Tools of the Trade, Part III

A few more "must-have" tools to keep on hand:

• 3D Traceroute (http://www.d3tr.com). Portable! Gotta have a good traceroute program, and 3D Traceroute is about as good as it gets.
  
• Sam Spade (http://www.samspade.org). Fantastic tool for IP lookups, DNS info, etc., etc. The site appears to be unavailable at the moment, but the Sam Spade tool is available for download at lots of sites around the net.
• Wireshark (http://www.wireshark.org). A quality packet sniffer is just something you must have. You can't even hope to dig into what is going on throughout your network if you don't have a good packet sniffer. Formerly known as Ethereal, Wireshark is the cream of the crop.
• Cygwin (http://www.cygwin.com). Cygwin provides a Linux-like environment in Windows. If you can afford the disk space, it is probably worth doing a full install. Tons of tools that we know and love from Linux now available in Windows. For me, it makes life much less stressful.
  

Nifty tool

Like any self-respecting techno-geek, I'm always on the lookout for new tools. I love to comb through SourceForge or Freshmeat, looking for new and interesting software. Ever since VMware released VMware Server as a free product earlier this year, I've spent a lot of time messing with it, trying new and interesting ways to use it, etc. I've been doing some really interesting stuff with it recently (I'll make an extensive post on this at some point in the near future), and have downloaded and experimented with dozens of the free Virtual Appliances. Just when I thought that VMware couldn't be any cooler, I found this: VMware Converter. It essentially takes an image of a running Windows machine and creates a virtual machine. They claim that you can image a hot machine without actually disturbing the machine being imaged. And it can all be done over Ethernet. And (this is arguably the best part), it is free. It can also create VMs from older VMware formats, Symantec Bacukp Exec System Recovery, and Microsoft Virtual Server/Virtual PC. I haven't had a chance to extensively test this yet, but assuming it lives up to their claims, this has so much potential, I don't even know where to being.

Kudos to the VMware folks.

Tools of the Trade, Part II

Since I just posted Part I yesterday, I'll keep this one brief. I just found a great new tool (well....new to me, anyway), so I thought I'd make a quick update.

• Keyfinder (http://www.magicaljellybean.com/). Portable! Need to find out the key that was used to register Windows or Office on a particular machine? Keyfinder is the tool to use.
• AbiWord (http://www.abisource.com). Portable! A great, cross-platform simple word processor. If you need something more heavy duty, you'll want to use Open Office, but if you just need a relatively simple, solid word processor, look no further.
  

Tools of the Trade, Part I

Things have been a little slow of late, so I thought I'd start a recurring feature: Tools of the Trade. I'll go over the tools that I use and things that I like to keep on hand. I'm a big fan of squirreling things away for later use. The trick is, of course, to remember what you've squirreled away so you can use it when the time comes. Some of these tools are portable (i.e. you can run them from a USB drive), and of course, some aren't. I'll try to identify which tools are portable, because if you're at all like me, you like to keep a nice supply of heavy-duty tools at the ready. In my experience, it pays to be prepared. During the course of this series, I'll also mention non-software tools and items that you'll want to keep around. Some are obvious (a screwdriver, for example) and some aren't (nail polish, for example......I'll go over that one another time). Also, these tools are in no particular order. That being said, let's dive in.

• Nmap (http://insecure.org). This is one of those tools that I simply can't function without. If you aren't familiar with nmap, learn it. If you're already familiar with it, read the docs again. Seriously. I make it a point to re-read the docs fairly regularly, partly because it changes a little bit from version to version, but also because it does so many things, I can't remember them all.
• Perl (http://www.perl.com). Ok, technically it doesn't have to be perl. Really any serious scripting language will do. (Ruby, Python, etc., etc.) The point is that you'll want to be very proficient in at least one cross-platform scripting language. It has saved my bacon more times than I can count.
• Notepad++ (http://notepad-plus.sourceforge.net). Portable! A very robust text editor. If you're looking for a fancy word processor, you're looking in the wrong place. Notepad++ is a great editor that supports having multiple documents open simultaneously (I curse you, Windows Notepad) and it knows how to handle both Windows and *NIX line endings (again, I curse you, Windows Notepad). It supports syntax highlighting for lots of languages and is easily enhanced by way of plugins.
  
