Definitions and Value of Honeypots
Over the past several years there has been a growing interest in honeypots and honeypot related technologies. Honeypots are not a new technology, they were first explained by a couple of very good papers by several icons in computer security, Cliff Stoll's book the "Cuckoo's Egg", and Steve Bellovin and Bill Cheswick's paper "An Evening with Berferd." This paper attempts to take their work further and discuss what honeypots are, how they can add value to an organization, and several honeypot solutions. There are a variety of misconceptions on what a honeypot is, how it works, and how it adds value. It is hoped this paper helps clear up those issues. Also, few people realize the risk and issues involved with honeypots. Though honeypots made add value, the time and resources involved may best focused on greater priorities.

making a one-way CAT5 cable
For IDS deployments a.k.a. a sniffbox.

Computer Forensics - by Ibas
Electronic evidence and information gathering have become central issues in an increasing number of conflicts and crimes. In situations ranging from the suspicion of disloyalty by staff and information theft, to other serious crimes, Ibas can assist in gathering and documenting electronic evidence.

Ibas offer services to the police, prosecuting authorities, lawyers and public and private companies in cases involving seizure and analysis of data. Results and findings can be presented in written reports or through verbal testimony e.g. in legal proceedings. In the information age the field of Computer Forensics is experiencing strong growth. Computer Forensics from Ibas will leverage the expertise and technology built through more than 20 years of experience with Data Recovery and Data Erasure.

Candes Systems Inc.
TEMPEST Computers and Peripherals.

Security Toolbox
The Security Toolbox is a collection of freeware tools related to Windows security. The tools are not based on anybody elses source code, and we will not give away the code or give explainations of how the tools are built, so please don't send any mails asking for either - we will ignore all such mails. Also, please note that using some of these tools against systems without permission from the system owner(s) may be illegal in your country! Although some of these tools can be used by unethical attackers we hope that these tools will do more good than bad overall.

Technology Pathways=
Welcome to the Technology Pathways Resource Center. In this area you will find documents we feel are beneficial to the computer security community.

Forensic Acquisition Utilities
This is a collection of utilities and libraries intended for forensic or
forensic-related investigative use in a modern Microsoft Windows
environment. The components in this collection are intended to permit
the investigator to sterilize media for forensic duplication, discover
where logical volume information is located and to collect the evidence
from a running system while at the same time guaranteeing data integrity (e.g. with a cryptographic checksum) and while minimizing changes to the subject system.

wepcrack
WEPCrack is a tool that cracks 802.11 WEP encryption keys using the latest discovered weakness of RC4 key scheduling.

AirSnort
AirSnort is a wireless LAN (WLAN) tool which recovers encryption keys. AirSnort operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered.

ELZA
The ELZA is a scripting language aimed at automating requests on web pages. Scripts written in ELZA are capable of mimicing browser behavior almost perfectly, making it extremely difficult for remote servers to distinguish their activity from the activity generated by ordinary users and browsers. This gives those scripts the opportunity to act upon servers that will not respond to requests generated using netcat, rebol, telnet or similar tool.

TMAP
We have developed a CAPI based telephone network mapper (wardialer + more), that is capable of detecting analog peers as well as digital peers. We have released a non-commercial version that is free for personal use.

RING
The Intranode Research Team presents a new operating system detection method, based on temporal response analysis. As a proof of concept, we release the open source tool called RING – for Remote Identification Next Generation.

Basic Steps in Forensic Analysis of Unix Systems
Instead of being a "cookbook" that you follow, consider this a collection of techniques that a chef uses to construct a fabulous and unique gourmet meal. Once learned, you'll discover there are plenty more steps than just those listed here.

Explore2fs
Explore2fs, the WIN32 explorer for Linux ex2fs partitions.

Honeypots
Just released, Honeyd. Honeyd is a OpenSource solution that can emulate thousands of computers at the same time. It can also emulate different operating system types, at both the application and IP stack level.

BUILDING A JUMP KIT

This document describes how to make a 'jump kit' for investigating Linux systems that are potentially compromised.

Free NT Security Tools
Fortunately there are a few third party utilities that we can use with NT to make our life easier and help answer some of the questions. I believe that it is very important for us NT Administrators to be aware of these programs. They can certainly make securing our networks easier and they have the added benefit of being free. That is right they are free. Now there is no excuse for any of us not to download these programs and learn how to use them.

