<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: ttl]]></title>
    <link>http://securityratty.com/tag/ttl</link>
    <description></description>
    <pubDate>Sun, 23 Dec 2007 19:06:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[EPTS: Proposed Event Processing Definitions, September 20, 2006]]></title>
      <link>http://securityratty.com/article/c90d53785950324b36b55747a92766da</link>
      <guid>http://securityratty.com/article/c90d53785950324b36b55747a92766da</guid>
      <description><![CDATA[For interested readers, here are the event processing definitions we provided to the (future) EPTS working group on September 20, 2006, coordinated (edited)by David Luckham and Roy Schulte
adaptive...]]></description>
      <content:encoded><![CDATA[<p>For interested readers, here are the <a href="http://www.thecepblog.com/pdf/EVENT.PROCESSING.DRAFT.GLOSSARY.V4.SEPT.pdf" target="_blank">event processing definitions</a> we provided to the (future) EPTS working group on September 20, 2006, <a href="http://complexevents.com/?p=195" target="_blank">coordinated (edited) by David Luckham and Roy Schulte</a>;</p>
<p><strong>adaptive process management</strong> (n.) an element of resource and business process management, adaptive search and event processing. Sometimes referred to as “Level 4” event processing or process refinement.</p>
<p><strong>application concept</strong> (n.) a definition of a set of properties that represent the data fields of an application entity. An application concept can describe relationships among themselves. For example, an order concept might have a parent/child relationship with an item concept. A department concept might be related to a purchase requisition concept based on the shared property, department_id. Application concepts can include an application state model.</p>
<p><strong>application state modeler</strong> (n.) a UML-compliant application that allows you to model the life cycle of a concept instance — that is, for each instance of a given concept, you can define which states it will pass through and how it will transition from state to state. States have entry actions, exit actions, and conditions, providing precision control over the behavior of an event processing agent. Transitions between states also may have rules. Multiple types of states and transitions maximize the versatility and power of the application state modeler.</p>
<p><strong>derived event</strong> (n.) an event that is created as a result of processing one or more other events.</p>
<p><strong>complex event</strong> (n.) an event that is a situation-entity abstraction of two or more simple, derived or other complex events.</p>
<p><strong>complex event processing</strong> (n.) CEP is a technology for extracting information from message-based systems. CEP is primarily an event processing concept that deals with the task of processing multiple events from an event cloud with the goal of identifying the meaningful events within the event cloud. CEP employs techniques such as detection of complex patterns of many events, event correlation and abstraction, event hierarchies, and relationships between events such as causality, membership, and timing, and event-driven processes.</p>
<p><strong>event</strong> (n.) a instance of an event definition. It is an immutable object that represents a business activity that happened at a single point in time. Just as one cannot change the fact that a given activity occurred, one cannot change an event — events are immutable.</p>
<p><strong>event aggregation</strong> (n.) the aggregation of simple, derived or complex events into higher levels of event abstractions.</p>
<p><strong>event definition</strong> (n.) a set of properties related to a given activity that represents an important or interesting change of state in a human, system or computational activity. An event definition includes event properties such as event priority, event time to live (TTL), and a description of the payload, which is comprehensive information related to the activity that occurred. Events expire when the TTL has elapsed, unless the event processing agent has instructions to consume them prior to that time.</p>
<p><strong>event channel</strong> (n.) a communications channel in which events are transmitted from event source to event receivers, typically received as electronic messages. Each channel can have multiple destination and. events can be configured to transmit to a default destination. JMS is an example of an event channel.</p>
