Slashdot Mirror
Missing Open Source Security Tools?
Kinetic writes "There are many great open source security tools out there, Nmap, Nessus, and DSniff, just to name a few. However, with the world of security constantly changing, this begs the question, what open source security tools are missing? What commercial security tools have no viable open source alternatives? When securing/testing/exploring networks (home or enterprise), what security tools/applications/functionality are lacking (or non-existent) in the open source world?"
Here comes the "THAT'S NOT THE PROPER USE OF BEGS THE QUESTION" people. Get over it. English changes.
Open source security tools are missing.. security holes?
Oh, wait, you probably mean stuff that actually works.
That's not how you use "begging the question"!
Thank you.
"A great democracy must be progressive or it will soon cease to be a great democracy." --Theodore Roosevelt
Are we searching around for a project to start? The best stuff comes when you're scratching your own itch.
You are not a beautiful or unique snowflake -- but you could be if you got off your ass.
does anyone remember the name of that utility that will show you what a user is browsing in a new netscape browser window? i thought it was part of dsniff but I think I'm wrong. anyone know what I'm talking about?
Does the name Pavlov ring a bell?
Also important, if you don't think anything is missing, or even if you do, what software do you use for security purposes? Anything obscure but useful or unusual uses of common software?
-Tim Louden
...what security tools/applications/functionality are lacking (or non-existent) in the open source world?
How about an open source Security Information Management System (SIMS) Description, Article .
Something that lets us intergrate, collect, and correlate what the other great tools (Nessus, Snort, Nmap) find.
I've yet to find an open source tool that can show a "matrix" graph of source and destination talkers by MAC/IP/IPX name in realtime as found in Sniffer. Other tools show some of this information, but do not render the same graphical display (chords of a circle) as Sniffer.
With ethereal there's to do this with snapshots using graphviz, but not realtime...
I do not deploy Linux. Ever.
When we can create a truly fertile environment for elements like this in OSS, then we'll have arrived.
These tools could "leverage" existing security tools which exist in the open source world (stuff like tripwire for example) to get cross-platform support.
You don't have to just look at security, either; A multiplatform enterprise management suite with plug-in modules for filesystem, printing, security, scheduling, and good old monitoring would be a great thing to do for free. Software that does all that costs millions of dollars, single installs for sufficiently large sites can run upwards of US$10M.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
It raises the question.
"Begging the question" is a fallacy of reasoning. Simple rule of thumb for those who don't want to understand what it means: don't suggested that you want to "beg the question" because whether you use it correctly or not you come across as a fool.
If you are looking for a proven open standard methodology for performing security tests, then Open Source Security Testing Methodology Manual (OSSTMM) is the way to go.
In addition, there is the linux distro of Trinux, which includes most of the common linux open source security auditing tools.
LainTheWired = isgod( int Lain, int denial, float truth)
Ever since the FWTK offered a semi free toolset, the community failed to develop real free simple, stable and secure application level proxies.
There are some more now, but most have discovered bugs due to missing deffensive programming.
That was one of the reasons I started freefire.org, even when the mailing list currently is not used.
--
www.eckes.org
I propose a fork of Apache that contains a complete implementation of all IIS functionality (circa 2001), preferably enabled by default. The application must operate as 'root'. This will ensure that certain IT positions will remain abundant for many decades.
Do you like German cars?
Yes I know there are no viruses today. That's what wargaming is for. Be prepared. It's the only way.
It seems to be that people who make security tools don't open source them on the normal channels because they don't want 5cr1p7 k1dd135 stealing them. For instance, I'm currently working on an SNMP scanner to analyze a fibre channel network - no way am I open sourcing it; it shows entirely too many holes. *shrugs*
*black hat on*
Besides, if the holes you find become fixed due to public notice, how are you going to exploit them in the future?
*black hat off*
I use it every day all day long and could not do my job wihtout it. But I would really love a GUI better than ethereal for it. Something that implempents the more advanced features of Sniffer Pro or whatever they are calling it this week. Better searches, better ability to highlight and get data. Also the enahancement I would really like to see in tcpdump (and thus all the frontends for it) would be the ability to filter on x.x.x.x x.x.x.x in other words to be able to see traffic from or too a specific IP and another IP. This comes up in testing for me all the time. For example I want to see if a given packet is making it from my PC to a device somewhere. If that device happens to be chatty it would be nice to be able to filter it down to between it and my PC. Since I'm normally admining at least one of the devices between me and it from the same PC all the workarounds feel clunky. So not so much a new app but ways in which a good app can be improved. For example when the put the -packet_trace function in nmap it became much more useful for me than it had been and it was already da bomb.
Cypherpunks: Civil Liberty Through Complex Mathematics. Those who live by the sword die by the arrow.
See Lumeta and sourcefire products.
...
Bonus if it can be passive and list OS, services,
#include "coucou.h"
This smug bitching is getting old, really quick.
You must be new here because "smug bitching" on Slashdot got old about 3 or 4 years ago.
Oh great (Score:-1, Offtopic)
by Anonymous Coward on Monday June 28, @05:35PM (#9554903)
Here comes the "THAT'S NOT THE PROPER USE OF BEGS THE QUESTION [wsu.edu]" people. Get over it. English changes.
I am constantly trying to improve the security of my home network, and the available tools are pretty powerful. My biggest problem has been to find powerful reporting tools. I use iptables as a firewall, tripwire for intrusion detection, etc. But it's not always easy to see what's going on in the system. Tripwire produces decent reports; but there is no easy way (afaik) to get a list of intrusion attempts, network traffic, port scans, etc. Sure, the information is in the logs - but the log information is hard to parse and often not as complete as it should be.
Under capitalism man exploits man. Under communism it's the other way around.
A ton of tools are available for nix boxes, take a look at the live cd security distros. Tons of perl scripts or .c files. infosec geeks don't need fancy GUI's we need little scripts that can be piped or molded for different needs. look at all the tools that have been ported to win32 from linux/bsd like hping, nmap, nessus, ethereal, netcat, nemesis, datapipe, fport, lcrzoex, snort, etc. It's the closed source guys who need to get cracking. Look at Foundstone all they do is port stuff cause the win32 crap sucks. OSS tools are the ones leading the pack on this front. That being said perhaps Snort could be a bit easier/less prone to false positives, I couldn't grasp it completly until getting a book on it.
-- "of course thats just my opinion, I could be wrong." --Dennis Miller
You can do stuff like tcpdump -i xl0 src 10.0.0.1 and dst 10.0.0.2 and stuff like that.
But yeah, I know that I'm swimming against the current here.
http://www3.ca.com/Solutions/Product.asp?ID=4856
Does what you're describing.
Or loose and lose!
To my knowledge there is no, or perhaps very limited, support for the WPA standard. Granted, this isn't a tool, but it's security related.
Here's one I just thought of. Maybe it's been made, and maybe 16,000 people will point out why it isn't necessary or that it's built into find or emacs or something. Here goes anyway:
/
Write an app that takes a username as input and shows me all the files/directories that user can read or edit or execute. If I run it as root, it shows me All files. If run as me under my account, all of my files that that user could play with. For example:
shell% sudo fileSecurityCheck -www
will show me all files that are deleted when my webserver gets hacked.
http://www.gentoo.org/proj/en/hardened/
Who cares if it's common? Common people are stupid, cow-like beasts who couldn't entertain an original thought if their lives depended on it.
Enforcing proper usage keeps the language from degrading to a form where it can no longer express complex ideas, as common people are incapable of formulating such ideas.
Yeah I love to COMPAIN about those fools!
Your begging the question as to the proper use of you're language.
Proud neuron in the Slashdot hivemind since 2002.
Etherape looks rather nasty. Either that or it's just my filthy mind. (BTW who's Ethe?)
Common people are stupid, cow-like beasts who couldn't entertain an original thought if their lives depended on it.
I bet you have a lot of friends.
Plenty, thanks. Easy enough to deal with, just don't expect anything of them and you won't be disappointed.
Get Knopix STD (always a copy in my backpack) A live linux distro aimed at security with up to date packages for the following areas (From the Knopix STD site) http://www.knoppix-std.org/ * authentication * encryption * forensics * firewall * honeypot * ids * network utilities * password tools * servers * packet sniffers * tcp tools * tunnels * vulnerability assessment * wireless tools Turn it into a firewall, a web server, an IDS box, a honeypot. Use it to do data recovery on an dead or locked computer, perform a vulnerability assessment, a penetration test, perform an autopsy on a compromised machine, test your incident response team. Listen to your MP3 collection and play gnugo while waiting for that nessus scan to complete.
come comment on the madness at http://slashdot.org/~phreak03/journal/
It's common usage among the uneducated. If you want to project that image of yourself (that of an uneducated buffoon) then continue to use it in that way. It just makes the rest of us look better.
and don't forget sentinix
http://sentinix.org
defiance
Ad-Aware and Spybot of course!
By summer it was all gone...now shesmovedon. --
A tool for managing the various aspects of encryption on a system would be useful:
1- Setup and administration of VPNs (PPTP, IPSEC)
2- Administration of secure remote access (SSH)
3- Partition encryption
4- File encryption
5- Email encryption
YES there are bits and pieces, some distributions have more than others, but no control point for system-wide administration and enforcement that can be implemented across distributions.
Can You Say Linux? I Knew That You Could.
Most open source project focus on utility, not on appearance. The most powerful tools are often the simplest ones (in appearance). However, the ability to visualize and/or put a user-friendly interface is usually a good next step. Some may call this approach the "Microsoft dumbing down" approach, since it is Microsoft who usually put deceptively simple user-interface in front of a much more complex and powerful tool.
However, that doesn't mean these tools couldn't benefit from good visual front ends (and I'm sure people will point out there are plenty). Human's ability to make sense of well designed visual information (a la Edward Tufte) cannot be understated.
I also seem to recall reading a slashdot story a long while back about Infineon (I think) that had a hardware sniffer that is able to reconstruct TCP/IP traffic/session/connections that are captured, and it recognized hundreds of protocols/applications.
Bring all of that together: open source software being able to visually display security information in a meaningful way, using some kind of open standard like, say, OpenGL. Adding more to the existing foundation tools that we already have, that's where some contribution can be useful.
But that's just what I think, by no means do I think it's the best answer.
#5 is a Windows-only deficiency, but the rest aren't. I mentioned Antivirus software 3 times because I think it's at least 3 times as important as the others. As more and more (read: dumber and dumber) people migrate to non-Windows platforms, viruses and malware are going to start to be more of a problem for those of us on Better Platforms.
All's true that is mistrusted
I am unaware of open source software that meets the functionality of PWSEX or LC5.
We need security/monitoring tools which our Mom's can operate and understand.
What accents do those two words even sound similar in? It really bugs me, because there's just no way I can confuse the two, so when someone else does, it always throws me -
loose, rhymes with goose and moose,
lose, rhymes with ooze and shoes.
you probably meant "flak", as in, "anti-aircraft fire".
but, i'm glad you mentioned "flack" because that's slang for a PR shill: I am noticing a vastly increased number of what appear to be PR pieces on Slashdot. Like, remember back a couple of months ago when there were a bunch of Microsoft security holes uncovered, then wouldn't you know it, suddenly a story appears about a bunch of unix computers at some university being compromised. One was news, the other was not, but it was necessary to get the anti MS stuff off the front pages.
So this story today: "gee, what are the gaps in opensource security tools?" This is planted, folks, it's not news, it's just anti open source.
I haven't heard of an open source tool with the same functionality as the former Raytheon SilentRunner, now CA eTrust Network Forensics
or the similar tool Niksun
An open source tool with similar capabilities would be an excellent project
Something that can premiscuously detail a LAN. It should use netcat, nmap, ethereal and the other standards to map, in real time, you LAN traffic. It should also have the ability to intercept and decode any stream on your network.
So, let's say Billy is reading Slashdot when he's supposed to be doing data entry. You see a red (for example) line leading from Billy's box to the firewall with the line labelled "slashdot.org" and the IP address. Click on Billy's box and "zoom" to focus the GUI to Billy and right click menu to "intercept and decode" to pop-up a konqueror window that follows Billy's URL jumps and shows you what he's reading. The same would be true of mpegs he's watching or mp3s he's downloading.
Other functions would be to show all nodes in the LAN as well as OS versions, all traffic in and out of each node, and any services running per node. Servers running things like ntlogon, apache or SMB would be marked as such. A "bookmarking" type feature could also be implemented as well as a sticky-note feature for notation and easy navigation.
