FUG-BR / Grupo Brasileiro de Usuarios de FreeBSD - Todas Categorias
 
 
21.11  
Inicio arrow Todas Categorias
Principal
Inicio
Noticias
Artigos
Regras da Lista
Assinar a Lista
Histrico da Lista
Galeria de Imagens
Contador Usurios FUG
FUGs Estaduais
Downloads
Enquetes
FAQ
Resumo do Site
Links
Pesquisar
Contato
Sobre a FUG-BR
RSS
-
DOC-BR (FUG BR)
Introduo
Projeto DOC-BR
Handbook
FAQ Oficial
-
+ Noticias
Alertas de Seguranca
Alertas em Ports
BSD em Geral
DaemonNews (Ingles)
MyFreeBSD
Todas Categorias
-
Login
Nome de Usurio

Senha

Lembrar login
Esqueceu sua senha?
Sem conta? Crie uma


Tecnologia Geral
Nome da Fonte # Artigos Link da Fonte
RNP (noticias) 15 http://www.rnp.br/noticias/rss.xml
CAIS (RNP) 20 http://www.rnp.br/cais/alertas/rss.xml
 
  • Propagao de Contedo RSS da FUG-BR   (6)
    Propagação de conteúdo da FUG-BR através de RSS, para você ficar por dentro das notícias da FUG e do histórico da lista de discussão utilizando seu sofware favorito para leitura RSS, como leitor de news, cliente de correio eletrônico ou o suporte builtin à RSS dos navegadores da família Mozilla.
  • BSD Geral   (10)
  • Software Livre em Geral   (3)
  • Tecnologia Geral   (2)
  • Google News   (4)

    Google News, notícias Google a respeito de sistemas BSD e Código Aberto em geral.

    Estas pesquisas são as mesmas que você pode fazer em http://news.google.com e http://news.google.com.br , com algumas palavras chaves relevantes ao interesse do visitante do Web Site da FUG-BRR.

[Voltar]
FUG-BR - Espalhando BSD
Dicas Rpidas:
Quer saber todos os arquivos que um dado port instalou? Use pkg_info -L <nome do port>. Quer reler a mensagem de pós-instalação de um port já instalado? Use pkg_info -D <nome do port>. Quer consultar informações de um port sem precisar mencionar seu nome e versão exatamente como registrados? Use pkg_info -x <expressao>, por exemplo, pkg_info -L -x perl
 


Wallpapers
Fontes Externas
FreeBSD Multimedia Resources List FreeBSD Multimedia Resources
bsdtalk - Joerg Sonnenberger - MP3 version

Joerg Sonnenberger - MP3 version
From: bsdtalk
Tags: bsdtalk, interview, eurobsdcon, michael dexter, joerg sonnenberger, mp3
Michael Dexter sent me an interview he recorded on behalf of BSDTalk with Joerg Sonnenberger at EuroBSDCon 2007.

bsdtalk - Joerg Sonnenberger - Ogg version

Joerg Sonnenberger - Ogg version
From: bsdtalk
Tags: bsdtalk, interview, eurobsdcon, michael dexter, joerg sonnenberger, ogg
Michael Dexter sent me an interview he recorded on behalf of BSDTalk with Joerg Sonnenberger at EuroBSDCon 2007.

OpenBSD - OpenBSD 4.2 Release Song - "100001 1010101" - MP3 version

OpenBSD 4.2 Release Song - "100001 1010101" - MP3 version
From: OpenBSD
Tags: openbsd, artwork, mp3

Those of us who work on OpenBSD are often asked why we do what we do. This song's lyrics express the core motivations and goals which have remained unchanged over the years - secure, free, reliable software, that can be shared with anyone. Many other projects purport to share these same goals, and love to wrap themselves in a banner of "Open Source" and "Free Software". Given how many projects there are one would think it might be easy to stick to those goals, but it doesn't seem to work out that way. A variety of desires drag many projects away from the ideals very quickly.