M & G - Video and Audio Communications
M & G Technology (Europe) is a leading supplier of video and audio communications products for industrial, commercial, security, law enforcement and emergency services applications.
All of our products are built to the highest quality specifications and rigorously tested in live environments before being released to our customers.
Whether you are seeking a portable monitor for completing a microwave link, a miniature transmitter for a covert video transmission or a multi-channel telemetry control panel, first seek our advice on what we have available in our wide range of equipment - or what we can design to fit any unusual requirement.
Our pages regarding selection of equipment

International Journal of Digital Evidence
International Journal of Digital Evidence (IJDE) is a forum for discussion of theory, research, policy, and practice in the rapidly changing field of digital evidence.

Authentication Tokens: Balancing the Security Risks with Business Requirements [pdf 137k]
Stolen passwords represent a significant threat to today's enterprise. It has become apparent that a simple username and static non-changing password combination to login to a system is not adequate to protect most business information. As the corporate network is increasingly used to store disparate levels of company confidential information, there is a need for user access control.
Authentication tokens are hardware or software devices that generate dynamic one-time passwords through the use of a mathematical function. This report examines the business needs, implementation/deployment strategies, and security risk scenarios of hardware vs. software-based token technologies. No single technology will provide the ultimate solution for every situation, and there are advantages and disadvantages to the use of each type.

Trace-Back: A Concept for Tracing and Profiling Malicious Computer Attackers [pdf 109k]
In the computer security arena, every now and then, a vulnerability comes along causing a significant impact. The impact of a vulnerability is based on factors such as popularity of the vulnerable platform and the ease of exploitation of the vulnerability. Lots of research gets done on a vulnerability, beginning from its origin to the various permutations and combinations of exploit code that come out subsequently. In recent years, we have seen self-propagating exploit code (in other words, worms) becoming quite popular.
Very little is known about the events taking place in the time period between the instance that a vulnerability gets discovered by an individual or a small group of individuals, and the moment when exploit code becomes publicly available on the Internet. To zero in on the origins of a particular piece of exploit code is quite a daunting task. Very little research has been done on the subject outside of government or military organizations. Tracing back origins is a very tricky task, especially if one has to reconstruct events backwards. This paper addresses this very issue - trying to roll the film reel backwards from the time the exploit code becomes widespread in public, and filling in the blank frames to the beginning of the movie. This may not be the ultimate "big-bang" theory of the exploit universe, but it provides us with new viewpoints on exploits and their originators.

pdd: Memory Imaging and Forensic Analysis of Palm OS Devices [pdf 181k]
One goal of incident response is to preserve the entire digital crime scene with minimal or no modification of data. This paper introduces pdd or "Palm dd", a Windows-based tool for memory imaging and forensic acquisition of data from the Palm OS family of PDAs. pdd will preserve the crime scene by obtaining a bit-for-bit image or "snapshot" of the Palm device's memory contents. Such data can be used by forensic investigators, incident response teams, and criminal and civil prosecutors.
This paper also presents the Palm OS internals (hardware, file system, and debugger functionality), pdd details (usage, process, flowchart, and timing), and forensic analysis results (flash memory, record removal and deletion, retrieval of system passwords, and telephony applications).

The Importance of Application Security [pdf 109k]
The demand for digital security has never been greater in the history of the field. Unfortunately, confusion around where to start and how to manage risk is also at an all time high. This paper outlines the importance of application security and how to tell if application security should be part of your company’s digital security strategy.

nemesis packet injection tool-suite
Nemesis attacks directed through fragrouter could be a most powerful combination for the system auditor to find security problems that could then be reported to the vendor(s), etc

Cryptix
Cryptixtm is an international volunteer effort to produce robust, open-source cryptographic software libraries. Cryptix products are free, both for commercial and non-commercial use and are being used by developers all over the world. Development is currently focused on Java.

cryptcat = netcat + encryption
Cryptcat is the standard netcat enhanced with twofish encryption.

event log monitor for windows nt 2000 xp
EventReporter monitors Windows NT / 2000 / XP event logs and reports via syslog or email. Always know what is going on in your network. Automated monitoring helps detect problems before they manifest. If you own few server, email monitoring is probably best. For a larger number of servers, we recommend a centralized log via syslog. Syslog servers are available for Windows, Unix, Linux and other operating systems.

