ASCII Art in BackTrack

Someone asks me how do I create the ascii art for my /etc/motd and /etc/issue. Easy:

$ echo -e Google\\nBackTrack\\npentester > motd

$ figlet -cf smslant < motd >> /etc/motd

$ figlet -cf smslant MySeq >> /etc/issue

Spoofing ICMP Echo Request with scapy

Scapy is a powerful packet generator. Here's a quick example how to spoof an ICMP Echo Request packet with Scapy.

# scapy

Welcome to Scapy (2.1.0)

>>> ip=IP()

>>> ip.src='192.168.0.255'

>>> ip.dst='192.168.0.1'

>>> ip.display

<bound method IP.display of <IP src=192.168.0.255 dst=192.168.0.1 |>>

>>> icmp=ICMP()

>>> icmp.type=8

>>> icmp.code=0

>>> icmp.display

<bound method ICMP.display of <ICMP  type=echo-request code=0 |>>

>>> send(ip/icmp)

.

Sent 1 packets.

>>>

ICMP Parameters

A quick revision on the ICMP type (for reference).

Commonly used ICMP types and codes:

• 0, 0 - echo reply
• 8, 0 - echo request
• 3, 0 - dest. unreachable: network
• 3, 1 - dest. unreachable: host
• 3, 2 - dest. unreachable: protocol
• 3, 3 - dest. unreachable: port
• 3, 4 - dest. unreachable: frag needed and DF was set
• 13, 0 - timestamp request
• 14, 0 - timestamp reply
• 15, 0 - info request
• 16, 0 - info reply
• 17, 0 - mask request
• 18, 0 - mask reply

For the full list, please refer to IANA site.

The Cost of Switching to SSL

We can access to Gmail using HTTPS for a long time. Recently, Google has added full SSL service to Gmail and has made some decisive changes to its services. We have seen a redesigned Search, a redesigned YouTube, Google News, changes in Google Apps and the the addition of an Encrypted Search for enhanced security using SSL/TLS.

Most websites do not provide it because it is expected to be something of a high standard and is believed to require powerful servers. On the contrary, the truth is that HTTPS is not at all as resource intensive on the server as it is believed to be.

A Chrome Engineer at Google, Adam Langley writes at the Imperial Violet stating,

all of our users use HTTPS to secure their email between their browsers and Google, all the time. In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that.

However, the downside with SSL is that it includes a considerable latency in connection. This research reveals that there is a latency of 3.5x on SSL handshakes, the method of initializing a connection to  server. Basically, using SSL connections slows down connection establishment to a server. So did Google just compromise speed for security? Definitely not.

Google is using several mechanisms to reduce this latency. See this excerpt from the post at Langley’s blog.

OpenSSL tends to allocate about 50KB of memory for each connection. We have patched OpenSSL to reduce this to about 5KB.

Moreover Google also caches most HTTPS requests which allows it to serve them faster in subsequent queries. Google claims that this resume behavior takes place 50% of the time. SSL has been optimized at its best at Google.

These facts prove that SSL is not as resource intensive as it is blamed to be. The fact of it being more expensive is just a commercial aspect and a business policy.

IDS Evasion by TCP Checksum

Good posting at Packetstan about potential evasion where IPS fails to validate TCP checksums.

Summary:

• If IDS turns off the validation on TCP checksum, packet evasion is possible.
• First, establish the 3 way-handshake.
• Then, fool the IDS by sending a RST packet with bad TCP checksum.
• Then continue sending the EVIL packets.