Hardware Firewall On a USB Key

An anonymous reader writes "An Israeli startup has squeezed a complete hardware firewall into a USB key. The 'Yoggie Pico' from Yoggie Systems runs Linux 2.6 along with 13 security applications on a 520MHz PXA270, an Intel processor typically used in high-end smartphones. The Pico works in conjunction with Windows XP or Vista drivers that hijack traffic at network layers 2-3, below the TCP/IP stack, and route it to USB, where the Yoggie analyzes and filters traffic at close-to-100Mbps wireline speeds. The device will hit big-box retailers in the US this month at a price of $180." Linux and Mac drivers are planned, according to the article.

Comments

Not really a hardware firewall

[dreamchaser]

A true hardware firewall wouldn't have to hijack traffic via a driver. It would have it's own ethernet port and would inspect data before it even touches the network stack on the host OS.

A bit hyped up if you ask me.

Re:Not really a hardware firewall

[TheRaven64]

Why not just put an ethernet controller into it, and use it as a USB network adaptor?

Re:Not really a hardware firewall

[larkost]

Except that all of your traffic is now going over your USB port twice... and the USB port is your most processor-intensive I/O. I have no idea how the numbers will work out... but there is a good chance that this will eat a lot of processor time.

Re:Not really a hardware firewall

[kasperd]

Why not just put an ethernet controller into it, and use it as a USB network adaptor?

I think that is exactly the point the grandparent was trying to make. If it had an actual ethernet interface you would only have to transfer the packets over the USB interface once, thus you'd reduce the load on the machine. You'd also get better security since the machine would no longer be connected to the network without going through the firewall. You'd avoid hacking the network stack, and the result would be something working on more systems without the need for special drivers. And you'd free up the ethernet port on the machine, so it could also be used in situations where the machine did not have exactly as many ethernet connections as you'd want. Basically adding a real ethernet interface to this gadget would have increased its value by at least a factor of two.

odd

[otacon]

Did anyone else find it odd that it runs linux, but doesn't actually work with a linux box, but only with a windows one?

Re:odd

[Josiah_Bradley]

If it's running Linux then you can probably get the same apps it's running and install them on your Linux machine. And if your already running Linux you probably don't need a firewall for windows anyway...

Why would I want this?

[morgan_greywolf]

I mean, increasingly, firewalls are being combined into multipurpose devices that provide NAT, Web serving, DMZ, VPN, media streaming, wireless access, etc. I mean even the lowly Linksys WRT54G, available for ~$50 USD almost anywhere, supports VPN, provides NAT, DMZ, UPnP capabilities, rudimentary web filtering, and has a built-in wireless access point. I mean, this thing doesn't even support wireless, which would make it useful for laptops, etc.

IOW, someone tell me why I should care?

Re:Why would I want this?

[richardtallent]

Just like software firewalls, this is just snake oil for feeble-minded people who don't realize that firewalls are for blocking access *between* networks, not for closing ports that shouldn't be open in the first place on individual machines.

Re:Why would I want this?

[fishybell]

According to their nifty flowchart it supports whatever windows supports. It takes the inbound traffic after the hardware receives it, but before the TCP/IP stack. It sits in the same place as a software firewall, but offloads the calculations and filtering to the dongle's cpu.

Why would anyone want this? Well, a router that combines firewall, nat, vpn, etc. is fine for home use, but what about the coffee shop? For a mobile computer having a on-computer firewall is a must. As far as why anybody would choose to use this over any software firewall... I can only assume it's for people who don't want yet another piece of software hogging their cpu. Most software firewalls aren't that intensive, but if you're looking to free up that 3-5% of your resources, hardware is the way to do it. Of course, without a benchmark showing a difference, the actual performance increase is lost in the market speak.

Re:Why would I want this?

[Kam Solusar]

Heck, for half that price you could buy a little router and carry it with you! And in many parts of the world you could even get a little guy to carry it for you too!

Not too bad

[NickisGod.com]

My favorite is the "Layer-8" security engine (Patent pending).

That's where all of my clients' problems come from.

-Nick

Marketing Gimmick

[dreamchaser]

It's a marketing gimmick. At the very best it's a software firewall with a (not really needed) co-processor to do packet inspection.

Personally it looks like a waste of money to me.

from the article

[MarcoAtWork]

Once running, the Pico establishes an SSL (secure sockets layer) http connection to Yoggie's central servers, where it checks for updated firewall policies and rule sets, Touboul said. It subsequently checks every every five minutes, by default.

so basically this means allowing a black box to hijack completely my IP stack, a black box which phones home every 5 minute and arbitrarily downloads software updates... just think if this company's server was compromised even for an hour, given that all of the devices update every 5 minutes you could compromise pretty much all of them at the same time.

Not to mention that if this device can insert a 'low level driver' that hijacks the IP stack, I'm sure a virus will come up sooner or later that will re-hijack this and compromise it. The only really 'safe' hardware firewall is, guess what, a completely separate hardware firewall (like my custom LEAF install on my old p3-500), this sounds like those 'one time pad, guaranteed!' crypto products we often lambast here on /.

Re:Why?

[rickkas7]

Software firewalls are hardly performance hogs.

You've obviously never used Norton Internet Security 2007 or McAfee Internet Security Suite 2007.

USB2, yes.

[RingDev]

Uhh, USB2 runs at 480Mbps and in practice can push 40MBps (320Mbps) for bulk transfer (ie USB Hard drives).

So for them to claim that this device can push 100Mbps really isn't that surprising. So long as the little processor can burn through the logic checks fast enough, the bus can definitely handle the load.

-Rick

Re:Troll!

[Pojut]

They are like you in every way, except for one thing: They remember to actually click "Post Anonymously"

Re:Hardware firewall definition

[Anonymous Coward]

A hardware firewall is a firewall that runs on separate hardware from the hosts that it protects. In other words, it's a software firewall on a dedicated machine, which may or may not have specialized packet-filtering hardware. The "hardware/software" distinction made by marketeers isn't really important; more significant is the distinction between "network firewalls" and "host firewalls". Network firewalls are separate devices that are capable of filtering all traffic entering or leaving a network of multiple computers; host firewalls are limited to the traffic entering or leaving a single host, and are normally tightly integrated with that host's operating system.

This gimmick consists of a coprocessor and some low level operating system drivers, and appears to be primarily designed as a host firewall. It might be useful in a network firewall, it the operating system components could be ported to an operating system adequate to the task.

holy hackable hardware, batman!

[radarsat1]

firewall schmirewall, I can't wait to see what "wrong" things people do with this.. a Linux machine on a USB stick? For 180$? Awesome.