USENIX Follow-Up

Given that USENIX finished today, I figured I'd say a few words beyond those already uttered this week. I found two of the "ask-the-experts" sessions to be very informative. Steve Bellovin of AT&T Research Labs and Bill Cheswick of Lumeta gave great talks. Yes, I gave the second edition of their book a three star review. Regardless, their USENIX talks were very helpful. After explaining how Lumeta's IPSonar works, Ches told us of a project called RocketFuel which is mapping the Internet, as Lumeta's most current maps aren't shared anymore due to post-9/11 security concerns. I found Cheswick's patent on "Method and apparatus for tracing packets in a communications network".

Mark Seiden gave a great talk on physical security. He believes digital security is superior to physical security, as physical security is dominated by people who believe obscurity is a legitimate way to achieve security. As a result, only criminals and locksmiths know which systems work, and the public is left vulnerable. Several years a group called Anti Security tried promoting a "closed source" movement. Their web site was down today but you can see an archive. (Incidentally, Matt Blaze's research created a firestorm in the physical security community.) Five years ago, Mark discovered a vulnerability in security systems used in airports, which "could enable terrorists to gain control of the electronic
badges that allow employees with security clearance to enter and
leave restricted areas."

Read More

Windows NT on FreeBSD

FreeBSD is my operating system of choice. I'd run FreeBSD as a guest operating system using VMWare and Windows XP as the host OS. Yesterday I managed to do nearly the oppositive. I installed VMWare via the VMWare3 port on my Thinkpad a20p running FreeBSD 5.1, and ran Windows NT 4 within VMWare!

Essentially I installed the port, started vmware.sh, and created a /usr/lib/vmware/licenses/user directory with the license.ws.3.0 file in it. I also executed 'mount_linprocfs linproc /compat/linux/proc' to prepare the Linux emulator. I used an unused VMWare 3 license made obsolete by my VMWare 4 license, and fired it up. Unfortunately, I had trouble getting the network to work (and read in the mailing list this is common), and read only one guest OS per session is allowed. I plan to use Linux as the host OS for my next test.

Read More

Sanctum Patent

I missed this on the Open Web Application Security Project web site until coworker Yen-Ming Chen brought it to my attention:

"On June 24th, 2003 Sanctum Inc. [was] issued US patent number 6,584,569 B2. You can read the patent online at the US Patent Office. The patent is entitled "A system for determining web application security vulnerabilities" and outlines a generic system and basic methodology for performing a web security assessment."

In my non-lawyer opinion, this means nothing. Thousands of patents are issued each year, just waiting to be knocked down in court by a prior art argument. Still, it reminds me how Marcus Ranum thanked Dorothy Denning for writing about intrusion detection in the 1980s, clearly establishing these prior art arguments and paving the way for commercial IDS products. Marcus should have mentioned James Anderson as well, whose 1980 paper "Computer Security Threat Monitoring and Surveillance" (.pdf) sets a very early IDS example.

Read More

Scott Granneman on Security Blogs

Scott Granneman who wrote "Blogs: Another Tool in the Security Pro's Toolkit" parts one and two. He mentions my blog in the second article, saying he likes it but wishes I had an RSS feed. That sent me scrambling to read his first article again, and experiment with setting up this at BlogStreet:

http://feeds.blogstreet.com/12858.rss

This seems to work using this old but free HoverNews news aggregator, but it looks like it builds off archives -- which I do monthly, not weekly, and is still too slow for daily updates. I've thought about upgrading to Blogger Pro which offers native RSS feeds and visitation stats, but they've been "retooling" for weeks now. So, consider RSS an experiment which will be resolved when I upgrade to Blogger Pro! And, thanks for the mention Scott! Update: A much better free newsreader appears to be Feedreader. Other sites which aggregate RSS feeds include Syndic8.com and Newsisfree.com.

Read More

Recent Security Conference Thoughts

Over the last three weeks, I've attended and/or spoken at events held by SANS, Black Hat, and USENIX. I was struck today by my perceptions of each group of attendees, which don't necessarily reflect the attendees of the past:

• SANS is less of a "conference" and more a source of weekly classes, populated mainly by newbies. Some of the instructors, like Ed Skoudis and Eric Cole, rock. The SANS archive begins with SANS Network Security 99, which I attended. Back in 1998 and 1999, SANS was known for its "SANS" conference held in the spring, and its "Network Security" conference in the fall. The audience was much different then; people I only saw once a year met me at SANS. Now I confine myself to invited talks where I present my own material or niche courses lasting one or two evenings.


• Black Hat was strictly an annual event from 1997 to 1999. In 2000 Black Hat branched out to Singapore and Amsterdam, and now 3-4 "conferences" are held each year. Still, Black Hat (at least in Las Vegas) has retained its "hacker image," with the audience consisting of assessment-minded white hats, brave gray hats, and lots of feds. This is now my favorite conference and I see most of my "once-a-year" colleagues here.


• This week is my first USENIX Security symposium. What can I say -- it's all researchers. I'm surrounded by college kids with grants from DARPA, NSF, and other agencies! USENIX has quite an international flavor too, and acts more academic. For example, while SANS sells thick books of slides, and Black Hat provides all its slides on CD-ROM (smart), USENIX publishes "proceedings," complete with ISBN. Eventually they will be online, but I found these to be interesting:




• Two by Niels Provos, who wins the "most-blacked-out-entries-on-a-web-site award" with "Preventing Privilege Escalation (.pdf) (think OpenSSH) and "Improving Host Security with System Call Policies" (.pdf) (think systrace)


• "802.11 Denial-of-Service Attacks: Real Vulnerabilities and Practical Solutions" (.pdf.gz) -- props must go out to Mike Schiffman's libradiate, since he paved the way last year!


• Andy Ellis of Akamai gave an awesome talk of administering 14,000 servers, but his slides aren't online. He described the Internet as being composed of "10,000 economic entities," NOT "dominated by seven or eight ISPs," and said "most traffic reaches users via small access networks," like T-1s and T-3s. He also said "BGP is all about screwing your neighbor," because ISPs want to get traffic off their pipes if the endpoint isn't on their network! So, they advertise high metrics and as a result BGP offers neither performance nor reliability. He related how Level 3 had a problem a few years ago, when they attracted all Internet traffic by mistakenly advertising a "negative metric." Andy described how Akamai maps out 50,000 "core points," where only two core points are used in every Internet session, every 12 hours via ping and traceroute. Akamai routes requests for content over an "overlay network," and maps users to the closest content based on the DNS server they used to resolve hostnames.

I'm interested in attending CanSecWest next spring. It's a small annual event which features interesting speakers, similar to Black Hat.

Read More

Cisco IOS 12.3 Security Features

Cisco released new security features in IOS 12.3. See the Security Command Reference for more. From the docs:

By using a single command-line interface (CLI), the AutoSecure feature allows a user to perform the following functions:

• Disable common IP services that can be exploited for network attacks


• Enable IP services and features that can aid in the defense of a network when under attack.


• This feature also simplifies the security configuration of a router and hardens the router configuration.

For general Cisco texts, check out the Cisco documentation site I found this tutorial does a good job covering the basics.

Read More

Global Early Warning Information System

After Marcus Sachs the Cyber Program Director for the Information Analysis and Infrastructure Protection in the US Department of Homeland Security spoke at Black Hat, CNET writes about the Global Early Warning Information System. No .gov site offers official details, although this Washington Post article is helpful. GEWIS seems to build on the Cyber Warning and Information Network.

In case you were wondering how fast people patch systems, check out this article referencing this panel at Black Hat. Earlier work by Eric Rescorla (.pdf) is also disappointing.

Read More