TaoSecurity Blog

Earlier I wrote about my proposed Tactical Network Security Monitoring Platform . Today I finally sat down and installed the operating systems I need on this system to create a portable tactical forensics and investigation platform. I did not want to use my main work laptop for this sort of work because I do not administer it. I needed my forensics platform to be separate from the corporate domain and totally under my control. I only feel comfortable attesting to the configuration of a system doing forensics if I built it from the ground up and I am the sole administrator. For operating systems, I had three needs. I wanted Windows XP because the majority of commercial forensics software runs on Windows. I wanted Ubuntu Hardy Heron so I could have access to Linux forensics software and VMware Server. (Windows is also a possible VMware Server candidate, but I might install a copy of VMware Workstation on the Windows side.) I wanted FreeBSD 7.0 in case I needed to do packet captur...

The latest issue of Hakin9 has been released. Several articles look interesting, including Javascript Obfuscation Techniques by David Sancho and an interview with Marcus Ranum. Hakin9 briefly interviewed Harlan Carvey and me. I've uploaded the one page of the interview if you'd like to read it.

I received a copy of the new BSD Magazine yesterday by air mail from Poland, and I have to say it looks pretty cool. It contains an article I wrote explaining how to install Sguil 0.7.0 on FreeBSD 7.0. At the time I used a CVS version of Sguil and FreeBSD 7.0-BETA4, but the article is still relevant. One caution: I discovered a bug in MySQL, which I logged as Optimizer does table scan for select count(*) w/5.1.22, .23, not 5.0.51, 5.1.11 . You will encounter this bug if you follow the instructions in my magazine article. The work-around is to use MySQL 5.0.51a instead of 5.1.22, as shown in the magazine. Dru Lavigne does a nice job detailing the magazine's table of contents.

The next NoVA Sec meeting will take place 1930 (7:30 pm) Thursday 24 April 2008 at Fishnet Security : 13454 Sunrise Valley Dr. Suite 230 Herndon, VA 20171 703.793.1440 Aaron Walters from Volatile Systems will discuss memory forensics. Thank you to Fishnet and Aaron for their last-minute cooperation! I'm cross-posting this notice to get as many people notified as possible in the day before the meeting.

What a great idea for a blog -- CloudSecurity.org : This blog is dedicated to “Cloud Computing” from an IT security perspective. Cloud Computing is a nebulous term covering an array of technologies and services including; Grid Computing, Utility Computing, Software as a Service (SaaS), Storage in the Cloud and Virtualization. There is no shortage of buzzwords and definitions differ depending on who you talk to. The common theme is that computing takes place ‘in the cloud’ - outside of your organisations network. Semantics aside, there is a much bigger question: what does it all mean from an IT security perspective? One day (during my working career, I am positive) we will all either 1) be cloud customers or 2) work in the cloud. I am glad to see someone take a stand now to try to understand what that means from a security perspective. You might also find Craig's other blog -- SecurityWannabe -- to be interesting. He did an interview with one of my Three Wise Men, Ross Anderso...

I'm looking for a dedicated server company that could provide a Debian environment suitable for running VMware Server. As a bonus it would be helpful to contract with a company that permits authorized outbound network scanning. As an alternative, I may try colocation. I am looking for a box for security testing, and VMware may not be suitable. I may need a box that can run Xen, for example. If you have any recommendations for dedicated server or colocation providers, please leave a comment or email me directly -- taosecurity at gmail dot com. Companies situated close to northern Virginia would be excellent. Thank you.

Earlier this month we joked that the Sguil project was acquired by Cisco , such that Sguil would be integrated into Cisco platforms. Cisco routers already run Tcl , but now thanks to Cisco's new Application eXtension Platform , other possibilities are developing. According to Optimize Branch Footprint with Application Integration , Cisco says: Linux-based integration environment with downloadable Software Development Kit (SDK) Multiple applications support with the ability to segment and guarantee CPU, memory, and disk resources Certified libraries to implement C, Python, Perl, and Java applications Supported by Cisco 1841, 2800, and 3800 Series Integrated Services Route Sun used to say The Network is the Computer . Cisco now states The Network as a Platform . In other words, why deploy another server or appliance if you can just run it on your Cisco router? I am unsure how this will play out. I figure Cisco just wanted to add to the confusion caused by virtualization with th...