Deep Rants

Encountered an ugly DB issue involving corrupt databases, with a questionable backup process resulting in 6 months of lost data pour moi. If logging can be rolled forward enough to recover enough data, so be it... otherwise it's likely the end of my experiment in blogging.

bah humbug

W

Most excellent!

Michal Zalewski, the evil genius that brings p0f and other sweet tools to the open [source] market has recently released fl0p! fl0p is a layer 7 application level fingerprinting tool initially offered to identify suspect encrypted channels where presumably none should exist and to help pick them out of the noise. It's nice and lightweight and while it can run in promiscuous sniffer mode, I'm using it on historical packet capture from my honeynet environments.

I'm liking it so far, but with only an initial 24 fingerprints in the initial development release, It looks like it will be up to the alpha users to improve what this tool is capable of detecting.

W
I'll buy him a beer any day

MD:Pro == An unbelievable prescription for professional ripoff. Here's another company trying to make a buck on a malware archive. GRRRRRR! This really gets my goat. While researching something else entirely, I encountered a tiny little news blurb from August 2006 for the Malware Distribution project. How I missed this waste of a tree news event, I have no idea. Oh, wait, actually I do know how I missed it. I don't read Bruce's blog either.

Even Bruce Schneier blogged about this site, but he didn't sound very decisive either way. I guess Bruce may have been busy at his desk trying to figure out how next best to strike a pose, so I'll offer up some final thoughts on this matter. "Security" Companies paying money for malware is a 'very bad thing' (TM). It will likely foster the creation of more 1337 and never before seen malware that is strangely enough only available via the MDPro portal.

How is it that they have >300k files? Maybe they are archiving every EVERY single OS file out there that they can get their euro grubbing hands on... for hashing purposes? If so, I wonder if they have enabled 'those' files for distribution and in doing so violating redistribution clauses all over the planet.

According to the MD:Pro website, they claim to be a project, but when you outright charge money wouldn't you call that a business model? MY OPINION Stay away from these guys entirely and forever.

To the Security/AV Companies, or independant researchers who are paying these guys or thinking about it... shame on you. If you do, You deserve to wear a big 'L' on your respective foreheads. Those who need samples should be well enough established to know all of many of malware sample repositories with distribution arrangements.

W
Malware profiteers come in all shapes and sizes, but all have one common trait... smell

My best buddy dmz has been using a particular monitoring package for quite some time now, and I, lacking that capability for a smallish net that hasn't been well managed *and is only my fault* I decided to try it out. The monitoring suite is the open source Zabbix, whereas many of you might know the veritable Nagios solution, I found Zabbix to be brain dead easy to deploy and configure. In under an hour I had my pretty monitoring page, db, and 11 agents deployed. I use Nagios at work and after 'my personal experience' I am sold on Zabbix.

W
Zabbix, take me to your leader you zarkin frood

Question. How does a chemistry major become such a security geek?
Answer. You are the too cool for words Maestro Jose Nazario.

Jose recently schooled me on some wickedly cool techniques for decoding malicious javascript on the unix platform using the NJS toolkit. I'm pretty annoyed that I hadn't read his blog post before, grrrr!

Mongo feel smart now.

W
I decode stuff

The World's largest ISSA chapter, fresh InSecurity, Marcus Sachs and sprinkle a room full of suits on top.

I and fellow handler Robert Danford attended the local Northern Virginia ISSA chapter meeting yesterday evening as non-members to observe our Internet Storm Center's very own Marcus Sachs, and to make sure he wasn't spouting a bunch of hooey. He presented the ISSA chapter group in attendance with a behind the scenes review of the Storm Center, the handlers themselves *w00t!*, and observations from the trenches. I did have to call hooey on something, and he graciously acknowledged it.

*From my vantage point in the peanut gallery*, I do believe I was witnessing some significant 'tude originating from folks in my immediate vicinity that appeared to be directed in the general direction of Marcus, the Storm Center and statements from Marcus' slides. *My opinion entirely here*, I do find it a drag when other stuffy industry curmudgeons can only scoff and belittle the work and efforts of others for what I perceive as their own scene whoring, egotistical fifedom building.

Regarding ISSA chapter business, I feel quite certain I am responsible for some voting fraud which in turn led to the adoption of a new name name for their security newsletter now dubbed 'InSecurity'. A runner up newsletter name was "Information Assurance Now" and I REALLY had to bite my tongue as a favorite meeting joke of mine is

"Now remember, what does ASSurance start with" while pointing directly at someone, pause.... then a quick retort of "You!", and then "actually it starts with Ass".

It seems that most folks I've encountered usually make that 'ass'ociation and chuckle before considering what really starts the assurance process.

W
That's a lot of Ass-urance, glad they didn't talk about DO'ing stuff

How does Securing LAMP lead to Sex over IP?

So I was randomly following untrusted URLs, sent to me in html rendered email trying to take a peek at Jose Oquendo's Securing Lamp paper.

So whatever do I find? But an RFC for SoIP (Sex0r over Internet Protocols). I couldn't believe it, I almost felt robbed as I've been talking for years about drafting the PoIP standard (Pregnancy over IP).

Yessiree Bob, PoIP is going to be groundbreaking in the soon to be exploding niche of the remote insemination industry. My trusted confidants and I are still mulling over the inherent issues in PoIP being a UDP based protocol and are working to resolve the recently discovered issues including spoofed PoIP packets, and man in the middle attacks.

W
So that's why my kids have blonde hair!