TaoSecurity Blog

I searched for "VMS Alpha" today at eBay and found this item for auction by niteraven-99 . This guy has put himself up for bid! "You are bidding on myself to work at your company. I will relocate at my expense and honor any offers received through eBay or otherwise. Here is my information. Over 15 years of extensive experience in the Information Technology Industry. Strengths are in networking, security, firewalls, LAN/WAN, Web Server, Application Server, SQL Server, and Oracle Server technologies including infrastructure design, integration, implementation, performance testing, problem resolution, security and network design, Firewall and IDS Implementation using a variety of platforms and products as well as, managerial and strong leadership skills." The "buy it now" price is $100,000 and the starting price is $50,000. Hurry! The auction ends Jan-30-04 11:57:37 PST.

ZDNet reports on the new National Cyber Alert System , also called the "National Cyber Advisory System." (Two names mean they're off to a great start I guess?) This portion of the new US-CERT provides the public with technical and non-technical email bulletins. I subscribed to both technical lists but have yet to hear back from the mail server. According to the press release : "The new National Cyber Alert System security suite of products includes: Cyber Security Tips: Targeted at non-technical home and corporate computer users, the bi-weekly Tips provide information on best computer security practices and "how-to" information. Cyber Security Bulletins: Targeted at technical audiences, Bulletins provide bi-weekly summaries of security issues, new vulnerabilities, potential impact, patches and work-arounds, as well as actions required to mitigate risk. Cyber Security Alerts: Available in two forms - regular for non-technical users and advanced for ...

This Slashdot thread discusses a new Internet Explorer hole posted to NT-BugTraq . A good story at Infoworld makes these comments: "This hole could easily be combined with another Explorer spoofing problem discovered in December. The previous spoofing problem allowed Explorer users to think they were visiting one site when in fact they were visiting somewhere entirely different. The implications are not only troublesome, but Microsoft’s failure to include a fix for the problem in its January patches has led many to believe it cannot be prevented. If the same is true for this spoofing issue, then it will only be a matter of time before someone who thinks they are visiting one website and downloading one file will in fact be visiting somewhere entirely different and downloading whatever that site’s owner decides. We also have reason to believe there is no fix. It may be that today’s flaw is identical to one found nearly three years ago by Georgi Guninski in which double-clic...

Thanks to this thread I learned how to install a single port that doesn't appear in the ports tree. For example, GNU netcat just appeared at Freshports.org on 12 Jan. I wanted to install this one port to a FreeBSD 4.9 REL box that hasn't ever updated its port tree, as shown here: moog# ls -al /usr/ports/INDEX* -rw-r--r-- 1 root wheel 4003057 Oct 2 16:55 /usr/ports/INDEX -rw-r--r-- 1 root wheel 4036779 Aug 15 21:56 /usr/ports/INDEX-5 I visited /ports/net/gnetcat and chose the download this directory in tarball option. This copied gnetcat.tar.gz to my system, and I moved it to /usr/local/ports/net. Next I extracted it and ran make and make install: moog# tar -xzvf gnetcat.tar.gz gnetcat/ gnetcat/Makefile gnetcat/distinfo gnetcat/pkg-descr gnetcat/pkg-plist gnetcat/files/ gnetcat/files/patch-src-udphelper.c moog# cd gnetcat moog# make && make install >> netcat-0.7.1.tar.bz2 doesn't seem to exist in /usr/ports/distfiles/. >> Attempting to fe...

Amazon.com just posted my five star review of Introduction to Microprocessors . From the review: "John Crisp's Introduction to Microprocessors (ITM) is an excellent book. It has a low average score because the author posted the first review with zero stars, which could be the result of an Amazon.com error. I loved this book. It gets right to the heart of the matter regarding the operations of microprocessors. Anyone who wants to really know what happens inside their CPU will love ITM too." I learned a second edition was just published, so I hope to read and review that book soon.

I learned by reading the Blogger Knowledge Base that Blogger now exports Blog feeds in the Atom API . This means if your newsreader is Atom enabled , you can subscribe to it like a RSS feed. I found XML-Atom-0.05 at search.cpan.org and saw it was in the FreeBSD ports tree . I first tried NewsMonster which integrates with Mozilla and supposedly supports Atom, but encountered an error when trying to run it. I next tried BottomFeeder , and found the precompiled Linux version worked fine using FreeBSD's Linux application binary interface (ABI). If you use BottomFeeder to access http://taosecurity.blogspot.com/atom.xml , you'll see the screen shot at left.

Amazon.com just posted my three-star review of Intrusion Detection and Prevention . From the review: "I had high hopes for "Intrusion Detection and Prevention" (IDAP) as it is the first book to devote chapters to different vendor IDS products. It's also the first to explicitly mention the buzzword "intrusion prevention" in its title. Unfortunately, the book does not deliver the value I expected... I took exception to some of the authors' conclusions. (Keep in mind a team wrote this book.) A cheap shot on page 187 shows the ISS chapter author doesn't understand what real analysts need to "trust" their IDS: "These increases in product signatures have given more customers the capability to trust the comprehensive nature of RealSecure over every other product, including the freeware power player, Snort." Analyst trust is built on transparency and validation, meaning he can see why the product generated an alert, and use additional...