WinAPIOverride32:an advanced api monitoring software.

WinAPIOverride32 is an advanced api monitoring software.You can monitor and/or override any function of a process. This can be done for API functions or executable internal functions.It tries to fill the gap between classical API monitoring softwares and debuggers.

It can break targeted application before or after a function call, allowing memory or registers changes; and it can directly call functions of the targeted application.

Main differences between other API monitoring softwares :

- You can define filters on parameters or function result
- You can define filters on dll to discard calls from windows system dll

- You can hook functions inside the target process not only API

- You can hook asm functions with parameters passed through registers

- You can hook hardware and software exceptions
- Double and float results are logged
- You can easily override any API or any process internal function
- You can break process before or/and after function call to change memory or registers

- You can call functions which are inside the remote processes

- Can hook COM OLE and ActiveX interfaces
- User types (enum, struct and union) and user defines are supported
- All is is done like modules : you can log or override independently for any function
- Open Source
- A library is provided for developpers who intend to build their one hooking software

http://jacquelin.potier.free.fr/winapioverride32/

RTIR -A premiere Open Source incident handling system.

RTIR is the premiere Open Source incident handling system. We worked with over a dozen CERT and CSIRT teams to build a world-class incident handling system. RTIR helps you handle the ever-increasing volume incident reports. RTIR lets you tie multiple incident reports to specific incidents. RTIR makes it easy to launch investigations to work with law enforcement, network providers and other partners to get to the bottom of each incident and to track it through to a successful resolution.


It's easy to integrate RTIR into your existing systems and workflow. With open source code, a rich API and a vibrant community, RTIR can be tied into many external systems with only a few lines of configuration or a few minutes of programming. If you're using a publicly available product as part of your incident handling workflow, someone has probably already integrated it with RTIR

Download From:

http://www.bestpractical.com/rtir/download.html

Google Criticized for 'Buzz' Privacy Faults

Google has announced it will ask all users to reconfirm their preferred privacy settings on its social networking site 'Buzz'. It follows a controversial launch in which many believed, correctly or otherwise, that their privacy had been compromised.


Buzz is Google's rival to Facebook and Twitter. It's integrated into Gmail and allows users to follow and reply to posts made by people they decide to follow on the service.

The service also allows users to share information from other Google-owned services such as Google Reader (an RSS newsreader) and picture-sharing site Picasa. It was clearly designed to encourage users to spend more time in Gmail and thus be more attractive to advertisers.

Automated 'Followers' Idea Backfires

The big problem with the launch was that Google decided to "help" users by automatically adding in some online followers from their email address book. This annoyed many users as they felt some of their information was now being shared with other people without their permission.

In one extreme case, a woman said she was automatically made a Buzz contact of an abusive ex-partner who only appeared as a regular email contact because they had been sending harassing messages.

FTC Commissioner Critical of Service
To make things worse, many users were in the dark about the implications of the Buzz service, with some believing their entire email history had been exposed. Others found opt-out settings but, because of the close integration, believed that turning off Buzz could only be done by quitting the email service altogether.

A privacy watchdog and several politicians complained about the move to the Federal Trade Commission. Although not a formal response to the complaints, one commissioner later said "I do not believe consumer privacy [considerations] played any significant role in the release of Buzz." (Source: bbc.co.uk)

Google Confirms Test Failure

Google later admitted it had only tested the service on its own staff rather than the usual test panel of employees' friends and family. That may have meant the results were distorted, as Google workers may have been more tech-savvy and less concerned about privacy implications than the general public.

Shortly after the launch, Google responded to criticism by simplifying the processes for blocking "followers," changing privacy settings or quitting Buzz altogether, but this only applied to new Buzz users. The firm also dropped the automated following system and replaced it with a list of suggested contacts.

This week's announcement goes a step further: the firm will now ask every user to specifically change or reconfirm their privacy option settings. That move, albeit late in the day, will go some way towards answering criticism that both Buzz and other social networking services need to adopt a policy of making all user data as private as possible until the user specifically says otherwise. (Source: pcmag.com)

Payment Card Industry Rock

Do you remember those old School House Rock commercials from the 70’s? I do, in part because someone gave my kids a DVD set with all of them on it. And apparently the folks at the PCI Council remember them too, because they’ve created a video that looks a lot like those old commercials. My favorite part is the fact that Bob Russo let a cartoon version of himself be part of the video. I wonder if the real Mr. Russo can sing and play the guitar?

StreamArmor – Discover & Remove Alternate Data Streams (ADS)

What are ADS (Alternate Data Streams)?

If you’ve had any experience with advanced malware or Windows forensics you’d already know what ADS are, but if you haven’t is a lesser known feature of the Windows NTFS file system which provides the ability to put data into existing files and folders without affecting their functionality and size. Any such stream associated with file/folder is not visible when viewed through conventional utilities such as Windows Explorer or DIR command or any other file browser tools.


StreamArmor is a tool for discovering hidden alternate data streams (ADS) and can also clean them completely from the system. It’s advanced auto analysis coupled with online threat verification mechanism makes it the best tool available in the market for eradicating the evil streams. StreamArmor comes with fast multi threaded ADS scanner which can recursively scan over entire system and quickly uncover all hidden streams. All such discovered streams are represented using specific color patten based on threat level which makes it easy for human eye to distinguish between suspicious and normal streams.