You could call it knetsec, but I actually like a bastardization of that... Knutsac.
put the what in the where?
-click and drool intrusion detection
-firewall that pops up when a program tries to connect out (like zone alarm does)
-way to plug all known security holes with a double click
Don't forget host-based tools - one of my favorite that will help keep you OUT of trouble is sudo which is a way of controlling and logging root access. Been around forever - tastes great AND less filling! ;-)
Hulk SMASH Celiac Disease
The above statement begs the question: "...what open source security tools are missing?"
No, it doesn't.
The truth of that statement does not depend on the fact that some open source tools missing. Therefore it is not an example of "question begging" (taking for granted exactly what you are trying to prove) at all.
It couldn't be jock itch.
It couldn't be an std.
Is there an opensource patch management application to keep multiple platforms current with various security patches and service packs?
Hey, spam me. nels.yahoo@member.fsf.org
It would solve 99.9% of security problems: The MS-Windows-to-Linux-Upgrade-Wizard
Liberals call everyone Nazis yet they are the closest thing to it.
For MS software for example. A good anti-virus with an up-to-date library. This might actually be too much work for unpaid volunteers.
And a good disassembly program. Like IDA Pro. This is what the pros use to analyze viruses and the like.
Something like a kick-ass OSS IDA Pro will be needed in the upcoming OSS-DRM wars.
Pardon the spelling. It was never my strong suite:)
The original post makes use of the phrase "begs the question". This does not mean "to wonder" or "leads me to think" or to "rhetorically enquire" or anything like that. It's plain and simple - it means to take something as given (similar to the concept of conditional probability). For example, you could say something like:
"Begging the question that it's raining tomorrow, would you like to go the cinema?".
In this example, you are asking the person to whom you are speaking to consider the question as if it will be raining tomorrow. You are asking them to ignore the question of whether it will rain, and consider their response assuming it WILL rain. You could ask this too:
"If it rains tomorrow, would you like to go to the cinema?".
You might consider me as a pedant - but you would be wrong (look up pedant). I would argue I am not being pedantic. I am not correcting a trivial mistake or trying to get one-up on the original poster - I am trying to correct an obvious and serious mistake. This is not pedantry, it is sharing knowledge in the hope of improving the use of such language for the benefit of everyone.
Being notified that a program is trying to connect to the network can clue you in that you have been infected by a worm, virus, trojan, or spyware. Sure, Linux has relatively few malicious programs now but in the future it may become a bigger target.
Mebon
I've thought about this, and figured it was easy enough to do with the find utility. Man page is here. It's not difficult to do, I'll leave it up to you to figure out the specifics.
-ReK
md5sum -c reality.md5
reality: FAILED
md5sum: WARNING: 1 of 1 computed checksum did NOT match
Most of my dealings with GNU/Linux have been to set up a NAT router which occasionally also has a webserver (apache) and maybe an IMAP server on it. The hardest part is always setting up the firewall: I have to turn to the Linux IP Masquerade HOWTO and/or learn ipchains/iptables every time... ...except for FREESCO: the Slackware-based floppy-sized distro for routing/firewall. Its text-based task-oriented setup utility and its web-based interface for setting up port forwarding is great! I just wished something like webmin had an interface like that instead of simply slapping a GUI on the ipchains/iptables mechanism. (you're just saving me from using a text editor - big fucking deal)
:(
Anywhoo... that's my greatest wish. (I can't always use FREESCO - one of the boxen I am setting up now not only does NAT but also WWW, mail, samba and has a software RAID mirror. So I have to install a GNU/Linux distro then make it into a firewall...or do I??) Maybe I've missed a new and amazingly nice offering, but last time I checked, most "firewall configuration tools" were either yet another textfile format for ipchains/iptables or a GUI for said textfiles.
We need more of metasploit like project...
We need a core impact clone!
How about EtherPEG for Windows so I can see what kinda smut people are viewing? AFAIK there is no open source version available.
The United States military.
http://alternatives.rzero.com/
Forensics is still shrouded in mysticism and secret handshakes in the both the open and closed source worlds. EnCase is fantastic, but the cost is prohibitive, the other commercial products cater to law enforcement, efectively killing the divorce investigators and legal business use. The ones who will sell to anyone are not worth their exorbitant prices.
