Editing c:\windows\system32\drivers\etc\hosts

My ISP is having some teething problems with its "upgrade." I needed a way to point my name resolutions for www.comcast.net to the one server they operate which is working, and not to the default server which isn't working. Following this tip I edited c:\windows\system32\drivers\etc\hosts: # Copyright (c) 1993-1999 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be...

Read More

Security Checklist for FreeBSD 4.8

While reading the BSDforums I learned of a new security checklist for FreeBSD 4.8. You can read the thread behind this doc. It's a work in progress and may help out the FreeBSD security initiative at CISecuri...

Read More

Odd Activity in Argus Logs

Checking my Argus logs this morning, I noticed a few odd scans. The first is to port 2 TCP, which according to the Internet Storm Center is becoming popular: 16 Jun 03 03:12:08 tcp 24.96.49.46.4396 -> my_IP.2 TIM 23 Jun 03 07:59:05 tcp 220.120.31.233.4900 -> my_IP.2 TIM I'm also seeing scans to port 57 TCP, which has history dating to Oct 02 and Nov 02 and is a signature of a tool called FX-Scanner (analysis). Apparently port 57 is used as a host discovery mechanism. Here are three examples. First, recon...

Read More

TaoSecurity Web Down

My TaoSecurity web site is down while my hosting provider upgrades its servers. Estimated returned to service is at least by Monday morni...

Read More

Les Cottrell Network Monitoring Tools

Les Cottrell maintains a comprehensive list of network monitoring tools. He responds to email if you'd like to suggest additions. CAIDA (Cooperative Association for Internet Data Analysis), lists tools al...

Read More

Packet Creation Tools

Looking for packet creation tools on UNIX? Nemesis and Hping have been around for three years, while Packit is a newcomer from earlier this year. You can find the FreeBSD ports for all of these at FreshPorts. Others exist but these are some of my favorites. I've used IPSorcery on Linux. Windows users can check out Komodia and lcrzoex (which also runs on UNI...

Read More

Anton Chuvakin profiles TaoSecurity Blog

Anton Chuvakin wrote this blog entry profiling my blog. Thanks Anton! Also, his blog made me aware that the former Psionic tools (acquired by Cisco in Oct 02) are available at Sourceforge. Cisco makes some of the tools available on their site, like Cisco Threat Response (formerly Clear Response), mentioned by Craig Rowla...

Read More

Support for Windows NT 4.0

Wondering how long your copy of Windows NT 4.0 will be supported? Visit the Microsoft Lifecycle site. Look here for the quick answ...

Read More

IPv6 in DoD

Time to learn IPv6. According to this article: "John Osterholz, director of architecture and interoperability for the Department of Defense, told a gathering of technology elite that the DoD would phase out purchases of IPv4 network technologies by this fall and would instead begin trials of equipment and applications based on the new IPv6 protocol for the Internet within 30 day...

Read More

2003 Recent Advances in Intrusion Detection

The 2003 Recent Advances in Intrusion Detection (RAID) conference will be held in Pittsburgh on 8-10 Sep 03. Word on registration is forthcomi...

Read More

Chucktips

If you want to learn more about FreeBSD, visit Chucktips, which looks like Slashdot and is newbie-friend...

Read More

RPM Tips

Although I prefer to use FreeBSD's package system, I recommend Linux users visit FreshRPMs.net or RPMfind.net for their RPM needs. If you need to install Linux software from source, but want to manage the code like an RPM, try CheckInsta...

Read More

Miscellaneous Hardware

IOGEAR has two products I need. The first is a combination Firewire and USB 2.0 CardBus adapter. The second is the COMBO ION™ drive is a 2.5” hard drive enclosure. Both are useful when doing host-based forensi...

Read More

OpenBSD Pf Scrubbing

I'm always looking for new ways to handle network traffic. I noticed that the OpenBSD Packet Filter offers scrubbing. This builds on the concepts discussed by Mark Handley and Vern Paxson, discussed at Slashdot. PF's "random-id" option should defeat Steve Bellovin's technique for counting NATed hosts. Peter Phaal of InMon wrote Detecting NAT Devices using sFlow, which relies on counting TTL values to detect NAT hosts. pf's "min-ttl" feature might obscure that tactic, according to another Slashdot thre...

Read More

Openroot

Want to play on a FreeBSD box? Check out OpenRoot, "a FreeBSD 4.8-stable box in which root access is given to everyone... OpenRoot is essentially a virtual machine (a jail in FreeBSD terminology) running ontop of FreeBSD." You can access openroot.no-ip.org on ports 30 and 31 TCP using secure shell. Log in as user 'openroot', password 'openroot', and then 'su -' with no password. However, it doesn't appear that 'root' users have a full working environment: openroot# ping www.google.comping: socket: Operation not permittedopenroot# w12:40AM ...

Read More

Small Form Factor Sensors

I plan to roll out new firewall and network security monitoring platforms for my home lab network. For the firewall, I'm considering an "embedded" BSD solution, like OpenSoekris, m0n0wall, or m0n0BSD, which run on the popular Soekris (mailing list) embedded computers, like the net4501 and the new net4801. I like these motherboards because they're equipped with three NICs. Other Soekris-based projects include FreeBSD wireless router (more info), theWall, Linux Embedded Appliance Firewall, linux4501, Personal Linux Router Project, and Debian ...

Read More

DCPhoneHome

Interested in by-passing access control, or understanding how it's done in order to monitor it? Check out dcphonehome, run by my friend Aaron Higbee, or Gray-Wor...

Read More

Commercial IDS Appliances Built on Snort

Consider all of the commercial IDS appliances built on the Snort detection engine: Sourcefire Network SensorSilicon Defense SentarusPacketAlarmStillSecure Border Guard; check the FAQ -- they run Snort but hide it wellArgus 1000; no relation to the one true ArgusFidelisSec CyberHoundSnort isn't the only open source IDS engine in town. Check out Shoki or Tamand...

Read More

Security Focus Vulnerability Database

In Jan 03 I noted the SecurityFocus vulnerability database didn't seem to include exploits anymore. Yesterday I was searching for Windows XP vulnerabilities for a class and found one example where exploits were availab...

Read More

Remote Capture Using Winpcap

Just when you thought network monitoring couldn't get any cooler -- I learned WinPcap (mailing list) version 3.0 support Remote Capture. "This is an highly experimental feature that allows [you to] interact [with] a remote machine and capture packets that are being transmitted on the remote network. This requires a remote daemon (called rpcapd) which performs the capture and sends data back and a local client that sends the appropriate commands and receives the captured data." What is even cooler -- "The [Remote] daemon [rpcapd] can be compiled...

Read More

Flow Tools

Thomas H. Ptacek, who co-authored a slightly famous paper on IDS several years ago, wrote me regarding his company's product, Peakflow X. According to their press release, the system profiles network traffic and complements traditional signature-based IDS: "Upon installation, Peakflow X monitors network traffic, automatically constructing a holistic real-time model of the entire network from the inside out. Identifying factors such as services (HTTP, FTP, Microsoft File Sharing, etc.), inbound and outbound traffic, and host-to-host behavior, Peakflow...

Read More

Problems with CISSP Questions

The June 2003 Information Security Magazine offered some great reading too. It reminded me of a Gartner statistic saying between 60 to 70 percent of Windows Server users run NT 4. Writing about his experience taking the CISSP exam, Andrew Briney nails the problem with CISSP questions: "There's a chunk of questions that are difficult for all the wrong reasons. They're poorly worded, misleading or simply evasive. Evasive: that's the word that first came to mind when I walked out of the exam. It just seems like these questions serve no purpose...

Read More

Security "Return on Investment"

The June 03 SC Magazine offered several excellent articles. Peter Stephenson discusses new forensic certifications, like the Certified Information Forensics Investigator (CIFI). (If you qualify by 31 Dec 03, you might be able to grandfather the cert without sitting for the test.) The same issue featured a case study called Tracking Down Cybercriminals. Unfortunately, SC Magazine quotes an Addamarkl survey saying "companies are unwilling to prosecute hackers, even when they have enough evidence for legal action. Information security departments...