Port Listing
PORT NUMBERS
The port numbers are divided into three ranges: the Well Known Ports,
the Registered Ports, and the Dynamic and/or Private Ports.
The Well Known Ports are those from 0 through 1023.
The Registered Ports are those from 1024 through 49151
The Dynamic and/or Private Ports are those from 49152 through 65535

LNX-BBC
Welcome to the LNX-BBC project. The LNX-BBC is a mini Linux-distribution, small enough to fit on a CD-ROM that has been cut, pressed, or molded to the size and shape of a business card.
LNX-BBCs can be used to rescue ailing machines, perform intrusion post-mortems, act as a temporary workstation, install Debian, and perform many other tasks that we haven't yet imagined.

Snake Oil Warning Signs:Encryption Software to Avoid
Good cryptography is an excellent and necessary tool for almost anyone. Many good cryptographic products are available commercially, as shareware, or free. However, there are also extremely bad cryptographic products which not only fail to provide security, but also contribute to the many misconceptions and misunderstandings surrounding cryptography and security.
Why ``snake oil''? The term is used in many fields to denote something sold without consideration of its quality or its ability to fulfill its vendor's claims. This term originally applied to elixirs sold in traveling medicine shows. The salesmen would claim their elixir would cure just about any ailment that a potential customer could have. Listening to the claims made by some crypto vendors, ``snake oil'' is a surprisingly apt name.
Superficially, it is difficult to distinguish snake oil from the Real Thing: all encryption utilities produce garbled output. The purpose of this document is to present some simple ``red flags'' that can help you detect snake oil.
For a variety of reasons, this document does not mention specific products or algorithms as being ``good'' or ``snake oil.''

IT Security Cookbook
This book is intended as a 'self help' guide to computer & network security, primarily for security managers, programmers and system administrators.

 CORE IMPACT
CORE IMPACT is a revolutionary risk assessment product developed to professionalize the Penetration Testing practice.

Although critical to security risk assessment, Penetration Testing has to date been a very manual effort requiring the use of disparate tools and informal knowledge. CORE IMPACT professionalizes the Penetration Testing process, automating many of the tasks required to deliver superior assessment results.

CORE IMPACT provides a comprehensive framework for performing Penetration Tests, making it possible to define and enforce a methodology, drastically increase productivity, reduce errors and leverage knowledge and expertise gained through successive engagements. This product revolutionizes the practice and elevates it to the new standards of quality required by today's organizations.

Outpost Firewall
FREE! Outpost Firewall is the most feature-packed Personal Firewall for Windows in the world. It gives peace of mind from any threats by Cookies, Ads, E-mail viruses, Backdoors, Spyware, Crackers, Adware and virtually every other Internet danger. This is the first firewall that supports plug-ins so its capabilities can easily be extended.

Evidence Eliminator
Deletes a lot of temporary files. I wonder how safe the deletion is (wiping or deleting is a big difference!).

Are You Being Watched?
How private is your PC data? Thanks to the proliferation of Internet worms and hardware and software spying tools, the erosion of loyalty between corporations and their employees, and the 9/11 disaster (which has caused many to value security over privacy and civil rights), the likelihood is greater than ever that your computer is reporting your every move to a suspicious spouse, a government agency, an employer, or the entire world. In this article, we'll cover the most prevalent spying hardware and software and explain how it can be used, abused, and detected.

Design Of A Default Redhat Server 6.2 Honeypot
The following paper is a description of how I have designed and implemented a honeypot system. The paper describes how the honeypot is used to capture data in layers using different techniques. The aim of the honeypot is to discover the techniques and tactics used by blackhats (hackers) to compromise computer systems.

Firewall Tester
The Firewall Tester consists of two perl scripts, the client part (ftest) and the listening sniffer (ftestd). The client injects custom packets, defined in ftest.conf, with a signature in the data part while the daemon listens for such marked packets. The scripts both write a log file which is in the same form for both scripts. A diff of the two produced files (ftest.log and ftestd.log) shows the packets that were unable to reach the sniffer due to filtering rules if these two scripts are ran on hosts placed on two different sides of a firewall. Stateful inspection firewalls are handled with the 'connection spoofing' option. A script called freport is also available for automatically parse the log files.

Blade
BLADE Software is the leading provider of Internet Security Application Testing Tools (ISATT), we provide IT Security Professionals with the products to independently check their security infrastructure and to validate the effectiveness of those defenses.

