OSSEC – Page 16 – The Open Source Security (OSSEC) Blog

OSSEC WUI version 0.2 is available

Posted on March 28, 2007July 3, 2020 by Daniel Cid

We are pleased to announce the release of the first non-BETA version of the OSSEC web interface (v0.2). This version contains the following features and bug fixes:

Added real time monitoring to the search page.
Added support for paginated search results.
Added “Log Format” as an option to allow searches based on the log format.
Added integrity checking page to allow monitoring of changed files/registry entries.

The full release message is available here.

Download it from here.

Install guide here.

As always, comments are welcome…

Finding ADS on NTFS

Posted on March 25, 2007July 3, 2020 by Daniel Cid

ADS (Alternate Data Streams) is a “feature” of the NTFS (file system used on Windows 2000, XP, etc) that permit files to be completely hidden from the system. You can read more about ADS in these two links: windowsecurity.com ADS and lads.

Currently I am working on merging rootcheck (an anomaly detection module) to Windows and one of the things it needs to detect is hidden files using NTFS ADS. However, so far, I couldn’t find any open source tool that detects them (yes, there is freeware programs out there, but no source code). Most of the articles I read point to lads, which is free, but not open source.

So, to fill this gap, I am releasing a beta version of a small tool (ads_dump) that scans a given directory and prints every ADS found. It is a standalone tool, but it will be soon included into ossec.

You can download it from here and the source code (GPL v2) from here.

Using this tool is very simple, just execute it and pass as an argument the directory to scan. It is going to print every ADS found. Example:

C:>ads_dump.exe
ads_dump.exe dir

C:>echo hidden > C:temp/a:hidden
C:>echo hidden > C:temp/a:hidden2
C:>ads_dump.exe C:temp
Found NTFS ADS: 'C:tempa:b'
Found NTFS ADS: 'C:tempa:hidden'
Found NTFS ADS: 'C:tempa:hidden2'

*Please note that it is still in beta (comments and suggestions are welcome). It will be also be included on the next version of ossec as part of the Windows anomaly detection module.

OSSEC Web UI v0.2 beta 1 available

Posted on March 21, 2007July 3, 2020 by Daniel Cid

The first beta of the ossec wui v0.2 is available for our beta testers. As I mentioned before, the best way to get involved in the project is by helping us testing our beta releases. If you do so, please let us know how it went.

You can download the beta 1 from here.

You can follow the same steps as mentioned here to install.

New features include paginated search results, real time monitoring of alerts, new integrity checking page and many other stuff (saving details for official release).

Let us know of any bugs or suggestions that you may have.

OSSEC in the news

Posted on March 19, 2007July 3, 2020 by Daniel Cid

For those that missed it, ossec has gained a lot of attention lately, specially with these articles from Linux World and Network World:

You can see all other stories about ossec at our in the news wiki section.

New ossec member

Posted on March 15, 2007July 3, 2020 by Daniel Cid

I am happy to announce the arrival of a new member to the ossec team. He is only 51cm tall and weights around 3.4kg, but we expect great contributions from him as soon as he can start coding. He has no name yet, but we will find one soon (no one liked the “root” idea). The whole family is happy and doing well.

*Update (Mar 16) – Finally a name was chosen: Davi Cid

OSSEC presentation

Posted on March 8, 2007July 3, 2020 by Daniel Cid

Michael Williams sent to us a copy of his excelent presentation about ossec. You can download the swf from here and the .ppt from here.

OSSEC v1.1 BETA2 available

Posted on March 1, 2007July 3, 2020 by Daniel Cid

As a follow-up from my previous post about the BETA1, the second beta for version 1.1 is also available. It contains some bug fixes that were found on the previous beta and some code cleanup.

You can download the Unix and Windows files from: http://www.ossec.net/files/snapshots/
Let us know of any question (dcid @ ossec.net).

Rootcheck entry for the “Solaris Worm”

Posted on March 1, 2007July 3, 2020 by Daniel Cid

If you are running Solaris 10 and are worried about the possible Solaris Worm, you can add the following 4 lines to the /var/ossec/etc/shared/rootkit_files.txt file at your ossec server. It will automatically update the rootcheck config for all your agents.

Or you can install the latest beta…

OSSEC v1.1 BETA1 available

Posted on February 21, 2007July 3, 2020 by Daniel Cid

If you are looking for a way to help the project, here is your chance. We just release the first beta for the 1.1 version and we need beta testers. This version has numerous bug fixes and new features, so a great deal of QA will be required. If you try it out, let us know if it worked or not (and provide the operating system/version that you used).

Partial changelog:Added support for hostnames in the server-ip configuration. Use “server-hostname” to specify it.Added granular e-mail configuration options. Extra email_alerts options can be added based on the severity or event location.Added support for Solaris 10 and OpenBSD su messages.Improved Windows installer to use NSIS Modern UI.Added overwrite attribute to the rules. It allows an entire rule to be overwritten. Example to overwrite rule 1002:

Partial changelog:

Added support for hostnames in the server-ip configuration.
Use “server-hostname” to specify it.Added granular e-mail configuration options.
Extra email_alerts options can be added based on the severity or event location.
Added support for Solaris 10 and OpenBSD su messages.
Improved Windows installer to use NSIS Modern UI.Added overwrite attribute to the rules. It allows an entire rule to be overwritten. Example to overwrite rule 1002:



<rule id="1002" level="8" overwrite="yes">
<match>Segmentation|XYZ</match>
<description>Rule 1002 overwriten.  </description>
</rule>

You can download the Unix and Windows files from:
http://www.ossec.net/files/snapshots/

Let us know of any question (dcid @ ossec.net).

Log alerts from OSSEC (NSM 2)

Posted on February 11, 2007July 3, 2020 by Daniel Cid

Richard Bejtlich, from taosecurity, posted two interesting blog entries, where he mentions some ossec alerts.

He says that he got some ossec log alerts, but lacked more information regarding what do you with them. I agree with his assessment, where he used Sguil to get more network-based details to see what happened during that time. However, in addition of using a network sensor, he could have setup a log server, where he would be able to do a great deal of analysis with his log data (without ever touching the affected system).

Using firewall logs, for example, he would be able to see all connections during that time from that IP address. Looking at authentication messages from all his systems, he would be able to see if that IP was ever able to connect remotely, or if it ever accessed any other service (like http or his mail server, etc).

What am I trying to say here? Well, as I said before, I just want to point that Network Security Monitoring (NSM) along with log analysis can provide much more visibility than any of this two alone.