[ITA] HackInBo Spring Edition 2017 – Video

Di seguito il video del mio talk “L’evoluzione del SOC di una infrastruttura critica” tenuto a Maggio 2017 ad HackInBo Spring Edition 2017 (qui le slides).

Potete trovare tutti i video di questa e delle edizioni passate nella pagina youtube di HackInBo

Grazie ancora a Mario, lo staff di HiB ed agli amici di Segment per il montaggio.

The WannaCry journey from a SOC point of view – internal sinkholing of killswitch servers

[ see also: The WannaCry journey from a SOC point of view ]

In the previous post I described how our Security Operation Center managed the WannaCry news.

We also made a lot of side activities in the past hours and one of these was to implement an internal sinkholing of the killswitch servers in case some clients where infected; with a working local sinkholing we where able to avoid the ransomware spreading in case of infection.

Killswitch for WonnaCry ransomware
Killswitch for WonnaCry ransomware

How? Let me explain.

Continue reading “The WannaCry journey from a SOC point of view – internal sinkholing of killswitch servers”

The WannaCry journey from a SOC point of view

#WCry at University of Milano-Bicocca
#WCry at University of Milano-Bicocca

[ see also: how and why we implemented local sinkholed killswitch servers ]

In the past hours a new ransomware called WannaCry (or WCry or WannaCrypt0) spread very fast on Internet and targeted a lot of public and private organizations. The ransomware make use of public exploits related to the last Shadow Brokers leak, in particular MS17-010 vulnerability that was fixed by Microsoft on March 14 (2 months ago). You can read very good tech posts here, here, here and here and I suggest you also to follow on twitter Hacker Fantastic and  Malware Tech.

Here I try to summarize my approach to the news, mainly highlighting what we did  in my company in the past months and how we monitored WCry from our SOC (Security Operation Center).

There was (and there is also now) a lot of hysteria, but for people like me that work in a SOC this is not an acceptable mood; you need to relax, really understand what’s happening and verify that what you did before is enough and, if not, apply emergency countermeasures. Continue reading “The WannaCry journey from a SOC point of view”

[ITA] HackInBo Spring Edition 2017

HackInBo
HackInBo

[ Qui potete trovare slides e video del mio intervento ]

Il 6 e 7 Maggio prossimi parteciperò come relatore ad HackInBo, un evento sulla Sicurezza Informatica totalmente gratuito che si svolge due volte l’anno a Bologna, ed organizzato in maniera del tutto volontaria dal buon Mario ed il suo staff.

HackInBo si differenzia in maniera netta dagli eventi organizzati qua e la dai vari vendor ed integratori di soluzioni di Sicurezza in quanto viene “dal basso”, è organizzato cioè da un gruppo di amici che lo fa per pura passione. Per dire: gli sponsor non possono parlare, saranno ovviamente (e giustamente) ringraziati ma l’unico vantaggio è il posto in prima fila. Continue reading “[ITA] HackInBo Spring Edition 2017”

Block Flash content on Squid proxy

No more flash
No more flash

One of the trending topic I discuss regularly with my company IT department is the need to block Flash content on our navigation proxies.

As a Security people I have no doubt about, Flash must be blocked. Period.

Because I manage some Squid proxy I made this simple and effective configuration in squid.conf  file. Continue reading “Block Flash content on Squid proxy”

Configure OTRS to process multiple Tickets in email Subject

Postfix email relay
Postfix email relay

OTRS Help Desk is an open source application (with Enterprise support) that has a lot of useful features: ITSM, Surveys, Time Accounting and System monitoring.

I use it on my company as a Service Desk for Security purposes (and more).
As you can read from our Success Story one of the feature we currently appreciate is the ability to track all the email exchanges into tickets simply putting ticket number in email Subject end CCing the proper configured email address. This allow us to interact with external parties without the need for other people to access our OTRS istance.  Continue reading “Configure OTRS to process multiple Tickets in email Subject”

SNORT rules Advanced Parser for pulledpork

Lone Hacker in Wharehouse by Brian Klug
Lone Hacker in Wharehouse by Brian Klug

Security Onion is an Ubuntu based distribution created to handle a lot of Security task.

One of the security tool installed is SNORT, the best open source Intrusion Detection System (IDS). Security Onion use Pulledpork to get IDS rules and process them.

I wrote a perl script to make advanced modification to the downloaded SNORT rules. This script can handle rule transformation based on regular expression and multiple substitution patterns. Continue reading “SNORT rules Advanced Parser for pulledpork”