Armored Penguin » Security

CanSecWest Pwn2Own contest results

VulcanRidr — Sun, 30 Mar 2008 04:59:58 +0000

This is one I have been watching. The CanSecWest security conference featured a Pwn2Own contest, in which a set of fully patched laptops, one running OSX Leopard, another running Windows Vista and a third running a patched version of Ubuntu Gutsy Gibbon.

Day 2 saw the takedown of the OSX machine with a Safari bug, which was previously unknown. Today, the final day of the contest, the Vista box was compromised with an unknown Flash exploit. Another term for an unknown exploit is a zero-day.

Zero-day exploits are almost indefensible. This is why I preach the sermon of defense in depth. Always have defenses in place that allow you to detect intrusions, and these defenses be layered. This gives you options to thwart the attack, even if it is only to start by pulling the ethernet cable.

As for the competition, I am somewhat surprised that the OSX box, which is Unix/BSD based fell first. However, it was an application-based attack versus a core OS level compromise…

Does this make Linux invincible? Absolutely not. It does say something about closed-source versus open source development, but there are also vulnerabilities in open source software, but there are more eyes available to look at it. We should never let our guard down, even running open source.

Hardware setbacks

VulcanRidr — Mon, 17 Mar 2008 14:40:17 +0000

Well, its been a heckofa week. I found the problem on defiant, my workstation and recording station for the podcast. /dev/hda is dying a slow and agonizing death. I have a replacement drive, however this weekend was chock full of activities. Saturday was spent with a friend of mine pulling the carbs off of the bike, finding and fixing the bent choke linkage, and getting her running. There are still carb balance issues, but she is running better.

Sunday was my youngest’s 18th birthday, and she wanted to go to the Melting Pot, which was a great experience but expensive.

So currently, I am backing the information off of defiant, and will hopefully be able to get the to the task of rebuilding in the next day or so.

As if that is not bad enough, crazyhorse, my firewall, finally gave up the ghost. I found I had no vpn access to my home network from work, and thought it was a problem with Comcast. However, I got home and checked it, and the drive light was on solid, the CDROM drive was flashing and the power supply was hot. So I spent friday night pressing the SPARC I have been building out into service…Until 2am saturday.

Once I get defiant back up and running, I plan to get some recording done.

New firewall

VulcanRidr — Mon, 03 Mar 2008 02:11:24 +0000

I’m building a new firewall box. It is an Ultra Sparc Ultra 5 that I inherited. It has a 333MHz UltraSparc IIi processor with 384MB of RAM and a 26GB drive.

This will replace my current box, which is a PII/233. I’ve built a minimal Debian installation, then added the tools I need, such as snort, tripwire, iptables and other tools.

And with every device you put on your network, make sure you scan it before you bring it online.