Read More

Network Tools

I'm trying to find products which can intelligently analyze network traffic to supplement traditional intrusion detection products. I'd like to get a look a Silent Runner, which offers visualization and analysis tools. Lancope Stealthwatch calls itself a "behavior-based IDS" which analyzes flows to identify anomalies. Incidentally, if you're looking for a giant list of IDS and other security products, visit Talisker's Network Security Resource. SPADE, the Statistical Packet Anomaly Detection Engine for Snort, is available but I have yet to...

Read More

Network Computing on Foundstone

After last week's bad press at Fortune and Slashdot, some good press for Foundstone. Network Computing likes Foundstone's 2.6 scanner -- and hasn't seen 3.0 yet. This job request looks fake to ...

Read More

Guess and FTC Settlement

The SANS and Neohapsis Security Alert Consensus told me of the settlement between Guess and the FTC. From the article: According to the FTC complaint, since at least October 2000, Guess' Web site has been vulnerable to commonly known attacks such as "Structured Query Language (SQL) injection attacks" and other web-based application attacks. Guess' online statements reassured consumers that their personal information would be secure and protected. The company's claims included "This site has security measures in place to protect the loss, misuse,...

Read More

Transforming the U.S. Air Force Enterprise Network

A captain I worked with in the AFCERT several years ago, Carl Grant, published Transforming the U.S. Air Force Enterprise Network in the latest IA Newsletter. Carl talks about the AFNOSC, which was also discussed in this testimony by the Air Force CIO John Gillig...

Read More

FreeBSD X Configuration

I installed FreeBSD 5.1 REL on my IBM Thinkpad a20p this afternoon. I finally have X working on a FreeBSD system "out of the box" -- more or less. X couldn't auto-configure my card, but I was able to do it manually. Once I was done installing XFree86 4.3 I installed KDE 3.1. I copied the .xinitrc (just a text file with 'exec startkde' from root's home directory to my user directory.) Here's my X config file: -bash-2.05b$ cat /etc/X11/XF86Config Section "ServerLayout" Identifier "Layout0" Screen 0 "Screen0" 0 0 ...

Read More

Don't Hack Air Force Systems

It does not pay to live in the US and compromise Air Force systems! From this article: An 18-year-old hacker who breached computers at Sandia National Laboratories and posted an anti-Israeli message on the Eglin Air Force Base Web site was sentenced Thursday to a year and a day in federal prison. Adil Yahya Zakaria Shakour also was ordered to pay $88,253 in restitution, and his computer use was restricted during the three years he will spend under supervised release after his prison term. Shakour, a Pakistani national who lives in Los Angeles,...

Read More

Combining NIC interfaces on FreeBSD

I wrote this post yesterday in response to a question on how to mirror interfaces for combining tap outpu...

Read More

Microsoft Patterns and Practices

A colleague informed me of the Microsoft Patterns and Practices site, which offers book-length treatises on many subjects. The latest is Improving Web Application Security: Threats and Countermeasur...

Read More

Cisco IOS Licenses

While reading comp.dcom.sys.cisco, I found a thread discussing licenses for Cisco IOS. This abbreviation of Cisco's software transfer and licensing policy states "owners of Cisco products are only allowed to transfer, re-sell or re-lease used Cisco hardware and not the embedded software that runs on the hardware." One option for licensed use of Cisco gear at reduced prices is buying refurbished equipment, sold by authorized resellers, and getting a SMARTnet support contract to access parts of Cisco's software center. There seems to be no shortage...

Read More

You go Marty!

Read Marty Roesch's response to the uninformed claims of Gartner, Inc.. From the Gartner press release:According to the Gartner, Inc. (NYSE: IT and ITB) Information Security Hype Cycle, IDSs have failed to provide value relative to its costs and will be obsolete by 2005.From Marty's response:Let me get this straight… better access control will completely remove the need for auditing? Auditing functions are a fundamental part of providing defense in depth in any security environment. Do they not understand this or, perhaps, have the economic challenges...

Read More

Stealing Network Address Space

Kevin Poulsen published an article on stealing network address space. From the article: Los Angeles County had been hit by a growing type of hi-tech fraud, in which large, and usually dormant, segments of the Internet's address space are taken away from their registered users through an elaborate shell game of forged letters, ephemeral domain names and anonymous corporate fronts. The patsies in the scheme are the four non-profit registries that parcel out address space around the world and keep track of who's using it. The prizes are the coveted...

Read More