Much of any operating system's usability depends on device support, and there are some very tempting alternative ways to support devices available to those who will surrender their moral code. A project could compromise by entering into NDA agreements with vendors, or including binary objects in the operating system for which no source code exists, or tying their users down with contract terms hidden inside copyright notices. All of these choices surrender some subset of the ideals, and we simply will not do this. Sure, we care about getting devices working, but not at the expense of our original goals.

Of course since "free to share with anyone" is part of our goals, we've been at the forefront of many licensing and NDA issues, resulting in a good number of successes. This success had led to much recognition for the advancement of Free Software causes, but has also led to other issues.

We fully admit that some BSD licensed software has been taken and used by many commercial entities, but contributions come back more often than people seem to know, and when they do, they're always still properly attributed to the original authors, and given back in the same spirit that they were given in the first place.

That's the best we can expect from companies. After all, we make our stuff so free so that everyone can benefit -- it remains a core goal; we really have not strayed at all in 10 years. But we can expect more from projects who talk about sharing -- such as the various Linux projects.

Now rather than seeing us as friends who can cooperatively improve all codebases, we are seen as foes who oppose the GPL. The participants of "the race" are being manipulated by the FSF and their legal arm, the SFLC, for the FSF's aims, rather than the goal of getting good source into Linux (and all other code bases). We don't want this to come off as some conspiracy theory, but we simply urge those developers caution -- they should ensure that the path they are being shown by those who have positioned themselves as leaders is still true. Run for yourself, not for their agenda.

The Race is there to be run, for ourselves, not for others. We do what we do to run our own race, and finish it the best we can. We don't rush off at every distraction, or worry how this will affect our image. We are here to have fun doing right.



OpenBSD - OpenBSD 4.2 Release Song - "100001 1010101" - Ogg version

OpenBSD 4.2 Release Song - "100001 1010101" - Ogg version
From: OpenBSD
Tags: openbsd, artwork, ogg

Those of us who work on OpenBSD are often asked why we do what we do. This song's lyrics express the core motivations and goals which have remained unchanged over the years - secure, free, reliable software, that can be shared with anyone. Many other projects purport to share these same goals, and love to wrap themselves in a banner of "Open Source" and "Free Software". Given how many projects there are one would think it might be easy to stick to those goals, but it doesn't seem to work out that way. A variety of desires drag many projects away from the ideals very quickly.

Much of any operating system's usability depends on device support, and there are some very tempting alternative ways to support devices available to those who will surrender their moral code. A project could compromise by entering into NDA agreements with vendors, or including binary objects in the operating system for which no source code exists, or tying their users down with contract terms hidden inside copyright notices. All of these choices surrender some subset of the ideals, and we simply will not do this. Sure, we care about getting devices working, but not at the expense of our original goals.

Of course since "free to share with anyone" is part of our goals, we've been at the forefront of many licensing and NDA issues, resulting in a good number of successes. This success had led to much recognition for the advancement of Free Software causes, but has also led to other issues.

We fully admit that some BSD licensed software has been taken and used by many commercial entities, but contributions come back more often than people seem to know, and when they do, they're always still properly attributed to the original authors, and given back in the same spirit that they were given in the first place.

That's the best we can expect from companies. After all, we make our stuff so free so that everyone can benefit -- it remains a core goal; we really have not strayed at all in 10 years. But we can expect more from projects who talk about sharing -- such as the various Linux projects.

Now rather than seeing us as friends who can cooperatively improve all codebases, we are seen as foes who oppose the GPL. The participants of "the race" are being manipulated by the FSF and their legal arm, the SFLC, for the FSF's aims, rather than the goal of getting good source into Linux (and all other code bases). We don't want this to come off as some conspiracy theory, but we simply urge those developers caution -- they should ensure that the path they are being shown by those who have positioned themselves as leaders is still true. Run for yourself, not for their agenda.

The Race is there to be run, for ourselves, not for others. We do what we do to run our own race, and finish it the best we can. We don't rush off at every distraction, or worry how this will affect our image. We are here to have fun doing right.