Autopsy/Penguin Sleuth Kit is great, but it has a long way to go to match the ease of use and reporting capabilities of EnCase.
The OS Forensic packages are labors of love to fix short commings or customize the tools for specific tasks. We need a OS Forensics Army Knife.
I want to be able to know what the recently fired employee was doing so I can make a case to the Legal Dept. There are many reasons to terminate an employee that do not "rise to the level" of prosecution, but certainly can result in Civil proceedings. I don't want to have to have a Windows box laying around for the eventuality of digging into ex-employee misdeeds.
I can also think of instances when "trusted" people jump ship unexpectedly, like when a senior developer resigns to take a position at a competitor. Wouldn't you like to be able to dig deep into the unallocated clusters of his HD?
Not exactly a security tool per-se, but some friends mentioned a screensaver that ran on linux and used etherreal or something similar to look for image files flowing by on the network, capture them and display them as a screensaver. A nice tool for a sysadmin to see what their users are looking at.
Anyone know the name/URL of such a beast?
Thanks!
Something I've started to see appearing are vulnerability management tools which combine asset/vulnerability management with workflow systems.
What does this mean in english?
Today, you scan your various class A/B/C's (with Nessus) within your company, and discover 300 vulnerable systems. You can generate a nice report, but not do much else without a lot of manual calling up of people and forwarding the report.
Instead, there are commercial tools available now that do a few things:
1) Classify IT assets and assign them to different groups (desktop team, unix team, database team) and how critical they are (carrying customer traffic, development servers, etc).
2) Individuals within each group can run ad-hoc scans of their team's systems, or alternatively await reports generated from scheduled scans.
3) Once vulnerabilities are discovered on each team's systems, they are notified and provided with a web-based system to update and close off vulnerabilities when patched. It is then possible to see from a high level, which teams have the most vulnerable systems, and how effective they are in managing security on their part of the network.
Those are the kind of products that the company I work for are now investigating, as for once, they provide solid metrics to demonstrate to management that we're doing our job.
Man watching 6 MSCE's around a sun box, looks alot like the opening scene's of 2001:space odyssey...
no.
A tool that takes virtually any input (Windows Event Viewer thingies, Unix Syslogs, Router Syslogs, Squid logs), and can correlate all of the events.
I know there's a Cisco-ish product that you can do this, and it monitors for certian 'bad' things happening on your network, and can send emails to a certian person or whatever.
Although, given the state of things, the ability to look back and see the state of the network at a given point to track down a user would be mighty handy as well. (When a user logged on, which URL's they accessed, when, what else they did, and so on)
Certain of the app server vendors provide functionality through their console products, but it would be nice to have a vendor neutral product that would let me browse/edit identity data regardless of the source (LDAP, the OS, whatever), let me map application roles to the environment, and let me examine and interchange various policy files, maybe using XACML as the lingua franca. Maybe also something that would keep track of JAAS login modules and JAAS config files.
Like is said, a bit boring, but it'd make it easier to assemble and deploy applications, and to move applications between app servers.
I was blown away by the Fluke Network Analysis Tools.
Given enough time, everything could be replicated with FLOSS, but nobody has. Somebody should....
-- I care not for your foolish signatures.
NOT PGP/GPG!
NOT PGP/GPG!
NOT PGP/GPG!
I am looking for a tool that supports both Windows 2000/XP and Mac OS X that does on the fly encryption for removable USB memory sticks.
I know of platform-independent tools like PGP, but after decrypting, unencrypted data would sit on the thumb drive. If I was interrupted after decrypting or (more likely) forgot to encrypt the file again, unencrypted data would sit on the drive.
I know of Mac OS X's encrypted dmg files, but Windows has no way of accessing them. I would use one of the countless number of Windows-, Mac-, or Linux-proprietary third party "put your passwords here" tools for doing encrypted files, but all that I know of are platform-specific.
So what am I looking for? Something that has Windows and OS X clients that I could put on the thumb drive, along with a file of arbitrary size containing the encrypted data. After authenticating with the software, one of the following would happen:
(1) either the software mounts the encrypted file as a disk drive just like daemon-tools mounts a CD image in Windows, or OS X mounts a dmg file
(2) or the software includes a 'secure' text editor that can edit the encrypted file.
