Fun with Symantec Endpoint Protection Local Quarantine Files

I've spent some time lately tearing apart the SEP Local Quarantine files, luckily they seem to be much less complicated than the SEP Central Quarantine files, but they seem to use the same basics in terms of structures used to store data and indicate field sizes. The big problem is that once you lift VBN files from the original device, Symantec's QExtract tool is basically useless, and there is no way SEP will extract it on another machine.

Many forensic blogs suggest doing XOR to obtain the binary, but in most cases the binaries are also split into 4k chunks with data structures starting with 0x09 followed by 4 bytes indicating the size of the chunk. I think Hexacorn blog(1) was the frst to point out the existence of such "chunk separators", but Shane King(2) was the one that figured out that the 4 bytes there stand for the size of the chunk.  Having a file peppered with such chunks might ruin your day if you are going to do anything serious with the extracted file. Since, I didn't want to limit the extraction to just PE binaries, I had to try to figure out some of these structures across a set of samples that I had available.

The other day, I was almost done with the extraction piece, when one of the more anomalous .VBN files turned out to contain two payloads. Luckily, it turned out to be the exactly the same binary as the first one, well at least the size and MD5 did match.

So the code is available on github:
https://github.com/frbapolkosnik/crits_services/blob/seplq_service/SEPLQ_service/SEPLQ.py

And you can either use it in CRITs or just import it into your little script, and save the payload the way you like.

(1) http://www.hexacorn.com/blog/2012/09/21/dexray-decrypting-vbn-files-part-2/
(2) http://dofir.net/post/81425257003/a-study-of-symantecs-vbn-file-format

Lately, I was able to get my hands on a used/refurbished WZR-1750DHP. Amazon marketplace had it in virtually new condition for under $90. 512MB of memory and dual core SoC made me think that it could be worth it. 

The original Buffalo firmware, while nice, was a major PITA straight from the 90s; almost any config change required a reboot. Turns out that Buffalo has WZR-1750DHPD, which essentially is the same thing with a nicely done DD-WRT firmware. It turns out that it's relatively easy to flash the Buffalo-supported DD-WRT firmware onto WZR-1750DHP. 

After loading Buffalo-supported version, the router turns into a far superior device than almost anything I had before. The only con is lack of the external antennas for extended range.

Some thoughts on coding in Python

I've been working on improving my Central Quarantine extractor script lately. One of the snags I hit was a stupid bug in zipfile module in Python 2.x-3.4.

It has to do with archive names not matching between two different places. When such mismatch occurs zipfile simply raises an exception and refuses to extract the files.

This mismatch thing is actually a feature in Zip format that allows the files to be effortlessly renamed without any need to re-pack the various files stored inside the ZIP file.

Since I was making sure that my code runs fine on both Python 2.7.6 and 3.4 the only point of contention was the bastardized zipfile module. The one from 2.7.6 would error out with Python 3.4 and the one from 3.4 would do the same whe running on 2.7.6...  I've added a conditional importing, but I've not tested it with other versions of Python...

After jumping through the hoops to ensure that my code runs properly on Python 3.4, I feel much better now that it also works perfectly well with 2.7.6.

It seems that I'm breaking out of a coding coma lately. I've started fixing stuff in Kludge, and it is fun. The downside is that it is really time consuming, as nothing comes easy when one needs to dig into the details.

CTF write-ups

I hope you'll enjoy the write-ups as much as I've enjoyed solving the challenges.

Crypto 1
Points: 25
Instructions: I read about this once... -- Submit in all lowercase no spaces
Category: Crypto/Stego
File: f3d0c9e33f9479a5109445d6c00f12559ea21e75

Solution:

$ file ./f3d0c9e33f9479a5109445d6c00f12559ea21e75.txt
./f3d0c9e33f9479a5109445d6c00f12559ea21e75.txt: gzip compressed data, from Unix, last modified: Fri Mar 23 13:06:29 2012

$ cat ./f3d0c9e33f9479a5109445d6c00f12559ea21e75.txt | tar -tzvf -
-rw-r--r-- jdm/jdm          76 2012-03-23 13:04 86d13ae80f15bda5818552afb669f86bb02af9a0

$ cat ./f3d0c9e33f9479a5109445d6c00f12559ea21e75.txt | tar -zxvf -

$ cat 86d13ae80f15bda5818552afb669f86bb02af9a0
DOHA JPWOLY'Z HSALYUHAL UHTL OPKLZ AOL MHJA AOHA PA PUCVSCLZ WSHFPUN JHYKZ?

Running it through Caesar cipher with offset of 7 it turns it into the following question:
WHAT CIPHER'S ALTERNATE NAME HIDES THE FACT THAT IT INVOLVES PLAYING CARDS?

Quick googling session reveals the answer.

Flag: pontifex

Crypto 2
Points: 75
Instructions: We got the password hashes from a system but don't know what to do with them. -- Crack the passwords and concatenate them alphabetically for the key. Submit in all uppercase, no spaces.
Category: Crypto/Stego
File: 2d2cda7a3f0b8f0b292c646f94bf9836073e94db

Solution:

$ file ./2d2cda7a3f0b8f0b292c646f94bf9836073e94db.txt
./2d2cda7a3f0b8f0b292c646f94bf9836073e94db.txt: gzip compressed data, from Unix, last modified: Sat May  5 17:07:27 2012

$ cat 2d2cda7a3f0b8f0b292c646f94bf9836073e94db.txt | tar -zxvf -
10896c1cb3d61b1c2d65690dc7c0d05e

$ file 10896c1cb3d61b1c2d65690dc7c0d05e
10896c1cb3d61b1c2d65690dc7c0d05e: ASCII text


$ cat 10896c1cb3d61b1c2d65690dc7c0d05e
Derp McDerp:1005:E94FB3E8775E0FE98B0EA5A7DF135B03:8EECDD4B8B43677BB162A15DBCB2C231:::
TehSuperUser:1006:AA1AB12D9BE8C0D126F8092A33DAAF05:76D202B312C8523D37FCDB4CD8288242:::
AnotherUser:1007:6F87CD328120CC55FF17365FAF1FFE89:B3EC3E03E2A202CBD54FD104B8504FEF:::
rockstar:1008:59FA69C37A475354FF7447F7A53FE0E0:2EAAE8097EDA4BE66FABB52A3EFDDB8E:::

Using invaluable http://www.objectif-securite.ch/en/products.php we can crack the lm hashes in seconds:

Hash: E94FB3E8775E0FE98B0EA5A7DF135B03
Password: DERPDERP
Hash: AA1AB12D9BE8C0D126F8092A33DAAF05
Password: SUPERPASS
Hash: 6F87CD328120CC55FF17365FAF1FFE89
Password: ABCD1234
Hash: 59FA69C37A475354FF7447F7A53FE0E0
Password: ZERGSTORM45

Flag: ABCD1234DERPDERPSUPERPASSZERGSTORM45

Crypto 3

Points: 175
Instructions: Crack the cipher, get the key ------------ The key to the cipher is the answer. Submit the key in all lower case, no spaces
Category: Crypto/Stego
File: 17ca6426ac08cef3641a5695667c921af89edb82

Solution:
$ file ./17ca6426ac08cef3641a5695667c921af89edb82./17ca6426ac08cef3641a5695667c921af89edb82: BinHex binary text, version 4.0

$ cat 17ca6426ac08cef3641a5695667c921af89edb82 | hexbin -l
This file is in "hqx" format.
name="809f9232ac55c50317c93753b6099a1d", type=    , author=    , 1 excess bytes ignored
data=2442, rsrc=0

$ hexbin -s 17ca6426ac08cef3641a5695667c921af89edb82 -u

$ cat 809f9232ac55c50317c93753b6099a1d.text | xxd -r -p
knviuatuwfrztrrcideixrgakbwalvisginwrpxppvvqqciojzlmphyqioeeipkmpoihwkepqfnctomjmlhwymglixgtzjwvhaestrfvaaihpmiccevqcnazbudjtmfbieczhlqatuedmjdwtixueedusiuwjuhfnguekvhzyudfypaaeyslbvqkcpjtqznhqstmhaswpnlvhqclkcatdwrqclwkprvtkvtzwgljefkatjxvlfspkbpneznfitqvtuxziyjvqeioyedfcxjmsvqvwswlgbtzwzeslwjxdvpzkrwlgzdvjffitwowjalttrdzglehmelfdwngpkqzbglrizdvxceudxjiidlzxchhczdbruhjdxqvvbiycajvandyxyeulwvmdmfccrwshmtkxyedccubpsjfzrvxuwuomjezpwhwglwkagkevxglwjeelkcqczxkprjvgmcksdeqciuatkeeljhvgpxuhvrfoeplhwvviqjvqexukuoxyjktaprxbuhypqklvjepqxclddrzvgrxjmlhmkiorlcxalwjaheytjhvjkhfnmvgioekenvxjmbpruogeiuaxlvraussqthheedipacaglqvuohvkvvhrrndtipbhasignnmpoesetiorgqqczseipkiuaqveidezydtxukkprdqqccaekebnluyjhvvmksspmcamrlelvmvtzwwmyompngvqvvfccuqslejxuhvgwuzmegjykdtpjogzrvwwztvrkhfpbvmckiukebwviauiivfdshbwlyeqihvumdmhrtbsijisuirzybfgkdtirnehlgvwlaraarxjqcngfmqciuatkekbuhlgigaswamwxjiikeisgkitmrhqvaqzmpbloiimgkifigrgfumofgvdtsimnqhuwblxyiorxqztalvshdrixgvkiandtwzilhwzbpxczcpwyeenpqcsjejmffsparpslsopwulxcmumqommmqleuspqqgzrbvpiefmpopismebyiplalwjjrdgjbwlgflpcshbwlhrzxvmndtygcovowjqhcmjqbqacahwlvrjnenihalfctkeuqcnpvrfempiaprvlgkikvclvjusqeemdmextbeivppagfnulmpmshpcbulriaxmeclusmpohjsltqeiewjuxvd

Plugging that into http://smurfoncrack.com/pygenere/pygenere.php and expanding the length of codewords to try to 20 yelds just slightly misspelled answer"INDECIPHERLBLECIPHER"

With the proper key it decodes to:
casessensoryinputwarpedwiththeirvelocityhismouthfilledwithanachingtasteofbluehiseyeswereeggsofunstablecrystalvibratingwithafrequencywhosenamewasrainandthesoundoftrainssuddenlysproutingahummingforestofhairfineglassspinesthespinessplitbisectedsplitagainexponentialgrowthunderthedomeofthetessierashpoolicetheroofofhismouthcleavedpainlesslyadmittingrootletsthatwhippedaroundhistonguehungryforthetasteofbluetofeedthecrystalforestsofhiseyesforeststhatpressedagainstthegreendomepressedandwerehinderedandspreadgrowingdownfillingtheuniverseoftadownintothewaitinghaplesssuburbsofthecitythatwasthemindoftessierashpoolsaandhewasrememberinganancientstoryakingplacingcoinsonachessboarddoublingtheamountateachsquareexponentialdarknessfellinfromeverysideasphereofsingingblackpressureontheextendedcrystalnervesoftheuniverseofdatahehadnearlybecomeandwhenhewasnothingcompressedattheheartofallthatdarktherecameapointwherethedarkcouldbenomoreandsomethingtorethekuangprogramspurtedfromtarnishedcloudcasesconsciousnessdividedlikebeadsofmercuryarcingaboveanendlessbeachthecolorofthedarksilvercloudshisvisionwassphericalasthoughasingleretinalinedtheinnersurfaceofaglobethatcontainedallthingsifallthingscouldbecounted

Flag: indecipherablecipher

Crypto 4
Points: 300
Instructions: Decrypt for the key ---------------------------- answer format is strupr(full unencrypted string)
Category: Crypto/Stego
File: 13930c973e7169c84c9c88211cbc5e54f32153cb

Solution:

A TIFF file presents the following ciphertext: RUCIQPQMMRNZEVONDT

running foremost against it reveals an jpg image with the following enigma key:
B,I,IV,III,14,18,20,AH,CK

One can decode using the enigma machinesimulator: http://startpad.googlecode.com/hg/labs/js/enigma/enigma-sim.html , then
after plugging the ciphertext into the enigma machine with the following settings:

Rotors: I-IV-III
Rotor Start: AAA
Rings: NRT
Plugboard: AH CK

the key is revealed.

