The DMZ

Andrey Botalov

08:57

After asking [this question](security.stackexchange.com/questions/14534/…) I received some responses and I can give some more reasons to implement attack detection:
1. Block attacker's IP. @schroeder said that blocking attacker's IP, even if spoofed, is a needed action. However, attacker is able to flood server with various malicious-like requests. I can't block all of them as they are too different and any IDS will have false negatives. I can't block IPs of those requests as after it legitimate users will be blocked. Also attacker may block a certain u…

Rory Alsop

@AndreyBotalov I would imagine the downvote is because it is difficult to tell exactly what you are asking

are you asking what the value of detection strategies is?

or are you asking for a list of activities

@DavidSchwartz's answer seems reasonable (if brief) and explains why detection can be good, and @shroeder's one has some useful info

The key for us is to understand what it is you are wanting - your question just isn't very explanatory in this respect

@Gilles have added an answer. Waiting to see if I get shouted at...

AviD

09:37

hey guys, I have a shopping question.... (@ScottPack you're probably the most likely to have info for me on this...?)

a client of mine is looking for a UTM-like firewall (linux based), preferably free-ish.

any recommendations?

also on the same book - any recommendations for a free WAF, besides modsecurity? (anyone ever hear of LVS?)

@RoryAlsop nice.

As a security professional with over 16 years in the field, and in my role as Chairman of the Scottish branch of the Institute of Information Security Professionals and the President of ISACA Scotland

... and as a respected moderator of SEI's own Sec.se.... ;-)

should really add that in there - yknow, just to rub his nose in it :D

hmm, could probably also add some links to questions here regarding that.

Rory Alsop

@AviD oh yeah - will do that

:-)

@AviD hmmm - not sure there are any really useful ones. Seem to mostly concentrate on the disclosure market

AviD

@RoryAlsop how about:

18

Q: How to disclose a security vulnerability in an ethical fashion?

How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.

Rory Alsop

dunno how I missed that one :-)

AviD

9

Q: Progress in market approaches to software vulnerability disclosure?

In A Comparison of Market Approaches to Software Vulnerability Disclosure (2006), Rainer Böhme describes the profound role of economic "market failure" in the industry dynamics that hinder software security. He also describes 4 kinds of markets that can help: Bug challenges, like payments by ...

disclosure vulnerability-markets

Rory Alsop

@AviD that one seems to be more around payment for vulnerability research/reporting

AviD

09:53

@RoryAlsop yeah, I guess. there is some discussion by zedman on how this can affect the disclosure mechanisms, but I think you're right about it.

CodeInChaos

10:10

I think the following question should be migrated to crypto.SE:

1

Q: Creating an encryption key from several other keys and using hash functions

When we want to combine two (or probably more) keys to create a single encryption key that relies on all of them, what is the proper method for doing that? Simple XOR? Using hash functions? ... I personally used this: md5( key1 || key2 ) Note: || means concatenation. I used md5 because i use 1...

cryptography encryption hash

Rory Alsop

done

CodeInChaos

hmm strange, I think the downvote I gave wasn't migrated, and I had to renew it, whereas the one I received was. Or perhaps somebody upvoted the answer I downvoted, and I now double-downvoted.

migration is strange stuff

Iszi

12:06

Hehe... Funny movie goofs. Thanks to Thunt at goblinscomic.com

Scott Pack

12:49

@AviD None to speak of really. I could probably look around and see if I could recommend anything. My firewall experience is pretty limited to Juniper, Cisco, and iptables. I've used some of the "home router" style things, like smoothwall and pfSense, but I'm always loathe to recommend them outside of a home or a highly technical office. pfSense does have a pretty amazing feature set, and you can purchase appliances from them.

AviD

13:01

@ScottPack cool, thanks

pfsense is more homeoffice type?

this is a very technical startup, so no worries there.

but very high throughput requirements.

Scott Pack

@AviD Based on the feature set, yeah. It's based on bsd (hence the pf part). It has a pretty good feature set. I only use it as a home NAT box with port forwards, packet shaping, and OpenVPN terminator. It also supports HA and a laundry list of other things I've not dealt with or gotten into.

As a gateway network device, it's got a pretty good feature set. I don't have a good feel (from a technical perspective) what UTM really means, so I don't know if it fits that.

AviD

@ScottPack huh? bsd => pf, how?

Scott Pack

pf is the software firewall that bsd uses.