BSDConTR - Turkish Conference on BSD Systems - BSDConTR 2007 - Presentations - PDF version

BSDConTR 2007 - Presentations - PDF version
From: BSDConTR - Turkish Conference on BSD Systems
Tags: bsdcontr, pdf, freebsd 7.0, freebsd, kris kennaway, pdf
Introducing FreeBSD 7.0

bsdtalk - AsiaBSDCon Update with Hiroki Sato and George Neville-Neil - MP3 version

AsiaBSDCon Update with Hiroki Sato and George Neville-Neil - MP3 version
From: bsdtalk
Tags: bsdtalk, interview, asiabsdcon, hiroki sato, george neville-neil, mp3
A quick update on AsiaBSDCon 2008 with Hiroki Sato and George Neville-Neil. More information at http://www.asiabsdcon.org/.

bsdtalk - AsiaBSDCon Update with Hiroki Sato and George Neville-Neil - Ogg version

AsiaBSDCon Update with Hiroki Sato and George Neville-Neil - Ogg version
From: bsdtalk
Tags: bsdtalk, interview, asiabsdcon, hiroki sato, george neville-neil, ogg
A quick update on AsiaBSDCon 2008 with Hiroki Sato and George Neville-Neil. More information at http://www.asiabsdcon.org/.

bsdtalk - OpenCon 2007 update from Marc Balmer - MP3 version

OpenCon 2007 update from Marc Balmer - MP3 version
From: bsdtalk
Tags: bsdtalk, interview, opencon, marc balmer, mp3
A short update on OpenCon 2007 with Marc Balmer. More information at http://www.opencon.org/.

bsdtalk - OpenCon 2007 update from Marc Balmer - Ogg version

OpenCon 2007 update from Marc Balmer - Ogg version
From: bsdtalk
Tags: bsdtalk, interview, opencon, marc balmer, ogg
A short update on OpenCon 2007 with Marc Balmer. More information at http://www.opencon.org/.

bsdtalk - Richard Stallman - Ogg version

Richard Stallman - Ogg version
From: bsdtalk
Tags: bsdtalk, interview, rms, richard stallman, ogg
Interview with Richard Stallman.

TaoSecurity
Network Monitoring: How Far?

In my January post The Revolution Will Be Monitored and elsewhere I discuss how network monitoring is becoming more prevalent, whether we like it or not. When I wrote my first book I clearly said that you should collect as much data as you can, given legal, political, and technical means because that approach gives you the best chance to detect and respond to intrusions. Unfortunately, I did not provide any clear guidance for situations where I think monitoring might not be appropriate. While this is by no means a political blog, I would not want my NSM approach to be taken as justification for monitoring and retaining every electronic transaction, especially beyond the security realm.

In that spirit I would like to point out three recent stories which highlight some of the contemporary problems I see with electronic monitoring.

First is Boeing bosses spy on workers. From the story:

Within its bowels, The Boeing Co. holds volumes of proprietary information deemed so valuable that the company has entire teams dedicated to making sure that private information stays private.

One such team, dubbed "enterprise" investigators, has permission to read the private e-mails of employees, follow them and collect video footage or photos of them. Investigators can also secretly watch employee computer screens in real time and reproduce every keystroke a worker makes, the Seattle P-I has learned...

"Employees should understand that the law generally gives employers broad authority to conduct surveillance, whether through e-mail, video cameras or other forms of tracking, including off the job in many cases."

The law grants companies the right to protect themselves from employees who break the law, such as by embezzling money or using the company warehouse to run a drug-smuggling ring.

The problem, [Ed] Mierzwinski [consumer program director at the federation of Public Interest Research Groups] said, is when companies use the surveillance tactics available to them to root out whistle-blowers.

"We need greater whistle-blower protections," he said. But, "if you're using the company's resources and you think it's protected because you're using Hotmail, think again."

My first point on this story is that I have never advocated NSM as a means to combat fraud, waste, and abuse by employees, let alone whistle-blowers. I have almost exclusively focused on external threats. I say let legal and human resources look for non-security policy violations.