Flag: THEKEYISALANTURING

Forensics 1

Points: 50

Instructions: Eye Heart FS! -- Submit they key as instructed

Category: Forensics

File: dc7f2a9830f5e8dad51c6f6dbc6edc8b3a7bc22f

hints.txt is inside the provided tar.gz file, after untaring/gunzipping it lists the following clue:

Answer these three questions and concatenate the answers for the key.

How large (in bytes) would a DOS3.3 "nibbled" image be?

What is the minimum journal size (in blocks) for a reiserfs disk?

What partition type (in hex) would a FAT16B partition have?

Quick google search for these items reveals that the mac specific DOS3.3 image was 232960 in length, ReiserFS' minimum journal size is 513 blocks. Finally, the hex code for Big FAT16 is 0x06

Flag: 2329605130x06

Forensics 2

Points: 99

Instructions: Ugh -- this is exactly why interns shouldn't do forensics. What a newb. -- Submit the key as found.

Category: Forensics

File: 94996036b13962bf8baaa324d998ed9476f620e3

$ file 94996036b13962bf8baaa324d998ed9476f620e3 

94996036b13962bf8baaa324d998ed9476f620e3: bzip2 compressed data, block size = 900k

$ cat 94996036b13962bf8baaa324d998ed9476f620e3 | tar xjvf -

dd_rtfm

$ file dd_rtfm 

dd_rtfm: data

When revieved through the "hexdump -C" or "strings" you can clearly see that the strings don't read quite right, it seems that the endianness is flipped.

to reverse that and get the key in a single liner we can do:

$ dd if=dd_rtfm conv=swab | strings | grep n00b

Flag: Silly n00b -- arguments are for l337!

Forensics 3

Points: 200

Instructions: You know that guy? The one who always hides his screen when you walk by? You're never quite sure what he's up to? Yeah -- you know him. Well we need to know what he's up to. We're moving his desk to the basement, and you remember what happened last time... We managed to get a memory dump and a file we think he was working with from his system, but we don't know what to do with it. -- Submit the key in ALL CAPS

Category: Forensics

File: 5748b64df3c691d1766e793e8dcf23b05383899d

Packet 1

Points: 25

Instructions: Who would cross the Bridge of Death must answer me these questions three, ere the other side he see. What should the Checksum always be for IPXWAN___ How many reserved bits in the TCP header, and what must it always be___ The code for a Point to Point Protocol Discard Request --------------------- Find the answer to these three questions, concat them for the first half of the answer, append with the color it creates (answers123Color)

Category: Packet

File: (none)

Flag: FF6011Orange

Packet 2

Points: 150

Instructions: What an odd way to send a secret message... ------------------------ answer format is md5(key including all spaces)

Category: Packet

File: 1c1d8c9c1f7cb39c6eb16efea9c0542447c2934d

Binhex decodes a pcap file, following the udp session reveals a sound file that transcribes into:
4d 61 63 68 30 4d 34 6e 20 73 41 89 35 20 3030 6f 48 20 59 33 61 68

which in ascii is: "Mach0M4n sAy5 00oH Y3ah"

The flag is md5 of that string (sans quotes).

Flag: c37947e01c8b338081e76a62ca5da88b

Potpourri 1

Points: 75

Instructions: LRN2 READ! -- Submit in all uppercase no spaces.

Category: Potpourri

File: b002d66a78882969f9d8eee555582509f01df944

Binhex decodes a zip file with an image of message written in Braile, which decodes into a question along the lines of  (the decode might be not exact):

"On November 2 1988 what worm was unleashed?"

Flag: MORRISWORM

Potpourri 2

Points: 125

Instructions: The PDF spec is so error tolerant, even the monkey from the infinite monkey theorem couldn't reproduce it! -- Submit the key as found

Category: Potpourri

File: cc7931560f8fc6d8df26f058afc6b8b03e31ae60

After decompressing a pdf with hamlet is revealed. One could search for the original pdf and diff it. The result of diff would indicate an object 368 being added. I've used my custom version of pdf-parser to dump the media files for me. Object 368 is an jpg image containing the key.

Flag: Z0MG you found 4n0th3r k3y!1!one1

Potpourri 3

Plugging the following into the sudoku solver

.7....69.35.7.........41..5....9.7..6..2..9.8.2.4..........4..7..91...2.5....7.8.

into http://www.sudokuwiki.org/sudoku.htm and clicking on "Solution Count" button gives the flag.

