Day in the Life of the Internet Storm Center

My Favourite Pony by B3ryllium · 2004-09-07 01:33 · Score: 4, Informative

An invaluable tool for PCs that are "public access" or even boot-partitions of computers at work:

DeepFreeze

Just one reboot, and any malware infection is obliterated. (There are alternatives, too, but I like DeepFreeze the best)

Re:My Favourite Pony by stratjakt · 2004-09-07 01:43 · Score: 5, Interesting

Nothing on that link tells you how the product works.

The closest I read was "Deep Freeze instantly protects and preserves original computer configurations" which reads to me that it's kind of like Ghost, except it keeps an image local on the HDD?

If so, I'd shy away from phrases like "Completely invulnerable to hacking".

XP's system restore feature gives you the same functionalities, if it's used properly (of course, it never is). I'm in the habit of making a save point before I do anything that could potentially bork my machine (testing some new driver tweak, etc), and have rolled back successfully on more than one occasion.

--
I don't need no instructions to know how to rock!!!!
Re:My Favourite Pony by ciroknight · 2004-09-07 01:55 · Score: 5, Informative

We happened opon this product at the school where I used to work, and as far as I can tell from using it and poking around at the program, it keeps a log of all harddrive transactions, then when rebooted, it plays back the log backwards, restoring to the state in which the system was before; no Ghost partitioning required, but none-the-less not invunerable to attack. We had kids bring in Knoppix CDs and obliterate hard drives for no other reason than they could.

My suggestion is to use Deep Freeze with Ghost (It's a complex setup, but if you "un-freeze" the system for one reboot, then Ghost, all you have to do is cast the image, change the computer's name (we had a pretty complex naming scheme), then reboot the machine and it's ready to go.) It's a formittable combination, and far better than products like "Foolproof Security". Hope this helps.

--
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush
Re:My Favourite Pony by B3ryllium · 2004-09-07 01:57 · Score: 1

Try it, they have a free demo. Try and see if you can break it (let me know if you can :)).

Assume that a competent system administrator has already disabled floppy/cd-rom booting and password-protected the bios. For the annoying people in a public place ("Ooh! Bonzai Buddy!"), that would be sufficient to prevent almost all malware.
Re:My Favourite Pony by stratjakt · 2004-09-07 02:04 · Score: 5, Interesting

See, I have this co-worker who constantly fucks up his machines. He's supposed to be a programmer/analyst/tech support guy just like me (small company, you wear a lot of hats), but everytime something comes up, I have to handle it because his computer is broken.

"I can't build a working EXE, my Visual Studio is screwed up!" "I can't dial into that customer, because my modem isnt working" "I can't VPN in because my computer crashes when I fire up the Cisco client".

He's incompetent, but I'm dubious he's this incompetent. I traded him the machine in my office when I got a new one, everything worked perfectly. A week later, his VPN and Visual Studio are broken. I really dont have the time to keep rebuilding his machine for him. Of course, he claims he doesn't know how to reinstall Office or VStudio, etc..

I think he does it so he won't have to do actual work. I end up doing everything because he always has an excuse. When he's on site, his laptop is broken, so he has to phone in all the code changes he wants, I have to do it, cut an EXE and email it out. Of course, it's double bonus for him. Anything he fucks up on site, he can just blame me for, since I'm actually doing the work remotely.

It's pissing me off, and it makes our company look like a bunch of morons. My archetypal PHB thinks he's just the cats ass because he comes in "early" every morning (he shows up at 8:45 to drink coffee and read the paper, we open at 9. Sheesh).

Anyhow, this sounds like a decent product. I'm downloading the evaluation version now. I'll reinstall his machine one last time, ghost it, install this. Next time I hear "I can't dial in because my modem is screwed up", I'll reboot his box and it'll be fixed.

--
I don't need no instructions to know how to rock!!!!
Re:My Favourite Pony by ciroknight · 2004-09-07 02:04 · Score: 1

It's easy enough to break, but for high school students it might be a little tough. All that needs to be done is corrupting the transaction log that it keeps, which can be done by either tampering with the checksum that it keeps of it, the checksum that it keeps of the old files, or tampering with the actual transactions, all of which would take a lot of work (and most likely wouldn't be worth the trouble, as it would require writing a program for the specific task of finding the memory space of the driver, then breaking it in your favor).

--
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush
Re:My Favourite Pony by Johnny+Mnemonic · 2004-09-07 02:05 · Score: 1

Try it, they have a free demo. Try and see if you can break it (let me know if you can :)).

That offer good for the OS X version of their product, too? If so, you're on.

I'll also stipulate to disabling external booting via Firmware lock, disabling single user mode, and not having the root user enabled. I'll pretend that I can't defeat that by not changing the RAM--which is plausible on a workstation with a padlock (but not on a portable.)

--

--
$tar -xvf .sig.tar
Re:My Favourite Pony by ciroknight · 2004-09-07 02:07 · Score: 2, Interesting

And it'll work fine for that, as long as the asshat isn't insane enough to actually hack deepfreeze. But this is exactly what this product was made for, and it works wonders for keeping machines alive after a virus storm or freak driver accident.

Hope it works out!