My second point on this story is that I think the operative word here is surveillance. NSM is not a surveillance methodology. NSM does not advocate identifying a person of interest, then examining all traffic generated by or directed at that person. NSM is more channel- and system-centric. If I am going to conduct network surveillance of any type, I expect legal and human resources tasking. I do not engage in network surveillance for my own security purposes. I conduct NSM.

The next story is Cal-Ore Telecommunications on Solera Networks. This is a blog posting advertising the adoption of a packet capture appliance sold by Solera Networks to the Cal-Ore ISP in California. From the story:

Cal-Ore, a rural telephone company and ISP headquartered in Northern California, has been serving customers for more than 55 years. In order to comply with CALEA requirements, Charles Boening, Cal-Ore

Analyzing Protocol Hopping Covert Channel Tool

I enjoy analyzing covert channels, although my skills are far inferior to someone like Steven Murdoch. However, today via Packetstorm I learned of Protocol Hopping Covert Channel Tool by Steffen Wendzel. He wrote a text file describing his thoughts behind the tool called Protocol Hopping Covert Channels. Quoting the paper:

This paper describes a new way to implement covert channels. This is done by changing the protocol of the tunnel while the tunnel exists and even change the protocol on a randomized way without restarting the tunnel or reconnecting to the tunnel. A simple proof of concept tool called 'phcct' (protocol hopping covert channel tool) also known as 'takushi' (what is japanese for taxi) is available on my website http://www.doomed-reality.org. phcct implements only one (the easiest) version of such a randomized protocol hopping covert channel.

As soon as I read this I thought "this is so different from normal traffic, it will be easy to identify." I know that is true for manual inspection of traffic. I am not sure how automated tools would deal with it. The paper continues:

Do not forget the reason why doing this: It is to be stealth [sic]. Even if _one_ of the protocols you are using is recorded, the monitoring system will not collect ALL packets of ALL protocols in a network. This simply is a too huge amount of data. And yes, it makes the forensic analysis of network traffic much harder if there are multiple protocols used for a covert channel.

Apparently the author does not know about NSM or Sguil. Assuming you are performing this protocol hopping from a host on an enterprise network to a host on the Internet, a NSM sensor monitoring your Internet gateway will see and record this traffic.

I decided to give the author's proof of concept tool, phcct, a try. I compiled it statically on my Ubuntu laptop.

$ gcc -O -o phcct_s -fstack-protector-all -W -Wall -Wshadow -g
 -ggdb *.c -lpthread -static

Next I copied the binary to a VM running a Ubuntu 7.10 as a live CD/.iso. I used this static version because I noticed the Ubuntu live CD did not have the required libraries to compile from source, but run as a statically compiled binary it worked fine.

Now I started phcct on each workstation and hit return once each side was running. My laptop is neely, 192.168.2.101.

root@neely:~/phcct# ./phcct_s -a 192.168.2.115
starting phcct (a.k.a. takushi) ...
please press return if the peer is setup up.
connecting ...
connected via http
connected via ftp-data
connected via plain proto
waiting for local connection on port 9999 ...

My VM is ubuntu, 192.168.2.115.

root@ubuntu:/home/analyst# ./phcct_s -a 192.168.2.101
starting phcct (a.k.a. takushi) ...
please press return if the peer is setup up.
connecting ...
connected via http
connected via ftp-data
connected via plain proto
waiting for local connection on port 9999 ...

Once each side of the tunnel was activated, I used Netcat on each system to connect to port 9999 on localhost. First, neely:

richard@neely:~$ nc -v localhost 9999
localhost [127.0.0.1] 9999 (?) open

Second, ubuntu:

analyst@ubuntu:~$ nc -v localhost 9999
localhost [127.0.0.1] 9999 (?) open

Now I was ready to send traffic. For example, I typed this on neely:

This is traffic from neely to ubuntu.

and it appeared on ubuntu:

This is traffic from neely to ubuntu.

Then I did the reverse. I repeated this cycle four times, for a total of five exchanges or ten total messages. When done I exited each Netcat session.

During this process I captured the traffic using Tshark. You can download it here.

I prefer to start the analysis by looking at session data. Here is what Argus 2.x thought of the traffic.