Flag: 471852693358769214296341875813596742647213958925478361162984537789135426534627189

Reversing 1

Points: 25

Instructions: Do you believe in magic? What tasty hex number was originally used to mark newly allocated (freed) memory prior to initialization? -- Submit the key as hex, all uppercase (so 0x[UPPERCASE])

Category: Reversing

File: (none)

Flag: 0xDEADBEEF

Reversing 3

Points: 175

Instructions: Blast from the not-so-distant past... in more ways than one. -- Submit the key as found

Category: Reversing

File: ad32c019ae35816ce196db2042d572e41875cd44

Another pdf challenge, the pdf is wrapped in a C64 disk image among other things. The pdf contains a javascript, which won't run unless it detects AdobeReader version 5, and then it pops up a question for the code. It turns out that there is a common multiplier to the algorithm used, once one extracts the code and runs it in a debugger or modifies the pdf. It's pretty easy to derive the multiplier by plugging 1, then 10. The result has to be rounded up with no decimal places. 

Flag: 996638400

Some thoughts about NAS devices

Today I'm going to share some thoughts about various NAS devices I've considered for my home environment.

Number one objective is to have a power efficient device, since these things will most of the time sit there and contribute to your monthly electricity bill.

Couple of years ago I've decided to try Thecus N2100, it seemed nice and hackable and it had two GigE ports, but it had a really IO subsystem making it really slow. I was hoping that the bugs could be worked out, but it didn't happen. So, I've popped two WD green drives (1TB), replaced the internal fan with a quieter one, upgraded the memory to 512MB. The transfers are still really slow and the included version of BusyBox is pretty outdated and buggy. If you have filenames with some bad characters in them, or lots of files in the folders some services such as the Mediabolic media server would just crash. It's real legacy hardware now, the CPU on the unit is plagued with some serious bugs and the original kernel seems to be much better than most other available. I've tried different things with it, but I wanted to keep it fairly stock, so adding the extra modules was the way to go. But eventually I got tired of it, and I've decided to retire it, after running it for a few months 24/7. I needed a device with an ftp server, and enough storage to be able to serve some content through DLNA and DAAP (iTunes-like).

One of the days I was looking for Raspberry Pi (still waiting for my order to arrive) specs and I've noticed a pink Pogoplug on sale for $25. Once I found out that it has a SATA port on the inside, I thought that I could use this thing to replace functionality of my other NAS. In a way this would be a downgrade, from two SATA ports to one, but on the other hand 4 USB ports and  less power hungry device with support for optware seems like a perfect match. Not to mention the initial investment part. So, I've chopped off a little sliver of the back cover to run the 90-degrees-angled SATA to e-sata cable, and it's almost ready. All I need now is a decent e-SATA drive dock or an enclosure and it's ready.

One of the big selling points for me was the 5GB of free cloud storage, that shows up up in the management screen as another drive. I'm trying to keep my ISP costs down, so my link is seriously limited in upstream bandwidth, so I was able to use that to host my pictures for my family members.

Another great feature is the built-in DLNA media server. It's been pretty stable, one of short comings was that it wouldn't index my small 80GB drive for the movies, but then luckily I was able to find the 5GB of the ShmooCon 2012 videos by browsing through folders.

It goes without saying that the thing allows one to turn on the built in ssh server, and mount optware from the USB drive

My final solution to the problem became much simpler than ones listed the above, and it entails a relatively beefy broadband router with an USB port, a  few tiny 32GB flash drives, an USB hub, and OpenWRT. It is still having some little issues that I'll have to take time to iron out, but at least it serves a multitude of tasks. So, I have there an VPN server, an ftp server, a samba share, DLNA media server, DAAP (iTunes compatible) server, and I couldn't be happier with it. It allows me to use Wake-on-LAN to turn on my beefier media server based on HP N40L microserver and OpenMediaVault when needed, where I have much more space for my git repositories, family albums, as well as vacation pictures and videos.

HexEd code on github.com

I've uploaded the latest version of the HexEd code to github. You can grab it at https://github.com/apolkosnik/HexEd

Goodies from Santa

With less than a week until Christmas it is the time to get a nice Christmas tree this year. With most of the school related work finished (72 hours without sleep, and taking two days off from work), I feel that I should share whatever I've produced during this crazy race with time this quarter. Shortly, I'll set up a github repository for my gifts to the public, but for now you can grab them off dev-host.org (http://dev-host.org/users/adamp/):

- HexEd - a hex editor that made me loose all that sleep. Incidentally, I intend on developing it further. (Updated with a bit cleaned up version).
- A modified version of Didier Stevens' pdf-parser that extracts media files and more
- Android MIUI ROMs for T-mobile G2x ported over from LG O2x

The things that the defenders tend to forget

This is by no means a complete list nor anything that will fit into every-one's situation. I'm jotting down some things that I ran across in my experience as a security professional that, I think, would make things easier to handle scenarios when the proverbial "shit hits the fan". I merely started scratching the surface of this, and I intend to update it on a semi-regular basis. If you have something to add, please do post it in the comments.

First things first
The first and the foremost thing is to know what you must protect on your network.
Once you know, you can start gathering the threat data that is relevant to your business. Remember, you are protecting the business, so they have to talk to the business and make sure that you are not creating an unworkable environment for them. After all, they have to generate the profit that allows you to function.

Policies
Everyone has to adhere to them. The trick is to be able to use them to your advantage. Yet, keep in mind that the auditors will rip you apart for not following them to the letter. Remember what was said in the previous paragraph about the business... you cannot forget to let your users breathe.

Patience and attention to detail
Securing an environment is a continuous process, it takes time, it requires adjustments, it requires tons of dedication and attention to detail.

Compartmentalization
Design the perimeters with the knowledge of the activities and processes involved. Knowing the types of activities gives you a tactical advantage. Find commonalities, and use that to design what kind of defenses are needed for these areas. Not all areas require equal protection, and equal supervision, often times the business areas will give you push-backs because the protections might be too aggressive. Don't segment too much, it is like with the databases that were normalized too much, the key is finding the right balance.

Completeness and preparing for the worst case scenario
Once you are done with the segmentation or compartmentalization, make sure that you got all your OSI layers covered and then some by appropriate monitoring, blocking and the methods of mitigation. Ensure that the defenses that you've put in place are granular, and allow you to quickly and efficiently isolate compromised devices or applications. Make sure that you have accounted for all the ingress and egress points in your environment, and you have your taps there. Enumerate your weak spots, and determine how you can provide additional protection in those areas. Make sure that you know your security devices inside-out, it might be able to give you an edge against the intruders.

Real time software/hardware inventory, internal software repository, and hashes
You need to have a detailed knowledge of all the software in your environment. Even more, you need to know all the version and revision data. This is essential, yet mundane task. There is a hope if you can have a group to host an internal repository of all the software used, and then you can gather all the hashes of the known good files in your environment. This in turn can allow you for ad-hoc integrity testing against known good.

Changes
Configuration changes are best presented in diff output form, when it comes to teal-colored networking equipment and other devices that support textual configurations. Changes should happen inside of change management windows, unless you can make your SIEM has a ticketing system that can correlate the requested devices and requested change windows. Keep in mind that verifying what changed is also important.

Crash dumps
Programs crash for various reasons, knowing what crashed, where, when, and why will prove beneficial on that Friday afternoon, when you get hit by semi-pros.

Trust but verify
People, people tend to get sloppy. Whatever your process, make sure that you’ve done your due-diligence. Automating testing and verification goes a long way, and reduces the time wasted, and people annoyed. If you can streamline some process, it is usually worth it. make sure you QA everything. In many cases, when something goes wrong, people will try to blame it on your devices, agents, software, you name it.

Baselines
Baselining and usage patterns are many of the low-tech techniques you can leverage to search for anomalies. Sometimes you can as far as using the statistical methods such as an empirical rule to define what is normal and what is not. These methods can give you the pieces that don't fit the puzzle for free. On top, you'd be able to find design problems or bottlenecks in your environment. Your engineers will thank you later.

Hardening
Make sure that you harden the devices before they go into production or your hair will go grey early. It’s good to have some notification measures built in, e.g. when admin account is used send a notification to your system. It usually requires lots of hand holding, and testing to get it right. The goal is to closely work with the admins, to make sure that the solution actually works, and has minimal performance impact. With the hardening step, it is absolutely essential to set up all your devices to perform NTP synchronization (with keys), or else you’ll have problems with temporal chaos, that will kill your SIEM’s database.