AviD

@ScottPack I think UTM is really a marketing term.... but technically, its used (at least its what I mean) mostly as an umbrella term for a unified network protection device, encompassing e.g. firewall, IPS, content filtering, gateway AV, anything else you want to put in there...

@ScottPack ahhh

Scott Pack

13:17

It supports running snort. When using similar products they ran snort, but it was a pain to actually manage it, so sprinkle some salt. Also lists squid as an available package.

AviD

Huh. I have no idea what you just said.

oh wait, I seem to remember squid is some reverse proxy, correct?

Scott Pack

Squid is a web proxy, yes.

AviD

and you're saying that it improves snort management?

Scott Pack

I'm not saying that, no. :) I've used similar products to pfSense that included snort. Managing rules and configs was a fucking nightmare.

I don't know what it's like in this one, but previous experience makes me wary.

AviD

and pfsense is not?

ah, okay.

Scott Pack

13:20

On the plus side, pfsense software is free. So it'll be easy for you to throw in a lab and fiddle.

AviD

so, in effect you're suggesting grabbing a bunch of different products - pfsense for fw, snort for ips, squid for proxy, etc - and putting that all together-ish.

shouldnt be surprising, i guess.

Scott Pack

At this point I don't feel like I know enough about the UTM market to really make a recommendation.

What I am saying, however, is that as a gateway device firewall product that's cheap, I'm impressed with pfSense. And that you can install an IDS and WebProxy on pfSense as add-on modules.

AviD

@ScottPack forget UTM. Network-level protection systems - fw, ips, etc. whatever else one typically needs

@ScottPack excellent, that'll do.

Scott Pack

Those add-on modules just happen to be snort and squid.

doc.pfsense.org/index.php/Features_List

AviD

and im sure it would be possible to find an addin module for AV, and whatever else they want...

Scott Pack

13:24

Chances are someone has ported clam to it, yeah.

AviD

@ScottPack excellent. VPN support and such is also needed. decent enough in pfsense?

Scott Pack

I've only used the OpenVPN one, but yeah, seemed to work well enough.

Again, I've only used it at home. Can't say I've really stressed it.

AviD

great, thanks a ton!

Scott Pack

Let me tell you, though, the thing is stable as all get out. I've only had two outages in the last year. The first was a power outage long enough to deplete my UPS, and the second was a power blink where I learned my battery was bad.

AviD

@ScottPack that doesnt even count.

Scott Pack

13:27

And that's on an old 2GHz P4 that had a previous life as a university provided computer to a dorm room.

AviD

any idea what the performance would be like?

this is a startup moving to hadoop, because they have sooooo much traffic.

Scott Pack

pfsense.org/…

I've never done any performance tests.

AviD

@ScottPack excellent. I also appreciate your gentle RTFM there... ;-)

but it scales directly to hardware, so thats not a problem.

Scott Pack

Pretty much, yeah.

AviD

they'll be putting it on amazon virtuaboxen, so they'll be taking whatever is needed.

Scott Pack

13:31

You know, gimme a minute. I may have some real world performance data that is almost tangentially related but could help with visualizing scale.

AviD

@ScottPack eh, I would say dont dig too hard.

that link is good enough to give an idea.

worst case, they scale out, if up isnt good enough.

Scott Pack

Especially if it's a VM, yeah. And no, I wasn't able to find anything useful.

Or, at least would have been useful even as a comparison

Honestly, the firewall/routing side of it is going to be IO bound more than CPU. It's only going to be the IDS, VPN, Proxy stuff that will actually stress the CPU at all.

Oo, this might be helpful. Are you familiar with the Cisco PIX 515?

AviD

@ScottPack nope.

you forget, I'm an apps guy ;-)

Scott Pack

/me sighs

AviD

2 days ago, by CodeInChaos

I only care about hardware when it doesn't work

Scott Pack

13:41

It is now EOL, but was built to either run as a transparent network firewall or a NAT device, like your old home Linksys.

It was rated at a total of 160Mbps total throughput. The thing ran a P3-350MHz and maxed out at either 256 or 512MB of ram (I can't remember).

AviD

@ScottPack okay?

Scott Pack

The point of that tidbit, is to say that pushing packets is easy. You're more limited by the IO than you are your processing power.

AviD

@ScottPack true. as long as there's no buffering backlog.

