Bay Auction for "The Best Sr. Network/Security Engineer"

I searched for "VMS Alpha" today at eBay and found this item for auction by niteraven-99. This guy has put himself up for bid!

"You are bidding on myself to work at your company.

I will relocate at my expense and honor any offers received through eBay or otherwise.

Here is my information.

Over 15 years of extensive experience in the Information Technology Industry. Strengths are in networking, security, firewalls, LAN/WAN, Web Server, Application Server, SQL Server, and Oracle Server technologies including infrastructure design, integration, implementation, performance testing, problem resolution, security and network design, Firewall and IDS Implementation using a variety of platforms and products as well as, managerial and strong leadership skills."

The "buy it now" price is $100,000 and the starting price is $50,000. Hurry! The auction ends Jan-30-04 11:57:37 PST.

Read More

US-CERT National Cyber Alert System

ZDNet reports on the new National Cyber Alert System, also called the "National Cyber Advisory System." (Two names mean they're off to a great start I guess?) This portion of the new US-CERT provides the public with technical and non-technical email bulletins. I subscribed to both technical lists but have yet to hear back from the mail server. According to the press release:

"The new National Cyber Alert System security suite of products includes:

Cyber Security Tips: Targeted at non-technical home and corporate computer users, the bi-weekly Tips provide information on best computer security practices and "how-to" information.

Cyber Security Bulletins: Targeted at technical audiences, Bulletins provide bi-weekly summaries of security issues, new vulnerabilities, potential impact, patches and work-arounds, as well as actions required to mitigate risk.

Cyber Security Alerts: Available in two forms - regular for non-technical users and advanced for technical users - Cyber Security Alerts provide real-time information about security issues, vulnerabilities, and exploits currently occurring. Alerts encourage all users to take rapid action."

Read More

Another Internet Explorer Hole

This Slashdot thread discusses a new Internet Explorer hole posted to NT-BugTraq. A good story at Infoworld makes these comments:

"This hole could easily be combined with another Explorer spoofing problem discovered in December.

The previous spoofing problem allowed Explorer users to think they were visiting one site when in fact they were visiting somewhere entirely different. The implications are not only troublesome, but Microsoft’s failure to include a fix for the problem in its January patches has led many to believe it cannot be prevented.

If the same is true for this spoofing issue, then it will only be a matter of time before someone who thinks they are visiting one website and downloading one file will in fact be visiting somewhere entirely different and downloading whatever that site’s owner decides.

We also have reason to believe there is no fix. It may be that today’s flaw is identical to one found nearly three years ago by Georgi Guninski in which double-clicking a link in Explorer led you to believe you were downloading a text file but were in fact downloading a .hta file.

In both cases, the con is created by embedding a CLSID into a file name. CLSID is a long numerical string that relates to a particular COM (Component Object Model) object. COM objects are what Microsoft uses to build applications on the Internet. By doing so, any type of file can be made to look like a “trusted” file type i.e. text or pdf.

Guninski informed Microsoft in April 2001. The fact that the issue has been born afresh suggests rather heavily that the software giant has no way of preventing this from happening. "

This is ridiculous. How long will corporate America tolerate this before abandoning Internet Explorer for Mozilla? Unfortunately, in complete violation of all good software design principles, IE is tightly integrated into the Windows desktop. Running Mozilla is only part of the solution. Abandoning Microsoft for Mac OS X on the desktop is a better idea. I run FreeBSD 5.2 on my laptop but that's not the best idea for normal consumers.

For another essay on fundamental Windows flaws, read Shatter Attacks - How to Break Windows.

Read More

Installing a Single Port

Thanks to this thread I learned how to install a single port that doesn't appear in the ports tree. For example, GNU netcat just appeared at Freshports.org on 12 Jan. I wanted to install this one port to a FreeBSD 4.9 REL box that hasn't ever updated its port tree, as shown here:

moog# ls -al /usr/ports/INDEX*
-rw-r--r--  1 root  wheel  4003057 Oct  2 16:55 /usr/ports/INDEX
-rw-r--r--  1 root  wheel  4036779 Aug 15 21:56 /usr/ports/INDEX-5

I visited /ports/net/gnetcat and chose the download this directory in tarball option. This copied gnetcat.tar.gz to my system, and I moved it to /usr/local/ports/net. Next I extracted it and ran make and make install:

moog# tar -xzvf gnetcat.tar.gz 
gnetcat/
gnetcat/Makefile
gnetcat/distinfo
gnetcat/pkg-descr
gnetcat/pkg-plist
gnetcat/files/
gnetcat/files/patch-src-udphelper.c
moog# cd gnetcat
moog# make && make install
>> netcat-0.7.1.tar.bz2 doesn't seem to exist in /usr/ports/distfiles/.
>> Attempting to fetch from http://us.dl.sourceforge.net/netcat/.
Receiving netcat-0.7.1.tar.bz2 (325687 bytes): 45%
...edited...