A look at whisker's anti-IDS tactics
Anti-Intrusion Detection System (IDS) tactics were one of the original key features of my whisker web scanner. The goal of any anti-IDS tactic is to mutate a request so much that the ID systems will get confused, but the web server will still be able to understand it, hence the subtitle "just how bad can we ruin a good thing?"
This paper is aimed at explaining the thought process and implementation behind various anti-IDS tactics whisker uses to avoid web scan detection. While I specifically have ID systems in mind, this also applies to monitors, sniffers, log parsers and anything else trying to interpret web traffic and/or requests. The methods, analysis and theories presented within this document can also be applied to other protocols and concepts--however, HTTP is my focus due to the implementation of whisker.

Access Data
AccessData has been a leader in password recovery and applied cryptography since 1987. Since that time, AccessData has developed a trusted relationship with the Federal Government, state and local law enforcement, and corporate America.
To help keep government agencies and corporate security departments up to date with current computer forensic technology, AccessData has developed new forensic software and training seminars to help both the novice and expert computer specialists. Now your forensic team can gain access to AccessData's years of knowledge and experience.

Microsoft Baseline Security Analyzer
Microsoft has created a new tool, the Microsoft Baseline Security Analyzer (MBSA), to analyze Windows systems for common security misconfigurations. Version 1.0 of MBSA includes a graphical and command line interface that can perform local or remote scans of Windows systems. MBSA runs on Windows 2000 and Windows XP systems and will scan for missing hotfixes and vulnerabilities in the following products: Windows NT 4.0, Windows 2000, Windows XP, Internet Information Server (IIS) 4.0 and 5.0, SQL Server 7.0 and 2000, Internet Explorer (IE) 5.01 and later, and Office 2000 and XP.

Hack In The Box
Hack In The Box is designed to facilitate discussions on security related topics, create security awareness, and to try and provide a comprehensive database of security knowledge and resources to the public. We aim to make HITB a single place, or community on the INternet where people and corporations can go to find security information and the latest news from the underground as well as from the computer technology sectors.

The site provides access to security links and resources, including news, books, mailing lists, tools, products and security services as well.

The staff at hackinthebox.org is committed to stimulation discussion between users and computer professionals to help Keep Knowledge Free. We hope you will find these resources useful.

14th Annual Computer Security Incident Handling Conference
The annual FIRST Conference is the only event of its kind. It focuses on the field of computer security incident handling and response. In recognition of the global spread of computer networks and the common problems faced by computer owners, the conference is held in different parts of the world. The presentations are international in scope and include the latest in incident response and prevention, vulnerability analysis, and computer security. Additionally, these events serve as the foundation for the improvement of computer security worldwide via the sharing of goals, ideas, and information.

How much is enough?
A risk management approach to cumputer security (PDF).

Solving the Perfect Computer Crime
While the perfect computer crime is one that, by definition, will not be discovered, heightened awareness of cyber security has helped law enforcement keep up with the technologies and tactics used to compromise computers, networks and databases.
But cyber cops still struggle with such issues as the international reach of the Internet, an increasing number of combined threats and a wide spectrum of legal hurdles.

remote-expoit.org
http://www.remote-exploit.org has finaly become to life. This website is mostly a platform to give something back to the community. All the texts, tools, links that we collect or will collect in the future will be collected in here if it's possible. The people behind remote-exploit.org are some in security interrested individuals that found each other :-) you all know what i mean i guess. Some may say we are just freaks...but hey...lets freakout! We try to bring exclusives when possible and try to bring some :-) and light into the dark world of hacking and security.

The draft Special Publication 800-45 Guidelines on Electronic Mail Security
The document is intended primarily for a technical audience. It provides detailed guidance on setting up and maintaining a secure email system, and includes pointers to related material.

Offline NT Password & Registry Editor
This is a utility to (re)set the password of any user that has a valid (local) account on your NT system, by modifying the crypted password in the registrys SAM file.
You do not need to know the old password to set a new one.
It works offline, that is, you have to shutdown your computer and boot off a floppydisk. The bootdisk includes stuff to access NTFS partitions and scripts to glue the whole thing together.
Note: It will now also work with SYSKEY, including the option to turn it off!

InterSect Alliance
InterSect Alliance is a team of leading information technology security specialists, with extensive experience in both the policy and technical aspects of IT Security.

• SNARE - System iNtrusion Analysis & Reporting Environment


• RazorBack - SNORT Intrusion Detection Front-End


• BackLog - a Windows NT service that facilitates the real time central collection and processing of Windows NT Event Log information


• BackLog for Solaris


• Windows 2000 - Graded Security Configuration Document


• Internet Information Server 4 - Graded Security Configuration Document


• Linux - Graded Security Configuration Document


• Apache - Graded Security Configuration Document

Privacy Bird
AT&T invites you to download the new AT&T Privacy Bird software for free. This software will help Internet users stay informed about how information they provide to Web sites could be used. The AT&T Privacy Bird automatically searches for privacy policies at every website you visit. You can tell the software about your privacy concerns, and it will tell you whether each site's policies match your personal privacy preferences. The software displays a green bird icon at Web sites that match, and a red bird icon at sites that do not.

The IBM Tivoli Privacy Wizard
The pressure for comprehensive, effective privacy policies are rising every day. Creating your written policy is only the first step in this increasingly vital process. To be useful, your policy must then be translated into an electronic language that can be applied across your IT infrastructure. But how do you translate a human-language policy into an electronic format that applications can actually understand and use?
With the IBM Tivoli Privacy Wizard, it's easy and available to you for no charge!
The downloadable IBM Tivoli Privacy Wizard lets you define your privacy policies and translate them into an electronic language that many applications can understand and apply. Your IT department can then use that information to implement and maintain the new privacy policies. Policies created by the Wizard can be exported to P3P format, the current industry standard.

How To Give Network Security Administrators a Tremendous Headache
When I first plunged into the internals of HTTPS proxies, the idea on how to abuse these for unlimited Internet access immediately came to me. It dawned on me that, in essence, an HTTPS web proxy is a sort of tunnel into the Internet for everyone who is willing to speak the HTTP's protocol CONNECT command. And since all the traffic that passed through the tunnel is supposed to be SSL encrypted (so as to form an unhindered SSL session between the browser and the HTTPS server), there are little or no access controls possible on such a tunnel. I filed these ideas under the section "Interesting; must do something with this later"...
When "later" came, it turned out that the realisation described above could have very interesting security repercussions.....

SAFE ROOMS COME OUT OF HIDING
It would be easy to think that the safe room starring in Jodie Foster's new film, "Panic Room," is merely the product of a screenwriter's imagination.
Most people haven't heard of these hidden spaces that provide safe havens for homeowners in the tense minutes between a break-in and the arrival of the police.
Well, safe rooms are out there, and not just in the homes of California celebrities and corporate heads in New York, where "Panic Room" takes place. A trio of them are currently being constructed inside a downtown Boston condominium near the Four Seasons Hotel.

Often brushed aside as an urban myth or a plaything for the paranoid, safe rooms have been around for centuries. They're the modern-day equivalent of castle keeps and bomb shelters that can be found in high-end homes, corporate offices, and even health clinics. Nobody has statistics on just how many are out there, since their effectiveness depends on the silence of their owners and the people who build them. The $ 30 million opening weekend of "Panic Room" drags what was once secret into the public lexicon.
Suddenly, safe-room designers are using the film as an excuse to speak very carefully about the rooms they outfit with bulletproof doors, surveillance cameras, ventilation systems, and tamper-proof communication equipment. Cynics may say they are motivated by a desire to generate new business, but the designers are unveiling an industry that has been quietly thriving for decades.

Links on CopsCops.com
Listing of links with description.

CIS Investigative Resources
Huge listing of links, sorted by subject.

Freeware downloads: Security

• Access Control
  Restrict and monitor Internet usage, this includes keystroke monitoring, Internet usage etc.


• Anti-Virus (Specialized)
  Anti-Virus tools, specialized for individual viruses, trojans or worms. These tools are usually released quickly after a new, fast spreading virus is discovered.


• Anti-Virus Tools
  Virus protection is a "must have" when you are using the Internet.


• Cache and Cookie
  Clean your browser cache, securely delete files and/or cookies.


• E-mail Security & Encryption
  Protect the privacy of your email communications.


• File Encryption Tools
  These tools can be used to encrypt email messages or files on your computer.


• Password Manager
  Manage and store your passwords, generate random passwords and more.


• Personal Firewalls
  Protect your computer from intruders.


• Secure File Deletion
  Digital File Shredders - Permanently delete files beyond recovery...


• Security Tools
  These tools are intended to monitor your Internet or network connection and alert you of potential intruders. They are NOT firewalls!

SpyBlocker Software
This site is dedicated to help secure your communications and files from third parties, as well as several other important security aspects that may arise when you are connected to the Internet.

