Carter Bullard Releases Argus 2.0.6

Normally a change from a 2.0.5 to 2.0.6 release wouldn't be big news. That's not the case with Argus, however. 2.0.6 has been about a year in the making. Argus is the world's longest living open source session data collection program. It runs on most any UNIX distribution and appears in my book. Give it a try!

Read More

TaoSecurity.com Moves to Niuhi

Visitors to www.taosecurity.com will notice they are no longer redirected to mywebpages.comcast.net/taosecurity. I've started hosting TaoSecurity.com at Niuhi.com, co-operated by a fellow security consultant. This move should only have positive effects. If you bookmarked the old Comcast site, please use www.taosecurity.com.

Read More

Upgrading Ruby

This morning when checking for updated applications I saw that lang/ruby18 was updated recently:

drury:# portversion -v | grep ruby
ruby-1.8.1_2                <  needs updating (port has 1.8.1.2004.05.02)
ruby18-bdb1-0.2.2           =  up-to-date with port

I remembered what trouble we had with Ruby and Portupgrade a few months ago, so I used Portupgrade to upgrade Ruby by itself:

drury# portupgrade -v ruby^M
--->  Session started at: Tue, 04 May 2004 12:16:17 -0400
--->  Upgrade of lang/ruby18 started at: Tue, 04 May 2004 12:16:19 -0400
--->  Upgrading 'ruby-1.8.1_2' to 'ruby-1.8.1.2004.05.02' (lang/ruby18)
--->  Build of lang/ruby18 started at: Tue, 04 May 2004 12:16:19 -0400
--->  Building '/usr/ports/lang/ruby18'
>> ruby-1.8.1-2004.05.02.tar.bz2 doesn't seem to exist in /usr/ports/distfiles/ruby.
>> Attempting to fetch from ftp://ftp.iij.ad.jp/pub/lang/ruby/snapshots/.
Receiving ruby-1.8.1-2004.05.02.tar.bz2 (2395420 bytes): 
...edited...
===>  Cleaning for ruby-1.8.1.2004.05.02
--->  Removing the temporary backup files
--->  Installation of lang/ruby18 ended at: Tue, 04 May 2004 12:18:19 -0400 (con
sumed 00:00:07)
--->  Cleaning out obsolete shared libraries
[Updating the pkgdb  in /var/db/pkg ... - 159 packages found 
(-0 +1) . done]
--->  Upgrade of lang/ruby18 ended at: Tue, 04 May 2004 12:18:19 -0400 (consumed
 00:02:00)
--->  Listing the results (+:done / -:ignored / *:skipped / !:failed)
        + lang/ruby18 (ruby-1.8.1_2)
--->  Packages processed: 1 done, 0 ignored, 0 skipped and 0 failed
--->  Session ended at: Tue, 04 May 2004 12:18:20 -0400 (consumed 00:02:02)

Ruby was updated and now I plan to use Portupgrade to update the rest of my ports.

Read More

Review of Network Security Assessment Posted

Amazon.com just published my four star review of Network Security Assessment. From the review:

"Network Security Assessment (NSA) is the latest in a long line of vulnerability assessment / penetration testing books, stretching back to Maximum Security in 1997 and Hacking Exposed shortly thereafter. NSA is also the second major security title from O'Reilly this year, soon to be followed by Network Security Hacks. NSA is a good book with some new material to offer, but don't expect to find deep security insight in this or similar assessment books.

NSA begins with the almost obligatory reference to the king of assessment books, Hacking Exposed (HE), saying 'I leave listings of obscure techniques to behemoth 800-page "hacking" books.' I don't think some of the techniques covered in HE but not NSA are "obscure." Noticably lacking in NSA is coverage of dial-up techniques, wireless insecurities, Novell vulnerabilities, and attacking clients rather than servers. Should NSA receive a second edition, I expect to see the book expand closer to the 'behemoth' it seems to deride."

Read More

Review of Ethereal Packet Sniffing Posted

Amazon.com just posted my five star review of Ethereal Packet Sniffing. From the review:

"Ethereal Packet Sniffing is the first book in Jay Beale's new Open Source Security Series with Syngress. It's a great book to lead the way. Ethereal is full of helpful tips and clear discussions that benefit newbies and wizards alike.

