan and test, deploy signatures, alert SOC and start monitoring campaign during lockdown efforts

Snort signatures (untested):

alert tcp any any -> $HOME_NET 3389 (msg:”Potential MS12-020 RDP DoS attempt – MaximumParatmers”; flow:to_server,established; content:”|03 00|”; depth:2; content:”|7f 65 82 01 94|”; distance:24; within:5; content:”|30 19|”; distance:9; within:2; content:”|30 19|”; distance:25; within:2;content:”|30 1c|”; distance:25; within:2; byte_test:1,=,255,2,relative; reference:cve,2012-0002; classtype:attempted-dos; sid:1000031; rev:1;)

alert tcp any any -> $HOME_NET 3389 (msg:”Potential MS12-020 RDP DoS attempt – MaximumParatmers”; flow:to_server,established; content:”|03 00|”; offset:0; depth:2;content:”|7f 65 82 01 94|”;distance:24;within:5;byte_jump:1,10,relative;byte_jump:1,1,relative;byte_test:1,=,255,4,relative; reference:cve,2012-0002; classtype:attempted-dos; sid:1000026;rev:1;priority:1;)

Wireless fun with your Macbook

Since OSX Snow Leopard there is an Airport wireless API that allows some fun tricks but it takes some minor setup to use it properly...

First make sure you can easily run the new Airport API utility:

sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/sbin/airport

Now you have easy ability to scan and sniff packets:

airport scan



And the sexiest feature is to dump packets in monitor mode:
sudo -s airport sniff 11

Note that you still cannot actively inject and sniff without using a realtek USB wifi card.

To stop the airport utility from sniffing drop it into the background and kill the process ID:

ctrl+z
then
sudo -s killall airport

So what kind of attacks are possible without injection? Well any wireless traffic (non encrypted via WEP/WPA/HTTPS) on the channel your sniffing you can then read with a packet inspection tool like tcpdump which comes by default on your Mac. A pcap will be saved in the /tmp directory, simply read it in with tcpdump to see what fun you captured!

Gregs-MacBook-Air:tmp gregmartin$ ls /tmp |grep air
airportSniffmcg8L2.cap

To print the ASCII content of all HTTP traffic:
tcpdump -s0 -Anr /tmp/airportSniffmcg8L2.cap port 80

or

tcpdump -s0 -Anr /tmp/airportSniffmcg8L2.cap port 80 |grep -i pass



Here we see an Android phone at the Boingo wireless captive portal ready to log in!

Of course you can use any libpcap tool such as Wireshark to analyze the resulting file.

Why you don't steal from a hacker

So during the London riots I return home the next morning to find my flat ransacked and my Macbook Pro laptop stolen!
Police showed up, took a report and dusted for prints, performed typical forensics... One thing they did not expect was that I had installed the amazing open source tracking software from http://preyproject.com

Once I flagged my laptop as missing within Prey, I waited eagerly for the first report to come in. I was concerned he wouldn't be able to get past the login password but he was clever enough to add a new account: Here is how to create a new admin account on a Mac

Almost two weary days had gone by and I'm at dinner on a business trip in Luxembourg and I received an email which nearly knocked me out of my chair with excitement.





Next thing I did was buy a pack of smokes and run back to my hotel room so the games could begin... I cranked up the frequency of reports to one in every five minutes to try to get a screen capture of him using gmail or facebook so I could snag a name or login credentials.

After two hours hours of watching him surf religious revelation videos, shopping for Mercedes A class on autotrader he finally popped onto facebook! This was the treasure trove of information, at this point I had the following:

His Name: Sxxxxx Kxxxx
His School: xxxx School Class of 2009
His address: xxx N End Rd London W14
His IP Address: 90.201.72.xx
His ISP: BSKYB
His wireless AP: SKY378xx
His Facebook Page: https://www.facebook.com/profile.php?id=101952xxx

Of course I had pictures of him from the webcam on my Macbook as well as his Facebook page, now I just had to pass the info on to London Metro police and get to bed at a decent hour as I had to run an all-day meeting the following morning!







The tip of the iceberg, now that all the details were collected, London Metro police could make their move!



And the icing on the cake... justice served. Add me on twitter @gregcmartin lets laugh together!

ArcOSI 2.8 released

Releasing a new and greatly enhanced version of ArcOSI tonight with the following new features:

Config file support
White listing
http and https proxy support
New feeds


Fixed numerous bugs and finally updated the Windows EXE version!

Snag a copy @ http://code.google.com/p/arcosi

Samsung Key Logger Mess

So some brilliant writer for network world "Mohamed Hassan (CISSP)", reported based on his anti-virus tool having a false positive finding "Star Logger" key logger installed on his new Samsung Laptop. So the story quickly spread across the blogosphere including engadget and other high profile blogs then was amplified by twitter.