StreamArmor has built-in advanced file type detection mechanism which examines the content of file to accurately detect the file type of stream. This makes it great tool in forensic analysis in uncovering hidden documents/images/audio/video/database/archive files within the alternate data streams. StreamArmor is the standalone, portable application which does not require any installation. It can be copied to any place in the system and executed directly.

Platform

Windows XP, 2K3, Vista, Longhorn and Windows 7 (both 32 & 64 bit versions) On 64 bit platform, only 32 bit processes are supported.

You can download StreamArmor v1.0 here
http://www.rootkitanalytics.com/tools/streamarmor.php

Flint – Web-based Firewall Rule Scanner

Flint examines firewalls, quickly computes the effect of all the configuration rules, and then spots problems so you can:

•CLEAN UP RUSTY CONFIGURATIONS that are crudded up with rules that can’t match traffic.
•ERADICATE LATENT SECURITY PROBLEMS lurking in overly-permissive rules
•SANITY CHECK CHANGES to see if new rules create problems.
Flint is absolutely free. There’s no catch. You can download the source from the git repository. This isn’t the “play at home” version; it’s their second product, and they want to do it open source.

Why You Need Flint

You have multiple firewalls protecting internal networks from the Internet and controlling access to customer data. Your business changes, and so do your firewalls, and not always at the same time. Firewalls can get out of step with policies.

Everybody makes mistakes. To understand a firewall configuration, you have to read hundreds of configuration lines, and then you have to think like a firewall does. People aren’t good at thinking like firewalls. So most firewalls are riddled with subtle mistakes. Some of those mistakes can be expensive:

•INSECURE SERVICES might be allowed through the firewall, preventing it from blocking attacks.
•LAX CONTROLS ON DMZs may expose staging and test servers.
•FIREWALL MANAGEMENT PORTS may be exposed to untrusted networks.
•REDUNDANT FIREWALL RULES may be complicating your configuration and slowing you down.

You can download Flint here:

VMWare Virtual Machine – FlintVM-current.zip
OVF Virtual Machine – FlintVM-current.ovf.zip
Source – flint-current.tgz

http://runplaybook.com/p/11

Critical Log Review Checklist for Security Incidents

This cheat sheet presents a checklist for reviewing critical logs when responding to a security incident. It can also be used for routine log review.

General Approach

Identify which log sources and automated tools you can use during the analysis.
Copy log records to a single location where you will be able to review them.
Minimize “noise” by removing routine, repetitive log entries from view after confirming that they are benign.
Determine whether you can rely on logs' time stamps; consider time zone differences.
Focus on recent changes, failures, errors, status changes, access and administration events, and other events unusual for your environment.
Go backwards in time from now to reconstruct actions after and before the incident.
Correlate activities across different logs to get a comprehensive picture.
Develop theories about what occurred; explore logs to confirm or disprove them.

Potential Security Log Sources

Server and workstation operating system logs

Application logs (e.g., web server, database server)
Security tool logs (e.g., anti-virus, change detection, intrusion detection/prevention system)
Outbound proxy logs and end-user application logs
Remember to consider other, non-log sources for security events.

Typical Log Locations
Linux OS and core applications: /var/log

Windows OS and core applications: Windows Event Log (Security, System, Application)
Network devices: usually logged via Syslog; some use proprietary locations and formats

What to Look for on Linux
Successful user login----- “Accepted password”,“Accepted publickey”,"session opened”

Failed user login----- “authentication failure”,“failed password”
User log-off----- “session closed”
User account change or deletion----- “password changed”,“new user”,“delete user”
Sudo actions----- “sudo: … COMMAND=…” “FAILED su”
Service failure----- “failed” or “failure”  

What to Look for on Windows
Event IDs are listed below for Windows 2000/XP. For Vista/7 security event ID, add 4096 to the event ID.

Most of the events below are in the Security log; many are only logged on the domain controller

User logon/logoff events----- Successful logon 528, 540; failed logon 529-537, 539; logoff 538, 551, etc

User account changes----- Created 624; enabled 626; changed 642; disabled 629; deleted 630
Password changes----- To self: 628; to others: 627
Service started or stopped----- 7035, 7036, etc.
Object access denied (if auditing enabled)----- 560, 567, etc

What to Look for on Network Device
Look at both inbound and outbound activities.

Examples below show log excerpts from Cisco ASA logs; other devices have similar functionality.

Traffic allowed on firewall----- “Built … connection”,“access-list … permitted”

Traffic blocked on firewall----- “access-list … denied”,"deny inbound”,“Deny … by”
Bytes transferred (large files?)----- “Teardown TCP connection … duration … bytes …”
Bandwidth and protocol usage----- “limit … exceeded”,“CPU utilization”
Detected attack activity----- “attack from”
User account changes----- “user added”,“user deleted”,“User priv level changed”
Administrator access----- “AAA user …”,“User … locked out”,“login failed”

What to Look for on Web Servers
Excessive access attempts to non-existent files

Code (SQL, HTML) seen as part of the URL
Access to extensions you have not implemented
Web service stopped/started/failed messages
Access to “risky” pages that accept user input
Look at logs on all servers in the load balancer pool
Error code 200 on files that are not yours

Failed user authentication----- Error code 401, 403

Invalid request----- Error code 400
Internal server----- error Error code 500