I've been using Ethereal for around five years, and this book still taught me a few new tricks. The key to the new material is Ethereal's development, from 0.2 in July 1998 to 0.10.3 this year. (The book covers 0.10.0 which is far from being outdated.) The many improvements lend themselves to the sort of explanations found in Ethereal. For example, my favorite material involved filters. Although chs. 4 and 5 had minor overlap regarding this feature, I learned new ways to manipulate Ethereal's packet search and display capabilities."

Read More

Fixing Another Problem with Ports

Today while using portupgrade to update my ports tree, I ran into this problem. The process was trying to upgrade OpenMortal when it died:

--->  Uninstallation of openmortal-0.6 ended at: Sat, 01 May 2004 18:26:13 -0400
 (consumed 00:02:22)
--->  Upgrade of games/openmortal ended at: Sat, 01 May 2004 18:26:13 -0400 (con
sumed 00:02:28)
[Updating the pkgdb  in /var/db/pkg ... - 258 packages found
(-1 +0) (...)ruby18 in malloc(): error: allocation failed
Abort (core dumped)

That didn't look good. I tried this and got similar results:

orr:/root# portversion -v
[Updating the pkgdb  in /var/db/pkg ... - 258 packages found
(-1 +0) (...)ruby18 in malloc(): error: allocation failed
Abort (core dumped)

At this point I decided to try rebuilding the package database:

orr:/var/db/pkg# mv pkgdb.db pkgdb.db.broken
orr:/var/db/pkg# pkgdb -F
--->  Checking the package registry database
[Rebuilding the pkgdb  in /var/db/pkg ... - 258 packages foun
d (-0 +258) ....................................................................
................................................................................
................................................................................
.............................. done]

Now everything works, although OpenMortal is no longer installed. I reinstalled it from /usr/ports/packages/All, which is a NFS mount to my package builder:

orr:/root# cd /usr/ports/packages/All
orr:/usr/ports/packages/All# pkg_add -v openmortal-0.7.tbz 
Requested space: 205905528 bytes, free space: 2372941824 bytes in /var/tmp/instmp.RTmsXw
...truncated...

Read More

Packet Description Markup Language

While reviewing a new book on Ethereal, I learned about the Packet Details Markup Language (PDML). PDML is a way to express a packet in XML format. For example, here is an ICMP echo request:

tethereal -n -r snort.log.1082637820 -T pdml icmp

<?xml version="1.0"?>
<pdml version="0" creator="ethereal/0.10.3">
<packet>
<proto name="geninfo" pos="0" showname="General information" size="60">
<field name="num" pos="0" show="1" showname="Number" value="1" size="60"/>
<field name="len" pos="0" show="60" showname="Packet Length" value="3c" size="60"/>
<field name="caplen" pos="0" show="60" showname="Captured Length" value="3c" size="60"/>
<field name="timestamp" pos="0" show="Apr 22, 2004 08:47:14.358334000" showname="Captured Time" value="1082638034.358334000" size="60"/>
</proto>
<proto name="frame" showname="Frame 1 (60 bytes on wire, 60 bytes captured)" size="60" pos="0">
<field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/>
<field name="frame.time" showname="Arrival Time: Apr 22, 2004 08:47:14.358334000" size="0" pos="0" show="Apr 22, 2004 08:47:14.358334000"/>
<field name="frame.time_delta" showname="Time delta from previous packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/>
<field name="frame.time_relative" showname="Time since reference or first frame: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/>
<field name="frame.number" showname="Frame Number: 1" size="0" pos="0" show="1"/>
<field name="frame.pkt_len" showname="Packet Length: 60 bytes" size="0" pos="0" show="60"/>
<field name="frame.cap_len" showname="Capture Length: 60 bytes" size="0" pos="0" show="60"/>
</proto>
<proto name="eth" showname="Ethernet II, Src: 00:00:d1:ec:f5:8e, Dst: 00:03:47:75:18:20" size="14" pos="0">
<field name="eth.dst" showname="Destination: 00:03:47:75:18:20 (00:03:47:75:18:20)" size="6" pos="0" show="00:03:47:75:18:20" value="000347751820"/>
<field name="eth.src" showname="Source: 00:00:d1:ec:f5:8e (00:00:d1:ec:f5:8e)" size="6" pos="6" show="00:00:d1:ec:f5:8e" value="0000d1ecf58e"/>
<field name="eth.addr" showname="Source or Destination Address: 00:03:47:75:18:20 (00:03:47:75:18:20)" size="6" pos="0" show="00:03:47:75:18:20" value="000347751820"/>
<field name="eth.addr" showname="Source or Destination Address: 00:00:d1:ec:f5:8e (00:00:d1:ec:f5:8e)" size="6" pos="6" show="00:00:d1:ec:f5:8e" value="0000d1ecf58e"/>
<field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/>
<field name="eth.trailer" showname="Trailer: 00000000000000000000000000000000..." size="18" pos="42" show="00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00" value="00000000000000000000000
0000000000000"/>
</proto>
<proto name="ip" showname="Internet Protocol, Src Addr: 172.27.20.4 (172.27.20.4), Dst Addr: 192.168.60.3 (192.168.60.3)" size="20" pos="14">
<field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/>
<field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/>
<field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)" size="1" pos="15" show="0" value="00">
<field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="00"/>
<field name="ip.dsfield.ect" showname=".... ..0. = ECN-Capable Transport (ECT): 0" size="1" pos="15" show="0" value="00"/>
<field name="ip.dsfield.ce" showname=".... ...0 = ECN-CE: 0" size="1" pos="15" show="0" value="00"/>
</field>
<field name="ip.len" showname="Total Length: 28" size="2" pos="16" show="28" value="001c"/>
<field name="ip.id" showname="Identification: 0x1026 (4134)" size="2" pos="18" show="0x1026" value="1026"/>
<field name="ip.flags" showname="Flags: 0x00" size="1" pos="20" show="0x00" value="00">
<field name="ip.flags.rb" showname="0... = Reserved bit: Not set" size="1" pos="20" show="0" value="00"/>
<field name="ip.flags.df" showname=".0.. = Don't fragment: Not set" size="1" pos="20" show="0" value="00"/>
<field name="ip.flags.mf" showname="..0. = More fragments: Not set" size="1" pos="20" show="0" value="00"/>
</field>
<field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="0000"/>
<field name="ip.ttl" showname="Time to live: 53" size="1" pos="22" show="53" value="35"/>
<field name="ip.proto" showname="Protocol: ICMP (0x01)" size="1" pos="23" show="0x01" value="01"/>
<field name="ip.checksum" showname="Header checksum: 0xb8f0 (correct)" size="2" pos="24" show="0xb8f0" value="b8f0"/>
<field name="ip.src" showname="Source: 172.27.20.4 (172.27.20.4)" size="4" pos="26" show="172.27.20.4" value="ac1b1404"/>
<field name="ip.addr" showname="Source or Destination Address: 172.27.20.4 (172.27.20.4)" size="4" pos="26" show="172.27.20.4" value="ac1b1404"/>
<field name="ip.dst" showname="Destination: 192.168.60.3 (192.168.60.3)" size="4" pos="30" show="192.168.60.3" value="c0a83c03"/>
<field name="ip.addr" showname="Source or Destination Address: 192.168.60.3 (192.168.60.3)" size="4" pos="30" show="192.168.60.3" value="c0a83c03"/>
</proto>
<proto name="icmp" showname="Internet Control Message Protocol" size="8" pos="34">
<field name="icmp.type" showname="Type: 8 (Echo (ping) request)" size="1" pos="34" show="8" value="08"/>
<field name="icmp.code" showname="Code: 0 " size="1" pos="35" show="0x00" value="00"/>
<field name="icmp.checksum" showname="Checksum: 0x6861 (correct)" size="2" pos="36" show="0x6861" value="6861"/>
<field name="icmp.ident" showname="Identifier: 0x809e" size="2" pos="38" show="0x809e" value="809e"/>
<field name="icmp.seq" showname="Sequence number: 0x0f00" size="2" pos="40" show="0x0f00" value="0f00"/>
</proto>
</packet>

PDML is related to NetPDL. Both were created at the same Italian university that brought the world Windump.

Read More