Apparently the AV he ran only looks for "c:\windows\SL" directory. What! This shows the terrible state of A/V software and how poor the detection signature actually can be. Seriously looking for the presence of a directory is extremely poor...

Will be interesting if Samsung sues anyone in this matter as this has not been positive PR for them. And all you blog slinging CISSP's need to slow your roll and stick to blogging about professional's research and not what your laptop's A/V client back.



Other fun A/V fail stories:
McAfee Kills Windows PC's by the thousands
Symantec Nukes Thousands of Chinese PC's


Sources:
http://www.f-secure.com/weblog/archives/00002133.html

Message from Comodo hacker

This was copied from: http://pastebin.com/74KXCaEZ

Hello

I'm writing this to the world, so you'll know more about me..

At first I want to give some points, so you'll be sure I'm the hacker:

I hacked Comodo from InstantSSL.it, their CEO's e-mail address mfpenco@mfpenco.com
Their Comodo username/password was: user: gtadmin password: [trimmed]
Their DB name was: globaltrust and instantsslcms

GlobalTrust.it had a dll called TrustDLL.dll for handling Comodo requests, they had resellers and their url was:
http://www.globaltrust.it/reseller_admin/

Enough said, huh? Yes, enough said, someone who should know already knows...Am I right Mr. Abdulhayoglu?

Anyway, at first I should mention we have no relation to Iranian Cyber Army, we don't change DNSes, we

just hack and own.

I see Comodo CEO and others wrote that it was a managed attack, it was a planned attack, a group of

cyber criminals did it, etc. etc. etc.

Let me explain:

a) I'm not a group of hacker, I'm single hacker with experience of 1000 hackers, I'm single programmer with

experience of 1000 programmers, I'm single planner/project manager with experience of 1000 project

managers, so you are right, it's managed by a group of hackers, but it was only I with experience of 1000

hackers.

b) It was not really a managed hack. At first I decided to hack RSA algorithm, I did too much

investigation on SSL protocol, tried to find an algorithm for factoring integer, analyzed existing algorithms, for now I was not

able to do so, at least not yet, but I know it's not impossible and I'll prove it, anyway... I saw

that there is easier ways of doing it, like hacking a CA. I was looking to hack some CAs like Thawthe,

Verisign, Comodo, etc. I found some small vulnerabilities in their servers, but it wasn't enough to

gain access to server and sign my CSRs. During my search about InstantSSL of Comodo which signs CSRs immediately I found

InstantSSL.it which was doing it's job under control of Comodo.

After a little try, I analyzed their web server and easily (easy for me, so hard for others) I got FULL access on the server, after a little investigation on their

server, I found out that TrustDll.dll takes care of signing. It was coded in C# (ASP.NET).

I decompiled the DLL and I found username/password of their GeoTrust and Comodo reseller account.

GeoTrust reseller URL was not working, it was in ADTP.cs. Then I found out their Comodo account works

and Comodo URL is active. I logged into Comodo account and I saw I have right of signing using APIs. I

had no idea of APIs and how it works. I wrote a code for signing my CSRs using POST request to those

APIs, I learned their APIs so FAST and their TrustDLL.DLL was too old and was not working properly, it doesn't send all needed parameters,

it wasn't enough for signing a CSR. As I said, I rewrote the code for !AutoApplySSL and !PickUpSSL
APIs, first API returns OrderID of placed Order and second API returns entire signed

certificate if you pass OrderID from previous call. I learned all these stuff, re-wrote the code and

generated CSR for those sites all in about 10-15 minutes. I wasn't ready for these type of APIs, these

type of CSR generation, API calling, etc. But I did it very very fast.

Anyway, I know you are really shocked about my knowledge, my skill, my speed, my expertise and entire attack.

That's OK, all of it was so easy for me, I did more important things I can't talk about, so if you have to

worry, you can worry... I should mention my age is 21

Let's back to reason of posting this message.

I'm talking to the world, so listen carefully:

When USA and Israel creates Stuxnet, nobody talks about it, nobody blamed, nothing happened at all,

so when I sign certificates nothing should happen, I say that, when I sign certificates nothing should

happen. It's a simple deal.

I heard that some stupids tried to ask about it from Iran's ambassador in UN, really? How smartass you are?
Where were you when Stuxnet created by Israel and USA with millions of dollar budget, with access to SCADA systems and Nuclear softwares? Why no one asked a question from Israel and USA ambassador to UN?
So you can't ask about SSL situtation from my ambassador, I answer your question about situtation: "Ask about Stuxnet from USA and Israel", this is your answer, so don't waste my Iran's ambassador's worthy time.

