The Open Source Security (OSSEC) Blog
It looks like I did a big mistake by releasing the web ui and not providing any screenshots of it. So, here they are (better later than never).
If you want to share your screenshots, just send them to us and we will publish them here too. PHP developers to help with the project are also welcome!
We are pleased to announce the release of the first non-BETA version of the OSSEC web interface (v0.2). This version contains the following features and bug fixes:
The full release message is available here.
Download it from here.
Install guide here.
As always, comments are welcome…
ADS (Alternate Data Streams) is a “feature” of the NTFS (file system used on Windows 2000, XP, etc) that permit files to be completely hidden from the system. You can read more about ADS in these two links: windowsecurity.com ADS and lads.
Currently I am working on merging rootcheck (an anomaly detection module) to Windows and one of the things it needs to detect is hidden files using NTFS ADS. However, so far, I couldn’t find any open source tool that detects them (yes, there is freeware programs out there, but no source code). Most of the articles I read point to lads, which is free, but not open source.
So, to fill this gap, I am releasing a beta version of a small tool (ads_dump) that scans a given directory and prints every ADS found. It is a standalone tool, but it will be soon included into ossec.
You can download it from here and the source code (GPL v2) from here.
Using this tool is very simple, just execute it and pass as an argument the directory to scan. It is going to print every ADS found. Example:
C:>ads_dump.exe ads_dump.exe dir C:>echo hidden > C:temp/a:hidden C:>echo hidden > C:temp/a:hidden2 C:>ads_dump.exe C:temp Found NTFS ADS: 'C:tempa:b' Found NTFS ADS: 'C:tempa:hidden' Found NTFS ADS: 'C:tempa:hidden2'
*Please note that it is still in beta (comments and suggestions are welcome). It will be also be included on the next version of ossec as part of the Windows anomaly detection module.
The first beta of the ossec wui v0.2 is available for our beta testers. As I mentioned before, the best way to get involved in the project is by helping us testing our beta releases. If you do so, please let us know how it went.
You can download the beta 1 from here.
You can follow the same steps as mentioned here to install.
New features include paginated search results, real time monitoring of alerts, new integrity checking page and many other stuff (saving details for official release).
Let us know of any bugs or suggestions that you may have.
For those that missed it, ossec has gained a lot of attention lately, specially with these articles from Linux World and Network World:
You can see all other stories about ossec at our in the news wiki section.
I am happy to announce the arrival of a new member to the ossec team. He is only 51cm tall and weights around 3.4kg, but we expect great contributions from him as soon as he can start coding. He has no name yet, but we will find one soon (no one liked the “root” idea). The whole family is happy and doing well.
*Update (Mar 16) – Finally a name was chosen: Davi Cid
As a follow-up from my previous post about the BETA1, the second beta for version 1.1 is also available. It contains some bug fixes that were found on the previous beta and some code cleanup.
You can download the Unix and Windows files from: http://www.ossec.net/files/snapshots/
Let us know of any question (dcid @ ossec.net).
If you are running Solaris 10 and are worried about the possible Solaris Worm, you can add the following 4 lines to the /var/ossec/etc/shared/rootkit_files.txt file at your ossec server. It will automatically update the rootcheck config for all your agents.
Or you can install the latest beta…