I do remember that a certain 3rd party plugin to ISA needed to collect cache and correlate a large amount of previous requests. that actually did strain the hw, but then thats no longer just firewall.

Scott Pack

Pretty much, yeah.

Stack Exchange

15:55

blog.stackoverflow.com/2012/05/…

Iszi

@StackExchange No onebox? That's... odd.

Oh, that's because it's a 404.

Scott Pack

Your face is a 404.

2

Iszi

16:13

@ScottPack Your daddy's a 404, you bastard. :-P

Scott Pack

444

:(

Right, lunch time.

Iszi

16:33

@ScottPack Heh. Being not entirely familiar with HTTP response codes, my first Google attempt was for "http 444". The first result was "HTTP 444 Pages minion's took over".

Then, I eventually did find my way to the Wiki page.

List of HTTP status codes

The following is a list of Hypertext Transfer Protocol (HTTP) response status codes. This includes codes from IETF internet standards as well as unstandardized RFCs, other specifications and some additional commonly used codes. The first digit of the status code specifies one of five classes of response; the bare minimum for an HTTP client is that it recognises these five classes. Microsoft IIS may use additional decimal sub-codes to provide more specific information, but these are not listed here. The phrases used are the standard examples, but any human-readable alternative can be provi...

And yes, @ScottPack, now I'm off of Wiki.

Iszi

18:10

This seems out-of-scope to me. The question should be asked to those who manage the site, or to the members of the community, where he wishes to submit the information.

0

Q: Submitting a Vulnerability / Exploit

This question is in relation to submitting a vulnerability to sites like packetstorm or exploitdb. I have found a SQL Injection floor in a piece of software, that the version number 7.0.0. There currently is no submissions for this version. However in a previous version 6.0.3 there is the same ...

exploit

Scott Pack

I was just about to throw out an answer, and then I realized where he wanted to submit it. At face value it doesn't exactly feel like responsible disclosure.

Iszi

@ScottPack Ah. There's a point to that as well.

Scott Pack

que?

Iszi

@ScottPack I meant "good point", but apparently failed to convey it clearly, with the level of verbosity attempted.

Scott Pack

Indeed.

Iszi

18:17

I'm in an odd state today. Not sure why.

Scott Pack

I sometimes read the news. You're in an odd state every day.

2

Iszi

@ScottPack You following the comment chain on that question? Please let me know if I wander off target.

In other news, something cool is supposed to be happening here in the next 20 or so minutes: spaceflightnow.com/atlas/av031/status.html But, given how things went the last time I made such a claim, I hesitate to offer any guarantees.

Scott Pack

I think your comments are fairly well on base. Or, at least, I agree with them.

Iszi

18:40

And, this is why I don't give guarantees about these things anymore...

HOLD EXTENDED. Liftoff will not occur at 2:46pmEDT while Centaur interstage purge issue is worked. No new time. http://tinyurl.com/GoAEHF2 #AEHF

Tweeted by SpaceflightNow on May 3, 2012 at 6:37 PM

Scott Pack

Meh, it's a test.

Iszi

@ScottPack No, this one's an actual launch. The one I put out last time was a test. That one eventually did happen, but late.

Scott Pack

I was a little disappointed, actually.

"Oh look, a lot of smoke. Looks like some of the cars I drive behind."

Iszi

Yeah, that happened on my way home. Never did catch up on the video.

Gonna miss this one too, it looks like. I'm leaving in 14 minutes, and the issue they're troubleshooting will require an on-site check at the pad. No way they'll get there, be done, get back, and good to come out of the hold in 10 minutes.

@AviD @RoryAlsop Would one of you mind topping off the close votes on "Submitting a Vulnerability / Exploit" please?

AviD

19:29

@Iszi done. and added @ScottPack's comment too.

Scott Pack

19:59

I was just about to explain that a known vulnerability in version 6 does not mean they know it exists in 7, but yeah, then I saw his disclosure targets...

CodeInChaos

20:11

One http code I miss is a standardized "Blocked by censoring proxy"

Gilles

@RoryAlsop thanks!

Thomas Ward

23:08

0

Q: Reliability of DNSBLs for Stopping Forum Spam

I know that certain DNS Blacklists are considered more reliable than others, in that they don't have as many false positives. I run a forum that is known to be spammed, and I've installed a mod to incorporate multiple DNSBL lookups with varying weights in order to have less false-positives by co...

tools

in case anyone has any input/answers :)

also, hiya!

Transcript for