Some people say “Reverse Engineering is an art”. Well, this might be true if you consider stuff like mathematics as art. It is more an application of standard methods that evolve constantly. Actually, everybody can learn these methods and start to RE executables. With the RE-Google plugin for IDA Pro, even your granny can start reversing :)

Reverse engineering is like solving a jigsaw puzzle. In order to see the whole picture you need to find the corner pieces, then the frame, and then work your way forward from there. The corner pieces for reversing are strings, constants and function names. The function names that people normally start with are the one’s imported from shared libraries (e.g. Dlls). Strings contain human readable hints about the functionality. Specific constants add more clues to solve the puzzle or can sometimes even be used to identify certain (types of) algorithms. The imported functions tell about the actions performed by it.

We are excited to announce the latest chapter coming on Board, the United Arab Emirates Chapter, hosted and formed by aeCERT.  This is the very first Chapter to be joining from the middle-east, we are very excited to have them on board and expect great things from them!

Shucran!

lance

The Dionaea honeypot got more and more mature during the last weeks. As Markus blogged in Iteolih: Miles and More the software is now able to detect shellcode via libemu and generates a nice shellcode profile out of this.

The SMB / DCERPC implementation also got fairly mature and is now able to cope with all packet types and also most caveats and differences of implementations in exploits. As I registered more and more RPC vulnerabilities in the module, it was definitely time to give libemu something to eat! :)

Here is a brief introduction on Qebek, answering some questions.

We got a new milestone due:

10.08.2009

• thread-pool works

• stream recording works

• shellcode detection using libemu works

• shellcode emulation using libemu works

• compiles on linux&openbsd

An exploit taken from a public repository, run against the software, is detected and emulated.

To shorten things, basically all required points are hit with current svn.

So, given the time we just saved, some words about how it works.

The core functionality in dionaea is written in c, but python is embedded as scripting language and required parts of the c-api are exported to the embedded python, using cython bindings.

Today I make a retrospection on my work on the Glastopf Web Honeypot during the Google Summer of Code Program. My goal was to push forward the development on a Honeypot for an attack vector in web security which is really underestimated in current discussions. The main objectives could be merged into one intention: Increasing our attractiveness and answering every request as close as possible to a real world system. This got achieved with the new PHP file parser and the dynamic Google dork list which we provide for the Google crawler.
Since the past three months, we also collected a lot of attacks. Actually we have around 1.27 million unique attacker IP and requested vulnerability combinations in our database. In total we have something above 14 million hits on our three deployed sensors. We also collected the vulnerabilities which got triggered by the attacker. Currently we have more than 30 thousand different vulnerabilities in the database! So there is a lot of noise out there to catch :)
For the coming months after the Google Summer of Code program I’m looking forward to finish the integration of Glastopf in the SURFids environment (a plugin is already done), and further steps into the improvement of the PHP file parser. There are also plans on analyzing the collected PHP bots and botnets.
So the program was real fun and I’ve learned a lot during this summer. I’m looking forward to increase the already existing knowledge from the Honeynet Project on web app security and the methods used by the attackers!

Hi all:

       I have finished almost all the coding stuff of Project #1, now you can try out the new PHoneyC with shellcode/heapspray detection here:

http://code.google.com/p/phoneyc/source/browse/phoneyc#phoneyc/branches/phoneyc-honeyjs

        Please feel free to report any bug or suggestion on shellcode/heapspray detection to me.

        As Geng and his partner is still working on the DOM simulation of PHoneyC (Project #2), I will do more test and write an overall introduction to the ideas and structure of the new PHoneyC after merging in his final commit.

Today I received a spam email from “Sicherheits-Center” (“security center”) with subject “Vorsicht! Ihr Paypal-Konto wurde begrenzt!” (“Attention! Your paypal account has been restricted!”). Not only the subject but the whole message was in really bad German - I am sure everybody had the chance to delete similar spams and you know what they look like. The advertised link was already down and also already included in Google’s “Safe Browsing” list of malicious URLs. But the message contained a piece of interesting information which I think is interesting.

Second milestone reached! Honeybrid has now all its functionalities working and it’s time for testing. In order to check that everything works efficiently, I deployed a Windows honeypot to receive traffic from five /24 unused subnets during half an hour. Here are the details of this experiment.

Configuration

Here is a overall diagram of the testing architecture:

(Internet) <=====> [NATing Gateway with Honeybrid] <-------> [Windows Honeypot]

The NATing gateway was configured with the following iptables rules:

Hi Folks,

I worked on the Front-End to make my interface more user-friendly, I don’t detail every modifications, we can split them in three:

• Profile Management

• Organisation Management

• Honeyclient Management

My code is under Honeynet Subversion so you can consult it if you’re curious !
I also corrected a lot of bugs even if some of them are a bit persistent….

I discussed with Ian Welch, my tutor, about how to communicate between Honeyweb and honeyclients.
We chose to use Axis2 as the webservice technology and we imagine how to implement this.