Ständer für Surly Troll, Ogre and ECR

Seit ich vor ca. 1,5 Jahren mein Surly Orge gekauft habe, störte mich im Grunde nur eine Sache: der fehlende Fahrradständer. An vielen Orten ist es ohne Probleme machbar, das Rad anzulehnen, aber eben nicht überall.

Irgendwann bin ich dann auf dieses Video von Craig Meyer auf Youtube gestoßen:

Dort listet er folgende Dinge auf, die man benötigt:

Die Montage an sich dauert dann keine 30 Minuten, ich habe nicht mal das Hinterrad ausgebaut und trotz Scheibenbremse mit etwas Fingerspitzengefühl machbar.

Und so sieht das Ergebnis aus:

Surly Ogre Fahrradständer
Surly Orge Kickstand Verschraubung kein Problem mit Scheibenbremse
Surly Ogre Kickstand Ansicht
Surly Ogre Kickstand ausgeklappt

Einzige Herausforderung ist noch die Gelenkschale für einen Thule Chariot, die jetzt so angebracht ist, dass sie wohl nicht nutzbar ist. To be continued…

36c3 Day 1

So day 1, I arrived around 11 AM and got myself in a queue which was surprisingly well organised and fast-moving. There is even a page to show waiting times for the last few years.

Once passing the entry area I was a little overwhelmed, lights, people, noise everywhere and the space seems simply large…

At some assembly, I met a good friend and long-time CCC / C-Base hang around who introduced me to some people and within a blink, 3 hours of conversation were gone.

Along the way, I learnt stuff about Freifunk, open firmware, and many more, but the most important thing – very good conversations and friendly people.

An aspect that is not covered much in blog posts or wikis is food. I was not sure how to prepare for the long days in regards to food and drinks. Turns out there are a lot of bars serving Mate (of course), beer, cola and other stuff and there are a lot of food places, so no a problem there (not vouching for the quality…)

Hacker Jeopardy was something I was curious but watched back in the hotel.

36C3 Day 2

Pretty early, for congress standards I guess, hit the CCL around 11 AM and most floors and assemblies were empty, which had its own vibe.

Some people I wanted to meet during the congress I tried to meet today and was quite successful with.

By accident, I ran into a pitch of „| age“ a tool „a simple file encryption tool & format“, which looked quite cool and will try to play with it at a later point.

36c3 part 1

For many years I wanted to go to a CCC and this year because of different reasons I was finally able to go, this blog post is going to cover my planning and following posts will hopefully follow.

Preparing

There is a log of coverage already how to prepare for a congress. Obviously, you need a ticket. I got my ticket thanks to a co-worker who is a pretty active member of a local chaos group, so was fairly easy (thx stean)

So after getting a ticket, a place to stay needs to be found. In most cases, I run with AirBnB, this time I was unable to find a cosy place nearby so I ended up doing a hotel reservation and I hope this was a good choice.

And last but not least, transportation. The way to go here for me is using german railway services, Deutsche Bahn. There is even a special page from Deutsche Bahn to get a special ticket for a lower price.

Stuff

Of course, going to a conference you need your basic stuff as for every conference/travel, so I will not go into that too much. Especially for the congress, I tagged most of my gear that I plan to bring to the venue with my twitter handle and my domain so that it is easy to find the owner.

In addition to my normal list I packed the following items:

  • permanent markers (white/black) – maybe I can help with those
  • Magic ties (Amazon link) – I love those things
  • Stickers (mostly for FIRST)
  • batteries (AA+AAA) because why not.

A water bottle, because @c3himmel asked for it:

Tech

The tech also needs some extra time, in particular, updating every service/application running is critical. As I do not trust the wifi (as with any other wifi) VPN and a backup VPN was tested/updated.

To be able to work on stuff I also freed up some space on the devices, just in case.

Power up batteries, external power supplies and co. I do not want to run out of power.