$ ra -nn -L0 -A -r ph.1.arg -s saddr daddr sport dport proto pkts bytes
  SrcAddr       DstAddr     Sport Dport Type SrcPkt DstPkt SAppBytes DAppBytes   
192.168.2.115 192.168.2.101.43598 2510   tcp 6      4      96        0
192.168.2.115 192.168.2.101.43198 80     tcp 5      3      281       0
192.168.2.115 192.168.2.101.52158 20     tcp 6      4      96        0
192.168.2.101 192.168.2.115.49586 80     tcp 4      4      281       0
192.168.2.101 192.168.2.115.45106 20     tcp 3      3      0         0
192.168.2.101 192.168.2.115.50200 2510   tcp 7      7      192       0

You can see the tool using destination ports 2510, 80 and 20. There are six sessions although one of them is empty. The five active sessions correspond to our five conversations.

Let's look at the traffic on each using Tcpflow. In the ls output I omit the first few fields for space purposes.

taosecurity:/home/analyst$ tcpflow -r ph.1.lpc   
taosecurity:/home/analyst$ ls -al 192*
281 Nov 14 13:59 192.168.002.101.49586-192.168.002.115.00080
192 Nov 14 13:59 192.168.002.101.50200-192.168.002.115.02510
281 Nov 14 13:59 192.168.002.115.43198-192.168.002.101.00080
 96 Nov 14 13:59 192.168.002.115.43598-192.168.002.101.02510
 96 Nov 14 13:59 192.168.002.115.52158-192.168.002.101.00020

Notice the file sizes match the byte counts seen above. Here are the contents of each. Note the use of cat -tev to 

taosecurity:/home/analyst$ cat -tev 192.168.002.101.49586-192.168.002.115.00080
GET / HTTP/1.1^M$
Host: google.de^M$
User-Agent: Mozilla/5.0^M$
Accept: text/xml^M$
Accept-Language: en-us;q=0.5,en;q=0.3^M$
Accept-Encoding: gzip,deflate^M$
Accept-Charset: ISO-8859-1,utf-8^M$
Keep-Alive: 300^M$
Connection: keep-alive^M$
Cookie: GPC=2FW=0:This is traffic from neely to ubuntu.$
^M$
^M$
taosecurity:/home/analyst$ cat -tev 192.168.002.101.50200-192.168.002.115.02510
^A^B^C0 FW=0:This is traffic from neely to ubuntu.$
^A^B^C1 FW=0:This is traffic from neely to ubuntu.$
^A^B^C3 FW=0:This is traffic from neely to ubuntu.$
^A^B^C4 FW=0:This is traffic from neely to ubuntu.$

taosecurity:/home/analyst$ cat -tev 192.168.002.115.43198-192.168.002.101.00080
GET / HTTP/1.1^M$
Host: google.de^M$
User-Agent: Mozilla/5.0^M$
Accept: text/xml^M$
Accept-Language: en-us;q=0.5,en;q=0.3^M$
Accept-Encoding: gzip,deflate^M$
Accept-Charset: ISO-8859-1,utf-8^M$
Keep-Alive: 300^M$
Connection: keep-alive^M$
Cookie: GPC=4FW=0:This is traffic from ubuntu to neely.$
^M$
^M$

taosecurity:/home/analyst$ cat -tev 192.168.002.115.43598-192.168.002.101.02510
^A^B^C0 FW=0:This is traffic from ubuntu to neely.$
^A^B^C1 FW=0:This is traffic from ubuntu to neely.$

taosecurity:/home/analyst$ cat -tev 192.168.002.115.52158-192.168.002.101.00020
^A^B^C2 FW=0:This is traffic from ubuntu to neely.$
^A^B^C3 FW=0:This is traffic from ubuntu to neely.$

At the end of the day we have messages exchanged using one real protocol (HTTP, with payload in the cookie field) and two pseudo-protocols (raw traffic on port 2510 TCP and attempted simulated FTP data traffic). The FTP data traffic isn't simulated properly because the SYN segments go to port 20 TCP. 

