Wordlist Manipulation

Today I wanted to append and/or prefix a brute force wordlist with some numbers, to generate some likely passwords. I couldn't find a good program to do this, so I tried my hand at some shell scripting. I got too ambitious and tried to add functions to remove duplicates (using the 'uniq' Unix command), sort the list (using the 'sort' Unix command) and do replacement (using the 'sed' Unix command). But all of these proved too time consuming to do right. I didn't want to force the list to be sorted alphabetically in case it was already sorted in a different way (likelihood of use, for example), so the 'uniq' command was useless. And the 'sort' command is so easy you might as well just use it alone. I didn't feel like putting the time into developing the "replace" function since I don't use it all that often (except for capitalizing the first letter, but Brutus has a tool to do that). So here's my script. Don't laugh, it's the first coding I've done since Dr. Scheme, about 5 years ago.

#!/bin/sh

##  listperm.sh - Takes a wordlist and performs permutations on it
##  Copyright (C) 2008 Beau Woods (beauwoods.com)
##
##  This program is free software: you can redistribute it and/or modify
##  it under the terms of the GNU General Public License as published by
##  the Free Software Foundation, either version 3 of the License, or
##  (at your option) any later version.
##
##  This program is distributed in the hope that it will be useful,
##  but WITHOUT ANY WARRANTY; without even the implied warranty of
##  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
##  GNU General Public License for more details.
##
##  You should have received a copy of the GNU General Public License
##  along with this program.  If not, see http://www.gnu.org/licenses/.

##  This script will take a wordlist and either prefix (-p) or append (-P)
##  each line with each line of the file it is to be combined with. For
##  modularity, it will generate new lists rather than overwriting the
##  old ones.

##  Command line options:
##  -in [filename] - This is the wordlist you want to permutate.
##  -out [filename] - This is the list of characters to add.
##  -p [filename] - This will prefix the wordlist with another list.
##  -P [filename] - This will append the wordlist with another list.

vflag=on
ops=0
while [ $# -gt 0 ]
do
 case "$1" in
  -in) infile=$2; shift;;
  -out) outfile=$2; shift;;
  -p) prefile=$2; shift;;
  -P) postfile=$2; shift;;
  *) echo "Error: Unexpected Argument: "$1; error=1; break;;
 esac
 shift
done
 
##  This if block will check to see if the input file is given and will
##  throw an error if not.
if [ -z $infile ]; then
 echo "Error: No input file specified."
 error=1;
fi

##  This if block will check to see if the output file is given and will
##  throw an error if not.
if [ -z $outfile ]; then
 echo "Error: No output file specified."
 error=1;
 else
 ##  This checks to see if the output file exists and if it does, throws
 ##  an error and exits the program. I don't want to clobber the file.
 if [ -f $outfile ]; then
  echo "Error: The output file already exists. Please delete it"
  echo "       and rerun the script."
  error=1;
 fi
 ##  OK, now that we know the file doesn't exist, let's create it!
 touch $outfile
fi

##  This if block checks to see if more than one permeutation operation
##  is called and if so, throws an error message.
if [ $ops -gt 1 ]; then
 echo "Error: Only one permeutation option may be run at once."
 error=1;
fi

if [ $error ]; then
 echo >&2
 echo "Options: -in [filename] -out [filename] -p [filename] -P [filename]"
 echo ""
 echo "  This script will take a wordlist and either prefix (-p) or append (-P)"
 echo "  each line with each line of the file it is to be combined with. For"
 echo "  modularity, it will generate new lists rather than overwriting the"
 echo "  old ones."
 echo ""
 echo "  Command line options:"
 echo "  -in [filename] - This is the wordlist you want to permutate."
 echo "  -out [filename] - This is the output file."
 echo "  -p [filename] - This will prefix the wordlist with another list."
 echo "  -P [filename] - This will append the wordlist with another list."
 echo ""
 exit 1;
fi

##  This will determine if we are doing a prefix or append operation and will
##  set the input file correctly. We could do this at the beginning, but if
##  the arguments are out of order then something might get clobbered.
if [ $prefile ]; then
 postfile=$infile;
 else
 if [ $postfile ]; then
  prefile=$infile;
 fi
fi

#####
##  OK, time to start doing work!
#####

##  This checks to see if the operation is a concatenation and combines the files.
for word in $(cat $prefile); do
 for i in $(cat $postfile); do
  echo "$word""$i" >> $outfile
 done
done

Shmoocon

I'll be at Shmoocon in Washington, DC on the weekend after Valentine's Day. If anybody wants to meet up or something, get in touch with me.

Mac OS X Trojan Horse - Wolf in Sheep's Clothing?

Recently, a Mac OS X Trojan Horse was spotted in the wild. Pretty much everyone reported on it. But the best analysis I've seen is at SecuriTeam.

This is not a new type of attack. There is no new vulnerability exploited. This is not a novel attack, such as a driver exploit. This does not use some new social engineering technique or distribution method. This is not the first instance of organized crime (presumably) attempting to make money from exploiting systems. So why is everybody making a big deal about the new malware? People are making a big deal about this one because of what it is not: a Microsoft attack.

This new Trojan Horse is the first one to take an established commercial malware framework to the Apple platform. For years, these fake codecs have troubled the Windows platform, making untold amounts of money for their creators. They hijack the user's Internet experience and target people inexperienced with computers. But until now, the relatively simple task of adapting these programs for the decade old operating system has been left undone. I believe that there are two reasons for this shift.

