Busy away from office this week

For everyone out there that enjoys St. Patrick's Day, I hope everyone had a good time and much fun. This week I did not get too much in terms of taking in the holiday, but it made the time go by quick.

This weekend I was sent out by my work to do some forensic and incident response consulting for some clients down in Southern California. The fuse was very short on this and I ended up leaving on a plane flight down to LA with just a few hours of the original notification. I got to work with some really good people that work hard at their job and really but all their efforts to bear. I even saw a novel method of pushing out a script they used while I was on-site so it was pretty rewarding. In all it was good work to do and then on Tuesday I was returning back to the Central Valley.

Wednesday I had to go back into the Bay Area and visit clients in San Jose. All day visit there was productive and I got to use much of my stored up energy. I noticed that I really seem to come alive when I am doing my job and especially so when there is a mission to accomplish. As a side note, I tried visiting this client a week ago but car problems left me on the side of the road waiting for a tow and getting the alternator replaced. Sometimes, older cars do that.

I have my wife and son Jason to thank for being very supportive and understanding of all this time away as it take away time we would normally spend if things were quiet. Jason is too young to truly understand but I do think that he notices something is not the normal.

Fun with Apache 2 and help from helpful sources

After I got the major work things out of the way and while I was waiting for a matter to come back to me I had some time to look at the major differences of running a Snort IDS sensor on Debian 5. First and foremost, I found I had a bit of a learning curve going from the webserver Apache 1.x to Apache 2. One of those was the modular setup that Apache 2 and how a seperate SSL package wasn't nessesary. But it was not without its problem to work out.

A half hour into a reload this evening I could only get regular HTTP web traffic to work, but no TLS/SSL-encrypted web sessions. Later today I had to watch Jason while dinner was being made and I can say he helped me figure out the problem.

While I was studying how to enable 'sites' in Apache 2, Jason was sitting on my lap and looking around the desk. I was lucky in getting a few nice pictures like this one at the time. Soon thereafter I made a breakthrough and I got the Apache2 SSL issue fixed.

I can also report that it may not be possible to pack in the standard Debian install, Apache 2, Snort, and MySQL and assorted networking tools into a 450-Mb parition. (Yes, I was trying to sqeeze in the install into a small compact-flash (CF) card, but it just means I need to use my 4 Gb CF card!)

Snort-SGuil IDS and new Debian version

A little background: Late last night after everyone else in the house went to sleep I was watching TV and doing a bit of research on an intrusion detection system (IDS) project I am working on in my spare time. I am a fan of the Snort IDS system and have been working with it for at least 5 or so years. About 4 years ago I was introduced to a network monitoring front-end that does outstanding data correlation and event reporting without having to perform regular browser-screen refreshing like you would have to do using the legacy ACID or BASE packages. Its called SGuil and you can read more about it by going to this link.

Anyway last night while I was looking around for SGuil configuration tips and advice I appened over to the Debian Linux homepage and what do I discover???! I found out that Debian 5 is now out as it just was released on February 14th, 2009. Well I immediately started a download of a net-install CD so I can revamp my IDS that I was just getting started on loading. I got as far as loading SSH, Apache, and Snort where it was capturing data on 3 NICs using passive taps when I made this discovery. Its easy at this point to blow it away and reload it with the latest version of Debian packages (and better as bug fixes and vulnerabilities are addressed in the new versions of the packages.) Something to do this weekend. Joy! :-) I mean...what else am I going to do...watch NetFlix all weekend?

A week home

Well, its been a week back at home and things are returning back to normal. I can see that I was missed by my work team and the group I work with at my Army Reserve Unit, the Western Information Operations Center in Dublin, CA. This past weekend I had to stay at home to keep a close eye on Jason while he was recovering (and my wife and I learned a lesson that in the beginning, it really takes two people to watch over one baby recovering from heart surgery.) So the Army had to do without me for a weekend.

The week back back at work has been pretty productive with catching up on old business that I had to curtail when I left suddenly two weeks ago and writing up reports. I am looking at a malware identification tool called TARA that features the use of detection rules. After a bit more study, I might end up using it more as the realm of malware will need every trick in the book to stay abreast of the threat.

