TaoSecurity Blog

We all know how popular Snort is as an open source intrusion detection event generation engine. Have you ever heard of Shoki ? I've known about it for a while, but will researching I found it seems to be progressing nicely. The latest release dates from May 2003. I'm probably most interested in the project's packet visualization tool, Hustler , from which the screenshot at left is taken. It looks like it doesn't just accept libpcap data, but must work with Shoki. It looks like Shoki is near the same phase as Sguil -- still rough, with some operator knowledge needed to get the system running. Another open source IDS vying for its place in the sun is Tamandua . Version 2.0 was released in June 2003. It may be a good tool (I haven't used either Shoki or Tamandua), but I'm reluctant to try Tamandua. Most of the presentations are in Portuguese, and the project seems to be the offshoot of a commercial company. At some point I'd like to have the skill...

While doing research for my book Real Digital Forensics I visited the home page for the network session data generation tool TCPTrace . I learned that a new manual was released last week. I also learned that Ohio University supports an IDS project called INBOUNDS . Their publications page is very impressive, since they host their students' theses and copies of some of the most important IDS documents of the last decade. I look forward to seeing Manikantan Ramadas, Shawn Osterman, and Brett Tjaden present their paper next week at RAID 2003 (Recent Advances in Intrusion Detection) in Pittsburgh.

I read at Snort.org how Jim Buzbee figured out how to run Snort on his Linksys WAP . This is no joke. The folks at Seattle Wireless discovered the Linksys WRT54G runs Linux kernel 2.4.5. Through a bug they investigated the box thoroughly. They also physically disassembled the box. They learned the web server used to administer the device is mini_httpd . Amazing.

Is Earth Station Five a media industry sting operation? A few friends told me about this site today, so I poked around a bit. ES5 appears to be some sort of file-sharing network which thumbs its nose to the Recording Industry Association of America and the Motion Picture Association of America . ES5 seems to have made its biggest splash in this CNET News.com article where ES5 "President" "Ras Kabir" claims "We're in Palestine, in a refugee camp." The earliest reference I found dates from 18 March 2003 in a post at a digital music site. It was also discussed on 25 June 2003 at the filesharing site Zeropaid.com . Prior to the News.com story, I found press releases which appear to be from 27 June 2003 , 1 July 2003 and 7 July 2003 . The News.com story states: "According to Earthstation 5 founder Kabir, the company was formed after a conversation with his brother Nasser in Ramallah two years ago, as Napster was circling toward its nadir. Ov...

I learned today that people who would like to be a CISSP without having the necessary number of years experience can become a CISSP Associate . I find this rather odd. According to the press release: "After passing the selected exam and signing (ISC)2's Code of Ethics, the Associate must garner the requisite work experience and successfully complete a professional endorsement process before he/she becomes officially certified as CISSP or SSCP. The CISSP, designed for professionals devising information security strategy, requires four years of professional experience in the field of information security, while the SSCP, designed for professionals following a tactical information security career path, requires one year of experience. Associates of (ISC)2 will not be able to use the designation of CISSP or SSCP until formally certified." Why bother, then? Is this "CISSP-lite"? I think it's a ploy to get more people to take the exam and say "Yes, pro...

Amazon.com just posted my five star review of Absolute OpenBSD . I thought this was a great book. No one else has written a general-purpose OpenBSD system administration guide. I used the book to get my first familiarity with OpenBSD. Michael is working on a book for NetBSD now called Absolute NetBSD . From the review: "The bottom line is this: Michael Lucas knows what to write to help system administrators get the job done. I wish other authors did the same. I'd love to see Lucas or another "No Starch" author write "Absolute Cisco Routers," followed by "Absolute Cisco Switches." Any takers?" Unfortunately, I was disappointed by Protect Your Information with Intrusion Detection and gave it three stars. From the review: "It was my fault that I bought this book. I should have been tipped off by the odd choice of "key points" on the cover: "describing firewalls, indicating security policy violations, analyzing the i...

While reading a Slashdot story on a Curses library ( .pdf ) version of GTK (The Gimp Toolkit) called Cursed GTK , I found a link to Contiki , a "highly portable, modern, open source, Internet-enabled operating system and desktop environment for very constrained systems, such as 8-bit homecomputers like the Commodore 64." You can access Ethernet using this special NIC . Can it get better? Oh yes. You can access a Commodore 64 remotely using a special version of VNC called CTK VNC by visiting this site . Above is a screenshot of the page when I used the Java VNC client. Not only was this site offering remote VNC access, it was also serving up web pages!