IP pool affinity and user mobility
Investigating devices that often change IPs is hard. With rigorous inventory management, it would be possible to assign IPs based on MAC or sometimes assign them based on userid. The longer leases, the better. Unless you got some kind of smart user tracking system, some nice NAC system, or identity management. Sometimes, you’d be able to harvest access card swipe data, and determine user’s locality. Just another trail of crumbs to use to build some smart rules based on event sequencing.

Login/Logoff times
Obviously, tracking user login/logoff times with addition of the location awareness is another very good place to pick up anomalies; it adds some more meta data to your equations. How could someone be in two places at the same time?

Encrypted traffic
The fact of life is that you got encrypted traffic traversing your perimeter. There are a few things you can sometimes do about it. Sometimes you’d encounter people trying to corkscrew ssh sessions through your authenticated web proxies, or even use web shells. Sometimes, you won’t be able to do much about it. In the worst case knowing source, destination, combined size of the transferred data, and frequency will allow you to draw some conclusions.

Firewalls
There are some extra smart firewalls nowadays, that evolved beyond the industry standards. See who’s the biggest visionary, and why. Why use the tried and true, when you can get so much more for your money. Don't forget to set up something to diff the rules every 10 minutes and open a tracking ticket with the diffs.

WebProxies/Mail gateways
They allow you to AV scan content going in and out if you can use ICAP, you can even set up a Flash/PDF/ZIP/Java vault for collecting, scanning, “defusing”, and out-of-band delivering the defused content to the users. On top of that proxies can be be useful in picking up the species of malware that are not proxy aware or that can’t handle authenticated proxies.

IDS/IPS, HIDS/HIPS
Compare the threat data against the coverage your vendors provide, and try to fill in the gaps with custom signatures. Review the signature stats, remove the noisy and irrelevant signatures, tune the parameters, update to reduce false positives, wash, rinse, and repeat.

Logs
Got to have them all, no matter what they are, then have them analyzed, parsed, categorized, correlated, workflow/use-case sequenced, and one-offs reviewed.

Watching it
So, you spent some substantial part of your budget on this shiny new SIEM. You got your firewalls, netflow data, IDS/IPS devices, multiple AVs, web proxies, NAC, mail gateways, you name it, you have them all. Then you realize that all you get is a headache from data overload, false positives coming from diverse sources, and the database in your SIEM is blowing up from the data overload.

Binding it all together
Great, what do I do about all that data? Bah! You need to organize it to make any sense out of it. Divide and conquer is one of the algorithms that you can use. You also need to use the knowledge of your environment to fine tune these massive amounts of events that are worthless or not applicable.

Enter Metadata
So, you need to use metadata, that is the data about the data you are collecting.
To bring some order to the chaos, you need to establish usage patterns, apply the knowledge you have about the business processes, and other events that can cause the anomalies. You want to have all your data available in a single place. Why? Because, you'd be able to derive some conclusions from it later on, and because you'd need to have to compare it to the threat data you're constantly collecting.

Wishful thinking
Yet I have to witness a SIEM system that allows you to feed it with your threat intelligence data, whether CVEs, Bugtraq IDs, or all sorts of advisories from various vendors, and combine that with all the data derived from your different compartments, IDS/IPS signatures, HIDS signatures, AV updates, patch deployment details, and any other inventory related data. With all that at your disposal you should be able to greatly improve signal to noise ratio in your SIEM. On another level, all this data, allows you to identify any deficiencies in your defenses, as well as produce reports that provide meaningful and measurable metrics to the upper management.

So, what's on the cover of that Verizon data breach report? part 2

Now search for word "key" in the text of the report or if you prefer to do it the hard way find a nice way to predict the key (I've done it the hard way at first).

Now plugging the key and the ciphertext from before into a vigenere decoder gives us the solution:

CONGRATSFIRSTTOCRACKGETSREWARDGOTOWWWVERIZONBUSINESSCOMSLASH
DBIRHUNTTOCLAIMFOREVERYONEELSEHIGHLVLSTATSFORFINSVCSANDRETAIL
FOLLOWPLSSHAREFINSVCSSOURCESEXTERNALNINETEENINTERNALNINEPARTNER
TWOTHREATSMALWAREELEVENHACKINGFIFTEENDECEITFOURMISUSESIXPHYSICAL
TWOERRORONEERRORSIGCONTRIBUTORINFIFTEENTOPTHREEHACKTYPESSQL
INJECTIONSEVENMISCONFIGACLSSEVENDEFAULTCREDSTWOTOPHACKVECTOR
ISWEBAPPTENTOPASSETISONLINEDATATWENTYSIXANDALLRECORDSTOPTHREED
ATATYPESAUTHCREDELEVENPIITENPYMNTCARDEIGHTPYMNTCARDWASNINETY
EIGHTPCTOFRECORDSTOPUUISUNKNOWNCONNECTIONSSEVENDISCOVERYTAKES
WEEKSTOMONTHSRETAILSOURCESEXTERNALTWENTYTHREEINTERNALONE
PARTNEREIGHTTHREATSMALWARETENHACKINGTWENTYONEDECEITTWOMISUSE
TWOPHYSICALZEROERRORZEROERRORSIGCONTRIBUTORINSIXTEENTOPTWO
HACKTYPESSQLINJECTIONSEVENSTOLENCREDSSEVENTOPHACKVECTORIS
REMACCMGTEIGHTTOPASSETISPOSELEVENANDOVERHALFOFRECORDSTOPTWO
DATATYPESPAYCARDTWENTYTHREEPIININEDISCOVERYTAKESMOSTLYMONTHS

So, what's on the cover of that Verizon data breach report? part 1

The Verizon data breach report is here.
On the front side you can see bunch of 1s and 0s... After conversion from binary to ASCII you get the following ciphertext:

EVNTXIGYIMWSNEHEIEFOTXBSCWYHRQMWGUZABVYCBBFREYFBVEDKEVMFRIFNG
FNRBFGVKSFPNBUFZJGCEEEWAKHPXEBTZJCZOWGTBSQGTMIAYDPYDRIRYETKCJR
PYHEPWKUOAEKNVTVZHSMZNTTIVIKMMRYSNUIAKBRKQMSTYCGCCRLRRIIREFGYT
JUBUXHEYSGLEYRVHIYXDEYZCJKVTOSOIXJEHOXEVMWJBNZMTKWZEFOFCNBWNC
UWMYFIUVBKWNPWTYOEYQTIRRYRCMNVFVLRSBNTPWPAOCZPEKHLFCEERRVWV
UYBVJPUVPOAYMIKQQNSWZGHZKDGYLAEGWPKESGCYZFVJDMEPQKSSLNVSVPUV
VRVYERHDTUTYYMQGEVWRMQSZFNPNRJIGGWAJNNJLKOEQHNETRPUQYDFZWCZ
KVJEXLMCKCSIFTCTSUTLDRRMIKQTNINPGRPQQXPTZDPAIOTCEUAZFEWDQLLPZR
HXLXQGSLRJTBLZRIRVISNZIWLMVYADVOHFEVNAKKGORRXSYGXPUMVGBOMRJLC
REFCMRQVXTMIYMJJVHXNBTSZMTJEFKFGKURFLNHXPKCWLEXMIYLGYNNRWAKS
EWTHPKGZKKXGAZELLUTAYCIEKWISHUNDKEKWARGBYZFGKEPKQGZZSRIMFLGKA
RTURAINSNGEEUMEXRVEELZXTISUWVZKOYLTPBHZWEOQWNXNPXPKSSXJHPANCV
FPRYADRLROEWEBQEWHZRGATZDGUCEKLFYHZJNNZIJRGNZRVBOCAUYEZGKPSJX
JIASMVFTDWFXBIDHQZEYKDRTDRIOPPKJRPISSKMCZJFZTBVBJUGEYANJIGJTDCPTZ
DEOGUTLZPEKHTNIHTGGUMVGBOMRJLCREFSWFZOCROHEAU

Ugh...

Looking back at the report, there's strange phrase at the bottom of page 48 "yr puvsser vaqrpuvssenoyr" which after quick rot13 reveals a french phrase: le chiffre indechiffrable

A quick google search for the phrase reveals a link to Vigenere cipher.

to be continued...

Once you get it solved there is a webpage that tells you what to do next: