TaoSecurity Blog

This Thursday is the next ISSA NoVA meeting . It will be held at the The MITRE Corporation in McLean, VA. The social hour starts at 1730 and the meeting starts at 1830. Dr. Gary McGraw is the speaker. I will probably bring his books so I can get them signed. RSVP as soon as possible. Remember that the next NoVA Sec meeting is a week from Thursday.

I read about the new SANS paper IT Security Industry Changes: Trouble on the Horizon (September 2006) (.pdf) in this NewsBites issue. Here are some excerpts and my reactions. Over the past six months, SANS Technology Institute's Stephen Northcutt has been gathering data and stories from security managers in more than 100 US organizations searching for patterns in job changes of security managers and the consultants who support them. The research was triggered by multiple emails from security managers who were facing reorganizations. His conclusions, albeit preliminary, paint a worrisome picture of job prospects for ill-equipped security managers, but also offer promise of some opportunities for success and advancement. That's an interesting project. Let's read more. [S]enior executives began to feel more comfortable voicing their frustration that they were wasting money paying for hugely expensive people and compliance reports that probably were not needed and that ofte...

I last talked about installing Sguil in March 2006 . Over the last few weeks I've worked on the scripts I use for FreeBSD platforms, mainly as a response to changes in the various libraries and components. For example, Snort 2.6.0.2 is now available, replacing the Snort 2.4.x line. The idea behind these scripts is to replace an English-text description of what to install where with a computer syntax version. If properly configured, these commands can set up everything you need for Sguil -- sensor, database, server, and client. One of the major problems I've encountered is making good choices about libraries and components. The various Tcl libraries are on the fringes of support, compared to more popular packages. This makes it difficult to provide scripts that work without any real user modification. I decided the best I can do for the "run-it-without-looking" crowd is to let the scripts install (by default) packages shipped with FreeBSD 6.1 RELEASE, assuming y...

I just wrote about Web Browsing with Tor . You might wonder if there's an easy way to switch to using Tor while running Firefox. I looked at the Torbutton extension, but then I found SwitchProxy . I like SwitchProxy because can you configure multiple proxies and decide when to use them. If you click on the thumb image above you'll see me accessing a Hidden Service using Tor while I have Privoxy and Tor working together. Notice the URL -- http://6sxoyfb3h2nvok2d.onion/ I can just as easily switch to my production proxy, or even import a list of anonymous proxies and have SwitchProxy cycle through them every X seconds.

A task I'm going to blog shortly recommends that I install Privoxy . I encounted some troubles using FreeBSD so I thought I would document them. First I installed the package. orr:/root# pkg_add -vr privoxy ...edited... Running pre-install for privoxy-3.0.3_4.. extract: Package name is privoxy-3.0.3_4 extract: CWD to /usr/local extract: /usr/local/man/man1/privoxy.1.gz extract: /usr/local/sbin/privoxy extract: /usr/local/etc/privoxy/config extract: /usr/local/etc/privoxy/default.action extract: /usr/local/etc/privoxy/default.filter extract: /usr/local/etc/privoxy/trust ...edited... *********************************************************** ** Before running privoxy you must modify the file ** ** /usr/local/etc/privoxy/config ** ** ** ** Start privoxy with: ** ** /usr/local/sbin/privoxy /usr/local/etc/privoxy/config ** ** ...

In my Installing Privoxy post I said I needed to install Privoxy for a certain task. I decided to use Privoxy with Tor to facilitate anonymous Web browsing. First I installed Tor via package. orr:/root# pkg_add -vr tor ...edited... Package 'tor-0.1.1.23' depends on 'tsocks-1.8.b5_3' with 'net/tsocks' origin. ...edited... extract: Package name is tsocks-1.8.b5_3 extract: CWD to /usr/local extract: /usr/local/man/man1/tsocks.1.gz extract: /usr/local/man/man5/tsocks.conf.5.gz extract: /usr/local/man/man8/tsocks.8.gz extract: /usr/local/bin/tsocks extract: /usr/local/etc/tsocks.conf.sample extract: /usr/local/lib/libtsocks.so.1 extract: /usr/local/lib/libtsocks.so extract: /usr/local/share/examples/tsocks/tsocks.conf.complex.example extract: /usr/local/share/examples/tsocks/tsocks.conf.simple.example extract: /usr/local/share/examples/tsocks/README ...edited... Package 'tor-0.1.1.23' depends on 'libevent-1.2' with 'devel/libevent' origin. ...

A great way to start a religious war is to discuss domain name services. I previously documented my experiences with BIND 9 on FreeBSD , and I really didn't want to repeat the process for my small lab network. Looking in the ports tree I found Dnsmasq , "a lightweight, easy to configure DNS forwarder and DHCP server. It is designed to provide DNS and, optionally, DHCP, to a small network." Wow, that sounds perfect (but I don't need DHCP). I decided to try this on a Debian host that had a fully populated /etc/hosts file. macmini:~# apt-get install dnsmasq Reading Package Lists... Done Building Dependency Tree... Done Suggested packages: resolvconf The following NEW packages will be installed: dnsmasq 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. Need to get 114kB of archives. After unpacking 303kB of additional disk space will be used. Get:1 http://mirrors.kernel.org stable/main dnsmasq 2.22-2 [114kB] Fetched 114kB in 1s (78.8kB/s) Selecting p...