We have updated once more our Security Onion Installation Guide with a few tweaks regarding setting up BRO emails and SSH.
There is also a new PDF version, using an updated template, available from the download section .

...
>>[READ MORE]

Last week, Security Onion repository moved from Google Code to Github. We have now updated our Security Onion Installation Guide with the new links.
Basically, replacing the base part of each link from the old reference
"https://code.google.com/p/rest_of_the_link]"
to
"https://github.com/Security-Onion-Solutions/rest_of_the_link]"

If you are looking for "issues", not only do you need to replace the base reference as mentioned above, but you also need to remove the "detail?id=" at the end of the URL.
For example:
https://code.google.com/p/security-onion/issues/detail?id=488 (does not work )
Becomes
https://github.com/Security-Onion-Solutions/security-onion/issues/48...
>>[READ MORE]

PIWIK is a an amazing Open-Source Web Analytics platform which is a good alternative to http://www.google.com/analytics/ as it provides full control to your data and more details (i.e.: full IP addresses).
You have 3x hosting options:

Use their cloud service. (More info here)

Host it yourself online: at the back of your web server or on a different/dedicated server. (More info here)

Host it offline, and manually import your apache logs. (More info here )

The advantage of hosting it online is that you can use a php/javascript trackers within your web pages producing more information on your visitors (screen resolution, plugins, etc)
It also allows you to do certain "tricks", such as tracking who downloads a specific image as ...
>>[READ MORE]

Entry Last updated on the 11th of May 2015
a PDF version is also available to download here
Security Onion (SO) is a great open source project created by Doug Burks.
It is a Linux Distribution based on Ubuntu and bundled/configured with all the tools you need to get a powerful, and free, Network Security Monitoring system (NSM). It can be used to monitor your network traffic for suspicious activities and malware.

This guide is aimed at people who quickly want to get started with SO with the following basic functionalities:

Getting an understanding of what Network and Server setup are required

Going through a basic SO installation

Getting basic understanding on how to tune Snort and remove false positives

Getting regular reports and speci

...
>>[READ MORE]

We recently encountered some errors when trying to recompile the VMwaretools on Kali (kernel 3.18) and Security Onion (Kernel 3.2):

error: implicit declaration of function ‘smp_mb__after_clear_bit’

error: ‘struct dentry’ has no member named ‘d_alias’

Those errors meant it was not possible to share files between the Host OS and the virtual machines, as compilation was failing in the vmhgfs-only directory.

Below are a set of instructions to fix those issues.
Please note the following was Tested with VMwaretools-9.9.2-2496486.tar.gz, and you need to do this as "root"

In Fusion/VMWare select reinstall VMwaretools - This will mount a virtual VMWare CDROM

Go to that CDROM and copy the VMwaretools tar.gz file onto your /tmp directory.

Unmount the CDROM (you may not need to do this, but we did have have issue once with the CDROM still mounted).

Uncompress the tar.gz file using "tar xvzf"

Go to /tmp/vmwa

...
>>[READ MORE]

A new era has begun, we have completed our migration/integration from encryptsolutions.com to elysiumsecurity.com.
Encryptsolutions.com was created in 1998, 17 years ago, mainly to offer a web platform and support to the BUGS cryptography project.
In this time our expertise has evolved beyond Cryptography and has grown accross multiple security areas which are reflected in this new website, brand and set of services

Our commitment to the open source community is as strong as ever and you can expect more guides/tools/articles to be published very soon.

...
>>[READ MORE]

Last Summer SANS organised a security/hacking challenge through 4 of their brochures, each brochure had an “easy” challenge in the form of a hidden message to de-cipher to get a URL to the second level of each of the 4 challenges.

Below is a brief explanation of the steps I took for the main technical challenges:

1. Challenge 1, level 2: Alice’s encrypted file for Bob
First you need to load the pcap file provided for that question into Wireshark, two type of traffic should catch your attention: some HTTP and SMB traffic. Doing a quick search (CTRL-F) for the string Bob in the “packet bytes” will get you to Frame 669, which is a web chat over HTTP where Alice mentions to someone that she needs to send a file to Bob and R...
>>[READ MORE]

Hacking conferences are a great way to learn he latest hacking techniques and more underground ways of thinking on IT Security. They complement nicely more corporate Security Training courses such as the ones offered by SANS.

They tend to be more chaotic, the talks are not as polished, some of the techniques discussed will have limited effect in the real world and connecting to the event WIFI is asking for trouble.
On the other hand, the atmosphere is buzzing with brain activities, convictions (right or wrong!), passion and cutting edge topics. If you can follow the rythme and embrace the moment then you will get out of this type of conferences energised and full of new ideas!

This year I attended the “Nuit du Hack” in France which runs other 24h, literally. You get some talks during the day, there is only 1 track so you get to watch/listen to all the talks. And during the night there is a traditional Capture The ...
>>[READ MORE]

In the last few days there has been an increasing noise related to some iOS backdoors. Apple does not deny they exist, but contests how they can be used.

This is not new, and the security researcher who presented his findings did highlight that, it is likely related to methods being used by certain forensic software sold to law enforcement.
What is “concerning” is the following:
– These backdoors are actively maintained and developed by Apple, how much more data will they allow to be extracted from iOS device in future;
– Those backdoors provide access to SMS, Contact, and other potential sensitive data on the phone; they also allow to bypass full disk encryption. This highlight the fact that unless you phone is off, the data on your phone is no longer encrypted per say, but only protected by access control (PIN);
– If it can be used by law enforcement, it can be used by “greyer” parties ...
>>[READ MORE]