Sourcefire Introduces Appliance

Sourcefire will announce a new appliance to compliment their standard IDS sensor, according to eweek: Security vendor Sourcefire Inc. on Monday will announce a new security appliance that company executives say will make intrusion detection systems more efficient and valuable in enterprise networks. The Real-Time Network Awareness appliance combines vulnerability assessment and correlation with change management in an effort to reduce or even eliminate the false positives and negatives that plague IDS systems. The RNA box is meant to work in conjunction...

Read More

Cisco Router Evidence Extraction Disk

Router forensics has come to my attention recently. Thomas Akin, author of Hardening Cisco Routers, gave this Black hat 02 presentation and offers CREED, the Cisco Router Evidence Extraction Di...

Read More

Patching in the Air Force

The 28 May SANS NewsBites reported: Air Force Service Evaluates Patches (19 May 2003)The Air Force has established the Enterprise Network Operations Support Cell (ENOSC), a software patch service. Patches are tested by the Air Force Computer Emergency Response Team which assesses its effectiveness and assigns it a number indicating its likelihood of interfering with other software. The patch along with that information is placed on the site and administrators can decide if it's an appropriate patch for their systems. ENOSC supports Windows 9x,...

Read More

Reducing IDS Alerts

The same issue of SC Magazine offered an article on reducing IDS false positives by altering the behavior of Windows Media Player -- not ignoring alerts. What ingenuity! I'd like to see more of this sort of thinki...

Read More

Gunter Ollmann Doesn't Like Hacking Exposed

This article by Gunter Ollmann of ISS takes a swipe at readers of the best-selling Hacking Exposed book series. Gunter manages to offend both prospective clients and those who perform his so-called "blind penetration tests," which apparently are inferior to his "crystal box penetration tests." From the article: I call such prospective clients HE-men (after the Hacking Exposed line of books). They are proof that a little knowledge in the wrong hands really can do a lot of damage...a ‘blind’ penetration test will take considerably longer to discover...

Read More

CAIDA Tool Taxonomy

I continue to research ways to capture information useful for network security monitoring. I found CAIDA's tools taxonomy helpful. RMON (Remote Monitoring) is one solution, especially since it can support full packet capture. (See the IETF charter, mailing list, and Cisco overview.) NetScout probes are a commercial option, although it seems ntop (mailing list) can be modified to collect RMON data. Cisco's NetFlow data appears useful. Competitors include sFlow and nFl...

Read More

Prevention Always Fails

Network Magazine's May issue featured the article Emerging Technology: Detection vs. Prevention - Evolution or Revolution?. This is another case where a policy enforcement mechanism is confused with a policy audit and verification system. Policy enforcement mechanisms include firewalls, routers with access control lists, and so-called "intrusion prevention systems," which are simply layer 7 firewalls. Policy audit and verification systems include some traditional intrusion detection products, along with traffic collection systems like Argus...

Read More

Sguil 0.2 Released

My friend Bamm Visscher released version 0.2 of his Snort-based network monitoring solution, called sguil. I will be working on more comprehensive documentation when I finish my current incident response deployments! Also, check out the new project logo! From the announcement: Sguil (pronounced "sgweel") is a graphical interface to snort. The actual interface and GUI server are written in tcl/tk. Sguil uses other open source software like barnyard and mysql for accessing data. The client interface provides 'hooks' to analyst tools like ethereal,...

Read More

Review of Art of the Steal Posted

Amazon.com just posted my four star review of The Art of the Steal. From the review: I typically read and review books on digital security. I bought "The Art of the Steal" (TAOTS) after being captivated by "Catch Me If You Can." TAOTS is an incredible book, but not because it is a masterpiece of English literature. Rather, TAOTS is an amazing and personalized tour of a seedy underworld where ingenuity serves evil purposes. In Amazon.com also posted my four star review of Stealing the Network. From the review: "Stealing the Network" (STN) is...

Read More

Vasiliy Gorshkov and Alexey Ivanov

The Washington Post is running a three part article on Russian criminals Vasiliy Gorshkov and Alexey Ivanov. From the article: Vasiliy Gorshkov did not set out to be a thief. Relatives and friends say he had wanted to build a dot-com . . . Gorshkov, then 24, didn't have the cash. Business associates recalled that he didn't even have enough money to keep paying his four programmers. But one of those programmers, 19-year-old Alexey Ivanov, said he knew how to raise the protection money, according to lawyers familiar with the conversation. Goshkov...

Read More

Loopback for Forensics on Linux and FreeBSD

Ever done forensics and needed to find the enhanced loopback kernel patch for Linux? Now you know where to find it. FreeBSD supports this natively using vnconf...

Read More

Nmap in The Matrix Reloaded

Kevin Poulsen reported that the new movie The Matrix Reloaded features Trinity using nmap and a SSH exploit!...

Read More

TaoSecurity Blog Added to Security Blog List

Jiri Ludvik added this site to his security weblogs list. I also learned of a site that creates a fictitious market for blogs, called BlogShar...

Read More

More on Fluffi Bunni Arrest

Here's an update on the arrest of the alleged ringleader of the Fluffi Bunni group: Senior detectives at Scotland Yard's Computer Crime Unit spotted 27-year-old Lynn Htun, believed to be the brains behind the infamous Fluffi Bunni hacking group, on the stand run by Insight Consulting and its business partner Siemens at the Infosecurity Europe 2003 show at Olympia, Lond...

Read More

New $20 Bill Arriving

Just as I'm reading Catch Me If You Can star Frank Abagnale's book Art of the Steal, CNN reports the $20 bill will be released with a color design this fa...

Read More

Sp_Perl for Snort

Saturday Jeff Nathan announced he and Brian Caswell have developed a new plugin for Snort: sp_perl. This detection plugin offers users full regular expression matching within a Snort rule as well as runtime execution of perl code. They briefed their work at CanSecWest 03. At the same conference, Jed Haile gave a short presentation on using Argus to monitor network flows. Russell Fulton has been doing the same thing with Argus for at least four years. Argus was publicly announced almost exactly seven years ago. I learned similar techniques...

Read More

Sourcefire Seminar

Yesterday I attended a seminar on Sourcefire by Marty Roesch. Marty will present at a few other citi...

Read More

ILOVEYOU Virus Three Years Old Today

Three years ago today the Love Letter virus rampaged across Outlook applications everywhere. I believe we set up our ASIM sensors to execute TCP resets on any mail message containing the words "ILOVEYOU". What a waste of CPUs! Fyodor, author of nmap, released the latest version of his security tool survey. This "who's who" of security tools is a good place to start to learn which tools to t...

Read More