Jason has been doing well this week and this is despite the head cold he seemed to pick up. At first the coughing was hurting his chest (we could see it in his facial expressions and especially his cries!) But either his chest stopped hurting as much or the cold symptoms abated very quickly as he seems like he is on the road to getting over it. I got a call from my parents today who said they got Jason's latest picture we sent to them and they enjoyed it. Here is a copy of that picture which is really something. Yes, Jason is now turning back into his cute self before the cold and his recent trip to the hospital. Its a marvel to see how much he is changing and growning in what seems like a matter of days.

Ah...back home!

So Jason got discharged from UCSF on account of good health and recovery progress on his recent cardiothorasic surgery. His labs looked good and the staff was satisfied in what they saw in the X-ray shots and heart ultrasound examinations over the past few days.

So all that got us home and we found that things were in pretty good order. The cats appeared to be a bit antsy at first but later got around to re accepting us. I think they were disappointed they could not watch Battlestar Galactica on SciFi channel on Friday nights till we got home. Well, we all know who really runs the house....

More news later when we get fully settled and adjusted.

Jason is making a good recovery

It's Sunday and it appears that everyone is getting in rest and recovery. Jason is becoming more and more himself after the surgery and we can get him to smile and 'talk' a little bit. I have never had any type of in-patient surgical care like this but I can image I would feel like a train wreck if I was in the same shoes as Jason if a proprotional proceedure were done on me. I am just thrilled that he is getting back to his old self. This is definately more like his character that we are accustomed to seeing. We too are also getting some more rest and the wear on us is starting to subside. I do miss home, the people I work with, the family cats, and the coffee machine once again like last year. But we are told the stay here will be a lot less than our stay during the summer.

Jason's color and appearance are going back to normal for him. Here is a latest picture as I promised I would post

Successful surgery and on the path of recovery

I have some good news for those that have been interested to know. Jason's sugery yesterday was successful. At about 8 Am he was wheeled into the surigcal ward where the cardiac surgeons performed a Glen proceedure and it went well where Jason was brought back to the pediactric ICU floor to recover. He was extubated in the evening and he did well enough resting through the night for his recovery from the surgery.

Today he is getting pain management and fluids to help nurse him along, even getting some of his formula by bottle. Jason is very much like me where much of my happiness is judged on food and eating!

I will have more news later and I might be able to put up some pictures later. That's all for now.

Suddenly back at UCSF

Folks-

What was supposed to be a routine visit to the doctors office turned into a trip to UCSF where we are all presently at. On Monday (yes, just after my last posting) Jason was seen by his cardiologist who recognized signs that Jason's health was very concerning and she had Jason readmitted to UCSF. (For everyone out there who's heart just stopped: Jason is presentlty OK.) Just as Jason got to his Dr's appointment he started presenting signs that his circulation was not all that well and our doctor caught onto it and took immediate action. I got called by my wife who told me the news. From there I had to hurridly & sloppily pack (I later found I did a rotten job at that) and leave work to meet with my wife so we can then travel to San Francisco where Jason was going.

That evening Jason had what was reportedly a great airplane ride to the hospital and the very next morning they performed a cardiac catherization. They determined that Jason's BT shunt was filling up and occluded. But Jason's circulatory system has built up extra blood vessles in the area which are referred to as 'collaterals' (sp?) and these have taken up the task where the shunt could not pass blood volume. I guess sometimes you can't top the wonder of nature and its ability to compensate.

Right now Jason is in surgery for his Glen operation and so far reported soon to come out as things have been successful in operating room. Jason was scheduled to have these exams and surgeries at a later date but everything got moved up because of his situation and the sudden onset. Anyway I will keep you posted. But everyone should know that Jason has been doing fine all along and handleing the change of routine very very well. He is in great hands here. These people are rock stars.

Into February and the rain has come

This past weekend has been a lot of fun. Football is out of the way until August and while most of the country is in the midst of a massive snowy weather pattern, California is finally getting rain. In recent years, January is a wet month for California and the local agricultural economy looks forward to it in making forecasts on how the crop seasons will go for the year.

Well it feels like Spring here. Not your usual weather. But its not all frowns. We get take Jason out in the afternoon for walks in his stroller and its warm enough that the walks are enjoyable. For the time being, we are not getting rained on, but a rain system is making its way in from the Pacific Ocean and the next few weeks may have some wet days in the forecast.

