Xprobe
Xprobe is an Active OS fingerprinting tool based on Ofir Arkin's ICMP Usage In Scanning Research project.
Xprobe is an alternative to some tools which are heavily dependent upon the usage of the TCP protocol for remote active operating system fingerprinting.
This is especially true when trying to identify some Microsoft based operating systems, when TCP is the protocol being used with the fingerprinting process. Since the TCP implementation with Microsoft Windows 2000 (and Microsoft Windows XP) and Microsoft Windows ME, and with Microsoft Windows NT 4 and Microsoft Windows 98/98SE are so close, usually when using the TCP protocol with a remote active operating systems fingerprinting process we are unable to differentiate between these Microsoft based operating system groups. And this is only an example...
Xprobe combines various remote active operating system fingerprinting methods using the ICMP protocol, which were discovered during the "ICMP Usage in Scanning" research project, into a simple, fast, efficient and a powerful way to detect an underlying operating system a targeted host is using.
Wednesday, July 31, 2002
On the trail of an identity thief
It was just another stolen credit card number, leaked by just another careless Web site, except for one thing — the victim wouldn’t take it sitting down. So he made a few phone calls, and managed to retrace the thief’s steps. Peeking through accounts at anonymous e-mail services, information brokers, and online banks, the victim got a rare glimpse of an identity thief at work. Here’s how that one stolen credit card became three bank checks totaling $3,000 — and perhaps much more.
It was just another stolen credit card number, leaked by just another careless Web site, except for one thing — the victim wouldn’t take it sitting down. So he made a few phone calls, and managed to retrace the thief’s steps. Peeking through accounts at anonymous e-mail services, information brokers, and online banks, the victim got a rare glimpse of an identity thief at work. Here’s how that one stolen credit card became three bank checks totaling $3,000 — and perhaps much more.
Wi-Fi Honeypots a New Hacker Trap
Hackers searching for wireless access points in the nation's capital may soon war drive right into a trap. Last month researchers at the government contractor Science Applications International Corporation (SAIC) launched what might be the first organized wireless honeypot, designed to tempt unwary Wi-Fi hackers and bandwidth borrowers and gather data on their techniques and tools of choice.
Hackers searching for wireless access points in the nation's capital may soon war drive right into a trap. Last month researchers at the government contractor Science Applications International Corporation (SAIC) launched what might be the first organized wireless honeypot, designed to tempt unwary Wi-Fi hackers and bandwidth borrowers and gather data on their techniques and tools of choice.
Hacking techniques
Password and user account exploitation is one of largest issues in network security. In this article Rob Shimonski will look at password cracking: the how and why of it. Rob will explain just how easy it is to penetrate a network, how attackers get in, the tools they use, and ways to combat it.
Password and user account exploitation is one of largest issues in network security. In this article Rob Shimonski will look at password cracking: the how and why of it. Rob will explain just how easy it is to penetrate a network, how attackers get in, the tools they use, and ways to combat it.
Handheld OSes Due for Security Advances
Just a few years ago, one could expect little more from a handheld computer than a convenient means of storing and retrieving data such as phone numbers and to-do-list items. Today, these devices have evolved greatly in terms of power, functionality and network connectivity, but as handheld computers and the mobile operating systems that drive them grow more complex, so, too, grows the potential for the sort of security vulnerabilities that plague their desktop- and server-based brethren.
Just a few years ago, one could expect little more from a handheld computer than a convenient means of storing and retrieving data such as phone numbers and to-do-list items. Today, these devices have evolved greatly in terms of power, functionality and network connectivity, but as handheld computers and the mobile operating systems that drive them grow more complex, so, too, grows the potential for the sort of security vulnerabilities that plague their desktop- and server-based brethren.
For Users, It's Back to Basics
As third-party developers and vendors of handheld devices beef up encryption and password management technologies, Palm OS, Pocket PC and other handhelds are becoming more secure.
But, experts say, IT managers should not rely on the availability of improved software alone to secure handheld devices. To be sure, users should be required to install anti-virus software and keep it up-to-date, authenticate with user names and distinct passwords, and use encryption software to safeguard confidential data.
As third-party developers and vendors of handheld devices beef up encryption and password management technologies, Palm OS, Pocket PC and other handhelds are becoming more secure.
But, experts say, IT managers should not rely on the availability of improved software alone to secure handheld devices. To be sure, users should be required to install anti-virus software and keep it up-to-date, authenticate with user names and distinct passwords, and use encryption software to safeguard confidential data.
Tuesday, July 30, 2002
Penetrating a VNC server behind a firewall
The following article will discuss bidirectional inside-out attacks, inspired from netcat. The article discusses how to access a victims VNC server behind a firewall, where the victim initiates connectons to the attacker.
The following article will discuss bidirectional inside-out attacks, inspired from netcat. The article discusses how to access a victims VNC server behind a firewall, where the victim initiates connectons to the attacker.
Monday, July 29, 2002
XML Web services need a firewall
XML application firewalls are like network firewalls in that they are focused on securing and monitoring your network. However, unlike network firewalls, they work at the application level using an in-depth knowledge of the Web services, service requestors, and message content. It is the XML Web services standardization of application-level data that makes application-level firewalls practical.
XML application firewalls are like network firewalls in that they are focused on securing and monitoring your network. However, unlike network firewalls, they work at the application level using an in-depth knowledge of the Web services, service requestors, and message content. It is the XML Web services standardization of application-level data that makes application-level firewalls practical.
Firewalls: More convenience or more security?
The topics I want to cover are: basic definition of a firewall; personal firewalls; the "more convenience or more security" debate; and my recommendations for a reasonable implementation of personal firewalls.
The topics I want to cover are: basic definition of a firewall; personal firewalls; the "more convenience or more security" debate; and my recommendations for a reasonable implementation of personal firewalls.
VPN users: The weakest link
Virtual private networks have generated their share of security concerns, but the focus has been primarily on flaws in VPN protocols and configurations. Although those issues are important, the most significant security threat in any VPN setup is the individual remote telecommuter making a VPN connection from home or an employee on the road with a laptop and the ability to connect to the corporate office via VPN.
Virtual private networks have generated their share of security concerns, but the focus has been primarily on flaws in VPN protocols and configurations. Although those issues are important, the most significant security threat in any VPN setup is the individual remote telecommuter making a VPN connection from home or an employee on the road with a laptop and the ability to connect to the corporate office via VPN.
VMS TUTORIAL - PART I
If you have heard a little bit about computer history or have read old-time hackers talk about their favorite machines, such as in the Jargon File [http://www.tuxedo.org/~esr/jargon/], then you probably have this vague idea of the pool of primordial soup embodied in the operating systems of the past. PDP-10, MULTICS, VAX, VMS, TOPS-20, CP/M, blah blah blah....what is all this? In order to really know one’s stuff computerwise, many sources, mostly reflecting an older viewpoint, say that you should know about all of this stuff. Today, one can navigate the Internet in all of it’s depth without knowing a thing about VMS, the topic at hand. For a few reasons, however, I still think it’s worth having at least some familiarity with for the well-rounded hacker.
If you have heard a little bit about computer history or have read old-time hackers talk about their favorite machines, such as in the Jargon File [http://www.tuxedo.org/~esr/jargon/], then you probably have this vague idea of the pool of primordial soup embodied in the operating systems of the past. PDP-10, MULTICS, VAX, VMS, TOPS-20, CP/M, blah blah blah....what is all this? In order to really know one’s stuff computerwise, many sources, mostly reflecting an older viewpoint, say that you should know about all of this stuff. Today, one can navigate the Internet in all of it’s depth without knowing a thing about VMS, the topic at hand. For a few reasons, however, I still think it’s worth having at least some familiarity with for the well-rounded hacker.
FBI's computer systems absolutely crap
A REPORT IN today's LA Times said that the Federal Bureau Investigation's (FBI's) computer systems were feeble well before last year's terrorist attacks and continue to be weak because of underinvestment and dodgy accounting tricks.
The newspaper also has got hold of a memo former attorney general Janet Reno wrote its director in May 2000 laying into the bureau's inability to use IT to track terrorist threats.
The paper, in the first of a two part investigation, describes the FBI as being in a state of "technological lethargy" because of institutional arrogance, bad prioritising, and poor relations with politicians in Washington.
A REPORT IN today's LA Times said that the Federal Bureau Investigation's (FBI's) computer systems were feeble well before last year's terrorist attacks and continue to be weak because of underinvestment and dodgy accounting tricks.
The newspaper also has got hold of a memo former attorney general Janet Reno wrote its director in May 2000 laying into the bureau's inability to use IT to track terrorist threats.
The paper, in the first of a two part investigation, describes the FBI as being in a state of "technological lethargy" because of institutional arrogance, bad prioritising, and poor relations with politicians in Washington.
One of These Things is not Like the Others
Anomaly detection can be described as an alarm for strange system behavior. The concept stems from a paper fundamental to the field of security - An Intrusion Detection Model, by Dorothy Denning. In it, she describes building an "activity profile" of normal usage over an interval of time. Once in place, the profile is compared against real time events. Anything that deviates from the baseline, or the norm, is logged as anomalous.
Anomaly detection can be described as an alarm for strange system behavior. The concept stems from a paper fundamental to the field of security - An Intrusion Detection Model, by Dorothy Denning. In it, she describes building an "activity profile" of normal usage over an interval of time. Once in place, the profile is compared against real time events. Anything that deviates from the baseline, or the norm, is logged as anomalous.
Sunday, July 28, 2002
Friday, July 26, 2002
security.rbaumann.net
This section presents my own White Papers which I (sometimes in corporation with others) wrote.
This section presents my own White Papers which I (sometimes in corporation with others) wrote.
Thursday, July 25, 2002
Defeating Forensic Analysis on Unix
Digital forensic analysis is rapidly becoming an integral part of incident response, capitalising on a steady increase in the number of trained forensic investigators and forensic toolkits available. Strangly, despite the increased interest in, and focus on, forensics within the information security industry, there is surprisingly little discussion of anti-forensics. In an attempt to remedy the lack of coverage in the literature, this article presents anti-forensic strategies to defeat digital forensic analysis on Unix file systems. Included are example implementations of these strategies targeting the most common Linux file system -- ext2fs.
To facilitate a useful discussion of anti-forensic strategies it is important that the reader possess certain background information. In particular, the understanding of anti-forensic file system sanitization requires the comprehension of basic Unix file system organisation. And, of course, the understanding of any anti-forensic theory demands at least a rudimentary grasp of digital forensic methodology and practise. This article provides a limited introduction to both Unix file systems and digital forensics. Space constraints, however, limit the amount of coverage available to these topics, and the interested reader is directed to the references, which discuss them in greater depth.
Digital forensic analysis is rapidly becoming an integral part of incident response, capitalising on a steady increase in the number of trained forensic investigators and forensic toolkits available. Strangly, despite the increased interest in, and focus on, forensics within the information security industry, there is surprisingly little discussion of anti-forensics. In an attempt to remedy the lack of coverage in the literature, this article presents anti-forensic strategies to defeat digital forensic analysis on Unix file systems. Included are example implementations of these strategies targeting the most common Linux file system -- ext2fs.
To facilitate a useful discussion of anti-forensic strategies it is important that the reader possess certain background information. In particular, the understanding of anti-forensic file system sanitization requires the comprehension of basic Unix file system organisation. And, of course, the understanding of any anti-forensic theory demands at least a rudimentary grasp of digital forensic methodology and practise. This article provides a limited introduction to both Unix file systems and digital forensics. Space constraints, however, limit the amount of coverage available to these topics, and the interested reader is directed to the references, which discuss them in greater depth.
Tuesday, July 23, 2002
Underground Tools
Here are the new tools that hackers/crackers will soon use against your systems. We do not recommend that you use such tools against any resources without prior authorization. We only list new tools published since the last issue of SAFER.
Here are the new tools that hackers/crackers will soon use against your systems. We do not recommend that you use such tools against any resources without prior authorization. We only list new tools published since the last issue of SAFER.
Monday, July 22, 2002
An Overview of ROIs for IDS
A positive return on investment (ROI) of intrusion detection systems (IDS) is dependent upon an organization's deployment strategy and how well the successful implementation and management of the technology helps the organization achieve the tactical and strategic objectives it has established. For organizations interested in quantifying the IDS's value prior to deploying it, their investment decision will hinge on their ability to demonstrate a positive ROI. ROI has traditionally been difficult to quantify for network security devices, in part because it is difficult to calculate risk accurately due to the subjectivity involved with its quantification. Also, business-relevant statistics regarding security incidents are not always available for consideration in analyzing risk.
In considering an implementation of IDS technology, a return on investment can be understood by analyzing the difference between annual loss expectancy (ALE) without IDS deployment and the ALE with IDS deployment, adjusted for technology and management costs. The ultimate initial goal, then, should be to prove that the value proposition (re: a benefit in the form of a quantifiable reduction in ALE) in implementing and effectively managing the IDS technology is greater than the implementation and management costs associated to deploying the IDS technology. We will examine how implementation methods, management methods, and IDS policy affect ROI. This article will seek to demonstrate the value associated with a well thought out implementat
A positive return on investment (ROI) of intrusion detection systems (IDS) is dependent upon an organization's deployment strategy and how well the successful implementation and management of the technology helps the organization achieve the tactical and strategic objectives it has established. For organizations interested in quantifying the IDS's value prior to deploying it, their investment decision will hinge on their ability to demonstrate a positive ROI. ROI has traditionally been difficult to quantify for network security devices, in part because it is difficult to calculate risk accurately due to the subjectivity involved with its quantification. Also, business-relevant statistics regarding security incidents are not always available for consideration in analyzing risk.
In considering an implementation of IDS technology, a return on investment can be understood by analyzing the difference between annual loss expectancy (ALE) without IDS deployment and the ALE with IDS deployment, adjusted for technology and management costs. The ultimate initial goal, then, should be to prove that the value proposition (re: a benefit in the form of a quantifiable reduction in ALE) in implementing and effectively managing the IDS technology is greater than the implementation and management costs associated to deploying the IDS technology. We will examine how implementation methods, management methods, and IDS policy affect ROI. This article will seek to demonstrate the value associated with a well thought out implementat
Subscribe to:
Posts (Atom)