$ tcpdump -n -t -r ph.1.lpc port 20
reading from file ph.1.lpc, link-type EN10MB (Ethernet)
IP 192.168.2.115.52158 > 192.168.2.101.20:
 S 2100176842:2100176842(0) win 5840 
IP 192.168.2.101.20 > 192.168.2.115.52158:
 S 3955486862:3955486862(0) ack 2100176843 win 5792
IP 192.168.2.115.52158 > 192.168.2.101.20: . ack 1 win 183

IP 192.168.2.101.45106 > 192.168.2.115.20:
 S 3970907263:3970907263(0) win 5840
IP 192.168.2.115.20 > 192.168.2.101.45106:
 S 671130558:671130558(0) ack 3970907264
IP 192.168.2.101.45106 > 192.168.2.115.20: . ack 1 win 1460
IP 192.168.2.115.52158 > 192.168.2.101.20: P 1:49(48) ack 1 win 183 
IP 192.168.2.101.20 > 192.168.2.115.52158: . ack 49 win 1448
IP 192.168.2.115.52158 > 192.168.2.101.20: P 49:97(48) ack 1 win 183 
IP 192.168.2.101.20 > 192.168.2.115.52158: . ack 97 win 1448
IP 192.168.2.115.52158 > 192.168.2.101.20: F 97:97(0) ack 1 win 183
IP 192.168.2.115.20 > 192.168.2.101.45106: F 1:1(0) ack 1 win 181
IP 192.168.2.101.45106 > 192.168.2.115.20: F 1:1(0) ack 2 win 1460
IP 192.168.2.101.20 > 192.168.2.115.52158: F 1:1(0) ack 98 win 1448
IP 192.168.2.115.20 > 192.168.2.101.45106: . ack 2 win 181
IP 192.168.2.115.52158 > 192.168.2.101.20: . ack 2 win 183

Real active FTP data traffic comes from port 20 TCP.

Can this technique be improved? Sure. Is it tough to analyze? Possibly. If you use a packet-by-packet approach, you can see what's happening. For example, here are a few packets containing payloads. Notice the use of the Tshark display filter using the -R switch.

richard@neely:~$ tshark -r ph.1.lpc -x -R 'tcp.len >= 20'
 19  62.570303 192.168.2.101 50200 192.168.2.115 2510 TCP 50200 > 2510
 [PSH, ACK] Seq=1 Ack=1 Win=5840 Len=48 TSV=4768072 TSER=3038481

0000  00 13 02 4c 30 2d 00 13 02 4c 30 2d 08 00 45 00   ...L0-...L0-..E.
0010  00 64 24 88 40 00 40 06 8f e3 c0 a8 02 65 c0 a8   .d$.@.@......e..
0020  02 73 c4 18 09 ce eb e8 a2 75 28 9d e1 d0 80 18   .s.......u(.....
0030  05 b4 e3 5b 00 00 01 01 08 0a 00 48 c1 48 00 2e   ...[.......H.H..
0040  5d 11 01 02 03 30 20 46 57 3d 30 3a 54 68 69 73   ]....0 FW=0:This
0050  20 69 73 20 74 72 61 66 66 69 63 20 66 72 6f 6d    is traffic from
0060  20 6e 65 65 6c 79 20 74 6f 20 75 62 75 6e 74 75    neely to ubuntu
0070  2e 0a                                             ..

 21  70.543503 192.168.2.115 43598 192.168.2.101 2510 TCP 43598 > 2510
 [PSH, ACK] Seq=1 Ack=1 Win=5856 Len=48 TSV=3055661 TSER=4752430

0000  00 13 02 4c 30 2d 00 13 02 4c 30 2d 08 00 45 00   ...L0-...L0-..E.
0010  00 64 13 0f 40 00 40 06 a1 5c c0 a8 02 73 c0 a8   .d..@.@..\...s..
0020  02 65 aa 4e 09 ce 7d 50 49 4a eb ba 86 09 80 18   .e.N..}PIJ......
0030  00 b7 70 7a 00 00 01 01 08 0a 00 2e a0 2d 00 48   ..pz.........-.H
0040  84 2e 01 02 03 30 20 46 57 3d 30 3a 54 68 69 73   .....0 FW=0:This
0050  20 69 73 20 74 72 61 66 66 69 63 20 66 72 6f 6d    is traffic from
0060  20 75 62 75 6e 74 75 20 74 6f 20 6e 65 65 6c 79    ubuntu to neely
0070  2e 0a                                             ..

 23  84.876175 192.168.2.101 50200 192.168.2.115 2510 TCP 50200 > 2510
 [PSH, ACK] Seq=49 Ack=1 Win=5840 Len=48 TSV=4773648 TSER=3053597

0000  00 13 02 4c 30 2d 00 13 02 4c 30 2d 08 00 45 00   ...L0-...L0-..E.
0010  00 64 24 89 40 00 40 06 8f e2 c0 a8 02 65 c0 a8   .d$.@.@......e..
0020  02 73 c4 18 09 ce eb e8 a2 a5 28 9d e1 d0 80 18   .s........(.....
0030  05 b4 92 56 00 00 01 01 08 0a 00 48 d7 10 00 2e   ...V.......H....
0040  98 1d 01 02 03 31 20 46 57 3d 30 3a 54 68 69 73   .....1 FW=0:This
0050  20 69 73 20 74 72 61 66 66 69 63 20 66 72 6f 6d    is traffic from
0060  20 6e 65 65 6c 79 20 74 6f 20 75 62 75 6e 74 75    neely to ubuntu
0070  2e 0a                                             ..

 25  88.388511 192.168.2.115 43598 192.168.2.101 2510 TCP 43598 > 2510
 [PSH, ACK] Seq=49 Ack=1 Win=5856 Len=48 TSV=3060172 TSER=4770065

0000  00 13 02 4c 30 2d 00 13 02 4c 30 2d 08 00 45 00   ...L0-...L0-..E.
0010  00 64 13 10 40 00 40 06 a1 5b c0 a8 02 73 c0 a8   .d..@.@..[...s..
0020  02 65 aa 4e 09 ce 7d 50 49 7a eb ba 86 09 80 18   .e.N..}PIz......
0030  00 b7 19 c7 00 00 01 01 08 0a 00 2e b1 cc 00 48   ...............H
0040  c9 11 01 02 03 31 20 46 57 3d 30 3a 54 68 69 73   .....1 FW=0:This
0050  20 69 73 20 74 72 61 66 66 69 63 20 66 72 6f 6d    is traffic from
0060  20 75 62 75 6e 74 75 20 74 6f 20 6e 65 65 6c 79    ubuntu to neely
0070  2e 0a                                             ..

 27  97.214303 192.168.2.101 49586 192.168.2.115 80 HTTP GET / HTTP/1.1

0000  00 13 02 4c 30 2d 00 13 02 4c 30 2d 08 00 45 00   ...L0-...L0-..E.
0010  01 4d e2 06 40 00 40 06 d1 7b c0 a8 02 65 c0 a8   .M..@.@..{...e..
0020  02 73 c1 b2 00 50 ec 6f 64 f6 27 b7 a8 06 80 18   .s...P.od.'.....
0030  05 b4 16 d2 00 00 01 01 08 0a 00 48 e3 1d 00 2e   ...........H....
0040  5d 0f 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31   ].GET / HTTP/1.1
0050  0d 0a 48 6f 73 74 3a 20 67 6f 6f 67 6c 65 2e 64   ..Host: google.d
0060  65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d   e..User-Agent: M
0070  6f 7a 69 6c 6c 61 2f 35 2e 30 0d 0a 41 63 63 65   ozilla/5.0..Acce
0080  70 74 3a 20 74 65 78 74 2f 78 6d 6c 0d 0a 41 63   pt: text/xml..Ac
0090  63 65 70 74 2d 4c 61 6e 67 75 61 67 65 3a 20 65   cept-Language: e
00a0  6e 2d 75 73 3b 71 3d 30 2e 35 2c 65 6e 3b 71 3d   n-us;q=0.5,en;q=
00b0  30 2e 33 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f   0.3..Accept-Enco
00c0  64 69 6e 67 3a 20 67 7a 69 70 2c 64 65 66 6c 61   ding: gzip,defla
00d0  74 65 0d 0a 41 63 63 65 70 74 2d 43 68 61 72 73   te..Accept-Chars
00e0  65 74 3a 20 49 53 4f 2d 38 38 35 39 2d 31 2c 75   et: ISO-8859-1,u
00f0  74 66 2d 38 0d 0a 4b 65 65 70 2d 41 6c 69 76 65   tf-8..Keep-Alive
0100  3a 20 33 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f   : 300..Connectio
0110  6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 43   n: keep-alive..C
0120  6f 6f 6b 69 65 3a 20 47 50 43 3d 32 46 57 3d 30   ookie: GPC=2FW=0
0130  3a 54 68 69 73 20 69 73 20 74 72 61 66 66 69 63   :This is traffic
0140  20 66 72 6f 6d 20 6e 65 65 6c 79 20 74 6f 20 75    from neely to u
0150  62 75 6e 74 75 2e 0a 0d 0a 0d 0a                  buntu......

This tool demonstrates the importance of a few NSM concepts. First, intruders are unpredictable. (Remember I use the term "intruder" to mean anyone doing something you don't like on your network, i.e., any policy violater. Second, by collecting everything and investigating once you have indicators, you can find activity not observed by existing inspection and blocking systems. Third, there is no substitute for full content. Statistics are nice, sessions are better, but only full content reveals what's really happening. Even session tools can be fooled or misguided, or at least have their output subject to misinterpretation.

I expect to see additional iterations of this tool and technique.
Copyright 2003-2007 Richard Bejtlich


Great Papers from Honeynet Project

If you haven't seen them yet, Know Your Enemy: Behind the Scenes of Malicious Web Servers and Know Your Enemy: Malicious Web Servers are two great papers by the Honeynet Project. You might want to see Web Server Botnets and Server Farms as Attack Platforms by Gadi Evron as background. You'll notice people like e0n are using NSM to combat bots. I have not seen any IRC-controlled SIP/VoIP attack bots and botnets yet. If you think your IPS will save you against bots, keep in mind the time it takes to update some of them. I also recommend reading The World's Biggest Botnets by Kelly Jackson Higgins.
Copyright 2003-2007 Richard Bejtlich


FreeBSD Binary Upgrade News

If you've read my previous posts on FreeBSD binary upgrades you'll see that Colin Percival's work on this subject has been one of my favorite additions to FreeBSD during the last few years. I recommend reading the latest two posts on Colin's blog for even more good news: FreeBSD minor version upgrades and FreeBSD major version upgrades using FreeBSD update.

I plan to deploy FreeBSD 7.0 in production soon, and the native capability to upgrade the OS using binary means is incredibly welcome. I build sensors to inspect and capture traffic, not recompile themselves. Congratulations and thanks to Colin for all of his work in this area and for integrating FreeBSD update into the base OS.

On another FreeBSD note, I need to try this: Building bootable FreeBSD/i386 images.
Copyright 2003-2007 Richard Bejtlich


Impact of NetFlow on Routers

Thanks to the great IOShints blog for pointing me to NetFlow Performance Analysis. If you have any questions regarding the impact of generating NetFlow records on your routers, check out this Cisco white paper.
Copyright 2003-2007 Richard Bejtlich


Must-Read Snort 3.0 Post

If you care at all about Snort you must read Snort 3.0 Architecture Series Part 1: Overview by Marty Roesch. Keep reading his blog for future descriptions of Snort 3.0. On a related note, Marty released Daemonlogger 1.0 recently. Daemonlogger is an open source full content packet logging tool.
Copyright 2003-2007 Richard Bejtlich


More Unpredictable Intruders

Search my blog for the term unpredictable and the majority of the results describe discussions of one of my three security principles, namely

Many intruders are unpredictable.

Two posts by pdp perfectly demonstrate this: