SANS is coming to Augusta GA in June!

SANS is coming to Augusta GA in June!  Doug Burks will be teaching SANS SEC503: Intrusion Detection In-Depth and Mark Baggett will be teaching SANS SEC560: Network Penetration Testing.

UPDATE: You can save $500 if you register for one of these classes by May 2. In addition, ISSA members are eligible for a 10% discount! The discount code was sent to the ISSA Members mailing list. If you are a member and you didn't receive the discount code, please contact a Chapter Officer. If you're not already an ISSA member, please consider joining so that you will be eligible for this and other discounts in the future.


For more information, please see:
http://augusta.issa.org/drupal/SANS-Augusta-2012
http://www.sans.org/augusta-2012-cs/

tcpdump and ngrep

Yesterday, I tweeted the following:

tcpdump -nnvvAi eth1 -s0 | grep "Doug Burks is teaching SANS SEC503 Intrusion Detection In-Depth in Portland"

 So what does it all mean?

-nn This option disables name resolution for IP addresses and port numbers.  Some versions of tcpdump do this with a single "-n", but the double "-nn" option should work on all of them.
vv This option enables Very Verbose output.  It wasn't strictly needed for the purposes of this command, but I'm in a habit of using it.
A This option prints just the ASCII text in the packets.  This is useful when looking for strings like "Doug Burks is teaching SANS SEC503 Intrusion Detection In-Depth in Portland" or "c99shell".
i This option allows you to specify the Interface (in this case eth1).  eth1 on my Security Onion box at home is connected to a Dualcomm Switch Tap that monitors all ingress/egress of my home network.  Doesn't everybody do full packet capture at home?
-s0 This option sets the snaplen. By default, tcpdump only captures 68 bytes and would therefore not see the entire payload of the HTTP connection.  Setting snaplen to 0 forces tcpdump to capture the entire packet regardless of its size.
grep Since we had tcpdump output in ASCII, we can easily use the standard grep command to look for interesting text strings.

I was waiting on someone to ask the question "Why not use ngrep instead?".  tcpdump's advantage is that it is more universally available than ngrep.  If you're doing Incident Response on a Unix box of some kind, chances are that it already has tcpdump installed and you can use that to look for suspicious traffic as defined above.

Most Unix boxes do not have ngrep installed by default.  But let's assume that you've got a dedicated IDS platform such as Security Onion which just so happens to include ngrep by default.  Here's the  ngrep version of the command:

 ngrep -d eth1 -s0 "Doug Burks is teaching SANS SEC503 Intrusion Detection In-Depth in Portland"

Here we use the "-d eth1" option to force ngrep to listen on device eth1 and the "-s0" option to force ngrep to look at the entire packet.  Note that, unlike tcpdump's default snaplen of 68 bytes, ngrep defaults to 65536, so this option isn't strictly needed here, but is included for completeness.  After specifying these options, we simply tell ngrep what string to look for.

Doug Burks is teaching SANS SEC503 Intrusion Detection In-Depth in Portland Oregon 8/22 - 8/27.  Sign up today!
http://www.sans.org/portland-2011-cs-2/description.php?tid=4866

Doug Burks is teaching SANS SEC503 Intrusion Detection In-Depth in Portland 8/22 - 8/27

Doug Burks is teaching SANS SEC503 Intrusion Detection In-Depth in Portland Oregon 8/22 - 8/27.  For more information about the class, please see:
http://www.sans.org/portland-2011-cs-2/description.php?tid=4866


Enter Discount Code COINS10 at the time of registration to save $356 on Tuition!

Suggestions for the Security Onion LiveCD

I'm currently working on the next version of the Security Onion LiveCD. What specific packages/features would you like to see added to the Security Onion LiveCD? Post a comment here or contact me on Twitter. Thanks!

The Security Onion LiveCD is now available!

The Security Onion LiveCD is now available! You can download it from the following location:
http://distro.ibiblio.org/pub/linux/distributions/security-onion/

What is it?
The Security Onion LiveCD is a bootable CD that contains software used for installing, configuring, and testing Intrusion Detection Systems.

What software does it contain?
The Security Onion LiveCD is based on Xubuntu 9.04 and contains Snort 2.8.4.1, Snort 3.0.0b3 (Beta), sguil, idswakeup, nmap, metasploit, scapy, hping, fragroute, fragrouter, netcat, paketto, tcpreplay, and many other security tools.