--
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush
Re:My Favourite Pony by scovetta · 2004-09-07 02:09 · Score: 3, Insightful

Confucius say:
"Never trust a product that includes the phrase:
Completely invulnerable to hacking..."

--
Wer mit Ungeheuern kämpft, mag zusehn, dass er nicht dabei zum Ungeheuer wird. --Nietzsche
Re:My Favourite Pony by jrockway · 2004-09-07 02:21 · Score: 4, Interesting

It's pretty good. I couldn't get around it in Windows after they blocked real mode programs. Before that I had to crack the BIOS password and then boot Knoppix, then delete key files. And sometimes the fucker still came back.

So from my independent analysis, I'd say DeepFreeze is good. I haven't done any code-tracing, though, so I don't know if some buffer overflow would ruin the whole thing. It wouldn't surprise me, though.

Closed source is what it is.

--
My other car is first.
Re:My Favourite Pony by Feng · 2004-09-07 02:23 · Score: 2, Insightful

Set the boot priority to boot the hard drive first and password protect the BIOS. That'll make it harder for them to mess things up!

--

--- if y cn rd ths y cn gt a gd jb n cmptr prgmmng!
Re:My Favourite Pony by RichardX · 2004-09-07 02:50 · Score: 2, Interesting

This is just a guess, but from the (very limited) description on the site - particularly the bit about only needing 2 Mb of drive space - I suspect than rather than keeping a rollback log, instead it redirects all writes elsewhere and somehow fools the system into combining them

I don't really know if that makes sense, but basically what I'm saying is I think instead of allowing changes to the stuff that's already on the drive, instead it makes the system write the changes to a "scratch space", as it were, and when it comes to read back files, it takes that into account... when you reboot, it wipes the scratch space (which just contains the differenced versions of the files)

The difference between the two methods is the differencing system doesn't take any "extra" space, as anything you're saving/installing you'll be taking into account in your HD space, whereas a changes log could grow huge, fast, and take up a lot of unaccounted-for-by-the-user-space

Wow.. reading this back, it's a really mangled and incomprehensible way of explaining a simple concept. I should write manuals for a living!

--
Curiosity was framed. Ignorance killed the cat.
Re:My Favourite Pony by joper90 · 2004-09-07 03:03 · Score: 1

u know what, i think hes doing this on purpose..
you also need to show him how to do it, and then here are no excuses.. However he WILL blame ghost for now fucking up his machine.
I would make him sign off something that states he is happy with it before he breaks the keyboard and cannot press 'enter' to resetup the drive.. i f**king hate people like that.
:)
Re:My Favourite Pony by Nimey · 2004-09-07 03:05 · Score: 1

So document what's going on with your cow-orker, then go to your PHB or PHB->PHB and get his sorry ass fired. If your direct PHB won't do anything, maybe he'll get fired too.

--
Hail Eris, full of mischief...

E pluribus sanguinem
Re:My Favourite Pony by Anonymous Coward · 2004-09-07 04:04 · Score: 0

Or, you could kill him.
Re:My Favourite Pony by Anonymous Coward · 2004-09-07 04:27 · Score: 3, Interesting

Just to add to what the others have said, my father also runs a school computer lab, and I fix things for him when I come home to visit every couple months. He is a drafting teacher close to retirement and knows CAD software inside and out but less so when it comes to administrating the network etc, although he is still picking things up. Oh and the school district's computer people are incompetent.

We use DeepFreeze in the lab and it works very well. I have yet to find or hear about any way for the student to mess up the machine as long as it boots off of the drive that DeepFreeze is installed on. Hanging out in script kiddy channels I heard a lot of people asking how to hack DF, but no one had any answers, other than boot disk. So if you disable booting from CDROM and floppy in the BIOS and use a BIOS password, then short of opening the case or figuring out your password, there is really no way that the user can mess things up.

-jackson
Re:My Favourite Pony by Cramer · 2004-09-07 04:49 · Score: 1

30sec with a screw driver and that password is history. You'll need a real lock (not the BS manufacturers tend to put on there) to keep that screw driver at bay. Heh, then it'll take a few minutes with a paperclip and a screw driver *grin*
Re:My Favourite Pony by sumdumass · 2004-09-07 05:17 · Score: 1

if i can get into the system running windows i can get into the bios and change the password.

Granted the average script kiddie would have dificulty in doing so but it is verry possible. Using a bios password to lock changes in boot order and such are really good for keeping people that shouldn't be on the computer in the first place off. If they have access to it in a working enviroment reguardless of user priviledges, it is hackable.

Maybe,in cases with school children or the existance of co-workers that all the sudden have computer poroblems when work needs to be done, some sort of monitoring program should be employed and a strict discleplin policy followed. I had users deliberatly fuck stuff up and after watching through a vnc session the boss fired one and punished the other. I think this is a real way of doing it. Fireing people should be a last resort but messing a computer up and costing the company money is just like vandalizing the break room or other companie property. An action that usually carries a statis of getting you fired.
Re:My Favourite Pony by Anonymous Coward · 2004-09-07 06:03 · Score: 0

It's pissing me off, and it makes our company look like a bunch of morons. My archetypal PHB thinks he's just the cats ass because he comes in "early" every morning (he shows up at 8:45 to drink coffee and read the paper, we open at 9. Sheesh).

Then you should come in early, too, if only to read the paper and drink coffee.