When USA and Isrel can read my emails in Yahoo, Hotmail, Skype, Gmail, etc. without any simple

little problem, when they can spy using Echelon, I can do anything I can. It's a simple rule. You do,

I do, that's all. You stop, I don't stop. It's a rule, rule #1 (My Rules as I rule to internet, you should know it

already...)

Rule#2: So why all the world worried, internet shocked and all writers write about it, but nobody

writes about Stuxnet anymore? Nobody writes about HAARP, nobody writes about Echelon... So nobody

should write about SSL certificates.

Rule#3: Anyone inside Iran with problems, from fake green movement to all MKO members and two faced

terrorists, should afraid of me personally. I won't let anyone inside Iran, harm people of Iran, harm

my country's Nuclear Scientists, harm my Leader (which nobody can), harm my President, as I live, you

won't be able to do so. as I live, you don't have privacy in internet, you don't have security in

digital world, just wait and see...By the way, you already have seen it or you are blind, is there any larger target than a CA in internet?

Rule#4: Comodo and other CAs in the world: Never think you are safe, never think you can rule the

internet, ruling the world with a 256 digit number which nobody can find it's 2 prime factors (you think so), I'll show

you how someone in my age can rule the digital world, how your assumptions are wrong, you already understood it, huh?

Rule#5: To microsoft, mozilla and chrome who updated their softwares as soon as instructions came from

CIA. You are my targets too. Why Stuxnet's Printer vulnerability patched after 2 years? Because it was

needed in Stuxnet? So you'll learn sometimes you have to close your eyes on some stuff in internet,

you'll learn... You'll understand... I'll bring equality in internet. My orders will equal to CIA orders,

lol ;)

Rule#6: I'm a GHOST

Rule#7: I'm unstoppable, so afraid if you should afraid, worry if you should worry.

My message to people who have problem with Islamic Republic of Iran, SSL and RSA certificates are broken, I did it one time, make sure I'll do it again, but this time nobody will notice it.
I see some people suggests using VPNs, some people suggests TOR, some other suggests UltraSurf, etc. Are you sure you are safe using those? RSA 2048 was not able to resist in front of me, do you think UltraSurf can?

If you was doing a dirty business in internet inside Iran, I suggest you to quit your job, listen to sound of most of people of Iran, otherwise you'll be in a big trouble, also you can leave digital world
and return to using abacus.

A message in Persian: Janam Fadaye Rahbar


[UPDATE 1]: Also check this: http://pastebin.com/DBDqm6Km

Webinar: Integrating Open Source Intelligence with ArcOSI

Join me today for a webinar of how integrating Open Source Intelligence within ArcSight ESM using ArcOSI.

If you would like to register: http://www.arcsight.com/webinars/watch/integrating-open-source-intelligence-osint/

Topics we will cover:

What is OSINT and how has it become a powerful SIEM use cases for 2011. The following webinar will cover:
• Why A/V does not cut it anymore
• How to detect the new threat: APT, client-side, malware
• What OSINT is
• An introduction to ArcSight Open Source Intelligence (ArcOSI)

ArcOSI 2.1 Released!

Just uploaded the newest version of ArcOSI Open Source Intelligence Utility for use with ArcSight ESM. I've added several new malware domain feeds and improved the code to handle connection errors, etc. I'm making time for this project now and will soon add support very soon for proxy and proxy-auth as this has been requested numerous times!

Thanks to everyone who has tested and just a reminder feel free to reach out directly if you have any issues, feedback or requests.

http://code.google.com/p/arcosi

-Greg

Look out

got Metasploit running on my iphone4 after a few tweaks..

Security B-Sides DFW Nov 6th

The very first B-Sides security conference in Dallas, TX is coming up Nov 6th and I will present early morning on mass exploitation using Metasploit a cucumber and an iPhone.

Please bring your friends and co-workers who are interested in Security as these conferences are completely free and typically loads of fun.

Hope to see you there, cheers.


http://www.securitybsides.org/BSidesDFW

Amun Honeypot with ArcSight CEF support

Playing around this weekend and created a CEF syslog output plugin for Amun honeypot, here is the sample output (dst IP scrubbed):

Sep 6 19:44:30 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=222.186.27.82,dst=76.78.17.74,msg=DCOM Vulnerability,dpt=135,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None
Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None

Now need to feed these into an ESM active list...

To be nice, I packaged up the CEF enabled Amun honeypot into a 200MB Ubuntu VM so you can try this out in your ArcSight lab or production. Follow the easy directions to re-IP and setup syslog out. You will be nabbing attackers and the latest malware in no time!

***update: I Googled the attacker IP's in the post above and found no mention of them in any open malicious IP lists, this highlights the effectiveness of using honeypots to gather the absolute latest intelligence on hosts attacking your perimeter (and others).

***update 2: VM boot issue fixed, sorry about that!