• Subversion (http://subversion.tigris.org). Version control. Why version control, you ask? Personally, I hate ever having to do the same work twice, so any time I have a config file or script or something that I've put some effort into, it goes under version control. That way, if I manage to fubar the file (any SysAdmin or programmer who tells you they've never done that is lying), I can retrieve any previous version with no effort.
• WinMerge (http://www.winmerge.org). Portable! Have two text files that you want to compare for differences? WinMerge is the tool for you. In my opinion, the best Windows-based comparison program.

If you have any tools that you think should be added to the list, email me at sifukurt AT yahoo DOT com.

Argus + GraphViz = Very Cool

Sometimes, it is really handy to be able to get a bird's eye view of your network traffic. I've used (and continue to use) ntop and I love it. It provides great reporting, but sometimes the bird's eye view is necessary. That's where Argus and GraphViz come into play. Here is the description of Argus from the website:

Argus is a fixed-model Real Time Flow Monitor designed to track and report on the status and performance of all network transactions seen in a data network traffic stream. Argus provides a common data format for reporting flow metrics such as connectivity, capacity, demand, loss, delay, and jitter on a per transaction basis. The record format that Argus uses is flexible and extensible, supporting generic flow identifiers and metrics, as well as application/protocol specific information.

The data that it collects on your network traffic (and it can monitor multiple interfaces simultaneously) is impressive. Argus runs as a daemon process and then you can use the client tools to extract the data from the Argus log. You can either dump the entire log or you can use filter the results for a specifc time period, or a specific host, or for a specific type of traffic. This data, then, you can feed to GraphViz to generate your graphs. The image below is generated using a Perl script that I wrote (using the Perl's GraphViz module, available at any CPAN mirror) using Argus data over a 1 hour period.


I color coded the arrows (or "edges" in GraphViz terms). The blue edges are TCP traffic, red is UDP, green is ICMP, and magenta is ARP. For TCP and UDP traffic, I've labeled the edges with the destination port. The only potential downside is that the resulting image can be a little large. Since Argus tracks all of your network traffic, this could be an invaluable tool in the face of some sort of security incident or virus outbreak.

OSSEC Host-based Intrusion Detection

I've used a lot of different file integrity monitoring programs (Samhain, Osiris, and Tripwire just to name a few), and I've messed with a number of different programs for log parsing and event correlation. Then I found OSSEC, which takes all of these things to an entirely new level. Now instead of having to manage multiple different softare packages, I can do it in one. But that's not the coolest thing. OSSEC will allow you to monitor syslog and Windows event logs as well as Apache, IIS, Snort, and numerous other logs from a single location, and it has a very robust set of rules to do event correlation. If you are so inclined, you can even take advantage of the Active Response option and have OSSEC disable accounts, drop in firewall rules, etc., etc. Plus it does file integrity monitoring on top of it all.

The server must be installed on a Linux or UNIX box, but the agent installs on just about anything, including the ubiquitous Windows platform. The agents can be configured to encrypt all of their communication with the server, or for systems that you can't install the agent (networking gear, for example), you can configure syslog on these devices to forward their syslog entries to the OSSEC server. OSSEC then seemlessly integrates all of these and creates a single, cohesive alerts file as well as breaking down alerts into daily files for easy review. Overall, very impressive. My only complaint is the reporting. The alerts file is fairly straight forward, but it is a flat text file. OSSEC comes with a few contrib scripts that will generate some text reports for you, but again, just flat text files. Ideally, I'd like to see a way to generate HTML reports (both summary and detailed reports) that are much better for sending to management and/or those who are less technically inclined. I suspect I'll probably end up writing such a tool myself as I have been unable to find one.

At any rate, OSSEC is very powerful and very cool. It does a lot of stuff very effectively, very thoroughly, and relatively easily. Check it out.

Link

Top 100 Security Tools

Not exactly the cutting edge of new information, but I was just combing through this list again today so I thought I'd mention it here. If you haven't already, you really owe it to yourself to check out the Top 100 Security Tools. Great list of tools and well worth your time.