Slashdot Mirror
Fyodor's Top 100 Network Security Tools
TheViewFromTheGround writes "Fyodor of nmap fame has released a top 100 list of network security tools, based on a poll of the nmap-hackers list, each with a handy synopsis and useful information about source-code availablity and OS-compatibility. The last version of this survey was published in 2003."
Yeah, I know bury it...how soon you forget.
If we don't fight for ourselves no one will.
(end of post)
This seems like a promising tool.
It's called, "Right to innovate!"
"Snatching defeat from the mouth of victory on a daily basis."
I clicked on the "rootkit detectors" link and was intrigued by the fact that it doesn't list IceSword - I recall reading an article that IceSword was the only one that detected the HackerDefender rootkit.
In 2002, Fyodor was the victim of an impersonation attack by a Slashdot user who was posing as a woman. Fyodor sent an email to the fake "woman" in an attempt to solicit further conversation and a possible meeting. When the hoax was revealed, the hoaxer insulted fyodor (I believe the word was "wanker").
Fyodor responded by using information disclosure vulnerabilities in yahoo email to find the originating IP address of the Slashdot prankster (SumDeusExMachine) who was at the time a college student based on the Pacific coast. SDEM was using an open X server for windows, MI/X, with no security enabled. Fyodor quickly scanned SDEM's box, found the open X server, and attached to it, monitoring SDEM's life for nine hours. He took many screen shots of SDEM's machine and posted them to his web site, insecure.org.
A lot of personal information was revealed in these screenshots, including the existence and ip address of a "secret troll irc server", which was running an irc bot capable of tracking and posting new stories. Jamie McCarthy used the information disclosed by Fyodor's attack to log onto this server, discover the new-story-bot, and modify Slashdot to break the troll's new-story-robot.
So in short, Fyodor has an open record of malicious entry, and Slashdot's admins have used the information he has gleaned to combat Slashdot trolling.
What you have to understand is that illegal and malicious hacking won't land you in jail. The FBI won't prosecute interstate computer hacking unless there are $5000 or more in damages. In this case, there were no damages, rending the "crime" unprosecuteable. Whether this makes the perpetrator a whitehat, greyhat, or blackhat is an exercise for the reader.
Script interpreters = security tools? For that matter, why isn't VBS high on the list then; all sorts of degenerate virus authors have shown that VBS can be quite powerful (and do all sorts of interesting network bits too).
Golly, the guy trolls a noted security expert and gets haxx0red for it, and we're supposed to feel sorry for him?
Karma is a bitch, isn't it?
Would you pick a fight with somebody bigger than you?
If you do, and you get pounded into pulp, do you expect sympathy?
He got what he deserved; reaped what he sowed.
Personally, I use nmap quite often to examine my own systems and make sure services are up or that firewalls are blocking the right ports. I also use tcpdump (and, for more complex tasks, ethereal) very often when debugging network problems. Kismet, of course, is a tool no geek should be without. On almost any long car trip, kismet+gpsd+gpsdrive are running, logging networks.
It's freaking awesome that all these tools are available for free. Three cheers for their authors.
ttuttle is a rankmaniac
SDEM wasn't 5 years old. Young, yes, but old enough to know better. And he was playing an adult game with an adult, and he reaped an adult-level response.
If a 17 year old points a gun at me, I'm going to respond with deadly force.
Nope, no sympathy AT ALL. None.
Ethereal was renamed wireshark, and is #2 on the list.
Ah yes, thanks for reminding me. A change of name does not make ethereal/wireshark more secure, though. I am surprised that a tool with so many security problems is so popular among "security users".
Personally, I use nmap quite often to examine my own systems
I do the same thing. want to know what ip's your netowrk printers are set to without having to go to each run and print a config?
>nmap -p 9100 *your network*
I came to the datacenter drunk with a fake ID, don't you want to be just like me?
Oh, that reminds me... I set up Nagios on my school's network (just for the hell of it--I'm at a school where the sysadmin would appreciate the help instead of being scared about me knowing the intimate details of his networks and servers) and I used nmap to map out what servers, printers, and routers were on the network. I even managed to map out the point-to-point T1 we have to another office, and point out a couple bits of information that shouldn't have been lying around. Nmap is a great tool.
ttuttle is a rankmaniac
I believe every word of that story, just like I believe Trollaxor's other stories involving Gay sex between Eric Raymond and Richard Stallman and Alan Cox forking Linux kernel.