Further reading

Fotos Maxdorf Triathlon 2019

Auch wenn ich leider nicht am Triathlon in Maxdorf teilnehmen konnte (irgendwann schaffe ich es mal an die Startlinie) haben wir das perfekte Wetter genutzt für einen kleinen Ausflug an die Radstrecke dieses top organisierten Wettkampfes, ich habe die Kamera ausgepackt und wir haben gute zwei Stunden die Radler angefeuert.

Aus eigener Erfahrung weiß ich, wie positiv selbst einzelne Anfeuerungen am Rand helfen. Und auch richtig cool wieviele Athleten sich für den Zuspruch bedankt und mit uns gelacht haben.

Da ich mir nicht sicher bin, ob es einen Foto Service gab, bzw, ich mit den Fotos nichts verdienen will, habe ich einfach alle ohne Aussortieren hochgeladen.

Die Bilder dürfen zur eigenen Verwendung unter CC-BY-SA genutzt werden unter der Nennung von Alexander Jäger als Fotograf und über einen Link hier her freue ich mich immer.

Viel Spaß mit den Fotos:

https://photos.app.goo.gl/WfPxrPGuwvnrzorv8

Convert curl to python request

While writing some code, I stumbled across a API documentation, that only had curl examples (prefer to have curl examples over no examples at all) but I had some troubles converting it to proper python code and a friend recommended a page called: https://curl.trillworks.com/

Convert curl syntax to Python, Node.js, R, PHP, Strest, Go, JSON, Rust

And it is even available on github. How cool is that?

This blogpost is only to save it as kind of a bookmark for future coding adventures.

CobaltStrike data with passiveSSL

Today, FoxIT published an blog post with an github repository listing potential CobaltStrike servers for the last few years.

I was interested in the data so I processed the data with my osint-timesketch scripts to add passiveDNS and passiveSSL data. I only took the IPs that where last seen >2019 to not create to much data.

Adding it to timesketch was pretty straight forward:

sudo tsctl csv2ts -f output_cobalt.csv --name cobalt_strike
Indexing progress: 23000 events
Total events: 23650

Some quick findings, after searching for google I discovered several weird certificates, among them.

Some weird things: safebrowsing(.)net is not owned by google, the IP to that certificate accoring to Virustotal https://www.virustotal.com/#/ip-address/204.154.199.184 is resolving to microsoftapis(.)com – for sure nothing good.

Some other funny things where found by a quick look…

Hack me if you can

Hack me if you can

Happy Hacker fake CA

Happy Hacker Fake CA

This outlines the importance of:

  • Share the data (kudos FoxIT!)
  • Provide researchers access to data sets (thx to CIRCL and Virustotal!)

My dataset is available on github.

Talent gap in security

Screenshot Github repository

There are a whole bunch of articles outlining the talent gap in security related positions. More and more jobs require IT skills and IT systems are more and more integrated in all areas of our life with an dramatic increase of open positions in security and privacy.

People living in areas like SF / silicon valley, New York or Zurich can find easily new jobs within days, but those locations are also very expensive and some companies can not hire there.

There is a good opportunity to fight the talent gap: hiring remote

This post is not to outline the benefits of shortcomings of working / hiring remote but the fact that it is very hard for candidates to find companies welcoming remote security minded people.

On the other side, companies have a hard job, market themselves against the big brands to attract remote people.

That combined is the reason I created yet another list on github, called companies-hiring-security-remote. It is a curated list and open for issues / pull requests to act as a platform for job seeking people and companies to give them a little more visibility.

I really hope that this will help people and I am happy to receive feedback.

Link to the repository: https://github.com/deralexxx/companies-hiring-security-remote

Bitcoin transaction in timelines

Investigation bad people might involve bitcoin, the blockchain technology is very popular among criminals, as it is easy to use and „untraceable“ [1]. E.g. in most ransomware cases like „Ryuk“ [2] the company Crowdstrike has listed several bitcoin wallets, that they attribute to the threat actor.

How can that information help your investigation / your intelligence gathering? IN certain ways, you could track your own wallets for transactions to these wallets. Another aspect, that this blogpost will cover on is the timeline aspect of it.

As bitcoin transactions make use of the blockchain, who is public by design, it is possible to:

  • tell, how many bitcoins a certain wallet currently holds
  • see transactions from the past

The second aspect is what I want to focus on, because if we have a look at the transactions, we might be able to identify the point in time a certain group was active and enhance our other DFIR activities enriched with that information. The transaction log is like your journal of your bank account, it tells basically who is transferring money to a wallet and where the bitcoins are transferred to.

In the example above, the bitcoin wallets we are interested in are (Source Crowdstrike Blog post):

BTC AddressTotal ReceivedNo ReceivedTotal Value (USD)
12vsQry1XrPjPCaH8gWzDJeYT7dhTmpcjL55.003$221,685.46
1Kx9TT76PHwk8sw7Ur6PsMWyEtaogX7wWY182.9910$734,601.91
1FtQnqvjxEK5GJD9PthHM4MtdmkAeTeoRt48.2504$188,974.93
14aJo5L9PTZhv8XX6qRPncbTXecb8Qohqb25.002$113,342.70
1E4fQqzCvS8wgqy5T7n1DW8JMNMaUbeFAS0.0011$6.47
1GXgngwDMSJZ1Vahmf6iexKVePPXsxGS6H30.003$132,654.91
1Cyh35KqhhDewmXy63yp9ZMqBnAWe4oJRr0.000$0.00
15LsUgfnuGc1PsHJPcfLQJEnHm2FnGAgYC0.000$0.00
1CbP3cgi1Bcjuz6g2Fwvk4tVhqohqAVpDQ13.002$82,917.49
1Jq3WwsaPA7LXwRNYsfySsd8aojdmkFnW35.001$221,979.83
129L4gRSYgVJTRCgbPDtvYPabnk2QnY9sq0.000$0.00
1ET85GTps8eFbgF1MvVhFVZQeNp2a6LeGw3.3251$12,661.74
1FRNVupsCyTjUvF36GxHZrvLaPtY6hgkTm38.993$246,893.95
1CW4kTqeoedinSmZiPYH7kvn4qP3mDJQVa24.0772$152,727.13
13rTF3AYsf8xEdafUMT5W1E5Ab2aqPhkPi0.000$0.00
17zTcgKhF8XkWvkD4Y1N8634Qw37KwYkZT0.000$0.00
14dpmsn9rmdcS4dKD4GeqY2dYY6pwu4nVV0.000$0.00
17v2cu8RDXhAxufQ1YKiauBq6GGAZzfnFw0.000$0.00
1KUbXkjDZL6HC3Er34HwJiQUAE9H81Wcsr10.001$63,358.27
12UbZzhJrdDvdyv9NdCox1Zj1FAQ5onwx30.000$0.00
1NMgARKzfaDExDSEsNijeT3QWbvTF7FXxS0.000$0.00
19AE1YN6Jo8ognKdJQ3xeQQL1mSZyX16op25.001$164,774.21
1L9fYHJJxeLMD2yyhh1cMFU2EWF5ihgAmJ40.0354$259,478.16
18eu6KrFgzv8yTMVvKJkRM3YBAyHLonk5G30.001$198,651.35
1C8n86EEttnDjNKM9Tjm7QNVgwGBncQhDs30.00822$194,113.76
12N7W9ycLhuck9Q2wT8E6BaN6XzZ4DMLau0.000$0.00
162DVnddxsbXeVgdCy66RxEPADPETBGVBR0.000$0.00
1ChnbV4Rt7nsb5acw5YfYyvBFDj1RXcVQu28.002$175,177.98
1K6MBjz79QqfLBN7XBnwxCJb8DYUmmDWAt1.72$12,455.95
1EoyVz2tbGXWL1sLZuCnSX72eR7Ju6qohH0.000$0.00
1NQ42zc51stA4WAVkUK8uqFAjo1DbWv4Kz0.000$0.00
15FC73BdkpDMUWmxo7e7gtLRtM8gQgXyb40.000$0.00
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk10.002$64,990.62
1CN2iQbBikFK9jM34Nb3WLx5DCenQLnbXp15.001$92,934.80
1LKULheYnNtJXgQNWMo24MeLrBBCouECH70.000$0.00
15RLWdVnY5n1n7mTvU1zjg67wt86dhYqNj50.413$326,477.83
1KURvApbe1yC7qYxkkkvtdZ7hrNjdp18sQ0.000$0.00
1NuMXQMUxCngJ7MNQ276KdaXQgGjpjFPhK101$41,034.54

