TaoSecurity Blog

If you recognize the inspiration for this post title and graphic, you'll understand my ultimate goal. If not, let me start by saying this post is an expansion of ideas presented in a previous post with the succinct and catchy title Control-Compliant vs Field-Assessed Security . In brief, too many organizations, regulators, and government agencies waste precious time and resources devising and auditing "controls," regardless of the effect these controls have or do not have on security. They are far too input-centric; they should become more output-aware. They obsess over recording conditions they believe may be helpful while remaining ignorant of the "score of the game." They practice management by belief and disregard management by fact. Let me provide a few examples from one of the canonical texts used by the control-compliant crowd: NIST Special Publication 800-53: Recommended Security Controls for Federal Information Systems (.pdf). The following is ...

This is a follow-up to my story Examining the MPAA University Toolkit . After reading the hysteria posted on the Slashdot story MPAA College Toolkit Raises Privacy, Security Concerns , I thought I would take a look at traffic leaving the box. Aside from traffic generated by the auto-start of Firefox, the only interesting event was the following. I captured it with my gateway Sguil sensor. Sensor Name: hacom Timestamp: 2007-11-23 21:27:04 Connection ID: .hacom_5136150487897024842 Src IP: 69.255.105.234 (c-69-255-105-234.hsd1.va.comcast.net) Dst IP: 66.252.137.155 (Unknown) Src Port: 39532 Dst Port: 80 OS Fingerprint: 69.255.105.234:39532 - UNKNOWN [S4:61:1:60:M1460,S,T,N,W4:.:?:?] (up: 3 hrs) OS Fingerprint: -> 66.252.137.155:80 (link: ethernet/modem) SRC: GET /version.txt HTTP/1.1 SRC: Accept-Encoding: identity SRC: Host: universitytoolkit.com SRC: Connection: close SRC: User-Agent: Python-urllib/2.5 SRC: SRC: DST: HTTP/1.1 200 OK DST: Date: Fri, 23 Nov 2007 21:27:31 GMT ...

I learned about the MPAA University Toolkit at Brian Krebs' always-excellent SecurityFix blog. If you want to know more about the user experience, please check out that post. Here I take a look at the monitoring software, focusing on Snort, operating on this application. I downloaded the 534 MB peerwatch-1.2-RC5.iso and started it in a VMware Server session. I used ctrl-c and then 'sudo bash' to exit from the initial script presented within X, set a root password, then used 'apt-get ssh install' to install OpenSSH and thus enable root access. From this point forward I accessed the system using OpenSSH remotely to facilitate copying information into this blog post. First, this looks like Ubuntu (Xubuntu, if you really care) Feisty Fawn , or 7.04. root@ubuntu:~# uname -a Linux ubuntu 2.6.20-15-generic #2 SMP Sun Apr 15 07:36:31 UTC 2007 i686 GNU/Linux I was most interested in learning about Snort on this toolkit. I saw this version installed. root@ubuntu:~# s...

Earlier this year my lab suffered a near lightning strike. A tree right outside the lab was struck by lightning, causing damage to multiple electronic and electrical devices outside and inside the building. Outside, the lightning disabled an exterior lighting system and my phone lines. Inside, the lightning took a severe toll on the lab. The cable modem to the outside world was destroyed. The NIC on the lab firewall facing the cable modem was fried, along with a second NIC in the firewall. The NIC on a sensor watching a tap between the cable modem and firewall was also destroyed. So far, this is a grim story. I have one good piece of news to report, and it involves the tap I mentioned sitting between the cable modem and firewall. The tap survived the lightning strike. More precisely, the tap continued to pass traffic even when its monitoring interface was damaged. Had the tap been receiving traffic from the modem or firewall, it would have continued to pass it. This truly ama...

Recently I posted FreeBSD Binary Upgrade News about developments with Colin Percival's FreeBSD Update tool. Today I performed a remote (via SSH) upgrade from FreeBSD 7.0-BETA2 to FreeBSD 7.0-BETA3 using FreeBSD Update. I document the process below so you can see how easy it is and for my future reference. Here is uname output to show the OS version prior to upgrading. # uname -a FreeBSD myhost.mydomain.com 7.0-BETA2 FreeBSD 7.0-BETA2 #0: Fri Nov 2 16:47:33 UTC 2007 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 I wasn't sure if the version of FreeBSD Update packaged with FreeBSD 7.0-BETA2 would natively support this process, so I gave it a try. # freebsd-update -r 7.0-BETA3 upgrade usage: freebsd-update [options] command ... [path] Options: -b basedir -- Operate on a system mounted at basedir (default: /) -d workdir -- Store working files in workdir (default: /var/db/freebsd-update/) -f conffile -- Read confi...

In my January post The Revolution Will Be Monitored and elsewhere I discuss how network monitoring is becoming more prevalent, whether we like it or not. When I wrote my first book I clearly said that you should collect as much data as you can, given legal, political, and technical means because that approach gives you the best chance to detect and respond to intrusions. Unfortunately, I did not provide any clear guidance for situations where I think monitoring might not be appropriate. While this is by no means a political blog, I would not want my NSM approach to be taken as justification for monitoring and retaining every electronic transaction, especially beyond the security realm. In that spirit I would like to point out three recent stories which highlight some of the contemporary problems I see with electronic monitoring. First is Boeing bosses spy on workers . From the story: Within its bowels, The Boeing Co. holds volumes of proprietary information deemed so valuable that...

I enjoy analyzing covert channels, although my skills are far inferior to someone like Steven Murdoch . However, today via Packetstorm I learned of Protocol Hopping Covert Channel Tool by Steffen Wendzel. He wrote a text file describing his thoughts behind the tool called Protocol Hopping Covert Channels . Quoting the paper: This paper describes a new way to implement covert channels. This is done by changing the protocol of the tunnel while the tunnel exists and even change the protocol on a randomized way without restarting the tunnel or reconnecting to the tunnel. A simple proof of concept tool called 'phcct' (protocol hopping covert channel tool) also known as 'takushi' (what is japanese for taxi) is available on my website http://www.doomed-reality.org. phcct implements only one (the easiest) version of such a randomized protocol hopping covert channel. As soon as I read this I thought "this is so different from normal traffic, it will be easy to identify...