TaoSecurity Blog

I noticed tonight that Amazon.com has altered their book pages rather noticably. Rather than posting a small book cover image in the upper left hand section of the page, they now show a large book cover on the right side of the page. When I publish word of my book reviews , like this , I link to the Amazon.com book cover image. I figure I am driving traffic to Amazon.com through a link to their site via the book review, so showing their book cover image is fair play. With the new book page layout, how could I know what image to use? I started by looking at the image link for a recent book I reviewed: http://images.amazon.com/images/P/0071409866.01._PE27_SCMZZZZZZZ_.jpg That produces the image above. I looked at the new Amazon.com page for the Network Processors book and saw it used the following image link: http://images.amazon.com/images/P/0071409866.01._AA400_SCLZZZZZZZ_.jpg That link produces the image above. Comparing the two URLs, I tried modifying the first link: http://ima...

I just received a SANS Local Mentor Program Update, Volume 1, Issue 5, April, 2005 email. Section 2 of this message is "Further discussion on GIAC certification changes." In the email we read the following: "The local mentor program has received numerous emails and calls about the new GIAC certification procedures which no longer require the writing of a practical paper... [B]ased on your input on we have developed the GIAC Gold Standard which will be known as the premier benchmark in assuring that a certified individual holds the appropriate level of knowledge and skills necessary in key areas of information security. GIAC Gold will distinguish itself from the existing 'GIAC Silver' certification by requiring candidates to complete a technical paper. After completing the exams necessary to pass the GIAC Silver certification, students will have the option to pursue the GIAC Gold Certification. All GIAC certified professionals who previously completed a 'p...

When reading today's Incident Handler's Diary , I learned of the public release of draft-gont-tcpm-icmp-attacks-03.txt by the IETF. This Internet Draft explains how forged ICMP messages could be used to conduct denial of service attacks against TCP services. This is the core of the problem: The Host Requirements RFC [4] states that a TCP MUST act on an ICMP error message passed up from the IP layer, directing it to the connection that created the error. In order to allow ICMP messages to be demultiplexed by the receiving host, part of the original packet that elicited the message is included in the payload of the ICMP error message. Thus, the receiving host can use that information to match the ICMP error to the instance of the transport protocol that elicited it. Neither the Host Requirements RFC [4] nor the original TCP specification [1] recommend any security checks on the received ICMP messages. Thus, as long as the ICMP payload contain...

Today is "patch Tuesday" at Microsoft . Let's consider how easy or difficult it is to get real details on the new vulnerabilities. First we visit www.microsoft.com/security and see "Current security updates:" Get information on the latest software security updates. - Exchange Security Update - Windows Security Updates - MSN Messenger Update - Office Security Update This is nice. Where do I start? I click on the link Windows Security Updates and end up at a page titled "Windows Security Updates Summary for April 2005." This page lists five security bulletins, Security Bulletin MS05-016 through MS05-20. I can't really tell a whole lot looking at the information on this page, although the "Technical bulletin" item for each yields clues. The first security bulletin, MS05-016 says Vulnerability in Windows Shell That Could Allow Remote Code Execution (893086) . Remote code execution is always bad. Does this mean an attacker can explo...

I flew from my home in northern Virginia to Anaheim, CA this morning to attend part of USENIX 2005 . I managed to join Practical System and Network Monitoring by John Sellens of Syonex . I looked forward to this talk because I typically do not deal with the network performance side of monitoring. John had to rush the end of his talk because he spent too much time discussing network monitoring projects that he did not recommend or didn't like. I still found his content useful, and I expect his talk tomorrow on System and Network Monitoring: Tools in Depth to be rewarding. Probably the most important lesson from his talk was the need to try out Nagios . I also started thinking about interesting ways to use Net-SNMP to retrieve information from systems running SNMP agents. John explained that no one has written a definitive text on network performance monitoring. Perhaps I will tackle that subject in the future, or will integrate the key theories, tools, and techniques into...

Yesterday my editor at Addison-Wesley sent several cover possibilities for our new book, Real Digital Forensics . The choice we agreed upon is pictured at left, and can be enlarged by clicking on the image. This another book in Addison-Wesley's informal security series, like the recent File System Forensic Analysis and Slamming Spam: A Guide for System Administrators . All of these titles feature a common cover layout, with a photograph of some sort of animal. We are in the initial review phase for RDF right now. Our editor sent a set of chapters to various reviewers, and they replied with suggestions for improvements. We are working through the reviews and will move to the copyediting phases once the necessary changes are made to the main text. Given the size of the book and the amount of copyediting and proofreading required, I believe RDF will appear on bookshelves late this summer. I am still working on Extrusion Detection: Security Monitoring for Internal Intrusions...

I have several short stories to report from BSD land. First, the DragonFly BSD project released DragonFly BSD 1.2 last Friday. DragonFly BSD is a continuation of the FreeBSD 4.x branch by a separate development team. I downloaded and tried the new release, since the single .iso boots as a live CD. This is a nice feature, as it lets you test your hardware's compatibility before installing the OS. I have no plans to run this OS in production, but I might deploy a test system in my lab. Did you ever wonder why certain Linux users are so adamant about calling their OS "GNU/Linux"? This is especially true of Debian users. To understand why, you should understand the history of the GNU HURD kernel. The HURD was the original kernel on which free software would run. The HURD wasn't making much progress when the Linux kernel arrived, so people starting running GNU utilities on the Linux kernel. People who remembered the HURD kernel and the importance of the G...