NetSec

8.16.2003

P0f v2 Beta from Michael Zalewski

P0f is a passive OS fingerprinting tool that gathers useful information
about visitors / attackers without triggering any suspicious traffic. In
addition to accurately and precisely fingerprinting a remote OS based on a
large number of metrics, p0f can also determine link types, distances and
uptimes of those hosts - all without sending a single packet. As such, p0f
is a useful addition to a firewall / IDS / server setup.

posted by GeeWhiz Saturday, August 16, 2003

8.14.2003

IST 248 Textbooks:
Required: Network Perimeter Security 0-7357-1232-8

Optional: Linux Firewalls 0-7357-1099-6 and Cisco Secure PIX Firewalls 1-58705-035-8

If your boss is paying, consider them all required. ; - ) We will focus first upon PIX (I have 6) and Linux iptables. I am thinking of scenario based labs, CTF style with teams. 4 - 6 teams of 3. Each team must protect "insecure" servers without touching the OS. This should make it both fun and realistic. Feedback welcome.

posted by GeeWhiz Thursday, August 14, 2003

Federal Information Systems Security Educators’ Association (FISSEA)
National Security Agency Centers of Academic Excellence in Information Assurance Education (CAEs)
Infraguard

posted by GeeWhiz Thursday, August 14, 2003

Snip from Cisco Advisory:

Using IOS with NetFlow Enabled to Detect Infected Hosts

NetFlow can be a powerful tool to help identify infected hosts. Netflow must be
enabled on an interface with the command ip route-cache flow.

Router>show ip cache flow | i 0087

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts

Fa2/0 XX.XX.XX.242 Fa1/0 XX.XX.XX.119 06 0B88 0087 1
Fa2/0 XX.XX.XX.242 Fa1/0 XX.XX.XX.169 06 0BF8 0087 1
Fa2/0 XX.XX.XX.204 Fa1/0 XX.XX.XX.63 06 0E80 0087 1
Fa2/0 XX.XX.XX.204 Fa1/0 XX.XX.XX.111 06 0CB0 0087 1
Fa2/0 XX.XX.XX.204 Fa1/0 XX.XX.XX.95 06 0CA0 0087 1
Fa2/0 XX.XX.XX.204 Fa1/0 XX.XX.XX.79 06 0C90 0087 1

posted by GeeWhiz Thursday, August 14, 2003

Internet Mail Consortium: S/MIME

posted by GeeWhiz Thursday, August 14, 2003

WAP: Wireless Application Protocol Security Paper

posted by GeeWhiz Thursday, August 14, 2003

Steve Bellovin has worked for AT&T / Bell Labs for a long time. Here is his paper on why firewalls are critical. From the BSDsnob.

posted by GeeWhiz Thursday, August 14, 2003

8.13.2003

"What would be the use of immortality to a person who cannot use well a half hour?"
--Ralph Waldo Emerson

posted by GeeWhiz Wednesday, August 13, 2003

New Blaster / RPC worm variant on the loose This one starts an IRC backdoor, probably for a DoS attack.

posted by GeeWhiz Wednesday, August 13, 2003

Phrack 61 is Out.
Worst Fears II: A Paper from SensePost

posted by GeeWhiz Wednesday, August 13, 2003

8.12.2003

RPC Worm Snip from NANOG
"This worm is amazing. I have only had filters in place for about 4.5 hours and I am already approaching 100 million matches for the deny tcp/135 across my network. Of that, only one customer has said that they needed 135 open for legimate use (probably more, but I have only heard from the one)."

Sean P. Crandall
VP Engineering Operations
MegaPath Networks Inc.

posted by GeeWhiz Tuesday, August 12, 2003

8.11.2003

ISC reports that the Blaster DCOM/RPC worm is propagating
Counterpane has snort signatures

posted by GeeWhiz Monday, August 11, 2003

WifiBSD is a FreeBSD based AP. Link from BSDsnob.

posted by GeeWhiz Monday, August 11, 2003

Richard Stephens' "TCP/IP Illustrated" is THE reference for TCP/IP. Here is Volume 1, online and FREE! Alexandre Dulaunoy, the site's host, seems to have written some interesting papers on privacy, communications and freedom.

posted by GeeWhiz Monday, August 11, 2003

8.10.2003

OpenBSD: Firewall On A Floppy (FOAF)
Transparent Bridging Firewall. Link from BSDsnob, of course.

posted by GeeWhiz Sunday, August 10, 2003