Kernel Based Keylogger
There is a wide variety of keyloggers for Windows and only a few crippled ones for Linux. This paper describes some basic concepts, used techniqes and hits. I've also included proof of concept LKM code which was tested "in the wild". A must read for every pen tester, system administrator and honeypot freak :)

socklog
Socklog in cooperation with djb's daemontools is a small and secure replacement for syslogd.

syslog-ng
syslog-ng, as the name shows, is a syslogd replacement, but with new functionality for the new generation. The original syslogd allows messages only to be sorted based on priority/facility pairs; syslog-ng adds the possibility to filter based on message contents using regular expressions. The new configuration scheme is intuitive and powerful. Forwarding logs over TCP and remembering all forwarding hops makes it ideal for firewalled environments.
syslog-ng is in use primarily on Linux, Solaris and FreeBSD, and should be quite easily ported to other BSD-like Unixes.

The Distributed Honeypot Project
Imagine having the ability to deploy an entire honeynet system on a single machine, complete with data control and data capture. The focus of this paper outlines a proof of concept that such a system is possible. Originally intended to be showcased using open source operating system technologies, the solution was completed via mainstream consumer products. Design and configuration of the system will be provided, along with discussion of other potential solutions. Although to my knowledge this is the first published example of this type of technology, it is completely possible that someone else has already implemented such a system. Think Alexander Graham Bell.

Modular Syslog
A replacement to traditional syslog daemons. Including cryptographic log protection, mysql, postgresql. Supported on Linux, BSD, Irix, Solaris and AIX.

R.U.N.S.A.F.E.
The information and associated steps listed on this page are key components to everyone's online security. Everyone should understand them and be able to take the actions described. R.U.N.S.A.F.E. workshops are offered once per semester that describe the incidents we've seen at JMU, the threats we're exposed to, and that teach the defensive concepts and procedures described here.

TUCOFS - The Ultimate Collection of Forensic Software
TUCOFS, or T.U.C.O.F.S., stands for The Ultimate Collection of Forensic Software. This site places all Law Enforcement Personnel in touch with the latest and greatest Internet based resources for High Tech Law Enforcement purposes. Resource types include files, sofware, websites and documentation.

Trinux: A Linux Security Toolkit
Trinux is a ramdisk-based Linux distribution that boots from a single floppy or CD-ROM, loads it packages from an HTTP/FTP server, a FAT/NTFS/ISO filesystem, or additional floppies. Trinux contains the latest versions of popular Open Source network security tools for port scanning, packet sniffing, vulnerability scanning, sniffer detection, packet construction, active/passive OS fingerprinting, network monitoring, session-hijacking, backup/recovery, computer forensics, intrusion detection, and more. Trinux also provides support for Perl, PHP, and Python scripting languages. Remote Trinux boxes can be managed securely with OpenSSH.

COMPUTER FORENSICS
Presentation on COMPUTER FORENSICS.

Open Source Security Tools
• Host Security Scanners
• Intrusion Detection
• VPN Tools
• Reporting Tools
• Secure Applications

Analyzer Switch
The Net Optics' Analyzer Switch / Matrix Switch maximizes your monitoring effectivness while minimizing incremental spending. The passive, 1xN SpyderSwitch enables a single protocol analyzer to perform real-time monitoring and analysis on your choice of up to 32 networks.

TCPDUMP public repository
This page was started to collect various patches that have been floating around for LBL's tcpdump and libpcap programs, and to continue the work needed on both projects.

lcrzoex
lcrzo is a toolbox containing over 300 functionnalities to test an Ethernet/IP network (sniff, spoof, configuration, clients, servers, etc.).

USERS NOTICE
To be used on your workstations and servers:
------
This computer system is for authorized use only. Users (authorized or unauthorized) have no explicit or implicit expectation of privacy. Any or all uses of this system and all files on this system may be intercepted, monitored, recorded, copied, audited, inspected, and disclosed to authorized site and law enforcement personnel. By using this system, the user consents to such interception, monitoring, recording, copying, auditing, inspection, and disclosure at the discretion of authorized site personnel. Unauthorized or improper use of this system may result in administrative disciplinary action or civil or criminal penalties. By continuing to use this system you indicate your awareness of and consent to these terms and conditions of use. LOG OFF IMMEDIATELY if you do not agree to the conditions stated in this warning.
------

Responding to Problems
CIO worked with the Secret Service, the FBI and industry leaders to create guidelines for reporting security incidents — what to report, who to report it to, and how.

Information Security Congress at UniNet - InfoSec 2002
As a way to share with the community valuable information, UniNet, the Virtual Network of Telematic Resources, is glad to present, THE INFORMATION SECURITY CONGRESS AT UNINET from April 15th to 19th.

