TaoSecurity Blog

In March I created a Windows Application Using Visual Studio Code, Cline, OpenRouter, and Claude . This was a program that created square screen captures. The user doesn't need to manually ensure the dimensions are a square. The program makes the window grow and shrink while keeping the length equal to the height.      In June I created an equivalent program on Linux using VSCodium, Cline, OpenRouter, and Claude.   I provided this prompt, which I derived from the last project.   ==    Create a graphical Linux application to take screen captures with the following features: Square Region Selection: Enforces a 1:1 aspect ratio during region selection 1:1 Aspect Ratio: Ensures all captures are perfectly square PNG Output: Saves high-quality images in PNG format Preview: Shows the captured image before saving Dark Mode by Default: Toggle to light theme if desired Square Interface: The application window itself uses a square ratio Default Save Location:...

I spent a chunk of the day troubleshooting a network security monitoring (NSM) problem. I thought I would share the problem and my investigation in the hopes that it might help others. The specifics are probably less important than the general approach. It began with ja3 . You may know ja3 as a set of Zeek scripts developed by the Salesforce engineering team to profile client and server TLS parameters. I was reviewing Zeek logs captured by my Corelight appliance and by one of my lab sensors running Security Onion. I had coverage of the same endpoint in both sensors. I noticed that the SO Zeek logs did not have ja3 hashes in the ssl.log entries. Both sensors did have ja3s hashes. My first thought was that SO was misconfigured somehow to not record ja3 hashes. I quickly dismissed that, because it made no sense. Besides, verifying that intution required me to start troubleshooting near the top of the software stack. I decided to start at the bottom, or close to the bottom. I ha...

Today I decided to install Suricata , the open source intrusion detection and prevention engine from the Open Information Security Foundation (OISF) , as an IPS. I've been running Suricata in IDS mode through Security Onion on and off for several years, but I never tried Suricata as an IPS. I decided I wanted to run Suricata as a bridging IPS, such that it did not route traffic. In other words, I could place a Suricata IPS between, say, a router and a firewall, or between a router and a host, and neither endpoint would know the IPS was present. Looking at available documentation across the Web, I did not see specific mention of this exact configuration. It's entirely possible I missed something useful, but most people running Linux as a bridge weren't using Suricata. Those running Linux as a bridge sometimes enabled an IP address for the bridge, which is something I didn't want to do. (True bridges should be invisible to endpoints.) Of course, to administer the ...

I decided my Dell PowerEdge 2300 needed to switch from FreeBSD to Debian. I wanted to try using this SMP system to run VMware Server Beta, which runs on Windows or Linux. I'd like to record two notes about how I got this system running Debian with the 2.4 kernel. First, the Dell PowerEdge 2300 uses a Megaraid RAID system that is not supported by the 2.6 kernel that ships with Debian. I couldn't get the 2.4 version of the installation process to recognize the RAID either, meaning Debian didn't see a hard drive on which to install itself. I found sites like Debian on Dell Servers and considered using custom .iso's for installation. Luckily I found a much simpler solution. During the installation, after the hardware check failed to find my hard drive, I ran the following commands. cd /lib/modules/2.4.27-2-386/kernel/drivers/scsi insmod megaraid.o That allowed the Megaraid to be recognized, after which a hardware re-check found the RAID and permitted installing the O...

I previously reported running FreeBSD 6.0 on my Hacom Lex Twister VIA 1 GHz Nehemiah. Today I decided to install Debian on it. I will warn you now that the majority of this post is documentation for my own reference, and the hope it might help someone else. If you're looking for short, pithy security insights, today is not your day. I used a USB-connected external CD burner as my installation source. The Hacom is very temperamental with it. I had to disable all booting sources except the USB-CD. Next I booted the Hacom with the USB-CD off. Once I got an error from the BIOS about a lack of bootable devices, I then turn on the USB-CD and press to try booting again. Installing Debian on the Hacom was fairly painless. I did not add any packages with aptitude during the installation. That meant the following packages were installed. hacom:~# dpkg --list Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Installed/Config-files/Unpacked/Failed-config/Half-installed |/ Err?...

I've previously posted about running Debian on my October 1994-era 90 MHz Pentium Quantex QP5/90 PM-3 with 80 MB RAM. I hadn't booted the box since June 2004. Today while reading a book on Debian I decided to try upgrading to Debian stable , also known as sarge or 3.1 at the moment. When I started the process, this was my uname output: Linux oates 2.4.18-1-386 #1 Wed Apr 14 17:34:59 UTC 2004 i586 GNU/Linux This is all I had to do: cat /etc/apt/sources.list deb http://ftp.us.debian.org/debian sarge main non-free contrib deb http://non-us.debian.org/debian-non-US sarge/non-US main contrib non-free # apt-get update # apt-get --show-upgraded upgrade Building Dependency Tree... Done The following packages have been kept back: honeyd libldap2 libopencdk8 lilo mutt The following packages will be upgraded: adduser apt apt-utils aptitude ash base-config base-files base-passwd bash ...edited... util-linux wget whiptail zlib1g 125 upgraded, 0 newly installed, 0 to remove and 5...

This morning I started reading Debian GNU/Linux 3.1 Bible by Benjamin Mako Hill, David B. Harris and Jaldhar Vyas. I installed Debian 3.1r1 in a VM. I did not select any software packages. When done, this is the netstat output I saw: richard@debian:~$ netstat -na -A inet Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:113 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:819 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN udp 0 0 0.0.0.0:813 0.0.0.0:* udp 0 0 0.0.0.0:816 0.0.0.0:* udp 0 0 0.0.0.0:111 ...

I bought two "exotic" boxes two years ago to help me learn non-BSD, non-Linux, yet UNIX-like operating systems. A visit to my BejNet page shows I own a HP Visualize B2000 workstation and an IBM RS/6000 7043 43p (aka 7043-150) workstation. I bought the first to learn HP-UX and the second AIX. Aside from some puttering, I never did much with either and my original need to become familiar with these declining market share operating systems decreased. To get these systems doing something more useful, I decided to replace each OS with a version of Linux. Neither was supported by NetBSD , although I did try to install the NetBSD prep port (which is supposed to support CHRP and PReP) on the RS/6000. I couldn't get the NetBSD CD to boot on it, so I turned to Linux. First I tried the Debian hppa port on the HP box. I was able to get the CD to boot, but to get the Linux kernel loaded I had to enter the HP IPL and follow these three handy hints to set ramdisk_size=327...

I have several short stories to report from BSD land. First, the DragonFly BSD project released DragonFly BSD 1.2 last Friday. DragonFly BSD is a continuation of the FreeBSD 4.x branch by a separate development team. I downloaded and tried the new release, since the single .iso boots as a live CD. This is a nice feature, as it lets you test your hardware's compatibility before installing the OS. I have no plans to run this OS in production, but I might deploy a test system in my lab. Did you ever wonder why certain Linux users are so adamant about calling their OS "GNU/Linux"? This is especially true of Debian users. To understand why, you should understand the history of the GNU HURD kernel. The HURD was the original kernel on which free software would run. The HURD wasn't making much progress when the Linux kernel arrived, so people starting running GNU utilities on the Linux kernel. People who remembered the HURD kernel and the importance of the G...

Last month I wrote a blog entry titled Linux Kernel Development Problems in response to discoveries of new Linux kernel vulnerabilities. I wondered what people were saying about possibly forking the Linux kernel to start a 2.7 branch. I found a fascinating thread from last month with subject starting with 2.7 on the linux-kernel mailing list. In my previous article I cited Ted T'so 's contribution to the thread. Here are a few other thoughts on Linux kernel development from that discussion. (For background on the new Linux development model, check here and here .) My take is simple: I prefer the FreeBSD development process. I avoid 6.0 CURRENT, except for lab test systems, because I know it has zero guarantee of stability. I play with 5.3 STABLE to see what might appear in FreeBSD 5.4. On production systems I run the "security" branch, which only has bug fixes and critical fixes (few are far between, in my experience). For Linux, I would like to see the...