Slashdot Mirror
Startup Prepares Cracker Attack Emulator
Startup.Blog writes "A startup company MuSecurity is shipping a product that emulates multitude of known attacks and integrates the security checks into quality assurance processes. The company 'will soon begin selling a new vulnerability assessment product that lets technology vendors and enterprise developers test their products with known hacker techniques, allowing them to fix bugs before products are put into use.'"
How is this anything new? There is open source (and closed) that has been available for a while that does this.
--
United Bimmer - BMW Enthusiast Community
So if you hook this up to a Windows box, does it blow up like the androids on the old Star Trek?
Slashdot - where whining about luck is the new way to make the world you want.
Mu Security would not say whether the product will be hardware- or software-based, but more details will be revealed in March, Furgerson said.
That's not very helpful. If we're talking a tool to check for security flaws already patched against, what good is that? Just keep your systems up to date. On the other hand, if we're talking about things like buffer-overflow checkers, then why not use an existing product?
This thing is going to have to be pretty darn impressive to actually find a niche other than people who don't know any better.
Javascript + Nintendo DSi = DSiCade
... and several other ones already axist.
I'd say that the only interesting thing about this announcement is an opportunity for geeks to analyse this new product and see if it contains any ripped off GPL'ed code.
FP.
Also FatPhil on SoylentNews, id 863
cracker sues Startup over piracy of cracker's trade secrets via emulation.
I read about this a couple days ago and spent some time on the company's site looking for an explanation of what they are doing that is so new. The answer I came up with is "Nothing". There is no information on their websites about specifc products or services. Looks like another snake-oil security startup.
There are other companies and even some academic groups (PROTOS from the University of Oulu, to name one) who have been doing real things in this area for years. There are also companies that take a source-code centric approach.
For several years now, there have been products that check for whole classes of vulnerabilities in applications. Such approaches are not limited to just known vulnerabilities in existing apps -- they check for common programming or configuration errors in custom applications as well. They are making it sound like checking for these things before systems go into production is a new concept. That's the whole point of security auditing.
Sorry, that was too easy. :)
While most crackers are pretty harmless, saltines are going to give you the most problem. Keep an eye out for Ritz as well, as I've personally had issues with keeping those out of my system.
If we all go visit their site at once will they see it as a DDOS? :-p
This is a cool idea, doesn't seem terribly novel to me though.
You can tell I'm an aries because of my ram.
How the hell are crackers and skiddies going to know what the company is about if they dont spell it ... mU53ur1+y
Does it call fed up employees who are just looking for someone to talk to, exploiting the conversation and getting valuable information necessary to break into the network? :)
Cool concept, but I wonder about how effective it'll be without good admins who know how to watch logs, set up honeypots when necessary, and train employees to shut up. Still, it could have it's uses.
"Better to be vulgar than non-existent" -Bev Henson
They are making it sound like checking for these things before systems go into production is a new concept.
You make it sound like hyperbole in marketting is something outrageous and previously unheard of.
It's a company, fer crissake. If it were an academic research group making out that they had invented a new concept, then that would be different and your criticism would be more valid.
If their product has no technical novelty, then your remarks should be directed at Slasdot editors for accepting it as News For Nerds. The company seems to be offering another competing product in this market. And that surely is A Good Thing.
"The question of whether machines can think is no more interesting than [] whether submarines can swim" - Dijkstra
"MuSecurity. We hack you first, so the hackers don't have to."
"Pre-root your box for only $19.95"
"Want a bot net? Have you own today!"
Oh, testing for exploits, not actually exploiting the box.. hehe.
Serious? Seriousness is well above my pay grade.
More "keeping up with the hackers" nonsense. How about we just leave nothing permitted that we don't already know is legit?
There's money to be made in treating cancer, but not curing it. And this is the IT equivalent.
vk.
Sounds like a vuln scanner. y0 spoonm :)
For those of you that want to emulate a cracker attack, I cannot recommended highly enough any of the ABBA albums out there. Turn that on amongst any non-crackers, and you will know rapidly how well things will hold up.
There are limits to this type of stress-testing, though - playing any "Rocky" movie will likely cause excessive bleeding from your ears. There's no reason to go overboard when cracker-testing.
In other news, the shares of the security company raised after it was leaked that Microsoft ordered dozens of vulnerability checkers.
Man beats MuSecurity by throwing his computer out of the office window, successfuly proving it cannot stop hackers against completely breaking the security. Movie clip at 11.
Almost all the staff is ex-Juniper. Talk about running off with corporate assets
Its the unknown ones you really have to worry about.
http://michaelsmith.id.au
...read the title as: 'Startup Prepares Cracker Jack Emulator'?
for the RoboAdmin! Yes! You can have your very own fully automated system administrator, and now New and IMPROVED with automated security checks! If you ever need help with your IT issues, simply chat with the RoboAdmin chat bot and you will start feeling better in no time!
...crackers' IP cannot be properly protected by law (DMCA) and patents.
The *only* way to protect virusses, spyware and other malware effectively from these kind of companies is through trusted computing, people. Go figure!
In Soviet Russia, product emulates YOU!!
N.B. mu is a nice Japanese Zen word which means emptiness of mind, or literally "nothing."
Paul Gillingwater
MBA, CISSP, CISM
damn white people, always hacking computers. we black folk, don't have none.
So what's with this "cracker" in the headline? And "cracker-in-a-box" is a Saltine.
Please stop trying to kidnap the English language. C'mon, Geeks are supposed to be efficient: "Cracker" already means too many other things to effectively assume a new mantle, especially one already being served in the global media with "hacker." Yes, we're all sad that we benign computer hobbyists have to call ourselves "benign computer hobbyists" instead of the far more edgy-danger-cool "hacker" as we could for about a week-and-a-half in 1994, but time -- and language -- marches on.
Seriously. Get over it. You're embarrassing the rest of us.
When I read the headline I thought this had something to do with saltines.
Non tam praeclarum est scire Latine, quam turpe nescire
-- Cicero
And I bet their biggest customer is .ro eh ? Does it also come with a copy protection ?
Slashdot Editor Duped by Guerilla Marketer
I thought there were a variety of products out there, some GPL'd that will do this same thing. Think nagios...
I demand that you provide more details of this revolutionary software product so that I may purchase 10,000 copies forthwith.
Lesson to Slashdot advertisers: why buy an ad, when you can just keep submitting stories about some blog entry that promotes your product until eventually one of them sticks?
If you were blocking sigs, you wouldn't have to read this.
Comment removed based on user account deletion
If this carries out attacks just as the real thing, isn't this the real thing and not an emulator? (I haven't RTFA of course)
Anyone else notice the ripped off Google Maps image on the 'Contact Us' page without credit?
A company that doesn't give credit where credit is due doesn't deserve money.
looks like a pump & dump.
100% agreed. In this headline it is particularly moronic, as one is misled to believe this is a tool for people developing copy protection.
MuSecurity looks like MicroSecurity (picture the little-mu greek character in front). Or, in ISO units, "very little security". Strange choice for a name.
The staff are the most important assets a corporation can have. Sadly (for the corporation), staff has free will, rights to exist, rights to apply their skills..
- AND -
the right to start working other places.
we don't need emulators to crack... Signed, a Cracka (aka "user")
NASCAR race post-race fights between fans (crackers) of different drivers. 'nuff said.
IronChefMorimoto
I'd prefer the term "Caucasian" or "White person." The term "cracker" is so insensitive. You clods.
Jeff Forristal did a really good analysis of source code instection tools at Secure Enteprise Magazine.
Enough of the fucking ballmer chair jokes.
Im no Microsoft fan but for fuck sake give it a rest.
It was funny at first but god damn it its so lame.
moron
"Instead, Mu Security's product performs a thorough and methodical analysis along the many lines of inter-dependencies that exist among protocols. Understanding how to create the right type and set of mutations needed to systematically expose potential vulnerabilities in highly interconnected applications and systems - identifying both existing and "day zero" threats - is a key part of Mu Security's breakthrough in determining the security readiness of such a wide range of systems. Marrying such capabilities to a platform approach allows such analysis to be comprehensive, efficient, and repeatable. The net result is that Mu Security's solution has already uncovered multiple day zero vulnerabilities in every system analyzed."
http://www.musecurity.com/
As mentioned previously, this sort of thing is being/has been done. One project I am familiar with is the Internet-scale Event and Attack Generation Environment (ISEAGE) project at Iowa State University.
Its webpage, has an overview of the project and documentation on its architecture and implementation. I think one of the key aspects of the project can be found in the overview: "Unlike computer-based simulations, real attacks will be played out against real equipment."
ISEAGE is approaching security from a real-world perspective, using real world devices. Sure, your software/hardware might be secure when the attacks are played against it; but is it secure when those attacks when there are dozens of attacks occuring simultaneously? What about when it is being hit by thousands of requests, or is under a DDoS attack? What happens when devices decide to start breaking the protocols, or the rules? What happens if a device physically fails? What is the effect of a device overheating during a DDoS attack? How do you simulate this/test for this other than hooking it up and hammering it with a DDoS attack?
This is the kind of information that is needed to prevent or mitigate an attack, but can't be found by reading code or running a scanner. How did the US figure out how to build rockets? We built some, they blew up, and better ones got built. The real world isn't the same as a lab.
Reading code is like reading the dictionary - you have to read half of it before you can go back and understand it.
Why does Slashdot continue with fruitless attempts to revise history by using the term "cracker"? It's not "cracker" and never has been. NEVER.
Just face it, there are criminal hackers, and there are ethical hackers. The same as there are criminal locksmiths (eg thieves) and ethical locksmiths.
If you want to try and change the term, at least don't lie about it and flame people when they quite rightly correct you.
...was took a script kiddie, and then replaced the kiddie part with more script.
The term has been around at least since the sixties.
Some of us remember past the 90s.
Before challenging an etymology, learn it.
If you're confused by the multiple meaning of phrases or words then you must have a hell of a time coding. And if you don't code, we don't care.
(score this as bait taken)
new security tool protects against top-posting on mailing lists.
http://goodluv.diaryland.com/bottompost.html the bottom post enforcer
Does this have anything to do with OpenBSD or Trustix Linux?
... oh you make me cry!
Windows, windows, windows
I guess you gotta see it and talk to them. I spent a couple hours last week with Kowsik (CTO/Cofounder of Mu) and one of my engineers and I was fairly impressed. They intend it's use only in a lab environment and for the depth and speed the box has its uses. It also packages some features and reporting that are well thought out and actually mirror operational realities and convenience.
What open source software does this? Mu is selling a security appliance which does object based protocol fuzzing. What could you possibly think holds a candle to it? Spike? Peachfuzz? Ya, right. These people have power relays for automated restarting, they have target monitoring, they can play man in the middle, and it's plug and play right out of the box. It's powered by XML for god's sake. A company can buy this thing, hook their device into it, tell it which protocol it speaks, and get canned protocol stressing out of the box by pressing a button. You know what else in the world does this? nothing. Nothing Open Source, nothing closed.
You're full of shit. Post one link to an open source fuzzer which treats protocols as object encapsulations, fuzzes them, and does so with zero configuration and full target monitoring.
What were you going to say? Nmap? Nessus? Do you even know the difference between protocol stressing and vulnerability assessment?
Fucking idiots on Slashdot getting moderated up for talking out of their assholes. It never fails. Solved the "noise problem" my ass.
Despite being moderated to the lofty score of 5 INSIGHTFUL, you couldn't be more full of shit if you spent an entire weekend eating helpings of creamy poop.
Nessus, Satan, and Nmap are tools used in vulnerability assessment. The first two use security signatures to look for known software bugs and either report or exploit them.
Mu is selling a security appliance which performs protocol stressing (aka fuzzing) on a known bunch of protocols. Other products in this category are Dave Aitel's (Immunity) Spike, Peachfuzz, a bunch of secret shit by HB Gary, well... there are a whole lot of them, but the important thing is this: they all suck dick.
Now these moo clowns, they've got a nice front end, a gui, a smart fuzzing engine... the whole nine yards. There is nothing like this on the market. Nothing open, nothing closed.
Now, I've used enough profanity to get myself moderated down, and keep you moderated up. And what's awesome is that you're totally wrong, and by being wrong you've totally warped everyone's perceptions of what's actually going on here. You've created anti-news.
And it's wonderful, really, to see the moderation system in action - creating fiction, promoting lies.