As for the rest, yeah--I'd fix his machine with deepfreeze, etc. and if you have some official auspices under which to do it (e.g. you're the sysadmin + company policy provisions for it--better make sure you have good reason to believe you have explicit authorization), you can put some loggers on the machine to see how exactly he's screwing things up.

Maybe he's just a terrible programmer who manages to damage windows with shoddy coding? (Hey, it's been done...)
Re:My Favourite Pony by Lisandro · 2004-09-07 06:35 · Score: 1

At the cybercafe i work we use GoBack (http://www.goback.com/) for instant hard drive restoration. It works fairly well and never gave us an issue; i didn't set up PCs, but i recall the guy who did had some problems with DeepFreeze.

I hate that this kind of software has to exist, but if DF doesn't do it for you, GoBack works just right.
Re:My Favourite Pony by pen · 2004-09-07 11:11 · Score: 1

I suspect that the 2MB requirement is for installation only. Whether it keeps a transaction log or saves the changes temporarily to a different location, that information still needs to be saved somewhere.

Otherwise you'd end up with a read-only hard drive. From personal experience, I can tell you that the hard drive is writable while you're using the system. The first time I saw it, I just thought that the computer was being reimaged upon boot.
Re:My Favourite Pony by Anonymous Coward · 2004-09-07 11:27 · Score: 0

You can never trust a former BeOS user. Hey bery, how's life treating you?

chuffy
Re:My Favourite Pony by JThundley · 2004-09-07 12:27 · Score: 2, Interesting

That's what I always thought.
Just last week at my college I thought I'd throw a knoppix disc and not use their 2 year old installation of Windows 98. Knoppix was slow as fuck with the little amount of RAM it had, so I thought I'd install it to the hard drive so it would run faster, DeepFreeze is on this machine, when I reboot win98 will be right back where it was, right? Wrong. I hope nobody finds out that I did that or I'll get banned from using the college network... again. DeepFreeze wasn't deep enough...

By the way, to see if DeepFreeze is on the computer: Ctrl-Alt-Shift-F6
Re:My Favourite Pony by ciroknight · 2004-09-07 16:48 · Score: 1

Not practical. We store ghost images on bootable cds, so the only way to restore the system was to boot from cd. We tried PXE, but our network just didn't like that idea. We tried floppies, but nearly 90% of the machines either had bad floppy drives, wouldn't boot to floppy for some unknown reason, or were completely missing floppies. It's a wonder the kids could bring ANYTHING from home in, if they didn't have cd burners at home that is.

--
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush
Re:My Favourite Pony by ciroknight · 2004-09-07 16:57 · Score: 1

I would call Deepfreeze a script kiddie deterent. I was given the task to break a machine with deepfreeze on it, just because our network administrators were really, well, not up to par.

I took the task head on and found that Deepfreeze works (to my knowledge, I'm not exactly sure about the internals) on keeping a transaction record, and then playing it back. It also is almost continually checking checksums of access files so that it knows which ones to fix later. Destroy either the ability to keep the checksum, the checksum itself, or the transaction data, and Deepfreeze has lost that file. Of course, it takes a lot to be able to do that, and I would say it would be very difficult with an NT kernel, but simply hooking into its device driver and fucking it up will prevent the system from it's delete/restore function on reboot. Of course, all of this is much easier said than done, and I wasn't asked to implement such a tool (and HAVEN'T, and WON'T), but I can say that this is far outside of the reach of a script kiddie. (Would have to know how the Windows kernel interfaces with device drivers, how that device driver works, and then how to break it in a way that will leave you with a viable system afterwards and not the BSOD. These are things that people typically don't know, and don't feel like working out.)

--
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush

Correct link by Tyrdium · 2004-09-07 01:33 · Score: 5, Informative

Ethereal's website is ethereal.com, not ethereal.org.

Re:Correct link by bahwi · 2004-09-07 01:42 · Score: 0, Offtopic

Poor guy
Re:Correct link by strictfoo · 2004-09-07 01:55 · Score: 0, Offtopic

Just shows that the Slashdot editors don't read the articles and/or follow the links either.

--
I've just signed legislation that'll outlaw Russia forever. We'll begin bombing in five minutes.
Re:Correct link by geordie_loz · 2004-09-07 02:26 · Score: 0, Offtopic

Perhaps if you want to advertise yourself as a PHP developer for hire, you'd want to remove the PHP parse errors in your code?

Parse error: parse error, unexpected T_STRING, expecting ',' or ';' in /usr/local/domains/josephguhlin.com/public_html/in dexfooter.php on line 8

Malware by Ford+Prefect · 2004-09-07 01:34 · Score: 5, Funny

A practice very common in malware analysis to isolate yourself from various ill effects of the malware

Best description of Windows I've heard in ages... ;-)

--
Tedious Bloggy Stuff - hooray?

Re:Malware by The+Jonas · 2004-09-07 02:02 · Score: 4, Interesting

True.

However, if anyone out there is running a honeypot as a hobby or are new to setting them up, some good advice on a more secure Windows configuration can be found here. Specifically, it details how to cripple DCOM using a hex editor and reconfiguring other networking services. Good advice, even if you don't use their product. Be careful, you may lose some desktop functionality.

ethereal.org? by Anonymous Coward · 2004-09-07 01:35 · Score: 0, Funny

Has some "Goddamn Hippy" taken over the packet analyser site?