Source of transaction information

There is a whole bunch of public webpages who give transaction history for a given wallet, but as it should be an automated step, the goal is to have a page with an API, after some searching I found: https://chain.so/api .

Making the call

Doing the API call to get transaction information is pretty simple:

GET /api/v2/address/{NETWORK}/{ADDRESS} 

That will give you the following information

{
  "status": "success",
  "data": {
    "network": "DOGE",
    "address": "DM7Yo7YqPtgMsGgphX9RAZFXFhu6Kd6JTT",
    "balance": "31.03885339",
    "received_value": "25828731.93733507",
    "pending_value": "0.0",
    "total_txs": 225,
    "txs": [ ... ]
}

Which is exactly what we need, with some Python JSON parsing, it is easy to get the info we want – the code I am using is available on https://github.com/deralexxx/osint_to_timesketch

After that we have an CSV with the date, the transaction happened, the raw information from the API and some meta data, enough to bake into a timeline.

Automation

The script is already made to output CSV files ready for importing them into Timesketch, as I found it to be the ideal tool to work with data points related to timestamps. Importing the CSV is straight forward and explained in the official documentation page [3].

The timeline csv looks like the following:

CSV of BTC history

Making it pretty

Importing it into Timesketch, the timeline looks very nice:

BTC transactions in Timesketch

Added Value

Now what is the added value for investigations? The above is another layer of data points /evidence. It can be used to weight limit findings in your organisation, e.g. you assume you are hit by a phishing campaign, if your phishing campaign was seen a lot earlier or a lot later than the transactions above display, it is unlikely you are hit by the same campaign. It can also be used to make a case against individuals if enriched by host forensics – your imagination is the limit.

End

I hope the article is helpful and the scripts can be used, let me know via comments within the blog, issues on github or twitter messages https://twitter.com/alexanderjaeger if you have any questions, improvements.

Thx for reading

Further reading / references

  • [1] http://www.sciencemag.org/news/2016/03/why-criminals-cant-hide-behind-bitcoin
  • [2] https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
  • [3] https://github.com/google/timesketch/blob/master/docs/CreateTimelineFromJSONorCSV.md

Autotimeliner to CyberChef to Timesketch

As you might know, I love to combine several OpenSource tools to get things done. One thing I wanted to play for some weeks is Autotimeliner by Andrea Fortuna.This tool is made to extract events from an Memory Image to combine it into a timeline. If you have a timeline, what comes next? Of course, putting it into Timesketch. So let’s give it a try.

We start with a memory dump from a Stuxnet infection from https://github.com/ganboing/malwarecookbook. Download the four files, extract them and you are good to go.

Prerequisites

Volatility

Installation is pretty easy, install Volatility either via pre-compiled binary or install it manually, see the Volatility installation wiki for further information.

Test it running:

vol.py -v

Sleuthkit

To install sleuthkit run:

brew install sleuthkit

or

sudo apt-get install sleuthkit

Installation Autotimeliner

Simply clone the GitHub repository:

git clone https://github.com/andreafortuna/autotimeliner.git

Run it

python autotimeline.py -f /Users/foobar/Downloads/stuxnet.vmem.zip/stuxnet.vmem -p WinXPSP2x86 -t 2009-10-20..2018-10-21

That might take some time depending on your hardware.

Now you have an csv file around 5.6 MB.


                _     _______ _                _ _
     /\        | |   |__   __(_)              | (_)
    /  \  _   _| |_ ___ | |   _ _ __ ___   ___| |_ _ __   ___ _ __
   / /\ \| | | | __/ _ \| |  | | '_ ` _ \ / _ \ | | '_ \ / _ \ '__|
  / ____ \ |_| | || (_) | |  | | | | | | |  __/ | | | | |  __/ |
 /_/    \_\__,_|\__\___/|_|  |_|_| |_| |_|\___|_|_|_| |_|\___|_|

- Automagically extract forensic timeline from volatile memory dump -

Andrea Fortuna - andrea@andreafortuna.org - https://www.andreafortuna.org

*** Processing image /Users/foobar/Downloads/stuxnet.vmem.zip/stuxnet.vmem
-------
*** Using custom profile: WinXPSP2x86
*** Creating memory timeline......done!
*** Creating shellbags timeline......done!
*** Creating $MFT timeline......done!
*** Merging and filtering timelines......done!
Timeline saved in /Users/foobar/Downloads/stuxnet.vmem.zip/stuxnet.vmem-timeline.csv

The format used for the dates is not compatible with Timesketch:

more /Users/foobar/Downloads/stuxnet.vmem.zip/stuxnet.vmem-timeline.csv
Date,Size,Type,Mode,UID,GID,Meta,File Name
Tue Oct 20 2009 12:08:04,0,ma.b,---a-----------,0,0,84995,"[MFT STD_INFO] Python26\Lib\SITE-P~1\setuptools-0.6c11-py2.6.egg-info\TOP_LE~1.TXT (Offset: 0x8a28c00)"
Tue Oct 20 2009 12:08:04,0,ma.b,---a-----------,0,0,85000,"[MFT STD_INFO] Python26\Lib\SITE-P~1\SETUPT~1.EGG\DEPEND~1.TXT (Offset: 0x75e4000)"
Tue Oct 20 2009 12:08:06,0,m..b,---a-----------,0,0,84985,"[MFT STD_INFO] Python26\Scripts\EASY_I~1.PY (Offset: 0x91b9400)"
Tue Oct 20 2009 12:08:06,0,ma.b,---a-----------,0,0,84986,"[MFT STD_INFO] Python26\Scripts\EASY_I~1.MAN (Offset: 0x91b9800)"
Tue Oct 20 2009 12:08:06,0,ma.b,---a-----------,0,0,84987,"[MFT STD_INFO] Python26\Scripts\EASY_I~1.EXE (Offset: 0x91b9c00)"
Tue Oct 20 2009 12:08:06,0,ma.b,---a-----------,0,0,84988,"[MFT STD_INFO] Python26\Scripts\EASY_I~2.MAN (Offset: 0x1042f000)"
Tue Oct 20 2009 12:08:06,0,m..b,---a-----------,0,0,84989,"[MFT STD_INFO] Python26\Scripts\EASY_I~2.PY (Offset: 0x1042f400)"
Tue Oct 20 2009 12:08:06,0,ma.b,---a-----------,0,0,84990,"[MFT STD_INFO] Python26\Scripts\EASY_I~2.EXE (Offset: 0x1042f800)"
Tue Oct 20 2009 21:21:26,0,...b,---a-----------,0,0,66083,"[MFT STD_INFO] Documents and Settings\Administrator\Desktop\SysinternalsSuite\ZoomIt.exe (Offset: 0x1a8a5c00)"
Wed Oct 21 2009 00:02:28,76800,m...,---a-----------,0,0,65342,"[MFT FILE_NAME] Program Files\NTCore\Explorer Suite\Tools\DRIVER~1.EXE (Offset: 0x14b9c800)"
Wed Oct 21 2009 00:02:28,76800,m...,---a-----------,0,0,65342,"[MFT FILE_NAME] Program Files\NTCore\Explorer Suite\Tools\DriverList.exe (Offset: 0x14b9c800)"
Wed Oct 21 2009 00:02:28,76800,m...,---a-----------,0,0,65342,"[MFT STD_INFO] Program Files\NTCore\Explorer Suite\Tools\DRIVER~1.EXE (Offset: 0x14b9c800)"
Wed Oct 21 2009 18:25:52,780800,m...,---a-----------,0,0,65338,"[MFT FILE_NAME] Program Files\NTCore\Explorer Suite\TASKEX~1.EXE (Offset: 0x14b1b800)"

so we need to adjust that. In the past, I used an own developed python script https://github.com/deralexxx/timesketch-tools/tree/master/date_converter for that, but that does not really scale, so I considered another option.

Cyberchef

An open source tool by GCHQ: https://gchq.github.io/CyberChef/

A simple, intuitive web app for analysing and decoding data without having to deal with complex tools or programming languages. CyberChef encourages both technical and non-technical people to explore data formats, encryption and compression.

https://gchq.github.io/CyberChef/#about

Installation

git clone https://github.com/gchq/CyberChef

https://github.com/gchq/CyberChef/wiki/Getting-started

Now open it

From the CSV that was generated, use your favourite tool to extract the first column of the csv which should look like that:

Date
Tue Oct 20 2009 12:08:04
Tue Oct 20 2009 12:08:04
Tue Oct 20 2009 12:08:06
Tue Oct 20 2009 12:08:06
Tue Oct 20 2009 12:08:06
Tue Oct 20 2009 12:08:06
Tue Oct 20 2009 12:08:06
Tue Oct 20 2009 12:08:06
Tue Oct 20 2009 21:21:26
Wed Oct 21 2009 00:02:28

Now use the following CyberChef Recipe

Fork('\\n','\\n',false)
Translate_DateTime_Format('Automatic','','UTC','YYYY-MM-DDTHH:mm:ssZZ,x','UTC')

And paste them all into input. It will result in a file you can download with the output.

Now the output txt has two CSV columns, you need to combine them with your autotimeliner csv to have the following headers:

datetime	timestamp	timestamp_desc
2009-10-20T12:08:04+0000	1256040484000	stuxnet.vmem_Mem_Dump_Timeline
2009-10-20T12:08:04+0000	1256040484000	stuxnet.vmem_Mem_Dump_Timeline
2009-10-20T12:08:06+0000	1256040486000	stuxnet.vmem_Mem_Dump_Timeline
2009-10-20T12:08:06+0000	1256040486000	stuxnet.vmem_Mem_Dump_Timeline
2009-10-20T12:08:06+0000	1256040486000	stuxnet.vmem_Mem_Dump_Timeline
2009-10-20T12:08:06+0000	1256040486000	stuxnet.vmem_Mem_Dump_Timeline

Now the csv should like like:

more stuxnet.vmem.zip/stuxnet.vmem-timeline_timesketch.csv 

datetime,timestamp,timestamp_desc,Date,Size,Type,Mode,UID,GID,Meta,message
2009-10-20T12:08:04+0000,1256040484000,stuxnet.vmem_Mem_Dump_Timeline,Tue Oct 20 2009 12:08:04,0,ma.b,---a-----------,0,0,84995,[MFT STD_INFO] Python26\Lib\SITE-P~1\setuptools-0.6c11-py2.6.egg-info\TOP_LE~1.TXT (Offset: 0x8a28c00)
2009-10-20T12:08:04+0000,1256040484000,stuxnet.vmem_Mem_Dump_Timeline,Tue Oct 20 2009 12:08:04,0,ma.b,---a-----------,0,0,85000,[MFT STD_INFO] Python26\Lib\SITE-P~1\SETUPT~1.EGG\DEPEND~1.TXT (Offset: 0x75e4000)
2009-10-20T12:08:06+0000,1256040486000,stuxnet.vmem_Mem_Dump_Timeline,Tue Oct 20 2009 12:08:06,0,m..b,---a-----------,0,0,84985,[MFT STD_INFO] Python26\Scripts\EASY_I~1.PY (Offset: 0x91b9400)

There is one little caveat, you need to add „“ around the message, because some values might break the Import process.

That can now be imported into Timesketch



Et voila, a timesketched Memory Dump