OpenBSD Pf Scrubbing

I'm always looking for new ways to handle network traffic. I noticed that the OpenBSD Packet Filter offers scrubbing. This builds on the concepts discussed by Mark Handley and Vern Paxson, discussed at Slashdot. PF's "random-id" option should defeat Steve Bellovin's technique for counting NATed hosts. Peter Phaal of InMon wrote Detecting NAT Devices using sFlow, which relies on counting TTL values to detect NAT hosts. pf's "min-ttl" feature might obscure that tactic, according to another Slashdot thread.

Read More

Openroot

Want to play on a FreeBSD box? Check out OpenRoot, "a FreeBSD 4.8-stable box in which root access is given to everyone... OpenRoot is essentially a virtual machine (a jail in FreeBSD terminology) running ontop of FreeBSD." You can access openroot.no-ip.org on ports 30 and 31 TCP using secure shell. Log in as user 'openroot', password 'openroot', and then 'su -' with no password. However, it doesn't appear that 'root' users have a full working environment:

openroot# ping www.google.com

ping: socket: Operation not permitted

openroot# w

12:40AM up 1 day, 14:13, 1 user, load averages: 0.00, 0.00, 0.00

USER TTY FROM LOGIN@ IDLE WHAT

w: proc size mismatch (8480 total, 1064 chunks): No such file or directory

openroot# last | head

openroot ttyp0 86.84.139.55 Fri Jun 27 00:39 still logged in

openroot ttyp0 80.128.117.2 Fri Jun 27 00:17 - 00:23 (00:06)

openroot ttyp1 csa.bu.edu Wed Jun 25 02:55 - 02:55 (00:00)



wtmp begins Wed Jun 25 02:55:49 GMT 2003

Read More

Small Form Factor Sensors

I plan to roll out new firewall and network security monitoring platforms for my home lab network. For the firewall, I'm considering an "embedded" BSD solution, like OpenSoekris, m0n0wall, or m0n0BSD, which run on the popular Soekris (mailing list) embedded computers, like the net4501 and the new net4801. I like these motherboards because they're equipped with three NICs. Other Soekris-based projects include FreeBSD wireless router (more info), theWall, Linux Embedded Appliance Firewall, linux4501, Personal Linux Router Project, and Debian on the net4501. The OpenBrick project exists, although the Mini-ITX community seems to have more support, along with vendors like LinITX and Ultim8PC. This CompactFlashTM Type II Card Adapter looks useful.

For the NSM box, I'm considering a Shuttle SB52G (support, review) with Intel 845VG chipset and FB52 motherboard sold by ExcaliburPC, NewEgg, and Knowledge MicroExpress. Crucial sells memory. Other options include the Slimpro 1BayPC (manufacturer?), LittlePC, MicroPC4 and Lex Light, For more information there's the mailing.freebsd.small list, the books Embedded FreeBSD Cookbook and Designing Embedded Hardware, or Slashdot.

One issue with these small form factor devices is having enough interfaces for serving as a firewall or router. Luckily FreeBSD 5.x supports the Linksys USB100TX and USB200M USB NICs. Iomega and others make USB floppy drives. One could always buy a full-fledged but cheap PC from TigerDirect.

Read More

DCPhoneHome

Interested in by-passing access control, or understanding how it's done in order to monitor it? Check out dcphonehome, run by my friend Aaron Higbee, or Gray-World.

Read More

Commercial IDS Appliances Built on Snort

Consider all of the commercial IDS appliances built on the Snort detection engine:

• Sourcefire Network Sensor


• Silicon Defense Sentarus


• PacketAlarm


• StillSecure Border Guard; check the FAQ -- they run Snort but hide it well


• Argus 1000; no relation to the one true Argus


• FidelisSec CyberHound

Snort isn't the only open source IDS engine in town. Check out Shoki or Tamandua.

Read More

Security Focus Vulnerability Database

In Jan 03 I noted the SecurityFocus vulnerability database didn't seem to include exploits anymore. Yesterday I was searching for Windows XP vulnerabilities for a class and found one example where exploits were available.

Read More

Remote Capture Using Winpcap

Just when you thought network monitoring couldn't get any cooler -- I learned WinPcap (mailing list) version 3.0 support Remote Capture. "This is an highly experimental feature that allows [you to] interact [with] a remote machine and capture packets that are being transmitted on the remote network. This requires a remote daemon (called rpcapd) which performs the capture and sends data back and a local client that sends the appropriate commands and receives the captured data." What is even cooler -- "The [Remote] daemon [rpcapd] can be compiled and it is actually working on Linux as well." This sounds similar to SVtun. I couldn't get remote capture to work with Analyzer (Sourceforge site) by the WinPcap team, even though it natively supports remote capture.

Read More