More "fun" than running viruses in vmware... by mkavanagh2 · 2004-09-07 01:36 · Score: 5, Funny

Is running them in WINE. Especially since it's not a virtual machine, and the virus might detect WINE then trash your lunix ;)

Re:More "fun" than running viruses in vmware... by DarkOx · 2004-09-07 01:52 · Score: 4, Interesting

only if you are crazy enough to run wine with elevated privilages.

--
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Re:More "fun" than running viruses in vmware... by IamTheRealMike · 2004-09-07 02:10 · Score: 1

What, you'd prefer it to trash your home directory instead? ;)
Re:More "fun" than running viruses in vmware... by NuclearDog · 2004-09-07 12:21 · Score: 1

su isolate
wine my_virus_executable.exe

I keep a seperate account on my machine specifically for running untrusted programs, so no worries for me.

ND

--
This statement is forty-five characters long.

virus by spotplace · 2004-09-07 01:37 · Score: 5, Interesting

Windows 98 has largely been ignored by the virus writers for the past two years... The worms this year that took down my school districts entire network of w2k machines didnt harm the windows 98 machines at all!

Re:virus by ciroknight · 2004-09-07 02:01 · Score: 4, Interesting

Funny, we had the opposite take affect at our school district. We migrated all of the machines we could to Win2k (some were just not powerful enough, sadly), and then got hit by a virus that thrashed the remaining Win98 systems, but left the Win2k machines completely alone. Needless to say, it was an older virus that someone brought in on floppy, but the effect nonetheless was devistating for quite a while. It also seems that the Win9x virus protection programs weren't as effective at scanning the floppy's on mount, verses the Win2k scanners that worked flawlessly for us (Norton for both, 2k3 on the Win2k machines, 2k1? on the Win98 machines).

--
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush
Re: virus by Alwin+Henseler · 2004-09-07 02:48 · Score: 4, Interesting

Yes, still running Win98 here, and I have the same experience. Visited Windows Update after install, then stripped out IE (98lite), full backup, use Mozilla, regularly updated virusscanner, and rarely run binaries fresh of the 'net. Result: last worm infection was long ago (on a LAN party), lockups are rare, no weird problems of any kind.
I guess a major factor is that many exploits are created by reverse engineering patches. As Microsoft has ended active support for Win9x systems, that also means no new patches for hackers to reverse engineer. Then there was this source code leak, wasn't it Win2k source code? So different code from what's in Win9x. And as Win9x systems are replaced with Win2k/XP, their smaller market share makes Win9x a less interesting target.
Re:virus by russint · 2004-09-07 02:49 · Score: 2, Funny

One more reason to get rid of all those ancient floppy thingies.

--
^^
Re: virus by Anonymous Coward · 2004-09-07 06:09 · Score: 0

I guess a major factor is that many exploits are created by reverse engineering patches.

That's what Microsoft says, but I don't buy it.

There are plenty of 0-day exploits out there which the public (including security@microsoft.com) never gets to see. Actually, it being patched is usually around the time the exploit gets leaked, because it's no longer so useful and someone wants the credit for 'discovering' it...

That said, yes--responsible administration of a Win 98 SE box can leave it relatively secure (at least, compared to Win XP)

On duty, 24/7 by p0 · 2004-09-07 01:39 · Score: 5, Funny

From TFA :
He is the only full-time staffer among the 30 ISC handlers who span the globe and are on duty 24-7. The rest are volunteers who take turns watching over the Internet. Most have other jobs and aren't expected to be awake for their entire 24-hour shift.

Who the hell is this Ulrich guy? R2D2?

--
This is my sig. There are thousands more, but this one is mine.

Re:On duty, 24/7 by Big+Nothing · 2004-09-07 02:11 · Score: 3, Funny

"Who the hell is this Ulrich guy? R2D2"

Funny you should ask...

Here's a pic of Ullrich and here's one of R2D2. Although the picture of R2D2 is a bit old (taken june 12:th, Long Time Ago), it's still obvious that the two are identical or that I am full of shit.

QED.

--
SIG: TAKE OFF EVERY 'CAPTAIN'!!
Re:On duty, 24/7 by Anonymous Coward · 2004-09-07 15:30 · Score: 0

TODO: add /AT/ to next build

Virus naming conventions by AndroidCat · 2004-09-07 01:40 · Score: 5, Funny

Does anyone really remember the difference between MyDoom-O and MyDoom-N? Perhaps they should start using first names like real storm centers do for tropical storms/hurricanes. They could issue warnings about incoming class 5 virus MyBad-Kevin.

--
One line blog. I hear that they're called Twitters now.

Re:Virus naming conventions by Anonymous Coward · 2004-09-07 02:40 · Score: 0

Residents of [Insert_Town] are today picking up the pieces after the devistating DOS attack which began early this morning.
Linux hippies were overjoyed at watching [Insert_Unliked_Corp]'s computer systems melt.
Symantec labs confirmed that this outbreak has all the hallmarks of the much feared W32.Slashdot-Taco@mm attack.
Re:Virus naming conventions by c0p0n · 2004-09-07 03:06 · Score: 2, Funny

Nope, because you would have to name the viruses with female names. We the /.'ers have enough problems to get a girl, I don't wanna know what could happen if they think that we geeks are male chauvinists...