Either way, the software (1) sits on the thumb drive and (2) provides on-the-fly encryption so the data on the thumb drive is never unencrypted.
I'm willing for this to be horrifically slow as I would be storing mostly text on such a system, but supporting at least recent Windows and Mac OS X is important to me. I run Linux on servers/gateways but prefer Windows or OS X for my primary desktop/laptop machines.
I would be willing to pay for such a product, but I don't trust closed-source encryption products. Please let me know if you have heard of such a product!
Incidentally, PQI makes very very small thumb drives. Froogle for 'PQI intelligent stick.' Their USB1 model has a write-protect switch, but their USB2 model does not. (I am not affiliated but have bought, used, and liked their product.)
--
"Extra Anus Kills Four-Legged Chick" -- Headline
... when you write an OpenSource application such as this:
http://www.forescout.com/activescout.html
Until then.
~hylas
When I was setting up my Debian box, before, I was offered the option of a firewall based upon a text interface.
/etc files directly.
In the end, I couldn't understand it well enough to activate it. What I'd really like, then, is a nice interface similar to Zone Alarm, but with lots of documentation (help files) written, as well.
That way, I can get the firewall up and running with a minimum of experience, and then can tweak it to my hearts content.
Bonus brownie points, if the documentation leads me into being able to understand the command-line text program's interface, as well, or [better yet] help me be able to read the logs and the
Sorry about this -- I hope I don't sound too stupid to use Linux (I'm not: I've set up everything from an appletalk server to a recording and mixing setup, and even programmed a little) -- but this was just too hard for me to use correctly, and be sure I was using it correctly.
Correct Horse Battery Staple: 72 bits of entropy. Enter "Correct H" into google. When it generates the phrase, that's
... application policies. Example: set a maximum security policy for each app and, if the app tries to break it, let the user decide what to do. Example: web browser. Tries to connect to the web: user selects to always allow that or to enter more specific rules. Tries to read from disk other files than those which are its own: user selects what to do. You could restrict browser access to a download directory. No viruses may get in and no browser bug may generate a security hole.
A bit like Symantec's firewall (as far as I can remember, but not limited to network access).
I should also be able to set up a special security directory where I store secret information. Any app access files in that directory, will, during their session, not be allowed to write any data or access the network or other data ports.
Just let each app run under its own policy. That would make Linux even more insensitive in regard to viruses and other malicious things like backdoors.
As far as I know SELinux is some sort of that. But as far as I know there are nice user interfaces missing that allow to interactively (and on demand) change the policies.
I played with an old-old-old demo version of NFR years ago and wanted a similar after-the-fact investigative tool, so I wrote my own. I record data about every single packet going to or from the Internet and feed it into a MySQL database. A web front-end supports queries against the DB, I can do more complex ad hoc queries from the MySQL prompt, and I have oodles of perl scripts that run analyses against the flat log files it generates. I've thought about asking my employer, on whose time I more-or-less developed it, about making it Open Source, but haven't had the impetus to actually do it. It's a great tool, and I'd be interested if there's something similar that's farther along.
Would you explain what you are referring to? I think I know, and if so, it is what I was going to ask if I hadn't seen it here in this thread, some way to offer up a phony address (that would still work) inside a single machine that is networked to the web. Sort of like a firewall for the firewall. Thanks.
www.metacoretex.com has easily the best database scanner out there. (no offense mr Klaus). It's fully modular and written in java - so you can run it anywhere.
to the best of my knowledge, is it the only db scanner tool out there.
(and yes it's a bit of a plug cause i know the guy who wrote it - but it still smokes...
"Omnis tuus capsa sunt inesse nos"
All of the tools to build an open-source SSL VPN exist, but nobody has put them together.
Apache
Apache_SSL/Mod_SSL
Apache proxy module
mod_security
LDAP (for tie-in with active directory)
Java-based SSH and telnet clients
Write a PHP based access control and management interface for the thing and voila! you have a hot new open source project.