This past weekend we had to travel to the USCG Coast Guard Island to get renewed ID and dependent ID cards. It was an all day experience because on certain days, only certain DoD or Department of Homeland Security offices are open for business and on a first-come, first-served basis. So we had to wait throughout the morning and afternoon once we arrived to be seen. While its tough to get an appointment during the week, it is well advised if your situation allows you to get away long enough to do it. Otherwise I recommend you show up real early, right around opening time. Too bad it took all day because we were thinking about taking Jason to the Oakland Zoo after getting the ID cards taken care of. Better luck next time.

We've gotten many pictures taken of Jason and they look great. I will post them on another posting and scan in the pictures that aren't already in digital format later, perhaps tonight or tomorrow night. Jason is doing really well and he is growing like a weed, very fast. He seems to be vocalizing more and is certainly more aware of what he does on things or people. He recognizes bottles and his baby toys and we've noticed he makes different grunts/squeals in response of them coming into view. When any one of the cats come nearby, he gets excited and sometimes he will reach out and pet them. Its really great to watch these moments.

That's all for now...

Busy Busy,...Happy New Year

Since the middle of December I have been up to my eyeballs in an work matter that has been challenging but offered many instances to learn from. One thing asside from work is I am trying to find a place where I can get my son enrolled into DEERS but there are only limited options that force me to take time off work to do so. Its safe to say that while the federal government has cut back on certain programs that are meant to support reservist servicemembers, the effectivess o the initatives started by these 'good idea fairies' is questionable at best.

Jason is doing well. He weighs 12 pounds now (about 5.5 Kg) and yesterday was a big day. No more NG tube for him. His Doctor OK'ed it and he is getting most of his formula fed to him by bottle now, even through the night. My wife wakes up to feed him trhoughout the night, but we are much happier and relaxed that we don't have to worry Jason might pull the NG tube out at night. He seems happier with it too.

I have alot I have to do today, but I will work on making more frequent posts as things go on. I have bunches of things to catch up on, but everyone should know we are all doing OK and our holidays were not too bad.

The start of December and goings on...

December is here and we have only a few weeks until the end of the year. Jason is doing well and his is growing. He is up to 10 lbs, 7 oz. He is starting to make vocal noises with us from time to time. To us that is a big deal to watch him start interacting with us like this or when he smiles in response to seeing us come into his view.

Work has been pretty good and I am keeping myself busy with the caseload. Lately there has been a lot of talk about the MS RPC vulnerability (08-067) and it appears to be drawing attention of the hacking and bot-net worm authors out there.

That's all for now.

Latest Jason Pics...Its been a while

Sorry that it has been a while but everyone should know that Jason is doing well. He is up to 10 pounds and he is becoming more active. he is starting to fit into bigger clothes and do more too. He still has regular visits to the Dr's office. They like what they see from him and his progress so far. I had the time today to pull two pictures off the camera and my camera-phone so you can get a current look at him.

Here he is laying next to one of the cats and reaching out to him. He just started learning about the cats and he seems to be aware that they are unlike us.
Here is a picture of him in one of the outfits that he had seemed to get, I don't know how. Its like he's telling us, "You can't see me."

Doing the data analysis job better

As I was talking to a collegue this week, there is something that makes me think that we can do stuff better. We agreed that there is a certain mentality to not be satisfied with the way things are and to try to build upon things and improve process, flow, efficiency. (Please don't confuse me as a humorless German because of that- I just like things to work better and I abhore the tedious tasks whenever possible.)

So on Friday I was looking at this matter I have been assigned to and itmhad a ton of Event logs to go through and examine for information that may lead me to understand how a group of servers may have been compromised in the first place. In this case there were about 25 different Event log files with many of them in different places in the directory structure that was sent to me. Going through each of these was going to be a challenge. I am always hesitant of moving files around when it involves a case I am working on, mainly because you making track into a situation. (Keep in mind that I always work on the backup of the data so if the rare occasion disaster strikes, I dont have to go back to the client asking for a do-over. Bad Ju Ju!) I also think when you move the data around you may have issues keeping one set event logs separated and distiguisable from another set. I put into use a tool that Harlan Carvey came up with in his book Windows Forensic Analysis, that takes event logs and can output them in .CSV format so they can be inported into Excel or any other spreadsheet. (I like to run them through a strings-searching tool myself, as sometimes the resultant .CSV files are too big for Excel to handle.) So you would think it is easy; just take each of the event logs and run them through LSEVT2.EXE and I would get my .CSV files to search through! Easy for one or two, but for 25, its a pain.