When done I did a "rehash" and found gnetcat on my system:

moog# rehash
moog# which gnetcat
/usr/local/bin/gnetcat
moog# gnetcat -h
GNU netcat 0.7.1, a rewrite of the famous networking tool.
Basic usages:
connect to somewhere:  gnetcat [options] hostname port [port] ...
listen for inbound:    gnetcat -l -p port [options] [hostname] [port] ...
tunnel to somewhere:   gnetcat -L hostname:port -p port [options]

Mandatory arguments to long options are mandatory for short options too.
Options:
  -c, --close                close connection on EOF from stdin
  -e, --exec=PROGRAM         program to exec after connect
  -g, --gateway=LIST         source-routing hop point[s], up to 8
  -G, --pointer=NUM          source-routing pointer: 4, 8, 12, ...
  -h, --help                 display this help and exit
  -i, --interval=SECS        delay interval for lines sent, ports scanned
  -l, --listen               listen mode, for inbound connects
  -L, --tunnel=ADDRESS:PORT  forward local port to remote address
  -n, --dont-resolve         numeric-only IP addresses, no DNS
  -o, --output=FILE          output hexdump traffic to FILE (implies -x)
  -p, --local-port=NUM       local port number
  -r, --randomize            randomize local and remote ports
  -s, --source=ADDRESS       local source address (ip or hostname)
  -t, --tcp                  TCP mode (default)
  -T, --telnet               answer using TELNET negotiation
  -u, --udp                  UDP mode
  -v, --verbose              verbose (use twice to be more verbose)
  -V, --version              output version information and exit
  -x, --hexdump              hexdump incoming and outgoing traffic
  -w, --wait=SECS            timeout for connects and final net reads
  -z, --zero                 zero-I/O mode (used for scanning)

Remote port number can also be specified as range.  Example: '1-1024'

I plan to test gnetcat to see how it compares to the original nc.

Read More

Review of Introduction to Microprocessors Posted

Amazon.com just posted my five star review of Introduction to Microprocessors. From the review:

"John Crisp's Introduction to Microprocessors (ITM) is an excellent book. It has a low average score because the author posted the first review with zero stars, which could be the result of an Amazon.com error. I loved this book. It gets right to the heart of the matter regarding the operations of microprocessors. Anyone who wants to really know what happens inside their CPU will love ITM too."

I learned a second edition was just published, so I hope to read and review that book soon.

Read More

Blogger is "Atom-Enabled"

I learned by reading the Blogger Knowledge Base that Blogger now exports Blog feeds in the Atom API. This means if your newsreader is Atom enabled, you can subscribe to it like a RSS feed. I found XML-Atom-0.05 at search.cpan.org and saw it was in the FreeBSD ports tree.

I first tried NewsMonster which integrates with Mozilla and supposedly supports Atom, but encountered an error when trying to run it.

I next tried BottomFeeder, and found the precompiled Linux version worked fine using FreeBSD's Linux application binary interface (ABI). If you use BottomFeeder to access http://taosecurity.blogspot.com/atom.xml, you'll see the screen shot at left.

Read More

Review of Intrusion Detection and Prevention Posted

Amazon.com just posted my three-star review of Intrusion Detection and Prevention. From the review:

"I had high hopes for "Intrusion Detection and Prevention" (IDAP) as it is the first book to devote chapters to different vendor IDS products. It's also the first to explicitly mention the buzzword "intrusion prevention" in its title. Unfortunately, the book does not deliver the value I expected...

I took exception to some of the authors' conclusions. (Keep in mind a team wrote this book.) A cheap shot on page 187 shows the ISS chapter author doesn't understand what real analysts need to "trust" their IDS: "These increases in product signatures have given more customers the capability to trust the comprehensive nature of RealSecure over every other product, including the freeware power player, Snort." Analyst trust is built on transparency and validation, meaning he can see why the product generated an alert, and use additional data to confirm its validity. Snort and NFR offer this; ISS does not. Furthermore, if you don't like how Snort works, you can modify the source code -- try that with a proprietary system."

Read More