TaoSecurity Blog

freebsd.png" align=left>I read a great article at ZDNet UK based on the May-June 2004 FreeBSD Status Report . Citing release engineer Scott Long, the article says he hopes FreeBSD 5.3 will arrive on the first of October, 2004. I like to see this sort of FreeBSD coverage in more mainstream publications, like last week's CNN article on open source. On a different note, visit the redesigned Sguil homepage . Scott Dexter did a really nice job, and we're looking for someone with suitable graphics-fu to redesign the Sguil logo. Please send any ideas to 'scottder at sguil dot net'.

Amazon.com just posted my five star review of Wi-Foo . The book's Web site is wi-foo.com . From the review: "'Wi-Foo' is the wireless book the security community needs. The book mixes theory, tools, and techniques in a manner helpful to those on the offensive or defensive side of the wireless equation. After reading 'Wi-Foo,' I'm glad I didn't try to cover similar topics in my 'Tao of Network Security Monitoring' -- these authors have written the definitive wireless 'hacking' text. Several aspects of 'Wi-Foo' make the book a winner. First, with the exception of crypto topics in chapters 11 and 12, they tend to defer to previously published works rather than rehash old topics. For example, rather than exhaustively explain 802.11i, they refer readers to 'Real 802.11 Security,' an excellent defense-oriented wireless book. 'Wi-Foo' also assumes readers are familiar with TCP/IP and system administration, leaving o...

Critics of intrusion detection systems say signature-based IDSs are too easy to evade, bypass, or fool. This is true when the IDS only provides alert data to analysts. Alerts are the results of judgements made by the IDS developers, as encoded in the IDS' rules and logic. To deal with events that have no signatures, we can turn to other forms of network security monitoring data. Session data is a record of transactions between parties, typically storing source and destination IP addresses and ports, session start and end times, and counts of packets and bytes of data sent by source and destination. Session data is best captured for connection-oriented TCP traffic, but sessions can be emulated for connectionless protocols like UDP and ICMP in a request-response model. Session data is immune to encryption, because no payloads are captured. Session data is also not dependent on signatures, because every transaction is recorded. This "neutrality" makes session data an e...

Amazon.com just posted my five star review of Hardening Windows Systems . From the review: "Roberta Bragg's _Hardening Windows Systems_ (HWS) is exactly the sort of book I expected from McGraw-Hill/Osborne's new 'Hardening' series. The publisher gained fame through its assessment-oriented 'Hacking Exposed' series, and now it advocates preventing intrusions via configuration instead of assessment. (Those familiar with my Network Security Monitoring theories will remember I believe 'prevention eventually fails,' but I still recommend doing everything possible to make the intruder's task difficult!) HWS is a Windows security tour-de-force, and I intend to recommend it often."

I just finishing reading the second edition of Know Your Enemy and wrote a review for Amazon.com . Unfortunately, Amazon.com is treating this completely new second edition as though it were the first edition . When I tried to post my review, I received this response: "Oops! Only one review per customer per product set is allowed. Your review was not accepted because we only allow each customer to write one review of each product set. An example of a product set is the collection of all editions of a book: hardcover, paperback, and audiobook. If you'd like, you can edit your existing review." I'm sure Amazon.com does this to prevent multiple reviews by the same person, but these are two completely different books. Amazon.com also harassed me to provide a real name to appear in my review. I had to tie this to a credit card. Aside from that aspect, I think this is a good idea. Review readers are supposed to believe the words of someone providing a "real nam...

Today while perusing the SANS Incident Handler's Diary , I noticed the "Handler On Duty" was Tom Liston, and his Web site was listed as LaBrea Technologies . I remembered Tom from his July 2001 post to the intrusions@incidents.org mailing list. There he theorized on the idea for his LaBrea "tarpit," code to trap malware visiting non-existent local IPs using various TCP tricks. Fearing DMCA, Tom no longer hosts LaBrea at his site, but it's available in the FreeBSD ports tree as security/labrea , and elsewhere. A visit to LaBrea Technologies shows Tom is working on the "LaBrea Sentry IPS - Next Generation Intrusion Prevention System." From Tom's description: "LaBrea Sentry connects to the local network and monitors attempts to access unused IP addresses. Once such attempts are detected, the LaBrea Sentry creates virtual machines to emulate an active server on the unused IP address, executes countermeasures defined by the user, l...

After installing a self-contained Sguil 0.5.0 installation on a new laptop, I updated my Sguil installation guide for Sguil 0.5.0. The new guide takes into account the merging of xscriptd's functions into sensor_agent.tcl and sguild. I also caught a problem with the databases/mysqltcl FreeBSD port. By default the Makefile requires mysql323-client as a dependency, but I recommend changing that to mysql40-client to keep all components running MySQL 4.0.20. Changes like these are the reason I didn't explain how to install Sguil in my book. As Sguil progresses towards a 1.0 release, a lot will change under the hood. The user interface and method of operation will remain stable, so I describe those features in my book.