If a few people had the time, they could give Juniper/Nokia/etc a run for their money.
a good metrics tool that can show the PHBs in semi-real time the security posture of their enterprise would be a good thing. it would also help identify weak areas, good areas, and actually quantify the money spent in IT security.
dr martin carmichael's doctoral thesis proposed a method to do this, but alas i cannot find a link.
"Omnis tuus capsa sunt inesse nos"
What a pedant I am that I do consider you a pedant without even looking up "pedant" in a dictionary...
Its probably too late for this post to get modded up enough for anyone to see it, but I've been at home sick so I didn't check Slashdot every 20 minutes like I usually do.
Based upon marketing hype, my management chain insists on using ISS's Internet Scanner (www.iss.net) to perform site-wide security scans and do vulnerability assessments. Nessus just simply isn't as feature rich as Internet Scanner. IS searches for thousands of vulnerabilities, and they are constantly adding new checks that can be dynamically loaded into the scan tool. The scans are highly customizable. The only problems are the tool can only run on a Windows server (i.e it can scan any network device including unix, printers, and Cisco), its a huge resource hog, and GUI only.
I'd love a nice, easy command-line based unix based system that has all the functionality of ISS, including the nice HTML output. The problem is, of course, that ISS has a huge head start.
"You cannot find out which view is the right one by science in the ordinary sense." - C.S. Lewis on Intelligent Design
What keeps me using "closed source" v.s. "open source" software..er security software?
Simple.
documentation that even a dimwit like me can understand, none of this "Enable IXXSS_SX SCAN becaws it work good. But only if you are paranoid, becaws it will slow the IXSS_SX scan down and might give you false negatives"
While 1
If (((Minute(Now) Mod 5) = 0) And (Second(Now) = 0)) Then
MsgBox "All Is Well",,"Hi"
End If
Wend
just save as whatever.vbs and doubleclick to run.
Metasploit (http://www.metasploit.com) has a real neat project going. I know I use it.
We need more open source tools that act as front-ends to monitoring and operations applications, glue to sit between the 24x7 security/network operations staff and highly advanced applications and devices which are designed for engineers and architects to manage.
Your typical 24x7 staff aren't experts - so we need expert systems to make them more effective.
An example is IP Blocker where you get a system set of Perl scripts that front-end changing the border router access control list.
Many of the procedures and functions we perform to ensure security across our networks can be automated, and it is these areas that need the most work today. Another example would be a script that checks an IP address on your network against your inventory records, vulnerability databases, and other criteria to display an exhaustive history for the device as known by your organization. How many times have you got a Snort or other alert for an IP on your network which you have no idea who owns or what it does
It appears the submitter is running out of open source tools to profit from:
http://edgeos.com/services/pro-toolkit/
It sounds amusing, and perfect for a network security course I'll probably be running in a few months :)
"Okay, so we're not going to watch a video to help you detect the second most important phase of an attack on your network infrastructure - bullshit."
I have seen plenty of security tools.
However, I have failed to find data recovery tools. Does anyone out there know of Open Source Floppy recovery?
Seeing how so many pay-for products like Norton Utilities and other near-nameless closed source internet-based companies sell you this stuff, I'd like to see a free implementation I can use at my IT job
"Wireless : LAN
One thing I see missing is a good network / host discovery tools with a rich feature set. Like being able to automagically map out a TCP/IP network via SNMP querying "seed" routers, and/or by passively observing network traffic, then being able to collect further information on each host through port scanning or SNMP walking. The biggest problem I see is there's alot of great tools out there, just none of them that does everything without having to jump between multiple programs. And of course, it would be with a curses based gui :)
Solarwinds has a tool called Sonar which does the "seed" router snmp-based discovery. They have some other nice tools too, but it still takes alot of tedious switching between applications to get all the information i'm looking for.
clue:(Tech Itch is the name of a drum n bass producer)
Add the line ... to your
Put:in a script for a cron job run every week or whenever. Or do it manually. Or craft your own script that doesn't actually perform the upgrade but emails you when something can be updated. The output of a cron job gets mailed to the user's account (in this case root).
We had a bath party in Iraq, but the bush made us end it, so now we side with the programmers who scratch their itches.
I'm still trying to figure out what people mean by 'social skills' here.
.. ask if its virus patterns are.
A few friday nights back, our ClamAV started catching a little worm called W32/Zafi.b.
