T

A

B

L

E

O

F

C

O

N

T

E

N

T

S

Jim O'Gorman & Marty Aharoni Interview…………………………………………………… 3
SECCON 2015 Hiroshima Tournament Report… …………………………………………… 7
CODE BLUE 3 Report, Part One … …………………………………………………………… 10
Threat Scope… ………………………………………………………………………………… 12

About this Publication– This publication is a publicly available product on the Hitachi Systems Security Research Center website, SSRC (Shield Security
Research Center). The website also hosts back-issues (note – in Japanese), SSRC research results among other documents.
SSRC: http://www.shield.ne.jp/ssrc
Terms of Use– This publication is produced by Hitachi Systems for informational purposes. Hitachi Systems cannot guarantee against mistakes or
mistakes. Further, Hitachi Systems cannot take any responsibility for the manner in which information in this publication is used.
The information in this publication was taken at a specific point in time. Thus, there may be cases where this information becomesoutdated.
– Reproduction of this publication in part or in its entirety is prohibited under Japanese Copyright Law.
© Hitachi Systems, Ltd. 2015. All rights reserved.

2

an
m
r
o
ood
G
w
'
l
E
.
.
a
.
O
aa..kk . a
Jim
i
n
o
r
a k ..aa.. m u t shAaa.. k
ty
r
a
& M
&

view
r
e
t
In

-Hacker Extraordiannares!
-Authors of Kali Linux-Behind the scenes of development
When you view a demonstration at any security conference presentation, you will likely
see a picture of the Kali Linux dragon on the desktop of the presenter’s PC. Kali Linux has
earned support from many hackers for it's distribution which specializes in penetration
testing. We spoke with the developer, Mati Aharoni and his affiliate in offensive security,
Jim O'Gorman on Kali Linux and Training Courses.
– Interviewer: Risa Kasahara– Photos and Layout: Ken-ichi Saito

3

Offensive Security Training
Valued Throughout The Industry
Risa Kasahara (afterwards,): Hello, thankyou very much for taking time for this interview
as you are very busy with Blackhat Training
Briefings. Today I would like to ask you about
your perspectives on Offensive Security and Kali
Linux. † 1 † 2
Jim O'Gorman (afterwards,(afterwards,

Jim O'Gorman “Elwood” (pictured left)) & Marty Aharoni

A penetration testing expert. In addition to): Thank you for the opportunity.

leading training courses, he also works in
Offensive Security consulting. He has knowledge

Stepping right into things, can you offer an

in Network Intrusion Simulation, Digital Forensics,

simple introduction to Offensive Security?

and Malware Analysis.

Offensive Security is Enterprise Security.

Marty Aharoni “muts” (pictured right)

Outside of security analysis, which starts with

A co-member of the Kali Linux development team.
A network security expert, he works in both militaryand government industry. Though his major work
is in vulnerability surveying, exploit development,
and penetration testing, he also instructs training
in tools and methods used by attackers.

penetration testing, we conduct development of
the open source tool Kali Linux as well as training
using Kali Linux. With Kali Linux, although there
are previous distributions like BackTrack, Whax,
and Whoppix, we have incorporated all of those.

Is this also open source?
I see. Now I understand the backgroundYes it is. Now, if we're speaking aboutbehind distribution.

business, we conduct hands on training todevelop specialists who use Kali Linux. There

With Offensive Security, we also utilize
another Exploit Database site.

†3

are also recognized certifications in Offensive

We boast thatour public vulnerability database is generally

Security, so we receive support from throughout

the largest of its kind, and whenever exploits

the industry for this.

are included in public vulnerability intelligence,
Why is it you think you receive such support?

we make an effort to publish them on our site as
well. Furthermore, in recent years as warnings
for mobile devices increase, we have released Kali

There are plenty of written tests for security

Linux NetHunter, which is a Kali Linux targeted at

qualifications, but as for hands-on style training,mobile devices. † 4

really there is only us. Further, we conduct apractical test to assess the qualifications of our† 1 Offensive Security

https://www.offensive-security.com/† 2 Kali Linux https://www.kali.org/† 3 Exploit Database https://www.exploit-db.com/† 4 Kali Linux NetHunter https://www.kali.org/kali-linux-nethunter/4

trainees and in reality, passing this test is not easy.
In the last 8 years, training has continued but,during this time, I think that people who haveearned certification on Offensive Security areseeing their recognition grow within the industry.
To add one more thing, I think the situation
where there are not enough security specialists is
related to this. As organizations bring in humanresources, our certifications have become one

From Google Trends - A comparison of theindicator of their qualifications.

popularity of BackTrack Linux and Kali Linux.
Compared to BackTrack (blue), since 2013 Kali

We offer security technologies and skill, but asLinux has become the major version in use.

time passes, these become obsolete. However,https://www.google.co.jp/trends/

the approach to try to solve problems directly

explore#q=backtrack%20linux%2C%20kali%20

through hands-on trial and error will not become

linux&cmpt=q&tz=Etc%2FGMT-9

obsolete. So the heart of what we deliver is theLinux. Why did you switch to Kali Linux even as

acquisition of this attitude.

BackTrack was very popular?
What an excellent opinion. We've discussed
that you began offering training 8 years ago, but

It was 2 years ago. At the time, BackTrack

what was your initial motivation for doing so?

was popular but there was a trend where there
were issues with packet management, capacity
was swelling, etc. So we decided to rebuild the

As stated earlier, there are many distributions
that serve as Kali Linux's ancestors. When

distribution. We changed the Linux base fromwe originally made Live DVD Linux which

Ubuntu to Debian, and rebuilt the development

consolidated numerous tools into one, theenvironment from scratch using new

intent in developing it was the idea that we'dtechnologies. We also removed the outdated

become free from the difficult labor of rebuilding

tools from BackTrack. This made Kali Linux both

environments. After that, in 2007 we had themore stable and secure than BackTrack. Here I

opportunity to participate in BlackHat USA. At

can show you some interesting data (referring

the time it was BackTrack, but I was surprised

to graph). This is a comparison of BackTrack andat how many people were using it. The idea toKali Linux using Google Trends. Kali Linux hasoffer security knowledge to so many people justbecome the overwhelming topic. It is thought

became stronger, so the following year, in 2008,

that interest and demand for penetration testing

we began training.

has risen, and if the success of this transfer hascome from us then it is definitely a good feeling.

I see, there is an importance to master theAbsolutely. That is very interesting data.

many types of penetration tests isn't there.

Incidentally, what is the significance of the “Kali”
in Kali Linux?

The Evolution of Kali Linux continues

Well, first, we want to bring about a meaning

Moving on, I'd like to ask you about Kali5

in the relation to distribution. In the Swahili

Okay, thank you. Kali Linux 2.0 will soon

language, Kali means “fearlessness.” It also has

be released. Can you offer any insight on its

various meanings in other languages as well. For

characteristics?

example, in the Philippines, it is the name of an
offensive, attack-based martial art. In India, KaliIn Version 1, we added big changes in theis the name of a Hindu female God who oversees

Linux base. In version 2 as well, there are somethe destruction and creation of the world as I

major changes in this same manner. The mostunderstand it. The Hindu significance is especiallymajor change is that it will be a “rolling release.”interesting considering the image of Kali LinuxAs a rolling release, it's not a set period version

being born from BackTrack.

update, but rather there will be frequent updates
to the software system. For this reason we'll be

I understand. In Japanese, “Kari” ( カリ・狩り：

able to respond to the particulars of things like

Japanese pronunciation of Kali) means “Hunting.”

package updates, and the thought is that thiswill make it a major improvement to the user
experience.

Really? That's amazing. Such a perfect image.
Well definitely add that to our documents.

I'll ask another question from a user related
to user-support. This person hears that you're

What kinds of standards have you selected forplanning to upgrade Metasploit in Kali Linux.

the editing tool in Kali Linux?

Not the professional version but the community
version. However even if you do so, due to a

Excellent question. Basically, we are using thesame ones normally used. Additionally, we sharewarning about a different Ruby version, you may

user and bug info on our Kali Linux Bug Tracker

not be able to upgrade. So what measures would(bugs.kali.org), but as a reflection of user demand,

you propose in this situation.

we also have a editing tool.
Actually, that is an improvement in Kali
Linux 2.0. Since Ruby is an important part of

My next question comes from a user. With
regards to the requests on your forums, is there athe Metasploit package, for example even if you

means for editor tool writers to get feedback fromdownload the package to access GitHub, due toyou?

the differences in the Kali Linux-installed Ruby
and that version, you couldn't really set it up very

Generally, no there is not. On the forums,

well. However, with the rolling release, because

tool writers can insert links to their homepages.

you're now able to appropriately time your Ruby

Perhaps, if there is a request to improve a tool, I

upgrade, from here out I don't think you would

recommend contacting the author directly.

have this problem.

Is there a list of tools written for Kali Linux? † 5

An excellent understanding of the
improvements that Kali Linux 2.0 will bring. I'msure that will make this user very happy! ThankOn the website that information is available

you very much for your time today.