--

Your head a splode
Re:Virus naming conventions by Anonymous Coward · 2004-09-07 03:16 · Score: 0

Female names like with Hurricane Ivan, right? (They changed the rules several years ago to allow boy hurricanes.)

Three links I just can't live without as an admin: by AcquaCow · 2004-09-07 01:41 · Score: 5, Informative

SANS Internet Storm Center
Provides current Internet port graph history and advisories

CERT's Vulnerabilities page
Provides current Internet virus history and news.

Keynote Internet Health Report
Provides a table of ping times between various Internet backbones and providers. Great for checking if it's your ISP, or the backbone they are attached to that's having a slow day.

I advise everyone to check these out, as they provide a great wealth of information in a nice organized format.

--

up 12 days, 22:30, 2 users, load averages: 993.20, 994.21, 994.56
*makes note to limit user processes...

Re:Ethereal is for the weak by Timesprout · 2004-09-07 01:42 · Score: 4, Funny

snort is for big girls blouses.

Real admins plug the network cable directly into their brains to perform packet analysis

--
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe

Re:The difference between this and real storm chas by no+reason+to+be+here · 2004-09-07 01:43 · Score: 3, Funny

Real storm chasing leads to really cool pictures.

Internet storm chasing leads to porn.

You mean to say porn isn't really cool pictures?

--
my pet machine

The Storm Center is excellent by Saint+Aardvark · 2004-09-07 01:43 · Score: 4, Informative

One of the first things I check out every day is the Storm Center's diary. Between that, and Microsoft's security page, and SecurityFocus, and Infosecdaily.net, I've got more than enough paranoia (I hope...) to make it through BugTraq and Full Disclosure.

What about the rest of you? What links do you check out, and what am I missing?

--
Carousel is a lie!

Re:The Storm Center is excellent by Anonymous Coward · 2004-09-07 01:52 · Score: 0

I check out /. and let the Windows update and automatic virus scanner update work their magic.

I don't have to be paranoid, you see, I don't turn those protective measures off in the first place. But then again, I'm not an 'expert' who is constantly getting hit by these viruses and worms.
Re:The Storm Center is excellent by Anonymous Coward · 2004-09-07 02:04 · Score: 1, Funny

Full Disclosure is my favourite. Their archives even contain traffic from 2005 and 2006. I can read about vulnerabilities full two years before they are discovered.
Re:The Storm Center is excellent by presmike · 2004-09-07 02:54 · Score: 2, Informative

I use http://www.dailyrotation.com/ You can customize which sites it draws headlines from. Saves me tons of time by having everying all in one place.

--
presmike
Re:The Storm Center is excellent by elwing · 2004-09-07 03:02 · Score: 1

I usually let vulnwatch deliver "important" information to my mail box. I don't keep on top of 0-day vulns any more, so vulnwatch is good enough for me. SANS @RISK is another mailing that's useful, although sometimes out of date.
Re:The Storm Center is excellent by El+Volio · 2004-09-07 04:25 · Score: 1
I have a set of tabs that I load every morning precisely for this; some of them are:
- ISS GTOC
- myNetWatchman (another perspective on port activity)
- NIPC Critical Infrastructure (updates are spotty but sometimes interesting)
- US-CERT Current Activity (often a tad behind)
ISC is definitely the main one to get but these are useful. I didn't list virus sites but those may be useful as well depending on your environment.
--
"You can never have too many elephants on your team."

Re:SuSE and VMware by UnderAttack · 2004-09-07 01:44 · Score: 2, Informative

Get the latest VMware build, and check the vmware community forums. But the latest build I downloaded installed without a hitch on Suse 9.1 running on an AMD64 system.

--
---- join dshield.org Distributed Intrusion Detec

Re:Ethereal is for the weak by Anonymous Coward · 2004-09-07 01:44 · Score: 5, Funny

Real admins plug the network cable directly into their brains

You mis-spelled brains. Its spelled 'ass'

I'm sure today will not be a typical day.. by craznar · 2004-09-07 01:46 · Score: 4, Funny

If slashdot lives up to its reputation, I can imagine that today will not quite follow the usual pattern for the ISC.

--
EMail: 0110001101100010010000000110001101110010 0110000101111010011011100110000101110010 0010111001100011011011110110

Re:Ethereal is for the weak by Anonymous Coward · 2004-09-07 01:47 · Score: 0

and its one of the BOFH's "special" cables

Zaaaaaaaap!

Re:The difference between this and real storm chas by Mark+Hood · 2004-09-07 01:52 · Score: 0, Offtopic

Hopefully they're really hot pictures.

Sorry.

Mark

--
Liked this comment? Why not buy me something nice

Small code ... ? by thrill12 · 2004-09-07 01:58 · Score: 5, Interesting

From the article:
"It's amazing how these virus writers get such small code," Ullrich says. "They should be working for some of the commercial code vendors."

Why not: s/should/could
And for the conspiracy-minded: s/working for/commanded by
Really twisted addon to the latter: s/code vendors/anti-virus vendors

Another episode in "preaching to the converted".

