Hunting: Recent news and your proxy logs

If you have been reading any of the blog posts or the twitter verse the past few months you might have seen reference to some Adobe Flash and Microsoft 0-days being used and maybe wondering if you have been a victim. Using nuggets of open source  intelligence like info from these posts by ShadowServer and  Sophos you just might have enough  data to search your proxy logs and see if you have experienced any of these attacks. You do have your web traffic going through a proxy don’t you? If you don’t you should start doing it and start collecting the logs. The logs are a treasure trove of information if you want to go hunting.

So let’s go on a hunt.

For this hunt like previous onces I will be using ArcSight Logger because that is what I have access to. I will also be leveraging websense for the proxy logs as well.

Indicators from the ShadowServer and Sophos blogs:

deploy.html,faq.htm,deployJava.js,movie.swf?apple,BrightBalls.swf?Elderwood

Logger Query:

deviceVendor = “Websense” AND  ( ( ( requestUrlFileName CONTAINS “deploy.html” )  OR  ( requestUrlFileName CONTAINS “deployJava.js” )  OR  ( requestUrlFileName CONTAINS “movie.swf” )  OR  ( requestUrlFileName CONTAINS “BrightBalls.swf” )  OR  ( requestUrlQuery CONTAINS “Elderwood=” )  OR  ( requestUrlQuery CONTAINS “apple=” ) ) )

Now this isn’t the most efficient query because of the CONTAINS operators but there is a trade off when doing searches like this and you just have to be prepared for it. There could also be some false positives as well espically around faq.htm so be prepared to use a  little excel foo. Or you can leave the faq.htm off I will leave that up to you. I did a quick hunt and went back 2 weeks and got the following hits:

Notice the swf file is different but the query was for Elderwood.  If I had just put  BrightBalls.swf?Elderwood as a search parameter I would have missed it. Good thing the bad guys used the same query string.  So do some experimenting you might find slicing and dicing on key terms will get you more data and more places to keep hunting.

Now for me this showed a sign I needed to do more digging and going for some packets to review if you have them and perhaps another search this time adding Geoffrey.swf as a search parameter to see if there is anything additional there.

As always happy hunting!

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: