Ask Fyodor Your Network Security Questions 274
Fyodor is the driving force behind Insecure.org and the top-rated Nmap network exploration and security auditing tool. He's also involved in The Honeynet Project (and is a coauthor of the project's book, Honeynet: Revealing the Security Tools, Tactics, and Motives of the Blackhat Community). One question per post, please. We'll run Fyodor's answers to 10 of the highest-moderated questions as soon as he gets them back to us.
My Question... (Score:5, Interesting)
Work guidelines? (Score:3, Interesting)
If you could change one thing. (Score:5, Interesting)
Re:If you could change one thing. (Score:1, Funny)
It's the latest craze in blanket security contracts offered by major firms!
What is your favourite tool? (Score:5, Interesting)
One question though: in all these tools, which one is your personal favourite? (This excludes Nmap, of course).
Thanks in advance!
Re:What is your favourite tool? (Score:3, Interesting)
What is your opinion of this class of products in their ability to allow a network admin to be knowledgable about the security of their own network and respond to threats?
DMCA? (Score:5, Interesting)
libnet (Score:3, Interesting)
What's your ratio of love:hate mail? (Score:5, Interesting)
How much criticism do you have to deal with? And how does it compare to the kudos you receive, quantity-wise? Has it ever made you doubt what you're doing?
PS- Thanks. nmap proves its usefulness to me every day.
My security question (Score:4, Funny)
Security Problem (Score:4, Funny)
His IP address is 127.0.0.1
Any advice from Fyodor or the Slashdot community?
Re:Security Problem (Score:1, Redundant)
Re:Security Problem (Score:2)
Re:Security Problem (Score:5, Funny)
Re:Security Problem (Score:2, Funny)
Re:Security Problem (Score:4, Funny)
That always stops the 127.0.0.1 hacker
Security Updates (Score:5, Interesting)
Rus
Recent increases in anal-retentiveness... (Score:5, Interesting)
What do you think can be done to make scanning IP addresses/ports have less of a negative stigma? This is in the same sort of category as legit vs. illegit uses of anything else (P2P, whatever)--what's the rationale for punishing something that could maybe lead to criminal activity, and how can we make network scanning tools have practical uses again?
Re:Recent increases in anal-retentiveness... (Score:2)
This is interesting. I hate it when people put a computer on the internet, but freaks out when harmless packets reach it's network interface.
Re:Recent increases in anal-retentiveness... (Score:2, Insightful)
HTH.
Re:Recent increases in anal-retentiveness... (Score:3, Interesting)
People who have a webserver on port 80, which is out and open to the public because they had something to say. (unless they password it)
People who have a default web server install with a default page (the most common in those days of (not necessarily legal
Re:Recent increases in anal-retentiveness... (Score:2)
Re:Recent increases in anal-retentiveness... (Score:2)
Re:Recent increases in anal-retentiveness... (Score:2)
There can be no harm in scanning any ports. I'm not talking about ping death or DOS. I'm talking about a regular port scan.
It's like knocking on someone's door to see if they're home. No harm, no foul.
Who is going to determine your motive?
Nobody can, and nobody should try.
It is what you do after the scan that matters.
Re:Recent increases in anal-retentiveness... (Score:2)
Re:Recent increases in anal-retentiveness... (Score:2)
Re:Recent increases in anal-retentiveness... (Score:2)
Re:Recent increases in anal-retentiveness... (Score:3, Interesting)
Re:Recent increases in anal-retentiveness... (Score:2)
There are plenty of reasons that are perfectly legitimate to run a port scan on someone's network. it's no different from a search engine running bots. When you connect a computer to any network, it is understood that your computer can be scanned and possibly services will be used such as HTTP or open FTP ports. How, I ask you, is the parent of parent's port 80 scan any different from a windows box doing a NetBIOS scan, or for that mat
Re:Recent increases in anal-retentiveness... (Score:2)
Get root, use -sS TCP SYN stealth port scan (best all-around TCP scan).
---
While money can't buy happiness, it certainly lets you choose your own form of misery.
Re:Recent increases in anal-retentiveness... (Score:2, Interesting)
As I recall, I'd elected to use a less stealthy TCP scan because I wanted to be as aboveboard as possible, sorta like the LAN equivalent of yelling "Hey, anyone home?" from the sidewalk as opposed sneaking up and trying the doorknobs with a stealth SYN scan. =P
Re:Recent increases in anal-retentiveness... (Score:3, Informative)
But it's better to not be detected at all. Plus with a SYN scan you have deniability. The source address can be spoofed (even nmap will do it -- see decoy scan). Thus, it wasn't necessarily you that sent the packets.
RTFM (Score:5, Interesting)
FNG--Fscking New Guy
-Terminology, broad-brush concepts, checklists, good reference list
Suit
-Management concerns, planning
Expert
-Detail, performance considerations
Categories are arbitrary; others will segment the market differently. Mainly seeking recommended authors/titles. Full-on reviews too space consumptive.
The human element (Score:5, Interesting)
What tool(s) are we missing from our toolbox? (Score:5, Interesting)
Super-DMCA (Score:5, Interesting)
Here's [securityfocus.com] the article on it that ran in Slashdot awhile ago.
Basically, the law says you can't "assemble, develop, manufacture, possess, deliver, offer to deliver, or advertise" any device or software that conceals "the existence or place of origin or destination of any telecommunications service." - thus making honeypots, even when used to thwart illegal computer activity, are illegal.
Re:Super-DMCA (Score:3, Informative)
Re:Super-DMCA (Score:2)
Basically, the law says you can't "assemble, develop, manufacture, possess, deliver, offer to deliver, or advertise" any device or software that conceals "the existence or place of origin or destination of any telecommunications service."
Good heavens, that would even make every bog standard NAT and Proxy illegal!
Who writes these laws?
Re:Super-DMCA (Score:4, Insightful)
FFS, what a stupid question
Curious Yellow? (Score:5, Interesting)
IPv6 (Score:5, Interesting)
Re:IPv6 (Score:3, Insightful)
Not been adopted by whom?
No, most companies/endpoints haven't adopted it, but most of the major equipment manufacturers (Cisco, Lucent, etc) have and have equipment available for it. It's in use by the University/Research-only "Internet2" currently. The major backbone providers are in the process of slowly switching to it.
Sure, it'd be cheaper to invent another standard now and move to that on a widescale basis than to adopt IPv6, switch to it, and then adopt a new s
Re:IPv6 (Score:2)
These are all trolls from the infamous Jim Fleming (resident of killfiles round the world).
will exotic OS's help? (Score:1, Interesting)
Thanks?
You'll have seen a lot of breakins. (Score:5, Interesting)
+5 (Score:2)
Weakest link: Between systems and people (Score:5, Interesting)
examples:
* "SSH shows a warning that the host key has changed. The user ignores it and continues on."
* "The browser warns the a SSL certificate doesn't match the host IP. The user ignores it and continues on."
* "The browser asks if you trust the signer before running some piece of ActiveX. The user ignores it and continues on."
* "The sysadmin warns not to share passwords. The users ignore that too."
Now the question. It seems to me that despite all the work being done in the security field, back in reality things have gone from bad to worse. People constantly sidestep the very systems that are put in place to protect them. Is anything being done in the computer security field to address this important "Human Factors" aspect?
--
Simon
Re:Weakest link: Between systems and people (Score:4, Insightful)
Users tend to ignore such warnings because similar warnings appear far too often for invalid reasons. This is not a new problem; Aesop wrote about the boy who cried wolf.
Re:Weakest link: Between systems and people (Score:2, Informative)
Re:Weakest link: Between systems and people (Score:2)
--
Simon
Re:Weakest link: Between systems and people (Score:3, Insightful)
It ain't the same thing...
--
Simon
Re:Weakest link: Between systems and people (Score:2, Funny)
You're being fooled by slashbot FUD.
Stepping into a network security carerer. (Score:5, Interesting)
Re:Stepping into a network security carerer. (Score:2, Interesting)
>Science. I've done plenty of Unix sysadmin work througout college and
>even deployed some high-interaction honeynets. I'm very interested in
>network security and systems programming. Do you have any advice for
>people in my situation who want to head into a career in network
>security?
>
I've recently landed my first job as a pen-tester. To get here I spent the last eight years reading everything I could get my hands on regardin
Re:Stepping into a network security carerer. (Score:2)
Re:Stepping into a network security carerer. (Score:2)
The Relevance of Low-Level Tools (Score:5, Interesting)
Given all of this, what motivation is there for a modern CS student to learn things like the 3-way TCP handshake, or the differences in implementations in various TCP/IP stacks, when the base level of the equation is irrelevant from a security standpoint? How can I convince our network administrators that it's worthwhile to learn something other than JNDI when it comes to network protocols; that for security and network troubleshooting, nothing will ever top a simple Ethereal packet trace?
Jouster
Perception of Access (Score:4, Interesting)
How do we preferentially improve white-hat work? (Score:5, Interesting)
How can we develop and promote the state-of-the-art in security (tools, understanding, knowledge) while giving as few gems as possible to the criminal wannabes of the world? In other words, how can we bias the work and research towards the defensive, rather than progress that's either neutral or preferentially offensive?
Assurance, not blocking attacks (Score:5, Insightful)
Naturally, fighting in the dirt with the black hats is a lot "sexier" and more entertaining than building highly robust and reliable systems which will guarantee future security. The popularity of honeypots with security hobbyists (as opposed to researchers) seems to be a result of this: people enjoy seeing the attacker flummoxed, feeling superior to him, defeating him. Yet this doesn't really result in the improvement of security against new attacks, and it arguably distracts from that purpose.
I'm interested to know where you see progress in security assurance, as opposed to scanning or blocking of old, known attacks. Who else, besides OpenBSD, is in the camp of improving the guarantees that systems provide their users: guarantees such as W^X, packet normalization, and so forth?
Legal implications (Score:5, Interesting)
Interesting stories involving nmap? (Score:5, Interesting)
What could best be done to create secure networks? (Score:5, Interesting)
Open port... what now? (Score:2, Interesting)
After a user uses nmap to enumerate open ports on their systems, what tools should they use to determine what prgram is keeping that port open?
Re:Open port... what now? (Score:3, Informative)
Re:Open port... what now? (Score:2)
Re:Open port... what now? (Score:2, Informative)
see: http://www.insecure.org/tools.html
Have you ever been tempted to use your gifts (Score:5, Interesting)
Have you ever hacked into someone else's computer? Have you ever considered it? What would cause you to think of doing this? Would your tools (nmap, etc.) be enough to allow you to do this?
And if you haven't, why is that the case?
Re:Have you ever been tempted to use your gifts (Score:3, Insightful)
Fyodor responded by using information disclosure vulnerabilities in yahoo email to find the originating IP address of the Slashdot prankster (SumDeusExMachine) who was at the time a
Mod parent down (Score:2)
For example: the method AC claims was used to get the "victim's" IP address is different from that claimed in a different post.
I smell trolls.
Kitchen-Sink-over-HTTP (Score:5, Interesting)
A modern protocol designer has to choose between efficient data representation and firewall penetration. She will almost always choose the latter. Thus we have a thousand X-over-HTTP protocols, most of which are replicating services (like RPC) that are exactly what the firewall administrator was trying to block.
As everything becomes X-over-HTTP, how long will it be before we see stateful HTTP firewalls to block malicious kinds of data flowing over HTTP? And when firewall administrators again take the easy way out, blocking everything but "plain" HTTP, how do vendors send their data? Are we, in fact, turning the Internet into the Web? Eventually, it seems that application communication will just be a special case of a Web browser fetching a URL. By tunneling everything over HTTP, and eventually dropping even the tunneling, is the Internet in danger of becoming nothing but the Web--sure, there are other services running, but nobody but the occasional network admin on an un-firewalled network can reach them?
Jouster
Re:Kitchen-Sink-over-HTTP (Score:2)
Or, if you don't like that explanation, how about the one wherein I point out that I default to masculine pronouns, and that by switching to feminine whenever I'm thinking about it, it sort of balances out?
Or the final option, which is that I want to use singular verb forms, and it's a pain in the ass to retrofit my entire sentence to fit in with plurality, rather than a simple 's
Feature for nmap (Score:5, Interesting)
I've been using nmap for quite some time now, and it's an excellent tool by all accounts.
My question is, do you plan to implement firewall discovery? Instead of just reporting what ports are open, you could report:
- closed
- opened
- filtered (no reply)
- firewalled (firewall reply)
Like suggested in the latest phrack.
Re:Feature for nmap (Score:2)
Yes, but "filtered" does not indicated wether the packets were just dropped by a tcp/ip stack, or if it was firewalled.
Best Security Advice? (Score:5, Interesting)
Do you have any suggestions?
Re:Best Security Advice? (Score:2, Interesting)
Have you tried this one:
Please give me your name, SSN, address, mother's maiden name credit card numbers/expiration dates and the keys to your home.
If that one doesn't work then try this: Please point a gun to your head and pull the trigger.
What makes a honey net enticing? (Score:5, Interesting)
ipv6 support in nmap (Score:2, Interesting)
Trusted Computing (Score:3, Interesting)
Background info: Linus Torvalds blesses DRM [theregister.co.uk]
End User Training (Score:5, Interesting)
I often find myself at a loss as to how to help train the end users at my company on how they can help insure the security of their systems and help prevent things like social engineering attacks and what good password practices are.
I usually run into problems of user apathy, training materials or discussions being too technical, or trying to apply to technical training techniques to sometimes non techncial problems such as the aforementioned social engineering attack.
Have you found a good way to educate largely non technical end users on ways that they can help contribute to the overall security of the systems of the company they work for. What should be included in the training? What should be left out?
Thanks
OS fingerprinting (Score:5, Interesting)
I have started reading papers on HTTP fingerprinting and such and wonder how these will figure into the NMAP architecture.
What are the most elusive OS's that aren't on the NMAP OS fingerprint database?
LAN security in todays environment (Score:3, Interesting)
a passive listening device on the LAN to gather information (even in a switched environment), do you
see future security focusing on authentication mechanisims on the LAN, even for the simplest of things (e.g. to get connected to a switch, to allow a MAC address, etc)? Going to a larger scale, do you see something like this taking place on the WAN? Lets say (putting on my lets get nasty hat) Microsoft Palladium (.net, NM$FPSG, whatever they call it now) authentication + your MAC addres s just to get connected to the net?
Wheee!!! (Score:2, Interesting)
Advice for people who aren't security experts (Score:5, Interesting)
The problem is that between keeping the server up to date, learning PHP, learning Postgres and developing the content I really don't have the time to be an expert in security in the same way as someone who focuses solely on security. What kind of advice would you give to someone in my situation?
standalones and small home nets (Score:5, Interesting)
Anti-intrusion network software (Score:5, Interesting)
But so far, we have only been attempting to detect and report possible intrusions into private networks or studying attack vectors using Honeypots.
There has been a lot of talk lately about the possibility of using independent worms that fix vulnerabilities in network hosts so that those hosts aren't used as an attack vectors to compromise/disable other hosts.
Instead of just detecting and reporting intrusions or active worms fixing vulnerabilites, how do you feel about having IDS systems reporting to a host/daemon that would then launch protective countermeasures against the possible detected intrusion?
Thanks. BTW, Nmap ROCKS!
How can I Measure, Understand and Control? (Score:3, Interesting)
Linux Booth Babe and Sdem (Score:5, Troll)
Thank you for taking the time to answer questions from the Slashdot community. A while back a Slashbot named Sub Duex Ex Machina (aka Sdem) created an account in the persona of a very attractive Linux booth babe. Apparently at some point there was some serious flirtation between you and this booth babe.
Once the truth was revealed, you were understandably angry at Sdem, and you proceeded to hack into his poorly secured W2K box. Although you did nothing malicious to it, you did post screenshots of his various goings-on to your website.
My question for you is this: Although Sdem's actions were rather sleazy, I'm wondering how far you can go to retaliate. Do you have a moral and ethical priviledge to access another persons computer? If so, how far can you go in your actions once you've accessed it? While meer screenshots are fairly harmless, would you have been justified in deleting his hard drive?
Thanks!
Re:Linux Booth Babe and Sdem (Score:2, Funny)
IPv6 (Score:5, Interesting)
What should a hacker be? (Score:2, Interesting)
P.S. For everyone else, I've had the privilege to work in a small way on an information sharing project to build on
Nmap delays (Score:2, Interesting)
For example, I use it to ping-sweep my local
Security / Cleanliness. (Score:3, Interesting)
As an author of a security book and of a well known security application, how much do you feel code cleanliness/quality affects security of products? ... Or do you feel that only a very few products should worry about security?
For instance from looking at nmap-3 it's, ignoring the style, littered with magic numbers _esp_ for things like size of an array of char (which is the only concept like a "string" that nmap has) and also more than a few obvious misuses of strncpy() etc. to go along with it.
Contrast this with other security concious programs, like vsftpd and postfix, and it's like the difference between night and day.
Obviously anyone putting nmap at the end of a CGI is just asking for pain, but one traditional view is that this isn't wouldn't be the problem of nmap ... but of whoever decided that it was security concious, not just a "security" application.
Spoofed UDP P2P idea (Score:2)
Apart from the obvious, such as ISPs filtering UDP packets that don't match their network ranges, and broadcast mechanisms having problems scaling, do you have any other insights to offer us?
How about "The Matrix:Reloaded?" (Score:2)
Did you at least get some free movie tickets?
nmap (Score:2)
THE MATRIX RELOADED SPOILER ALERT
.
.
.
.
I saw The Matrix Reloaded yesterday and, at that pivitol moment, yelled "Holy SHIT! Trinity's using nmap!".
Other's in the theater were less than pleased.
In this message [insecure.org], you say you did the "r00t dance". Can you please demonstrate the r00t dance for the Slashdot audience?
What's in a name? (Score:2)
Why did you choose this particular pseudonym?
Re:NMap (Score:1)
You didn't read the license, did you?
Re:Idea (Score:5, Interesting)
Please Mod Up (Score:2)
I've been a big fan of Fyodor's nmap from the moment I discovered it in Phrack -- thought the OS fingerprinting scheme was pretty damned novel for one thing -- and it's made it into my standard security kit. But this event, if true, is pretty disturbing (from both sides!) and deserves elaborat