(tools.kali.org). I believe it has 99% of available
tools listed. In addition to an explanation, there isalso a simple introduction on each tools' use.

† 5 Note: This interview was conducted on August 6th, 2015, just before the release of Kali Linux 2.0 on August 11th.

6SECCON 2015
Hiroshima Tournament ReportKen-ichi Saito

Competition Rules

SECCON 2015 Regional Preliminary,
2nd EventThe competition server ran virtual server
SECCON † is an initiative which seeks to find andprograms from various architectures, and on

develop human resources who can act globally inthese servers current directory was a file named

the field of Information Security. The executive

Flag.txt. Each of these server programs had

committee organized by JNSA (Japan Network

vulnerability, and thus it became possible to run

Security Association), has functioned since

several executable files or downloads.

2012. In 2015, it officially started the Yokohama
The participants found vulnerabilities in thetournament in June.

server programs through disassembling the
The second regional preliminary SECCON 2015

executable files, then using this they wrote

Hiroshima tournament took place on October

exploit code to show the contents of the Flag.

24th at the Hiroshima University Satellite Campus.

txt file and sent it to the server. The contents

SECCON conducts regional competitions whichshown in each Flag.txt files were recorded on thefocus on specific themes. For the Hiroshimascore server and became a point. The team with

event, it was a competition to run exploits

the most points at the end of the competition

against various architectures by hitting scripts

became the winner. The competition took placeand “Nekketsu” Shellcodes. Here, the shellcode

over 3 hours.

targeted an assembly program that aimed to
On the competition server, in addition tostart up a shell.

two problems about architecture of differing
There were 34 participants. From their self-

difficulty on (each worth 100 points), there wereintroductions at the start of the tournament, 30-also trivia questions (10 points each) used (ex.

40% were students, while 60-70% were madeWhat is a CTF?).

up from other factions including programmingin the event.

and security. There were also others who gave
Strategy Points

lectures on themes such as malware analysis
at security conferences. Compared to othertournaments, it appeared the skill level was quite

The adopted architecture for this competitionhigh.

was as follows+† SECCON 2015

http://2015.seccon.jp/

7

The tournament room setup at Hiroshima University’s satellite campus

ARM		

H8

MIPS

environment that was distributed to thePower PC

SH

CRIS

participants. This environment was also used in

FR-V		

M32R

M-CORE

Mr. Sakai's writing of the problem set. One could

MN-10300

SH64

V850

also consult this, because within the environment

Thumb

MIPS16

Blackfinit contained sample programs that ran the

CR16

M32C

RX

system call.

The representative architecture x86 was not used.

However, in Mr. Sakai's orientation, with the

In all honesty, there were fewer architectures

V850 architecture as an example, he introduced

whose names were known to the author. Therea hint for writing shell code while making awere likely lots which were unfamiliar to many ofcomparison of output assembly code and thethe participants as well.

sample program's source code in C language.
According to Mr. Sakai, if you could successfully

Before the competition, there was an orientation

analyze one architecture, you could likely guessfrom Makoto Iwamura (NTT) and the writer ofthe characteristics of other architectures.

the tournament problem, Hiroaki Sakai (Fujitsu).
Mr.Iwamura explained the importance of

Additionally, in the orientation, he gave a demo

running a system call in order to read the Flag.

of the exploit execution. Within the distributed

txt file's contents, and as the info inquired uponmaterials there was a V850 Exploit Code sample,

in the competition, brought up how to make theand this sample was used in the demonstration.

system call, return value functions, characterIn other words, with the V850 issue, if participants

strings, buffers and other rules.

could build their code and send it to the server,
they could score some points.

He recommended to view the GDB simulation
A tough competition and the outcome

source code in order to investigate the systemcall rules, as the competition server ran on a
GDB simulation. As a further strategy point,

After the start of competition, the service and

Mr. Iwamura alluded to the close compiler

trivia problems were successively resolved by the8The scores projected on the tournament main screen.

”nubia” holds his award certificate and prize earned as the

The various circles represent the participants.

winner of the tournament.

participants, and there was vigorous movement

architecture characteristics, as stated by Mr. Sakai

on screen displaying the scoreboard. However,in the orientation.

the movement gradually slowed, and soon it
The reason for using various architectures

reached a stalemate.
Participants searched for the vulnerability in the

We spoke with SECCON executive committee

architecture program, and writing the exploit

member Yoshinori Takesako (Recruitingcode was proving to be a tall hurdle to overcome.

