FIM or “File Integrity Monitoring” can be defined as the process of validating the integrity of operating system and applications files with a verification method using a hashing algorythm like MD5 or SHA1 and then comparing the current file state with a baseline. A hash will allow the detection of files content modification but other information can be checked too: owner, permissions, modification time. Implemeting file integrity monitoring is a very good way to detect compromized servers. Not only operating system files can be monitored (/etc on UNIX, registry on Windows, share libraries, etc) but also applications (monitoring your index.php or index.html can reveal a defaced website).
During its implementation, a file integrity monitoring project may face two common issues:
- The baseline used to be compared with the current file status must of course be trusted. To achieve this, it must be stored on a safe place where attacker cannot detect it and cannot alter it!
- The process must be fine tuned to react only on important changes otherwise they are two risks: The real suspicious changes will be hidden in the massive flow of false-positives. People in charge of the control could miss interesting changes.
There are plenty of tools which implement FIM, commercial as well as free. My choice went to OSSEC for a while. My regular followers know that I already posted lot of articles about it. I also contributed to the project with a patch to add Geolocatization to alerts. This time, I wrote another patch to improve the file integraty monitoring feature of OSSEC.
Today, disk space is not an issue for most of us. I remember when my father came back at home with my first hard drive (80MB!) for my Amiga in the Nineties. My reaction was “Wow, we will never fill it!“. Today, if I make a sum of all my storage at home, I’m above 10TB! And I’m sure that I will have to add more capacity in the coming months. No, this blog post is not related to “big data” but more a reflection about how developers write applications today. Again, when I was learning programming languages, professors always remembered to the students to keep our eyes on our resources: memory, CPU cycles, I/O and storage. One of the golden rule was: “If you allocated memory, don’t forget to free it! malloc() means free()“. Yeah, at this time, there was no 
. Today, computer resources are not a problem anymore. Their prices continue to decrease and the reflex of most developers is just to add resources (“Your application is slow? Add 2 cores and 2 gig of memory“).
A quick post to share with you my feedback about an issue I faced after a 
I’m just back from an Easter break with $WIFE and $KIDS but it does not mean that I was completely disconnected. Between familly activities, I read some items pending in my todo list. One of them was the book called “Penetration Testing – Setting Up a Test Lab How-To” from 
Here is a quick review of a book about the well-known network sniffer: 
This is my first post in 2013! Every begining of a new year, people tend to make a list of good resolution. I also did and one of them is to switch from Perl to Python to develop! Being a Perl addict for years, I don’t expect to completely abandon my beloved language but… I must be able to write better Python scripts! It’s a fact: Python is more and more chosen as the preferred language in many open source projects. I just started to read the 
Claudio Guarnieri and his developers gave us a great gift to finish the year. A few days before Christmas, they released the version 0.5 of 
“Security by obscurity is bad!“… Most infosec professionals will tell you this. The principle is to implement security by hiding stuff in the installation of tools or solutions. Often, people using security by obscurity believe that their stuff will be properly protected (not found by the attackers). But this technique will protect you only during the reconnaissance phase of the attacker. It will just make his task more difficult to gather interesting information.
Open proxies… Everybody likes them! Please don’t immediately think about malicious activities… Of course, open (and chained) proxies can be useful to make you anonymous on the Internet but they can also by very interesting for “good” purposes. As a pentester, they can help you to distribute your reconnaissance phase across multiple IP addresses and to reduce the risk to be identified. Most log management solution come with out-of-the-box light currelation rules to detect brute-force attacks (“if event X is seen Y times in a time window of Z seconds, pop up an alert“). Finally, you can use them to avoid stupid blacklists system which try to prevent you to abuse an online service. Note that in this (my) context “abuse” means “accessing several times the same resources for research purposes“. Nothing malicious!