What can it be used for?

• The Security Onion LiveCD can be used for Intrusion Detection. Simply boot the CD and double-click either the Snort-Sguil or SnortSP-Sguil desktop shortcuts. The Snort and Sguil daemons will then start, listening on eth0 for any suspicious traffic and creating alerts in the Sguil console.
• The Security Onion LiveCD can be used to test an Intrusion Detection System. Simply boot the CD and use the included tools (such as nmap, metasploit, idswakeup, scapy, hping, and others) to test your existing IDS or to test the included Snort 2.8.4.1 and Snort 3.0 Beta 3.
• The Security Onion LiveCD can be used to install an Intrusion Detection System. Simply boot the CD and double-click the Install desktop shortcut. For more information about installation, please see the README desktop shortcut.

You can read more about the Security Onion LiveCD (and, specifically, the integration of Snort 3.0 and Sguil) in my SANS GCIA Gold Paper "Snort 3.0 Beta 3 for Analysts".

Please take a look at the Security Onion LiveCD and let me know what you think!

* Special thanks to:

• Marty Roesch and the whole SourceFire team for all of their work these last 10 years to get Snort to where it is today.
  
• The Sguil team for the best open-source tool to manage Snort alerts.
  
• The SecurixLive crew for their awesome NSMnow installer, the easiest way to install and configure Snort/Sguil on Ubuntu Linux.
• Ubuntu (and Debian) for their well-made Linux distribution(s).
• The Reconstructor team for a very easy to use tool for remastering Ubuntu LiveCDs.
• All developers in the open-source community who work so hard and produce such amazing tools.
  

Announcing Detroit Dave's Raves

One of my SANS 503 Mentor students has started his own blog. Check it out at:
http://detroitdavesraves.blogspot.com/

SANS 503 Mentor class is full

Registration is now closed for the previously mentioned SANS 503 Mentor class here in Augusta. This was the first SANS Mentor class to sell out in a few years! Thanks to all who registered.

Links for Binary and Hex Refreshers

If you're about to take SANS 503 and it's been a while since you've had to deal with the world of binary and hex, here are a few good links for refreshing your memory:
http://en.wikipedia.org/wiki/Hexadecimal
http://en.wikipedia.org/wiki/Binary_numeral_system
http://www.underground-security.com/downloads/crew/frostbyte/tutorials/conversions-tutorial.php
http://www.blaenkdenum.com/binary-and-hexadecimal/
http://www.permadi.com/tutorial/numHexToBin/index.html
http://atrevida.comprenica.com/atrtut01.html
http://www.sans.org/training/tcpip_quiz.php

Reminder about SANS 503 training here in Augusta

We have less than 2 weeks to go before the January 20 deadline for the best deal on SANS 503 Intrusion Detection training here in Augusta! If you're not an ISSA member already, you can join today (only $120.00) and take advantage of the 40% discount for ISSA members. ISSA Members who wish to register for the class should contact me or one of the other chapter leaders for the Discount Registration code.

For further information, please see:
http://www.sans.org/mentor/details.php?nid=15354

Mentoring SANS 503

Starting in February, I'll be mentoring SANS 503: Intrusion Detection In-Depth. This class is extremely valuable for those who work with Intrusion Detection Systems such as Snort. Even if you have never used an IDS before, you will learn TCP/IP from an attacker's perspective, how to analyze packets using tcpdump, and how to configure Snort and write your own Snort rules.

Classes will be on Tuesday nights at Augusta State University from 7:00 PM - 9:00 PM starting on February 17, 2009. Greater Augusta ISSA members will receive a 40% discount off the normal price. If you wish to become a member of the Greater Augusta ISSA or are already a member and would like the SANS discount code, please let me or one of the other chapter leaders know.

For more information about SANS 503, please see:
http://www.sans.org/mentor/details.php?nid=15354

My name is Doug Burks and I'm a GCIA

Back in April, I traveled to Orlando and took SANS 503 from the amazing Mike Poor. I then spent the next few months reviewing the course material, listening to Mike Poor MP3s, and taking practice exams. On September 5th, I took the real exam and passed with a 95! (I almost broke my arm patting myself on the back.) This certifies me at the GCIA Silver level. I'm now working on my research paper for GCIA Gold.