McAfee's DAT files to catch this one came out 2 1/2 days later, on the Monday morning (UK time).
Apart from the Nimda outbreak of 2001, this year is the only time I've seen viruses arrive at our email gateway (thanks ClamAV) before our official antivirus software updates catch them. Netsky, Bagle, and Zafi.b were all caught by ClamAV before McAfee had released DAT files for them.
I'd recommend defense in depth, using multiple virus scanners. We scan all incoming (and outgoing) emails with ClamAV, Bitdefender (free for Linux boxes), and McAfee's uvscan.
It's way too easy to fall into the mindset which says "we have antivirus software everywhere so we're safe". There will ALWAYS be a window of vulnerability between the release of a new virus and the availability of detection patterns. And don't forget that a lot of Windows viruses/worms disable any antivirus software they find running.
Phil
If all viruses were based on security holes in software, you would have a point. But they aren't.
Many (most?) malicious programs do not exploit any software security holes; they just rely on stupid or careless users. The point of something like Norton Antivirus is not to make up for security holes in Windows/Office/whatever, it's mostly to mitigate users' carelessness or naivete.
Can your user account on your computer send mail? Connect to an arbitrary Internet host? Hell, spawn a process? If so, congratulations! you have just become a potential target of malicious software. Proprietary AV software doesn't particularly look for holes in OS's and applications, it looks at files and running processes for A) known signatures and B) known malicious behavior. I think an open source AV solution could potentially do that better.
All's true that is mistrusted
I know ethereal has a leg up on APriori-based protocol detector but I sure like to see that extended to other forms of Layer 2 (other than Ethernet DIX version 2).
I've been trying to find an authenticating/logging telnet proxy to work around this, but it's impossible to find, so I'm facing writing one myself.
Comment removed based on user account deletion
this begs the question
No, it doesn't. It raises the question. Begging the question is a type of logical fallacy.
Please don't use phrases you don't understand.
- configure what fields are logged,
- configure what fields are shown to me,
- configure what records are shown to me,
- configure if conversion from raw to symbolic values happen or not (e.g., hostname lookup, services lookup, etc.),
- save those view configurations and be able to reuse them later
- auto update with new log entries (like less -F, but with the above features)
Checkpoint's FW-1/VPN-1 is a dubious product in terms of security and licensing woes, but SmartTracker is an interesting log viewer.Anybody got similar functionality for iptables? I've looked around, but found nothing. I'm even now hacking new ulogd plugin to give me at least feature (1).
Joachim
People don't write Manifestos any more -- what's going on in this world? [Frank Zappa]
Webstretch is a free open-source tool that has just been created, which lets you alter information passed to a web server on the fly.
It should work on any OS, and forms a proxy between the browser and any destination (whether its another proxy or web server).
New facilities being added all the time e.g. statistical anaylsis, finding hidden areas (sometimes people put details in the robots.txt file), etc.
Still in beta, but shaping up well.
Real students of linguistics and languages do not take issues with things like this, only elitists and grammar Nazis do.
The statement "Languages evolve, but that fact is too often used as a cop-out for being too lazy to learn correct use of a language." is utterly nonsensical, because there *is* no correct use of a language. A language is a construct to serve the people, and as people change, so must the language. Languages evolve over time, and should be treated more like a living organism than a rulebook. The only "correct use of a language", by definition, is the way the majority of the populace is using it. In this case, the majority of the populace uses "begs the question" in this sense, so it is perfectly valid, and is not any less so than any other commonly used phrase.
Oddly enough I know the guy that wrote Ethereal, even though I don't use the program. He's in my Linux User Group. Great guy, he has helped me w/ numerous problems as I switch to Debian.
Anyway, have you asked for these features? Ethereal is under constant development. I think that as long as the new features don't slow the program down and they add necessary functions, they might get added.
--Somewhere there is a village missing an idiot.
Smackdown!
I will publish a security tool that can evaluate (or crash) the security of an Oracle Database.
This will be released as GPL.
A new Open Source security tool, because, there are too many applications, such as NMAP, SAINT, too many-many exploits or Proof-Of-Concepts, Firewalls, IDS, etc...
Missing Open Source Security Tools?
What is missing?
Just write your virus in Perl - portability problems greatly reduced.