So I figured out the way to make a list of each of the files, in each of the directories they resided in; remove the white-space (I hate white-space; only in a few cases does anything good ever comes from it and you will see one of those today) from the listings; put a numerical designation beside each file listing so I could tell them apart when the .CSV files were made; and perform a For - Do batch file loop that would read my listfile and for each listing take the filename and run it through LSEVT2.EXE and then redirect the output to a .CSV file with the number as the file name. It worked and I was able to get off the keyboard and let this run by itself without me directly managing it. It took just under 2 hours to run so in my mind it saved me (and the client) 2 hours of tedious bordom just by spending 20 minutes of a little programming, researching, troubleshooting, and testing. Here is what it looks like in a 'more visual sense':

Suppose I have 6 event logs, all in separate directories and the only thing similar is their extention (.EVT):

F:\Big Case\Web Server\SystemEvent.evt
F:\Big Case\Web Server\ApplicationEvent.evt
F:\Big Case\Web Server\SecurityEvent.evt
F:\Big Case\BES Server\System.evt
F:\Big Case\BES Server\Application.evt
F:\Big Case\BES Server\Security.evt

A DIR /s *.evt >> filelist.txt would put the files in one file, filelist.txt. But it still has white-space (which broke it the first couple times I tried it.) I would put it through Notepad and replace all white space so it would look something like this:

F:\Big_Case\Web_Server\SystemEvent.evt
F:\Big_Case\Web_Server\ApplicationEvent.evt
F:\Big_Case\Web_Server\SecurityEvent.evt
F:\Big_Case\BES_Server\System.evt
F:\Big_Case\BES_Server\Application.evt
F:\Big_Case\BES_Server\Security.evt

Then I would put a number next to each (the only time I approve of white-spaces is with tokens) and it would look like this:

F:\Big_Case\Web_Server\SystemEvent.evt 1
F:\Big_Case\Web_Server\ApplicationEvent.evt 2
F:\Big_Case\Web_Server\SecurityEvent.evt 3
F:\Big_Case\BES_Server\System.evt 4
F:\Big_Case\BES_Server\Application.evt 5
F:\Big_Case\BES_Server\Security.evt 6

This file would be saved as filelist.txt and in my program code I would designate %%num as the number and %%fil as the path-and-filename.

The heart of the for-do command would look something like this:
for /f "tokens=1,2" %%fil in (filelist.txt) do echo %%num && LSEVT2.EXE -c -f %%fil > %%num.csv

That is the general gist of how it works and it became a complete time saver. I owe heaps of gratitude to my colleague, Harlan Carvey. If it wasn't for his expertise and talent, I would never have dreamed this up.

Time form me to stop blogging and get on back to the case.

Weight gain and growth development

Jason has put on some additional weight this week. We weighed him the other day and he was at 8 pounds and 8 ounces. He looks like he has gotten bigger and he also is doing more. This is a big delight to us. We have noticed him lifting his head more and even once or twice reaching out for things. He certainly eyeballs us and its taking notice of things around him like the TV and some of his playthings.

That's all for now until I have more to go in this posting

At home care of Jason

This week was pretty good with Jason. He is doing well at home and he is now up to 8 pounds and 3 oz. His oxygen needs have been reduced by his cardiologist and it makes thing better all though out the day.l He is only on supplemental oxygen in the night time while he sleeps. This makes it easy to move about the house with him during the day without having to have an oxygen delivery tube snaking behind us as we go.

Today was a really big day because we finally got up the courage to replace Jason's nasogastrc (NG) tube. I can say there is nothing funny about taking a tube and passing it down your your nose down into the stomach. Its been a month since Jason had his last one put in and we have been home since we left UCSF. We were trained very well on the proper insertion and placement techniques in case we would have to actually do it at home. I really admire the coaching and encouragement they gave us, and today we had to draw upon it. We took out his old NG tube and gave him about two hours without it which was right between feedings. Then when it came time for another feeding, we put in the replacement NG tube. It can be very nerve-wracking to do on anyone, let alone a small infant who you can't instruct to swallow on command or have to listen to the crys as it goes it. But Jason was very good about it and settled down very quickly after it was in and we veriefied (4 times) that it had gone into the proper place.


(Really, I am not without a sense of humor. If you wan to see a funny video on the subject, check out these guys who posted a video on YouTube. They appear to be servicemembers so Im sure they can handle the discompfort.)