The number of people using Apple computers (and therefore OS X) has exploded over the last year and a half. I am currently sitting at a coffee shop and an informal survey shows that there are 12 Macs and only 6 PCs (including, unfortunately, mine). While this is an atypical distribution of hardware, it underscores the point. I know that most of these have been purchased within the last year and a half because they are almost all running on the Intel platform.

As the proportion of Mac users increases, the community is bound to decrease in computer experience. For the last few years, Apple has had a loyal core of customers who are technologically savvy and educated about proper use and maintenance of their machines. However, the recent adopters are typically more casual computer users. This statistic is based on anecdotal evidence, but it seems that most other observers have drawn the same conclusion.

These two trends, increased install base and decreased expertise, will continue upward as computer activities become increasingly platform independent. As more and more services are moved to a Web based format, the importance of a single operating system will diminish. However, malware will continue to exploit the underlying system resources because this is a viable source of income.

Criminal organizations' involvement in computer based crime has drastically risen in prevalence and sophistication over the last few years and there is no reason to believe that this will change. Just like with any money-making organization, these enterprises wish to maximize their revenue streams by exploiting new markets. In order to grow, new resources must be acquired. It appears that Apple computers have been firmly identified as a new resource for criminals.

And like any other emerging market, what is pioneered by one group will quickly be followed by other players. In other words, other criminal organizations will follow suit and develop their software for the OS X operating system to compete with this group's product offering. Eventually, this market segment will become more mature with a high percentage of organized criminals developing for both Windows and OS X platforms the way that other software makers do. What used to be a hobbiest market will be filled by mature product offerings.

If there is nothing new about a piece of malware, it should not be a big deal. But this one is a big deal that many people will only recognize too late. This Trojan Horse is something new precisely because it's just business as usual.

Long Time, No Post

It's been quite a while since I posted last. Sorry, I've been busy. But I do keep my "Interesting Articles" section updated. That is over on the right side of your screen (assuming you're looking at my blog and not the RSS feed). That list is all of the articles that I have read in Google Reader and chosen to "share" via the button at the bottom of each story. I wish that there was a way that you could click to get all of the links, not just the last five or so. I'm sure that there is, I just don't know how to do it so if anybody does, drop me a line.

For the record, I am working on some other public stuff, but I'm going to keep that under wraps for now. Nothing groundbreaking or significant, just adding to the general InfoSec fluff out there. If I had as much time as I do ideas I'd live forever. Hopefully I can gt better at figuring out which ones are worth pursuing so I don't spend my time starting into things that I don't end up finishing.

Perfect Security Is Impossible

I saw this post on securosis.com and it seemed like a great launching point for a discussion here. I want to take one point that he makes, that people seem to ask "what can I do to fix problems after the fact?" The fact that people ask this question hides a couple of addressable assumptions they often make about computer security.

The first of these is that computer problems should be addressed reactively, rather than proactively. Some people take the stance that they will always be vigilant, but many realize that they don't always do what they should. For example, most people know that they should have their vehicles serviced regularly for a multitude of maintenance issues, such as oil changes, brake replacement, tire rotation, check fluids, etc. But many of the drivers out there do not take these precautions as often as they should. Instead, they may take the attitude of "I'll fix it if it breaks." This may not necessarily be conscious decision, either; it may be that the "out of sight, out of mind" rule takes over, or that the owner is too busy to attend to it at the moment.

The reactive attitude also assumes that everything can be fixed and put back perfectly in place as it was. This assumption runs a little bit deeper in most people, because they do not really know how computers operate. On a car, a bent frame is not perfectly repairable; in our bodies, a removed organ does not grow back; in the universe, time flows only in one direction. Yet even mechanics, doctors, and scientists may not really understand that a computer can be broken in a way that is irreparable.

Fortunately, with computers we can address problems proactively. Computer security deals with protecting Confidentiality, Integrity, and Availability (the so-called C.I.A. triad). These are the three aspects of the rest of our lives that most of us attempt to protect, as well. It follows, then, that we should view our responsibilities towards our computers safe as we do our responsibilities to keeping ourselves safe.

Using caution applies to technology as with anything. Stay away from the seedier side of the Internet as you would stay away from the seedier side of the city you live in. If you need a hand deciding which are the well-lit streets and which are the back alleys, there are tools to help. McAfee Site Advisor is an excellent tool, and tends to err on the side of caution. K9 Web Protection will actually block many sites that you may wish to avoid, though it's not fool proof.

Be observant of your surroundings. If something seems not quite right, don't be afraid to be suspicious. If your computer is acting strangely or if the email from the IRS sounds fishy (phishy), then investigate the problem.

Be ready to take action. When you have determined that something strange is definitely going on, make sure you know what to do. If you don't know what to do, then know who you can speak with to find out. But more importantly, when you have figured out the proper action to take, don't delay! Many issues are exacerbated by doing nothing when you should be doing something (or vice-versa).

Finally, be prepared to fix or workaround the problem. Something will happen someday that will compromise the C.I.A. of your computer. Whether that means you delete the wrong files, you get a virus, or your house burns down, something will happen to your digital life someday. No one, even us geeks, is immune. Have backups, antivirus, etc. ready when you need them.

All of these lessons can, and should, be applied to the real world. Most of us understand this, even if we don't practice it every day. But too many people don't seem to realize that computers are not immune from the same physical realities of everything else. Either that or they are afraid to ask about these things. But Murphy's Law still applies, as does the principle that anyone can learn how to defend themselves against it.