Miniature digital voice recorder Edic-Mini
The digital voice recorder Edic-Mini is intended to record the voice messages to the built-in FLASH memory. It can play back the stored messages using the earphone or download the messages to the personal computer. Besides it can operate as a "digital diskette" to store and carry over any digital data of up to 16-1024 MB.
Edic-mini is an extremely small (17x57x10 mm) and light (8 g) device. It can store up to 4480 min of voice (much more with Voice Activation System (VAS) enabled), has a high-sensitive built-in microphone (range up to 8 m) and a wide dynamic range. It can continuously record for up to 80 hours or keep the date/time for up to 2 years from a single battery.
Since Edic-Mini has no moving parts it can safely operate in a wide environmental range and without being detected by the special equipment.

Operation Security Network Security Related Links and Tools.

Center for Internet Security
The Center for Internet Security (CIS) is a not-for-profit cooperative enterprise that helps organizations reduce the risk of business and e-commerce disruptions resulting from inadequate security configurations.
CIS members are developing and propagating the widespread application of Security Benchmarks through a global consensus process that brings together industry, government, academia and consultants. CIS Benchmarks enumerate the "When, Why, and How" aspects of technical security configurations across a wide range of operating system platforms and Internet software applications.

The benchmarks are available free of charge to the Internet community via this web site.

Honeypotting with VMware
Honeypots are becoming more common as security professionals attempt to conduct more detailed research on current "state of the art" practices among attackers. Honeypots are also invaluable for learning about an attackers motivations, their habits and patterns of behavior. Unfortunately setting up a proper honeypot is a non-trivial task, and correctly configuring network sensors to capture all data, as well as the resulting forensics tasks can be rather daunting. The good news is that there are a number of tools and techniques that can make life much easier for some honeypot administrators.

Department of Defense Computer Forensics Laboratory
The Department of Defense Computer Forensics Laboratory (DCFL) provides the community with timely, unbiased evidence examination, analysis and operational support. Teamed with the Department of Defense Law Enforcement and Counterintelligence Community our unique technical expertise and computer solutions ensure information superiority for the War fighter.

The Digital Offense

• FTP passive connection hijacker


• RFP's Whisker with SSL support


• Retrieves the system load from a XDMCP daemon


• Linux LKM that changes uname() results


• A chroot jail wrapper for ordinary shells


• SSL and Proxy enabled IIS 4/5 Unicode Exploit


• Relays a SQL query through IIS's RDS component


• Unix command line MS-SQL client


• Checks for the IIS 4.0/5.0 .ida/.idq heap overflow


• Determines if a DNS service is available.


• Upload files via PUT requests.


• Extremely fast nfs scanner (raw udp)


• Crashes the Windows 2000 SMTP service.


• Crashes the Microsoft FTP service.

thc - the hacker's choice
Welcome to the official THC website. THC is a short form for "The Hacker's Choice". THC was founded in 1995 in Germany by a group of people involved in hacking, phreaking and anarchy. Through the years THC was joined by other experts and grew to probably Germany's best hacking group.

The intention of THC is to demonstrate weaknesses in common security solutions that can be found in telecommunication and network services.
On this site you will find software and papers that were released by THC members. They should provide you with knowledge and the ability to check for security problems. We also want to advice you not to use any information or software provided on this site for illegal purposes. Respect the law as we do.
THC is a non-commercial group, every line of code, of text and of this site has been written in our free time. So please excuse any uncomfort, we are trying to give our best every single day.

Forensic Software Sources
This page is a compilation of sites that have been supplied to me, and ones I have found to contain useful sources of forensic software. No endorsement of any kind is made for any of the products found in these sites. These sites are merely compiled here for easy quick reference for those wishing to obtain forensic tools.

Peter Gutmann's Home Page
My research interests cover the design and analysis of security techniques and systems, with a sideline in various obscure security-related areas such as the recovery of deleted data from magnetic media, and whatever else happens to catch my interest.

Security and Encryption Links
Encryption and Security-related Resources. The following are security-related resources (aka "the crypto link farm") that I've found on the net.

How codebreakers cracked the secrets of the smart card
The process was complex, time-consuming, and very expensive. This was not about a lone hacker sitting at a computer screen trying to guess passwords. Instead, it was an attempt to split the foundation stone supporting an entire industry - the technology protecting pay TV.
The challenge handed in the autumn of 1997 to a team of scientists working quietly at a laboratory in Haifa, northern Israel, was to crack the encryption technique used to unscramble TV signals delivered to many paying customers through cable and satellite across Europe and the US.