This past week (busy)

This past week has been pretty busy with all that goes on. So that everyone knows, Jason is doing well and he has gotten bigger. As of the other night, he now weighs 8 pounds. He is making good progress and he appears to be developing well. We also have time to catch the cats making nice with Jason. The other day I took a picture of one of the cats, Max, with a bib around his neck. My wife and I could not stop laughing

Garage sale,haircuts, cable outage, and project creep

Jason is doing well at home the past few days and this gives us time to take care of some of these other things that had a need to be done. So today I was able to get up early and get somethings done while my wife kept an eye on Jason.

First was go and get a haircut. Frankly I never look forward to getting my hair cut in town because of two factors. The first being that they dont seem to know or care what they are doing. The 4 times I have let this place cut my hair, they have let me down twice-50% satisfaction. The other reason is that it is usually a long wait for just to get into the chair. I usually go over first thing in the morning and there is one barber there but two or sometimes three patrons ahead of me, so it will be an hour of waiting around before I get my unsatisfactory service. Bottom line, I am committed to finding a new babershop to spend my money-enough is enough.

When I got back to the house, I took some excess furniture that we had in the garage and home and got a hastily established garge sale going on the drive way. In our town, every weekend there seems to be one or two garge sales in the neighborhood and it makes it easy, so easy that I rarely ever have to post signs and car and foot traffic are a-plenty. by 1PM I got rid of an extra bed and Ikea chair-footstool set we had and that made for big space savings in the garage!

The pasf few days I have been working on setting up a DOS bootdisk that works with many network cards that are used in systems I have to work with. I have come up with a pretty good boot disk that supports most of these network cards and USB drive support so running Ghost to image and reload systems will be easy. I am finding more and more support features to put into this, but it is bordering on what is known as project-creep. My understanding of this term is when a small project grows and grows and grows beyond initial expectations. Lets see how it goes later on the week.

A visit to the doctor and Thomas's furry helper at work

Today we took Jason to his pediatrician and we got a good report from her and some helpful information. Jason is also growing well and she likes his progress. Jason appears to be up to 7 lb 2 oz or 3.23 kg which is all very good. And his cry is getting louder too, which is a good sign as it means he is recovering from the surgery a little more each day.

On the way to and from the medical center, Jason got to see some of the 'wildlife' we have here in the Central Valley in California. It really means mostly goats, dairy cows, and other than livestock, some ducks and cranes in ponds and irrigation canals. Exciting, eh?

I spent more time at work when we all returned in the afternoon and I started working on data aquisition exercises using EnCase (remote/crossover-cable, Linux, USB flash drives, etc) so I can come up with some teaching plans for work that are easy to deliver to clients. I got a kick out of my cat, Max, who came in the office to 'supervise' me. I think this cat certainly has a personality that is very unique.

Its funny because he actually waited until I had gotten out of my seat and he jumped right in and took my place from behind my back- as if he worked it out that way! In fact as I type this out, he is sitting in the same chair as if this is his domain.

Following Instructions (especially when it counts!)

Ok people; I have this thing about following instructions in good faith, especially if the person/group/organization knows more about something than you do, its someone else's money, or if lives are at stake. Take a gander at the little photo exhibit and read on.

I noticed an event while I was at the hospital where another child was admitted into the Pediatric Cardiac Intensive Care Unit (PCICU) transition floor at UCSF. The parents of this young child appeared to be pretty young themselves and their little young one had a serious need for open heart surgury. When the morning of the scheduled surgury came around, the nursing staff posted NPO notices ("Nothing per Oral"-no food or formula) on and about crib-side. But one of the parents later admitted to giving chips to the patient just hours prior to going into surgury.

Well, the surgical team of doctors and nurses got wind of this and decided they had to scrub the mission, out of possible risk of the child choking while under anesthesia. In my mind this is unexcusable; no amount of quibbiling will fix it or make any corrections. Later in the week the surgury was rescheduled and the instructions were explicit as the tolerance to stupidity was then low at that point. Well deserved, in my book.

Bottom line:Grow up; follow instructions, and take the responsibility when you fail to heed the word of expertise.

Olympus Mons of email to go through....

Folks. I've been back with the nose to the grindstone and I found a ton of email to go through, including numerous computer vulnerability reports from US-CERT and SANS. Its not even the silly season (Thanksgiving, Christmas, etc) yet. So this might provide for an over-abundance of work to do. Great! That is a good thing.

Check out the coin I was presented while I was deployed in 2007. I do love the work!