--
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd

Re:Ethereal is for the weak by vwjeff · 2004-09-07 02:05 · Score: 3, Funny

Real admins plug the network cable directly into their brains to perform packet analysis.

Real admins don't need the cable. They are already one with the network.

... and a nice Ethereal add-on... by m0rningstar · 2004-09-07 02:10 · Score: 5, Informative

... is Packetyzer, available from Network Chemistry http://www.networkchemistry.com/products/packetyze r/.

Has some neat additional features, such as conversation tracking and I believe it has a few more decodes. Only for Windoze, however, thus encouraging the VMWare machines.

Redefining protocols? by little_fluffy_clouds · 2004-09-07 02:11 · Score: 4, Interesting

From the article...

Like previous versions of MyDoom, this one too seems to be listening on certain ports for commands. Ullrich pings each port, but the virus does not react.

That's a neat trick.

I guess they mean "ping" as in "connected to a TCP or UDP port in some manner", and not the usual "send ICMP ECHO_REQUEST", which I don't believe has anything to do with "ports".

Ah, journalism.

--
What were the skies like when you were young?

Re:Redefining protocols? by Anonymous Coward · 2004-09-07 04:25 · Score: 0

I think you're splitting hairs. I "ping" co-workers. Submarines send "pings" for range finding. And really, isn't the submariner term the real source of the internet acronym? And in that sense, "ping" is just a sound, e.g. an engine can "ping" too.

I take "ping" to mean "check" rather than "create an icmp packet and expect a response". It's far shorter and gets the point across, and you don't sound like a wordy pedantic ass when you use it.
Re:Redefining protocols? by Anonymous Coward · 2004-09-07 14:54 · Score: 0

Ah, pedanty.
Re:Redefining protocols? by g-san · 2004-09-07 17:27 · Score: 1

And really, isn't the submariner term the real source of the internet acronym?

Packet Inter Net Groper.

As long as the hairs are splitting, I would never ping a port, but I might try to open a connection to it. You ping a host, you connect to a port. UDP is another story.

thats SuSE and _not_ SuSe by Anonymous Coward · 2004-09-07 02:11 · Score: 0

learn the meaning of company and product names first, before posting slashdot stories.

--
ignorants

Re:thats SuSE and _not_ SuSe by cuzality · 2004-09-07 03:08 · Score: 1

Actually, these days it's SUSE.

See: SUSE LINUX
Re:thats SuSE and _not_ SuSe by angrykeyboarder · 2004-09-07 08:27 · Score: 1

Either way, it's still unpronounceable. ;-)

--
Scott

©20014 angrykeyboarder & Elmer Fudd. All Wights Wesewved

Re:Similar Article by UnderAttack · 2004-09-07 02:13 · Score: 4, Informative

don't click on the link unless you want your cube mates stare at you ;-)

--
---- join dshield.org Distributed Intrusion Detec

Re:Ethereal is for the weak by Anonymous Coward · 2004-09-07 02:15 · Score: 1, Funny

Real admins plug the network cable directly into their brains to perform packet analysis

I really don't want to know what type of viruses you have!

Re:Similar Article by REBloomfield · 2004-09-07 02:20 · Score: 1

yeah, ditto. what gob shite modded that informative? or is that some kind of switchable proxy miror?

Re:Three links I just can't live without as an adm by stienman · 2004-09-07 02:22 · Score: 1

Those are great and all, but where do I go when Slashdot goes down?

-Adam

Re:Ethereal is for the weak by julesh · 2004-09-07 02:42 · Score: 1

Real admins plug the network cable directly into their brains to perform packet analysis

You mean like this?

Mirror by LiquidCoooled · 2004-09-07 02:46 · Score: 1

http://www.google.co.uk/search?q=cache:jo3aRe29uHs J:slashdot.org/+&hl=en

i know, i know...

--
liqbase :: faster than paper

Since when... by mikrorechner · 2004-09-07 02:48 · Score: 2, Insightful

...are the "commercial code vendors" interested in small code size?

--
"Oh, a lesson in not changing history from Mr I'm-my-own-Grandpa." - Dr Hubert Farnsworth

Another good product is.... by callipygian-showsyst · 2004-09-07 02:48 · Score: 1

Microsoft's "Virtual PC" for Windows. It gives you a complete virtualized PC that you can run on top of Windows. We use it a lot to test installs, to give ourselves a "clean machine" to make sure there are no dependencies that we didn't think of, and to test unknown software.

--
Best Buy can have you arrested

Re:Another good product is.... by haffi · 2004-09-07 03:45 · Score: 1

To bad that:

"Virtual PC 2004 does not support universal serial bus (USB) connections. "

(From the online help for Virtual PC 2004)
Re:Another good product is.... by Proteus · 2004-09-07 03:45 · Score: 1

Microsoft's "Virtual PC" for Windows. It gives you a complete virtualized PC

Well, not complete. Virtual PC is great if you need to run multiple versions/copies of Windows for testing purposes. However, VirtualPC isn't a complete VM -- if total isolation is required, Virtual PC isn't a good choice. However, if you don't need the total isolation of something like VMware, Virtual PC will probably work (and it performs better than VMware because it's not a complete VM).

I use VMware for isolation testing (malware, patches, &c.), but Virtual PC for version-compatibility testing (i.e. "Will this XP software work on our 2k machines?").

--
We may not imagine how our lives could be more frustrating and complex—but Congress can. – Cullen Hightower
Re:Another good product is.... by Anonymous Coward · 2004-09-07 07:54 · Score: 1, Informative

I am sorry, but you have been misinformed. Virtual PC is every bit as much a full virtualization as VMware. VMware and some Linux types seem to try to perpetuate the this incorrect meme.

As for performance, although Virtual PC may have marginally better performance on Windows OSes than VMware, under Linux OSes, the reverse is often true. The products are truely very similar on the desktop. VPC has slightly better general compatibility, and VMware has an edge in USB and network configurability, either of which may affect your specific choice.

VMware can host on Linux. VPC cannot. (Although VPC images may also be run under OS/2 and Mac OS, these alternatives do not seem to be attractive to the vast majority of the target virtual machine audience).

Elsewise, from the vast majority of perspectives, these two are interchangeable.

Forecast by dr_dank · 2004-09-07 02:50 · Score: 4, Funny

from the Internet Storm center. Tonight, expect a high pressure system of script kiddies from the northeast to make the morning telecommute messy. Tomorrow, scattered DDOS showers, high of 10000 bots. Now, here's Glenn with sports.

--
Where does the school board find them and why do they keep sending them to ME?

Re:Three links I just can't live without as an adm by Ice_Balrog · 2004-09-07 03:04 · Score: 2, Informative

For Linux users, I highly recommend Linux Security to keep up on current advisories.

--
#include "sig.h"

Re:Ethereal is for the weak by Anonymous Coward · 2004-09-07 03:06 · Score: 0

"big girls blouses"???

( . Y . )
That conjures up mental images of pr0n.
No wonder you scored high for off topic!

Re:Similar Article by Mant · 2004-09-07 03:08 · Score: 2, Interesting

This is something like the third article where someone has posted that link, then it has been modded up as informative.

Maybe a lot of Slashdotters don't pay attention when they Mod, but it smells to me of some organised trolling.

Re:Similar Article by Anonymous Coward · 2004-09-07 03:26 · Score: 1, Interesting

I'd guess organised trolling - responses pointing out the NSFW link have been modded down too.

Hahahhaha by brennz · 2004-09-07 03:32 · Score: 2, Interesting

The first word that caught my attention was the word "handler".

To paraphrase Dave Aitel, "handler = someone without a CS degree".

$ans is all about cash. That is why their classes are packed to the brim, so people can watch powerpoint presentations...

(yes I have attended one)

Half of the SANS hardening guides were ripped straight from the US government (NSA/DISA STIGs). No credit given either btw.

Re:Hahahhaha by pbemfun · 2004-09-07 03:47 · Score: 2, Informative

Obviously you didn't pay much attention in the class or attended a really bad one. I've attended a few SANS courses, and while they are expensive, they are worth every penny IMO. Every instructor I've had has gone beyond whats on the PPT presentations.
Re:Hahahhaha by Anonymous Coward · 2004-09-07 04:22 · Score: 0

Guess you didn't make the cut ;-). Not everyone with a CS degree qualifies to be a handler, or for that matter is able to pass a SANS/GIAC certification.
And as far as the '$sans is all about cash': Find another training provider that offers so much back to the community for free. (@RISK mailing, the ISC of course, top 20 list, SCORE project, support for cisecurity.org and more.)
Re:Hahahhaha by buffy · 2004-09-07 04:29 · Score: 1

So, what'd you do, go only to Track 1? Not that I'm saying that course is bad by any means, but it is only an introduction. The other tracks present far more information than is just included in the PPTs. SANS seems to use PPTs for just what they were designed for--as outlines to guide the discussion/presentation, not the full content.

The GIAC certifications are also one of the few cert programs that I think are worth pursuing. You have to prove a decent command of the material before you can complete the cert.

As for The Dave Aitel quote, what the hell? First off, who cares. It's not like most CS programs give a shit about packet analysis. That skill is usually home grown out of the interest/need of a specific individual. Regardless, I think most of the handlers do, in fact, have degrees, with a bunch more than just undergrad.

-buf
Re:Hahahhaha by brennz · 2004-09-07 07:56 · Score: 1

you should have at least mentioned your membership in the ISC so everyone would know you are biased.
Re:Hahahhaha by brennz · 2004-09-07 08:52 · Score: 1

$ans is all about cash.
Re:Hahahhaha by buffy · 2004-09-07 12:55 · Score: 1

Your point being?
Northcutt is one guy. Don't know of the actual situation being described, but there are more holes in that post than a piece of coagulated swiss dairy product.
SANS _is_ a non-profit. It does pay it's people (most of the handlers are volunteers--so don't be too big of a tool, please.) and it's speakers, and has a heck of a lot of infrastructure to support. All things that cost $$. They're not the only non-profit org that actually makes (and then uses) a fair amount of money. Take a look at the annual budget of the Red Cross!
Back to your original message:
The first word that caught my attention was the word "handler".
To paraphrase Dave Aitel, "handler = someone without a CS degree".
I took a bit of issue with this statement. You have yet to back it up with anything useful. Do you even know any of the handlers? What does it matter to you re: their degree, and how is it even relavant to the topic?
$ans is all about cash. That is why their classes are packed to the brim, so people can watch powerpoint presentations...
(yes I have attended one)
They're packed b'cause they're good. If you didn't get anything out of it, then perhaps there's something (someone) else at fault. Ahem.
Half of the SANS hardening guides were ripped straight from the US government (NSA/DISA STIGs). No credit given either btw.
No they weren't. Prove otherwise, or stop slandering a good organization of white hats.
Your original post is bullshit, and you back it up with more bullshit. Posting a link to an e-mail some guy wrote==bullshit. Got anything more useful? If not, please don't even bother to reply.
-buf
Re:Hahahhaha by welshwaterloo · 2004-09-08 00:35 · Score: 1

I know this discussion is a day old, but I wanted to post in case anyone read your comments and accidentally thought you knew what the fcuk you were talking about.
Just to clear the air - I am in no way affiliated with SANS, I just attended one of their classes recently.
$ans is all about cash.
Now, clever use of the dollar sign I agree - sure to lend much needed credibility to your ideas, but listen:
Where does it say on their site that SANS is a charitable organization dedicated to bringing practically free training to all??
Nowhere, you retard. SANS courses are mildly expensive, but you get what you pay for. I attended 6 days of training for about £2000.
Gee Bob, that's a lot of money! Sure it is, but when you do a little math [can you?] you see that per day - it's no more expensive and actually a deal cheaper than other technical training.
'Other technical training' companies also don't offer an enormous wealth of information, reports & step-by-step guides in their reading rooms. They don't partner with the FBI & Scotland Yard to help advertise the biggest risks. They don't give out software to benchmark the security of your workstations.
That is why their classes are packed to the brim...
Two frickin guesses why their classes are always packed to the brim. *smacks head*.
... so people can watch powerpoint presentations...
Shit! Hold the front page! Training Company Uses Presentation Package To Present Materials To Attendees.
Those bastards.
Oh, oh - wait. It's ba$tards, isn't it?
(Incidentally, my class had a two hour hands on workthrough of the day's material after the full day class.) The money grabbing scum.
If you've got beef with them, tell it straight - just don't go spreading fud.

Re:Hahhaha by Anonymous Coward · 2004-09-07 03:35 · Score: 0

That's not "Offtopic" at all. It's the very symbol for the topic.

Why is a larva the symbol for "Worms"?

OT: your .sig by JerkBoB · 2004-09-07 03:42 · Score: 1

up 12 days, 22:30, 2 users, load averages: 993.20, 994.21, 994.56
[*makes note to disable fork()]

That is one of the funniest .sigs I've ever read on /.

Still chuckling.

--
A host is a host from coast to coast...
Unless it's down, or slow, or fails to POST!

Re:Three links I just can't live without as an adm by sosuke · 2004-09-07 04:01 · Score: 0

umm, is the sans site not firefox compatible? thats pretty funny

Re:Ethereal is for the weak by MrNemesis · 2004-09-07 04:25 · Score: 1

This is actually a very good security measure. No-one is going to attempt to sniff the network after *that*

--
Moderation Total: -1 Troll, +3 Goat

Re:Similar Article by Anonymous Coward · 2004-09-07 05:21 · Score: 0

Maybe a lot of Slashdotters don't pay attention when they Mod, but it smells to me of some organised trolling

I would like to nominate Mant for the No Shit Sherlock Award of the year! Taking obvious clues and producing even more obvious conclusions merit this high award.

You shall now be known as Captain Obvious!

Re:Similar Article by 0x0d0a · 2004-09-07 06:03 · Score: 1

Nah. We just need a better trust system.

--
May we never see th

Re:Similar Article by Anonymous Coward · 2004-09-07 06:18 · Score: 0

Why? The NSFW reminders are just as offtopic as the disgusting link posts themselves.

Worms topic icon... by Gnividon · 2004-09-07 06:31 · Score: 1

..is a caterpillar, not a worm.

DON'T click the link in parent by 6Yankee · 2004-09-07 07:45 · Score: 1

Filth, pure filth. Don't say nobody warned you.

SAY NO TO DISGUSTING LINKS! by Anonymous Coward · 2004-09-07 08:17 · Score: 0

Sign the petition to get rid of these nasty websites from the internet over at Tech News Live!

caterpillars aren't worms by sjalex · 2004-09-07 09:26 · Score: 1

you insensitive clod!

My 'ounce of prevention' solution... by iamcf13 · 2004-09-07 10:49 · Score: 1

is at this URL.

Why use products like DeepFreeze after the malware has run and (irreperable?) damage is done when you can stop the malware from running in the first place.

Since malware by email is extremely popular, my approach simply treats all file attachments as 'text files'. 'Running' a text file on an uncompromised machine will cause the file to be loaded into another (trusted?) program.

These 'text files' can be safely handled, scanned for malware by trusted antivirus software, then deleted if infected or renamed back to their original extention.

As the old saying says:

An ounce of prevention is worth a pound of cure.

Why not focus on malware that doesn't use email to spread itself around and solve that problem instead?

Re:Similar Article by Anonymous Coward · 2004-09-08 06:03 · Score: 0

In case anyone is interested, that site appears to retrieve a copy of your clipboard, so be careful when visiting.

Slashdot Mirror

Day in the Life of the Internet Storm Center

123 comments