FAQ: Network Intrusion Detection Systems
This FAQ answers simple questions related to detecting intruders who attack systems through the network, especially how such intrusions can be detected.

MRTG: The Multi Router Traffic Grapher
The Multi Router Traffic Grapher (MRTG) is a tool to monitor the traffic load on network-links. MRTG generates HTML pages containing graphical images which provide a LIVE visual representation of this traffic. MRTG is based on Perl and C and works under UNIX and Windows NT.

Laptop Computer Security
This paper discusses the issues surrounding laptop computer security and offers some basic approaches to securing laptops.

Hammer of God Utilities
Here are just a few of the utilities we have designed to enhance your pen-testing sessions. Go nuts.

Security Toolbox
The Security Toolbox is a collection of freeware tools related to Windows security. The tools are not based on anybody elses source code, and we will not give away the code or give explainations of how the tools are built, so please don't send any mails asking for either - we will ignore all such mails. Also, please note that using some of these tools against systems without permission from the system owner(s) may be illegal in your country! Although some of these tools can be used by unethical attackers we hope that these tools will do more good than bad overall.

The Proxomitron - Universal Web Filter
A free webfilter for faster browsing!

Optical Tempest from LED's
A previously unknown form of compromising emanations has been discovered. LED status indicators on data communication equipment, under certain conditions, are shown to carry a modulated optical signal that is significantly correlated with information being processed by the device. Physical access is not required; the attacker gains access to all data going through the device, including plaintext in the case of data
encryption systems. Experiments show that it is possible to intercept data under realistic conditions at a considerable distance. Many di®erent sorts of devices, including modems and Internet Protocol routers, were found to be vulnerable. A taxonomy of compromising optical emanations is developed, and design changes are described that will successfully block this kind of “Optical Tempest” attack.

Optical Time-Domain Evesdropping Risk op CRT Displays
Tempest (in PDF format) with an extensive scientific explanation.

Opentap
Opentap plans to release free software that will be a minimalistic implementation of the Dutch (and soon European) tapping requirements, in so far they make sense and have been defined in current law and policies so that the ISP's costs and risks are limited to a minimum, and the citizen's tapped data is better protected against the unknowns of overspecified black boxes that ISP's would otherwise need to buy.

We are further redistributing and organizing all information regarding lawful interception for public access on this site, so people can find their way through the trememdous bureaucratic heap of papers that are and have been produced.

iPod at core of 'virtual shoplifting' case
According to a report in Wired, a youth armed with only an iPod walked into a US computer store and walked out with hundreds of pounds worth of Mac software.

By plugging the iPod into a display Mac using a FireWire cable, the virtual thief was able to simply drag and drop applications from the Mac to the iPod. The iPod wouldn't even have had to leave the thief's pocket.

Network scanners pinpoint problems
In the past, there hasn't been much good news about the state of vulnerability-assessment scanners. Their reputation has been plagued with false positive reports, lack of scalability, lagging updates and inadequate reporting tools.

While some areas still need a bit of improvement, vulnerability scanners have useful tools for helping network professionals identify potential vulnerabilities and security. However, we also found that many of these products may have trouble scaling to fit the requirements of enterprise networks.

APL-Level attacks on Embedded Systems
In PDF Format.

K12LTSP - K12 Linux Terminal Server Project
K12LTSP is based on RedHat Linux and the LTSP terminal server packages. It's easy to install and configure. It's distributed under the GNU General Public License . That means it's free and it's based on Open Source software.

Once installed K12LTSP lets you boot diskless workstations from an applications server. You can use old PC's as diskless clients or buy new ones for under $200 each.

All applications run on the terminal server. Workstations are "thin." They have no software or hard drives. Thin-clients are perfect for schools because they are easy to install and require little maintenance. They are reliable and immune to malicious tampering and viruses.

Sandtrap
Sandtrap is the FIRST commercially available, multi-line wardialer detector. It makes an excellent add-on to Phonesweep or use it on its own.

Free online network utilities - traceroute, nslookup, smart whois, ping, finger - each utility with source code

• Domain Dossier


• Email Dossier


• Browser Mirror


• Traceroute


• NsLookup


• AutoWhois


• TcpQuery


• AnalyzePath

Excel password remover
Have you ever forgotten your Excel workbook or sheet password?
Here you can download an almost FREE (Postcard ware) Excel add-in that removes/cracks sheet and workbook password protection in Excel® upto XP version.