<p><strong>event cloud</strong> (n.) a partially ordered set of events (poset), either bounded or unbounded, where the partial orderings are imposed by the causal, timing and other relationships between the events. Typically an event cloud is created by the events produced by one or more distributed systems. An event cloud may contain many event types, event streams and event channels. The difference between a cloud and a stream is that there is no event relationship that totally orders the events in a cloud.</p>
<p><strong>event-driven</strong> (n.) the behavior of a human, system or computational entity whose execution or actuation is in response to events, typically received as electronic messages.</p>
<p><strong>event-driven architecture</strong> (n.) an architectural style for distributed computing applications in which some of the components are event-driven and communicate by means of events.</p>
<p><strong>event processing</strong> (n.) computing that performs operations on events, including modifying, creating and destroying events.</p>
<p><strong>event-object</strong> (n.) an software object that represents an event, generally for the purpose of computer processing, that exhibits both encapsulation, inheritance and polymorphism.</p>
<p><strong>event prediction</strong> (n.) computational activity where the impact of events, complex events, and situations caused by events identified, including both opportunity or threat. Sometimes referred to as “Level 2” event processing, impact assessment or predictive analytics.</p>
<p><strong>event pre-processing</strong> (n.) computational activity where events are cleansed or normalized to produce semantically understandable data. Sometimes referred to as “Level 0” event processing.</p>
<p><strong>event processing</strong> (n.) computational activities on events dealing with the association, correlation, and combination of event data and information from single and multiple event sources to achieve refined identity and situation estimates for observed event objects, and to achieve complete and timely assessments of opportunities, threats, and their significance. Event processing is characterized by continuous refinements of event estimates and assessments and by evaluation of the need for additional sources, or modification of the process itself, to achieve improved results.</p>
<p><strong>event processing agent</strong> (n.) an EPA is a computational entity that performs event processing.</p>
<p><strong>event processing network</strong> (n.) a set of event processing agents and a set of event channels connecting them.</p>
<p><strong>event properties</strong> (n.) data representation of an event, typically by name-value pairs of type string, integer, real, boolean or a complex data type.</p>
<p><strong>event refinement</strong> (n.) filter, identify and track events &amp; make initial processing decisions based on association, correlation and state estimation. Sometimes referred to as “Level 1” event, or event-object, track and trace.</p>
<p><strong>event stream</strong> (n.) a time-ordered sequence of events. An event stream may be bounded by a certain time interval or other contextual dimension (content, space, source, certainty), or be open ended and unbounded.</p>
<p><strong>event stream processing</strong> (n.) a time-ordered sequence of events. An event stream may be bounded by a certain time interval or other contextual dimension (content, space, source, certainty), or be open ended and unbounded.</p>
<p><strong>rule</strong> (n.) defines what triggers unusual, suspicious, problematic, or advantageous activity within an event processing agent and what the EPA does when it discovers these types of activities. Rules execute actions based on certain conditions on events, instances, or a combination of both. A rule includes a group of condition-rule statements and action-rule statements. The condition statements instruct the EPA what to look for in events, and action statements instruct the EPA how to respond when conditions are met. If all the conditions in a rule are satisfied by events or instances or both, the EPA fires the actions. The action might be to execute tasks, create an event instance, modify property values in an event instance, create and send an event, or something else.</p>
<p><strong>rules engine</strong> (n.) a type of event processing agent that uses a declarative programming model to process events. Formally described as &#8220;an abstract structure that describes a formal language precisely, i.e., a set of rules that mathematically delineates a (usually infinite) set of finite-length strings over a (usually finite) alphabet“. Informally, it can be any system that uses rules, in any form, that can be applied to data to produce outcomes.</p>
<p><strong>rule language</strong> (n.) is an artificial language that is used to control the behavior of an event processing agent. Rules languages, like human languages, have syntactic and semantic rules to define meaning.</p>
<p><strong>situation refinement</strong> (n.) identify situations, or complex events, based on event clustering, event-event relationships and relationship analysis and context. Sometimes referred to as “Level 2” event processing.</p>
<p><strong>simple event</strong> (n.) an event that is not an abstraction or composition of other events.</p>
<p><strong>virtual event</strong> (n.) an event that is imagined, modeled or simulated.</p>
<hr />Note:  The Emerging Technologies Engineering Team at <a href="http://www.tibco.com" target="_blank">TIBCO Software </a>significantly contributed to these event processing terms and definitions.</p>
]]></content:encoded>
      <pubDate>Thu, 21 Aug 2008 01:47:11 +0000</pubDate>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/event-object">event-object</category>
      <category domain="http://securityratty.com/tag/business process management">business process management</category>
      <category domain="http://securityratty.com/tag/process">process</category>
      <category domain="http://securityratty.com/tag/event correlation">event correlation</category>
      <category domain="http://securityratty.com/tag/process refinement">process refinement</category>
      <category domain="http://securityratty.com/tag/simple">simple</category>
      <category domain="http://securityratty.com/tag/simple event">simple event</category>
      <category domain="http://securityratty.com/tag/process events">process events</category>
      <source url="http://www.thecepblog.com/2008/08/21/epts-proposed-event-processing-definitions-september-20-2006/">EPTS: Proposed Event Processing Definitions, September 20, 2006</source>
    </item>
    <item>
      <title><![CDATA[Visualized Storm fireworks for your 4th of July]]></title>
      <link>http://securityratty.com/article/cd69cdbb404159575b86657784e007bb</link>
      <guid>http://securityratty.com/article/cd69cdbb404159575b86657784e007bb</guid>
      <description><![CDATA[As expected, the Storm botnet maestros have queued up some pwnage for your 4th of July
See the SANS diary for all the details
Upon receipt of my first fireworks.exe sample this evening, I went through...]]></description>
      <content:encoded><![CDATA[As expected, the Storm botnet maestros have queued up some pwnage for your 4th of July. <br />See the SANS <a href="http://isc.sans.org/diary.html?storyid=4669" target="_blank">diary</a> for all the details.<br />Upon receipt of my first fireworks.exe sample this evening, I went through the standard routine and ran it through the analysis mill. Like the ISC said, not much new here, but if you'd like the nitty-gritty, I've put the analysis report <a href="http://holisticinfosec.org/analysis/storm/fireworks/fireworks_storm.txt" target="_blank">here</a>, the peers config list <a href="http://holisticinfosec.org/analysis/storm/fireworks/peers.txt" target="_blank">here</a>, and the pcap <a href="http://holisticinfosec.org/analysis/storm/fireworks/fireworks.pcap" target="_blank">here</a>.<br />However, what I was really inspired to do this evening was visualize the pcap with Raffael Marty's AfterGlow. His new <a href="http://www.amazon.com/Applied-Security-Visualization-Raffael-Marty/dp/0321510100" target="_blank">book</a>, Applied Security Visualization, is coming out next month, so we can turn old Storm news into a celebration of the 4th and the pending release of Applied Security Visualization. By the way, Raffael's visualization workshop slides from the 20th Annual <a href="http://www.first.org/" target="_blank">FIRST</a> Conference in Vancouver, B.C. last week are <a href="http://www.secviz.org/content/applied-security-visualization-first-2008-talk" target="_blank">here</a>, and mine regarding Malcode Analysis for Incident Handlers are <a href="http://holisticinfosec.org/publications/McRee_MATFIH_FIRST_final.pdf" target="_blank">here</a>.<br />So, a little AfterGlow magic,<br /><span style="font-style:italic;">tcpdump -vttttnnelr /home/rmcree/pcap/fireworks.pcap | ./tcpdump2csv.pl "sip dip ttl" | perl ../graph/afterglow.pl -c /home/rmcree/afterglow/src/perl/graph/color.properties -p 2 | neato -Tgif -o fireworks.gif</span>, and the results look just like the fireworks we hoped they would. <br />Happy 4th of July everyone! <br />Except you Storm a$$hat$. ;-)<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://holisticinfosec.org/analysis/storm/fireworks/fireworks.gif" target="_blan"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;width: 320px;" src="http://holisticinfosec.org/analysis/storm/fireworks/fireworks.gif" border="0" alt="" /></a><br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/07/visualized-storm-fireworks-for-your-4th.html&title=Visualized%20Storm%20fireworks%20for%20your%204th%20of%20July " title="Visualized Storm fireworks for your 4th of July ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/07/visualized-storm-fireworks-for-your-4th.html" title="Visualized Storm fireworks for your 4th of July ">digg</a>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 16:54:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/4th">4th</category>
      <category domain="http://securityratty.com/tag/fireworks">fireworks</category>
      <category domain="http://securityratty.com/tag/july">july</category>
      <category domain="http://securityratty.com/tag/security visualization">security visualization</category>
      <category domain="http://securityratty.com/tag/happy 4th">happy 4th</category>
      <category domain="http://securityratty.com/tag/peers config list">peers config list</category>
      <category domain="http://securityratty.com/tag/afterglow">afterglow</category>
      <category domain="http://securityratty.com/tag/visualization workshop slides">visualization workshop slides</category>
      <category domain="http://securityratty.com/tag/raffael marty">raffael marty</category>
      <source url="http://holisticinfosec.blogspot.com/2008/07/visualized-storm-fireworks-for-your-4th.html">Visualized Storm fireworks for your 4th of July</source>
    </item>
    <item>
      <title><![CDATA[Storm-Bot stripshow analysis]]></title>
      <link>http://securityratty.com/article/f93548291cc0e5f1e9e6da2a0c5fafe8</link>
      <guid>http://securityratty.com/article/f93548291cc0e5f1e9e6da2a0c5fafe8</guid>
      <description><![CDATA[Merry Christmas from the RBN. Now on a PC near you, a stripshow from Santa's helpers. Or not
The ISC reported the expected Storm surge Christmas eve at 0000 GMT
hxxp://merrychristmas.com/stripshow.exe...]]></description>
      <content:encoded><![CDATA[Merry Christmas from the RBN. Now on a PC near you, a stripshow from Santa's helpers. Or not.<br />The <a href="http://isc.sans.org">ISC</a> reported the expected <a href="http://isc.sans.org/diary.html?storyid=3778">Storm surge</a> Christmas eve at 0000 GMT. <br />hxxp://merrychristmas.com/stripshow.exe (modified to protect the innocent) yields a hash of 2BBA62FBC3B9AF85C3C7D64A82E1237C. Once executed it immediately copies itself as disnisa.exe to C:\WINDOWS and adds a startup registry key for the same. <br /><br />Current AV detection includes:<br />Kaspersky stripshow.exe - Email-Worm.Win32.Zhelatin.pd. <br />eTrust-Vet - Win32/Sintun.AT<br />Microsoft - Trojan:Win32/Tibs.gen!ldr<br />Symantec - Trojan.Peacomm.D<br /><br />After a quick time check to Microsoft's time server, this variant switches immediately to very noisy P2P on a variety of ports. In addition to the ISC-recommended HTTP and email blocks for outbound to merrychristmasdude.com, you have to consider if you really need outbound UDP traffic above 1024. I'm a firm believer in deny all and make exceptions only via legitimate business case. If you can achieve such lockdown, even though your hosts may suffer infection, they won't be communicating with their friends and neighbors. <br />From API analysis we see a few interesting tidbits:<br /><span style="font-style:italic;"><br />w32tm /config /update<br />403014     Copy(c:\malware\stripshow.exe->C:\WINDOWS\disnisa.exe) <br />77e6bc59     WriteFile(h=7a0) <br />403038     RegOpenKeyExA (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) <br />40305f     RegSetValueExA (disnisa) <br />402ba0     WinExec(w32tm /config /syncfromflags:manual /manualpeerlist:time.windows.com,time.nist.gov,100) <br />77e7d0b7     WaitForSingleObject(788,64) <br />402ba8     WinExec(w32tm /config /update,100) <br />40309b     CreateProcessA(C:\WINDOWS\disnisa.exe,(null),0,(null))<br />4030df     WinExec(netsh firewall set allowedprogram "C:\WINDOWS\disnisa.exe" enable,100) <br />71ab52c6     LoadLibraryA(C:\WINDOWS\system32\mswsock.dll)=71a50000 <br />71a5716a     LoadLibraryA(C:\WINDOWS\system32\mswsock.dll)=71a50000 <br />71aa14eb     GlobalAlloc() <br />40da1b     bind(8c, port=26790) <br />77e7ac53     CreateRemoteThread(h=ffffffff, start=404b05) <br />40da1b     bind(b8, port=7018) <br />40d9c7     listen(h=b8 ) <br />40a262     WaitForSingleObject(d4,2710)  <br /></span><br />Nice, do a little time sync, allow ourselves through the firewall, then bind, listen, and wait.<br />First, add another registry entry,<br /><span style="font-style:italic;"><br />0cd2d     RegCreateKeyExA (HKLM\Software\Microsoft\Windows\ITStorage\Finders,)<br /></span><br />then start connecting:<br /><span style="font-style:italic;"><br />71a54cee     LoadLibraryA(C:\WINDOWS\system32\mswsock.dll)=71a50000 <br />77e7ac53     CreateRemoteThread(h=ffffffff, start=71a519c4) <br />40d9f1     connect( 193.33.146.178:24714 ) <br />40d9f1     connect( 74.60.173.98:3887 ) <br />40d9f1     connect( 58.74.135.13:30843 ) <br />40d9f1     connect( 222.119.113.135:22295 ) <br />40d9f1     connect( 71.234.220.147:20232 ) <br />40d9f1     connect( 76.84.231.43:14172 ) <br />40d9f1     connect( 124.5.147.194:16544 ) <br />40d9f1     connect( 58.8.236.130:13224 ) <br />40d9f1     connect( 190.79.151.75:2952 ) <br />40d9f1     connect( 58.8.122.191:29646 ) <br /></span><br />Once this little bugger hits the network, expect flood-like traffic. <br />My infected sandbox victim exhausted my 1.5mb DSL connection instantly, in part from a ton of inbound responses from peers being logged at my firewall:<br /><span style="font-style:italic;"><br />SRC=78.166.75.60 DST=192.168.0.3 LEN=53 TOS=0x00 PREC=0x00 TTL=105 ID=59178 PROTO=UDP SPT=24045 DPT=26790 LEN=33 <br />SRC=78.166.75.60 DST=192.168.0.3 LEN=53 TOS=0x00 PREC=0x00 TTL=105 ID=60978 PROTO=UDP SPT=24045 DPT=26790 LEN=33 <br />SRC=78.166.75.60 DST=192.168.0.3 LEN=53 TOS=0x00 PREC=0x00 TTL=105 ID=4987 PROTO=UDP SPT=24045 DPT=26790 LEN=33 <br />SRC=78.166.75.60 DST=192.168.0.3 LEN=53 TOS=0x00 PREC=0x00 TTL=105 ID=6619 PROTO=UDP SPT=24045 DPT=26790 LEN=33 <br />SRC=78.166.75.60 DST=192.168.0.3 LEN=53 TOS=0x00 PREC=0x00 TTL=105 ID=13762 PROTO=UDP SPT=24045 DPT=26790 LEN=33 <br />SRC=78.166.75.60 DST=192.168.0.3 LEN=53 TOS=0x00 PREC=0x00 TTL=105 ID=18384 PROTO=UDP SPT=24045 DPT=26790 LEN=33 <br />SRC=78.166.75.60 DST=192.168.0.3 LEN=53 TOS=0x00 PREC=0x00 TTL=105 ID=19891 PROTO=UDP SPT=24045 DPT=26790 LEN=33<br /></span> <br />At last, the peer list referred to by the ISC, written to C:\WINDOWS (many more entries not included):<br /><span style="font-style:italic;"><br />[config]<br />[local]<br />uport=20142<br />[peers]<br />00003D6C8F338A3FDD3DF3648666F55C=0CCE03EE2BD100<br />0100A634122F3553A046EC451061927C=0CCEEF9C5BF700<br />02007E238D780D25FD5511285E2E596E=0CD9D73081A500<br />03001E62DC533E7AF6161729A953891B=180BB9671B4800<br />0400EB5EC13599373A3D544A2D6AF94F=180FAC024F7300<br />05004710B3440F5D2117CE555A62D04A=1810D0AE22DA00<br />06001471521206296D099433C93EC427=1813911C2E6100<br />07002D6D5B0FE3019C56B1290A564E59=1820B08043D700<br />0800A2417153943DC23C6C5C817C4159=18257B254F2600<br /></span><br /><br />There's nothing new or exciting here: SPAM component, headless P2P, seasonal social engineering, fast flux, and other pervasively annoying attributes.<br />User awareness, as always, is your strongest defense.<br />Cheers and happy holidays, except for you RBN a$$h0735.<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2007/12/storm-bot-stripshow-analysis.html&title=Storm-Bot%20stripshow%20analysis" title="Storm-Bot stripshow analysis del.icio.us"><img src="http://holisticinfosec.org/images/delicious.png" class="socialbkmark" border=0 alt="Storm-Bot stripshow analysis at del.icio.us"></a><a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2007/12/storm-bot-stripshow-analysis.html" title="Storm-Bot stripshow analysis "> <img src="http://digg.com/img/badges/16x16-digg-guy.gif" border=0 class="socialbkmark" alt="Digg Storm-Bot stripshow analysis "></a>]]></content:encoded>
      <pubDate>Sun, 23 Dec 2007 19:06:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/40d9f1 connect">40d9f1 connect</category>
      <category domain="http://securityratty.com/tag/w32tm config syncfromflags">w32tm config syncfromflags</category>
      <category domain="http://securityratty.com/tag/config">config</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/quick time check">quick time check</category>
      <category domain="http://securityratty.com/tag/w32tm config">w32tm config</category>
      <category domain="http://securityratty.com/tag/exe">exe</category>
      <category domain="http://securityratty.com/tag/src78">src78</category>
      <category domain="http://securityratty.com/tag/dst192">dst192</category>
      <source url="http://holisticinfosec.blogspot.com/2007/12/storm-bot-stripshow-analysis.html">Storm-Bot stripshow analysis</source>
    </item>
  </channel>
</rss>