Marketing Partners) about the tournament.
We tried to throw the question of whether the

However, as time passed participants whocompetition architecture was too much but

earned points outside of the service and trivia

according to Mr. Takesako, any architecture

problems intermittently appeared. It was “Nubia”

can be attached to regular use items such as

and “El.” In fact, among the 34 participants in theelectronics or cars, and is used by those controls.

competition, they were the only two to resolve

So he wanted to create a mechanism to shift

issues outside of the service and trivia problems.

attention to architecture security as we movetowards the era of IoT (Internet of Things).

From beginning to end, Nubia held the lead
and went on to win the event by, acquiring 1220

Additionally, if you say Exploit, most people

points. This was 400 more than el, who took

seem to think of Black Boxing, but Mr. Takesako

second place el. Nubia now advances to theadded he also wants people to know that you

SECCON Championship tournament which will

can Exploit using examinations of architecture as

take place in late January. As an additional prize,

well.

he received an autographed copy of Mr. Sakai's
The SECCON Regional Tournament will continue

book, “Hello World.”with events in Fukushima and Osaka. HISYS
Afterwards, Nubia stated that while he

Journal plans to report on those competitions as

progressed with program analysis, he achieved

well.

victory when he became able to guess theReference
The SECCON 2015 Problem Set is available on Mr. Sakai's personal website at http://kozos.jp/seccon

9CODE BLUE 3 Report, Part
Part OneOne
Ken-ichi Saito

A new challenge for CODE BLUE
As introduced in our previous issue, the 3rd CODE
BLUE was held over two days from October 27th28th at the Bellesalle Grand Shinjuku. Over the
next few issues, we'll deliver articles on the event.
This time, let's take a bird's eye view into CODEBLUE.
As many are already aware, CODE BLUE is

CODE BLUE Executive Committee Chairman and Tokyo Denki

an international conference where top class

University Teacher Ryouichi Sasaki

information security specialists gather and share
information that transcends languages andborders. In addition to lectures from well-known
researchers from the U.S. And Europe, it seeks out
excellent researchers from across Asia, startingwith Japan. The goal is to spread the results of
their research across the world.
At the opening of the meeting, Executive
Committee Chairman Ryouichi Sasaki from
Tokyo Denki University announced several new

CODE BLUE Administration Representative Shinoda Kana

initiatives for CODE BLUE. First, was the change

Shinoda Kana, a representative from thefrom a one track system to two tracks, generating

administration offices then took the podium.

a large increase in the amount of sessions.

She announced that this CODE BLUE had far

Another one targeting development of young

surpassed it's planned 500 participants with overtalent, was the establishment of a framework

600 registrations. Further, she elaborated on

for lecturers 24 years old and under (U-25). Mr.

the U-25 initiative that Mr. Sasaki had mentioned

Sasaki stated that through these initiatives CODE

previously. Although there were applicants from

BLUE could touch on more information, andacross the world, research from two Japaneserather than simply collecting more information

students had been selected. Additionally,

from participants, he wanted to build a true

among other inititaives in regard to young

exchange of information.

talent development, he added that thanks tocooperation from several industry partners, they10

were able to invite 12 students to participate in
An Energetic Exchange Among Colleagues

CODE BLUE at no cost to them.

Following the two days of presentations, a

A Lineup Rich In Diversity

Networking Party was held in the smaller hall
One characteristic of CODE BLUE is the wide

to allow a relaxed exchange among colleagues.

range of lectures it provides. Over the two days

The alcohol flowed and participants enjoyedthere were over 24 presentations. Althougha frank and relaxed discussion among each

there can be a tendency at information security

other. Throughout the event, student volunteers

conferences to stick with only technical topics, athelped with participants, meal set-up, etc. At

CODE BLUE there were many themes of interest.

the Networking Party these volunteers had

Within the timetable discussions human resource

the chance to participate and could be seen

development and community trends, dealing

enthusiastically speaking with many of the eventwith zero-day vulnerabilities, and IoT security forspeakers.

health care device and smart grid research, wereline up. Thanks to the establishment of the two-

After the party, many of the pictures taken will

track system , participants were able to choose

be publicly available on the CODE BLUE Flickr
account. † Participants can check the site topresentations that fit their own interests.

see if their phot ograph is on the site, and those
Of course there were plenty of participants

who did not make CODE BLUE can look to see

who came out of their interest in technology,

what the event was like. We asked several of theand the web-themed presentations wereparticipants from overseas about their thoughts

particularly popular among them. In fact, theon CODE BLUE and the majority responded

Web presentation drew so many attendees

with statements of how well-organized thethat although it had been scheduled to takeconference was.

place in the smaller of the two halls used for the
conference, larger one at the last-minute!

As the 2020 Tokyo Olympics approach, theimportance of Cyber Security continues to

We plan to delve further into each of the lectures

be stressed. Events like CODE BLUE are truly

in the next issue with a summary of each of thesignificant in this aspect. Each CODE BLUE event

presentations.

continues to grow in scale, and the expectation isthat the future events will be no different.

† CODE BLUE Flickr accounthttps://www.flickr.com/photos/119351343@N04/albums

11

A column on the current events in Cybersecurity news from an independent viewpoint

Threat Scope#13

What is the real role of cyber intelligence?
By El Kentaro
Seek quality over quantity!

In Cyber countermeasures,Intelligence is crucial

Speaking on his experience after participating inIn the last few years, “intelligence” has becomea certain leadership event, Mr. Day stated that thethe keyword focused on in the Cybersecurity

majority of what he heard on “intelligence” fromindustry. But in its true meaning, what really ismanagement levels was really just noise withcyber threat intelligence?

little actual value.

Presently, the answer to this brings about widely

Certainly, when vulnerabilities surface,varying definitions and explanations acrosstechnological information related them grows

security solutions vendors, client businesses, andmassively, just as when cyber attacks aregovernment and other organizations.

confirmed, raw data on things like domain names
and IP addresses also increases rapidly. However,in what ways can we analyze this raw data to

In a previous column, we heard from MichaelPeterson of the U.S. Central Intelligence Agency.

produce real intelligence that has value? Mr. Day†

He touched on the state of intelligence rooted

points out that recently the change from “data”

in his 40 years of experience with the agency.

to “intelligence” is what is being sought after inThis time, I'd like to introduce the blog written

Cyber Intelligence.

by Greg Day, Vice President and Chief Security
Officer for Europe, Middle East & Africa at Palo

Next, in discussing the rapid increase in

Alto Networks, in which he discusses cyber threat

vulnerabilities, he mentioned that the number

intelligence.

of CVE registered incidents in 2014 grew to9751, meaning that each day an average of 27

In a threat situation that continues to change

vulnerabilities and threats are revealed. As such,

each day, what really is Cyber Threat Intelligence?

Mr. Day notes that you can compare statements

Further, is a vast amount of information reallysuch as Sociologist Edward Osborne Wilson's“intelligence?” In asking these questions, Mr. Day

remark that “we are drowning in information,

speaks on his own experience and viewpoint

while starving for wisdom,” or the U.S. FBI's

about the role that Cyber Intelligence should

definition of intelligence, “information that has

hold.

been analyzed and refined so that it is useful topolicymakers in making decisions.” In doing so,
he notes that we have surpassed the amount† HISYS Journal Vol.8

http://www.shield.ne.jp/ssrc/contents/doc/SSRC-HJ-201504.pdf

12

of information that security experts can handle
Towards increasing the quality ofwithin the time available to make decisions.

intelligence
However, Day points out that in this situation,
there is still a chance to to produce real

In order to make possible valuable intelligenceIntelligence. He stresses the importance of thefrom the aforementioned three points, thefollowing three opportunities for intelligence topractical use of appropriately timed, practical

add value.

decisions and disposition methods, few false
detections, and a complete overhead view of theorganization is critical, according to Mr. Day.

1) Ensuring protection against as many threats as
possible, as rapidly as possible..

The current state of security in cyberspace is2) Be able to identify which high risk attacks arelikely to impact your organization.

thought of in terms in winning and losing. As

3) Be able to analyze from Indicators of

threats and events continue to increase, evenCompromise which attacks to be proactive

though tools that use SIEM (Security Information

against within your organization.

and Event Management) can support in thethreat countermeasure process, it is critical toParticularly, it is #3 which is the problem thatcombine both internal and external information

troubles security experts. As in cases of large

in developing intelligence.

scale information leaks in the media where IOCs
were discovered but not acted upon stand out,

As a final last point on the importance of cybereven when a compromise is suspected it cancountermeasures, Day wraps up with a note

be difficult to decide on exactly what kind ofon the layout of human resources. In eachattack it is or what it indicates. Of course, as aorganization there are a limited number ofcountermeasure to this problem the majority ofpeople to work threats, and to keep up with theorganizations engage in information sharing but

increasing speed of attacks and threats. The

the information is often limited only to members

more we can automate activity, the more we

within the organization.

can use those human resources to focus on theactivities where we need them.

Reference
Bland Information Overload or Business-Critical Intelligence?
http://researchcenter.paloaltonetworks.com/2015/11/bland-information-overload-or-business-critical-intelligence/13