CCIE Security Lab Changes

The much-expected change to CCIE Security track has finally arrived.

From Cisco CCIE Security Track home (http://www.cisco.com/web/learning/le3/ccie/security/index.html) :

Effective June 15, 2009, the Cisco CCIE Security lab exam will feature a new type of question format in a section called Core Knowledge. In this new section, candidates will be asked a series of four open-ended questions that require a short, typewritten response (typically several words). The questions will be randomly drawn from a pool of questions on topics currently eligible for testing on the CCIE Security lab exam. No new topics are being added. Candidates will have up to 30 minutes to complete the Core Knowledge section of the exam, and may not return to the questions later. First introduced to the CCIE Routing and Switching lab exam in February 2009, Core Knowledge questions will eventually be added to all CCIE tracks. The changes allow Cisco to maintain strong exam security, and they help ensure that only qualified candidates are awarded CCIE certification.

The change was first implemented in the CCIE Routing & Switching track effective February 1, 2009.

CCIE Routing & Switching Track:
http://www.cisco.com/web/learning/le3/ccie/rs/lab_exam.html

The immediate candidate reaction after CCIE R&S change notification, as expected, has been to attempt CCIE labs before these changes got effective. Not to miss a similar reaction by CCIE Security Candidates, who registered in flocks, before the new syllabii version 3.0 came into effect in mid-April 2009.

I touched base on these 4 open-ended questions from the R&S guys who recently appeared (& passed) the CCIE Routing & Switching Exam. The questions are from the syllabi, & any candidate who has sincerely prepared for this mammoth exam should be able to answer them.

Well, now that the Security Track has a new version 3.0 syllabii, I strongly believe these 4 questions are definitely going to play a crucial part in filtering out the certified CCIE's. I wonder why Cisco didn't chose to integrate it earlier. A lot many candidates who I know, ofcourse CCIE certified now, would have still trying to get past these 4 open-ended questions, had these changes been implemented earlier. Not to say, these didn't knew the syllabii or didn't prepared well, but this is concerned more with the sound knowledge & experience over the technologies covered in the exam.

CCIE is THE test of a network security professional's knowledge of core concepts, configuration & troubleshooting abilities. And the products, though a handful only - (ASA, IOS firewalls, IPS, NAC) - require a thorough understanding & a good hands-on experience. This move will ensure a candidate has good knowledge of the technologies, domains, products & solutions along with hands-on experience towards certification & those training institutes who've been earning a fuckin', easy $$$ using pattern-based / (somehow) known questions that came in the exam will have to find another way to get their candidates pass this new bar.

Good move, Cisco.

CCIE Security Lab Blueprint v3.0:
http://www.cisco.com/web/learning/le3/ccie/security/lab_exam_blueprint_v3.html

SamuraiWTF 0.6 Released

About:
The Samurai Web Testing Framework is a live linux environment that has been pre-configured to function as a web pen-testing environment. The CD contains the best of the open source and free tools that focus on testing and attacking websites.

http://samurai.inguardians.com

New Release:
The SamuraiWTF project team is proud to announce the immediate release of SamuraiWTF 0.6. This release contains a number of fixes and updates as well as the first release of a VM image. This VM requires Vmware 5.0 or better.

It will also work in any version of VMWare Fusion.

Download samurai-0.6:
http://sourceforge.net/project/showfiles.php?group_id=235785

Lynis v1.2.6 - Security & System Auditing Tool

Project information:

Lynis is an auditing tool for Unix (specialists). It scans the system and available software, to detect security issues. Beside security related information it will also scan for general system information, installed packages and configuration mistakes.

This software aims in assisting automated auditing, software patch management, vulnerability and malware scanning of Unix based systems. It can be run without prior installation, so inclusion on read only storage is no problem (USB stick, cd/dvd).

Lynis assists Auditors in performing Basel II, GLBA, HIPAA, PCI DSS and  SOX (Sarbanes-Oxley) compliance audits.

Please note that Lynis is Not a hardening tool. Lynis does not fix things automatically, it reports only & gives suggestions.

Intended Audience:

Security specialists, penetration testers, system auditors, system/network managers.

Examples of Audit tests:

    - Available authentication methods

    - Expired SSL certificates

    - Outdated software

    - User accounts without password

    - Incorrect file permissions

    - Firewall auditing

Current State:

Stable releases are available, development is active.

Download:

You can download Lynis 1.2.6 here:

http://www.rootkit.nl/files/lynis-1.2.6.tar.gz

For Lynis Documentation, please see here:

http://www.rootkit.nl/files/lynis-documentation.html

For System requirements, Supported Operating Systems & Hash information on Lynis download, please see here:

http://www.rootkit.nl/projects/lynis.html

Analysis: Twitter StalkDaily Worm

Twitter is again in news (surprise!, anyone). 

Another XSS worm hit Twitter creating (good, eh!) publicity of another portal -  StalkDaily. The XSS worm exploited improperly escaped profile URL field to re-display the malicious script, in this case - script src="hxxp://mikeyylolz.uuuq.com/x.js - resulting in infecting anyone who visited an infected profile.

Read more on this at: Fsecure

Strangely, that's just a small, noisy show of what XSS can do. It could have become more interesting though, using XSS to quietly infect the end-user systems & build up a botnet force. The possibilities are limitless.

Twitter seems to have rectified this issue as of now.

Until the next worm!

Safe Twitterin'  :)

wepawet - Analyzing Web-Based Malware

One of the most prevelant mode of infection is headed through malicious web-sites. An attacker may chose to host his own site & use it for malware propagation. Or better still, exploit vulnerabilties in other web site(s) & host his malware code on them.

There are different ways to verify if a site is hosting malicous script(s) - varying from tedious manual inspection of code, to using tools such as Malzilla (http://malzilla.sourceforge.net/) & several others, or verifying with Google Safe Browsing.

wepawet is a simple service/tool that many security professionals prefer to use for analyzing web based malicious code.

wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, pdf and JavaScript files.

wepawet analyzes a web-site & provides us with good information about the malicious resource, & the vulnerabilities exploited during an attack.

Basically, wepawet is a simple point, click & shoot tool for analyzing web-based malware.

You can check out wepawet here:

http://wepawet.iseclab.org/index.php

Welcome to iPositive Security

Welcome to my blog!

The main content will address InfoSec updates on Exploits, Tools, Security Incidents, Analysis & experiences in the domains of Ethical Hacking, Vulnerability Assessment & Penetration Testing.

I hope you find some useful resource here.

Thank you for visiting!

Karn Ganeshen