Slashdot Mirror
Hardware Firewall On a USB Key
An anonymous reader writes "An Israeli startup has squeezed a complete hardware firewall into a USB key. The 'Yoggie Pico' from Yoggie Systems runs Linux 2.6 along with 13 security applications on a 520MHz PXA270, an Intel processor typically used in high-end smartphones. The Pico works in conjunction with Windows XP or Vista drivers that hijack traffic at network layers 2-3, below the TCP/IP stack, and route it to USB, where the Yoggie analyzes and filters traffic at close-to-100Mbps wireline speeds. The device will hit big-box retailers in the US this month at a price of $180." Linux and Mac drivers are planned, according to the article.
A true hardware firewall wouldn't have to hijack traffic via a driver. It would have it's own ethernet port and would inspect data before it even touches the network stack on the host OS.
A bit hyped up if you ask me.
Did anyone else find it odd that it runs linux, but doesn't actually work with a linux box, but only with a windows one?
In a world of acronyms, the words are the real victims.
I mean, increasingly, firewalls are being combined into multipurpose devices that provide NAT, Web serving, DMZ, VPN, media streaming, wireless access, etc. I mean even the lowly Linksys WRT54G, available for ~$50 USD almost anywhere, supports VPN, provides NAT, DMZ, UPnP capabilities, rudimentary web filtering, and has a built-in wireless access point. I mean, this thing doesn't even support wireless, which would make it useful for laptops, etc.
IOW, someone tell me why I should care?
My blog
My favorite is the "Layer-8" security engine (Patent pending).
That's where all of my clients' problems come from.
-Nick
I keep wondering how they put such a fast processor on a usb stick and then squirt bidirectional 100Mbps over the USB port. Sounds a lot like my former boss trying to convince me that our building would give us 100Mbps internet for only $50/month. I dislike misleading articles and I dislike misleading product descriptions even more.
It seems much more likely that there's an app on the USB stick tht is run by the windows machine making the USB stick just a different delivery mechanism than a CD/DVD. Probably way cheaper to produce, update and ship.
It's a marketing gimmick. At the very best it's a software firewall with a (not really needed) co-processor to do packet inspection.
Personally it looks like a waste of money to me.
so basically this means allowing a black box to hijack completely my IP stack, a black box which phones home every 5 minute and arbitrarily downloads software updates... just think if this company's server was compromised even for an hour, given that all of the devices update every 5 minutes you could compromise pretty much all of them at the same time.
Not to mention that if this device can insert a 'low level driver' that hijacks the IP stack, I'm sure a virus will come up sooner or later that will re-hijack this and compromise it. The only really 'safe' hardware firewall is, guess what, a completely separate hardware firewall (like my custom LEAF install on my old p3-500), this sounds like those 'one time pad, guaranteed!' crypto products we often lambast here on
-- the cake is a lie
You've obviously never used Norton Internet Security 2007 or McAfee Internet Security Suite 2007.
Uhh, USB2 runs at 480Mbps and in practice can push 40MBps (320Mbps) for bulk transfer (ie USB Hard drives).
So for them to claim that this device can push 100Mbps really isn't that surprising. So long as the little processor can burn through the logic checks fast enough, the bus can definitely handle the load.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
They are like you in every way, except for one thing: They remember to actually click "Post Anonymously"
Living With a Nerd
A hardware firewall is a firewall that runs on separate hardware from the hosts that it protects. In other words, it's a software firewall on a dedicated machine, which may or may not have specialized packet-filtering hardware. The "hardware/software" distinction made by marketeers isn't really important; more significant is the distinction between "network firewalls" and "host firewalls". Network firewalls are separate devices that are capable of filtering all traffic entering or leaving a network of multiple computers; host firewalls are limited to the traffic entering or leaving a single host, and are normally tightly integrated with that host's operating system.
This gimmick consists of a coprocessor and some low level operating system drivers, and appears to be primarily designed as a host firewall. It might be useful in a network firewall, it the operating system components could be ported to an operating system adequate to the task.
firewall schmirewall, I can't wait to see what "wrong" things people do with this.. a Linux machine on a USB stick? For 180$? Awesome.
Dear All, Yes, I am from Yoggie and its a pleasure and honor for me to provide some "internal" information: Some of you mentioned that you need 2 network ports to make a "real" Firewall. True, please refer to our web site: www.yoggie.com and find the Yoggie Gatekeeper. This product released few months ago comes with two network ports running same processor, same memory, OS and 13 application. Some of you, view Yoggie as a Firewall and compare it to Routers and access points: Please note that Yoggie is by far more than just a Firewall and in fact its like a set of enterprise security appliances packed in a miniature computer. Lets see what's in there: 1. FireWall, NAT, DHCP Server and client 2. Full snort implementation including IPS on top. VRT updates will come soon. 3. 4 transparent proxies: 2 for web: HTTP, FTP and 2 for email: SMTP and POP3 4. True File-Type detection agent so file type are detected by content analysis and not based on MIME or file extension! Compressed file - are uncompressed in real time before scanning!!! 5. Anti Virus agent - Kasperski! 6. Anti Spyware agent - both signature based and behavior based! 7. Anti Phishing - since it sees the web and email traffic - it can "close the phissing loop" and verify content/url. 8. anti SPAM - based on Mailshell engine. 9. URL CAT and parental control - based on SurfControl. 10. Layer 8 agent - performs content scanning to "above layer 7" applications, AJAX, VBS, JS, etc. to detect new and unknown virus (not based on signature). 11. MLA - Multi Layer Security agent - a new invention - event correlation in REAL TIME for all event from all other modules - to drastically reduce false positive of IPS and Layer 8 agent. 12. VPN Client. These applications take 35% - 45% of PC Windows CPU. More, one cannot find a commercial implementation of all these applications in one security appliance, even when it comes to a 1U, 2U or 4U appliance. Simply, no one yet managed to integrate layer 2/3 security with layer 7 and above layer 7 content analysis. Yoggie is a unique combination of 7-8 commercial different security appliances. Why did we come with the Yoggie PICO? and why after Gatekeeper: First, we wanted to provide the experts with a 2 network ports solution: we launched the Yoggie Gatekeeper. After we came with this great invention that one can implement an *almost* identical solution using *s-route driver* at the lowest level that still NAT (yes, this is the first NAT and DHCP service inside a protected driver and in between network layers) IP address so external IP address is different from IP addresses Windows application gets. This unique implementation is the only one capable stopping attacks such as "ARP cache poisoning" - something only hardware based firewalls can do. (will go via software firewalls). We absolutely agree that Yoggie Gatekeeper using two network interfaces provides the ultimate separation and isolation but we also know that Yoggie PICO unique "S-Route driver" is by far better than software firewall. Why we didn't add network port to PICO ? - we let this choice with the Gatekeeper (for people that absolutely requires two ports) and made an alternative with almost same security level but with a much smaller form factor (easy to carry)and using the existing network port in the laptop. Your comments and suggestions are welcome. SST.