This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you
and a fag pwned, in your digital stance getting firewalled ho, cause I'm riding the net in
my six-fold, I was a dick with my 56, now with my cable I'm able to get that stable,
on the out, my name is Ace and I'm a Leo, on the digital highway, my name is Neo and
I'm a hero, in a flash, I'll screw you on burning dreamcast, you need some ISO, let me through
my hard drive rifle, our exchange you could never stifle, in a digital hug, you just caught
the love bug, I bootlegged your CD, I caused a fight between Un and Jay-Z, your CG, it's
all gonna be free, whether we take it by force or we take it nicely, you feel that rattling
your phones, when I tell you we just hacked out Jones, and NASDAQ leaves your fight on
your back, cause I am he who loves to hack and crack, cause I am he who loves to hack and
crack, this is dedicated to the hackers and the crackers, serial codes, source codes, ISOs,
RANs, SIFs, SIFs, this is dedicated to the hackers and the crack, this is dedicated to
everybody and welcome to Binary Revolution Radio number 163, I am Stank Dog with you again
this week, our air date this episode is September 12th, 2006, and you're in for a special treat
this episode, as I try to keep from spitting all over myself, we are actually coming to you
with another Bin Rev First, we bring you lots of firsts on this show, so this week we're doing
our first ever, ever, ever, I'm having a really bad time with the show today, we're doing our
first ever, is what I'm trying to say, Double Header, our double feature episode, back to back
episodes of Binary Revolution Radio, trying to get back on track here, get a couple very
technical shows in this week, and kind of get the flow going to the show again, and the
reason this is a first on Bin Rev Radio, this particular episode has two reasons for being
a first, it's the first time we've ever done a double header, two episodes, but this is
also the first time where my co-host has been live in the same room, where we're actually
not on the phone, we're not thousands of miles apart, we are actually about a foot and a half
apart, so Quine, welcome to the show.
Alright, thanks, I'm glad to be here, thanks for having me.
So, I'm not sure about the sound quality, we did as best we could trying to do some
sound checks and stuff up front, but I'm so naturally loud that it kind of made it a
little bit hard getting a nice decent sound check, so we're going to see if this holds
up, and hopefully there's not too much background noise in this episode, but it can't be worse
than 159, I mean, let's move on, and since we have two episodes this week, we have, we're
going to, let's see, we don't, we're going to kind of split up all of our normal housekeeping
stuff and split up our emails, so that we have more time on each individual show for
the main topic of that show, so, did you have any kind of housekeeping, actually, we should
probably mention, we usually mention this at the end, we'll mention housekeeping that
our BR407 meeting is this Friday.
Yes, it is.
So, this airing on Tuesday, I'd say Thursday, Friday, three days from, kind of, four days?
Well, that is if everyone, you know, listens to it by then.
Yeah, nobody listens to the show, what are we talking about?
So, other than that, anything else worth mentioning?
No.
Well, you're going to be, actually, let's give a little back story to the, to the, today's
topic.
Okay.
The, today's topic being open source security tools, which is kind of a vague topic, but
I wanted to do this episode because you put together a presentation for this for an upcoming
conference or something, what is that about?
It's not, open source security tools, open source in general is just such a, I mean, that,
that, that topic could be, you know, a series of shows in and of itself, let alone its own
show, its own dedicated radio show.
So, this, this topic is just very, I mean, we're scratching the surface on this, and hopefully
it'll, it'll uncover some things, maybe, maybe a few people that know, or if anyone's just
getting into a subject area like this, and kind of plant seeds in people's minds of, you
know, more tools they can go out and find.
And some of these tools that we're going to talk about today, many of our listeners have
not only heard of, but are very, very familiar with these tools, but some of them they may
not have, because there were some that I was not familiar with.
So, hopefully, even though a couple of them you may have heard of before, maybe you'll hear
something or learn something new about them that you didn't know, but you'll also pick
up some of the other tools that we, that you may not be familiar with.
So, yeah, let's, let's do, we're going to split the email up this week as well, but let's
do a couple of this episode and a couple of next episodes, so let's give that a shot now.
All right, so actually, kind of, let's put this under the email housekeeping portion.
I don't want to read the emails, but I wanted to give a quick thanks to Craig, who sent me
an email about having the file size on the podcast wrong last week.
When we copied the file over, we have a script that copies the file over from one server to
another, and it was uploaded fine, it streamed fine, the original file that we sent out, everything
was fine with that, but the script that copies the file choked for whatever reason, so it
sent over, out of a 15 or so megabyte file, it sent over a couple hundred K.
So, it just died halfway through, and I didn't realize it when I added it to the podcast,
and we have a little, kind of a, I won't say a little, a little bit of a content management
system that we use to feed the podcast feed, to feed the podcast feed, yeah, something like
that.
So, that was, that was my mistake, and I fixed it quickly.
Thanks to Craig for sending me an email about that, letting me know.
Now, as far as the email, I think really, there's, just as one very short email, we'll save
the rest for the next episode coming up in an hour and a half, stay tuned for that.
So, our first email, and only email for this episode, comes from Prince Vegeta, and it is
very short and to the point, and it just says, quote, I wanted, I just wanted to say that
episode 149 was one of the best.
So, straight to the point, Vegeta, thank you for that, I appreciate it, and episode 149,
for those of you who may not remember offhand, was with our good friend, Tabiz, long-time
friend of the show, long-time friend of mine in real life from the BR561 meetings, and also
our newest forum moderator, Tabiz, so welcome him to the forums, to the, to moderating of the
forums, of course, he's been around for a while, as many of you know.
Now, the topic on that episode was digital forensics, where we went down this long list
of different tools, with some interesting discussion and information about different
forensics tools, whether it was hard drive, encrypting, decrypting, data recovery, etc., etc.,
that sort of thing, and if you like that show, then I think you'll also like tonight's show
as well, so I thought that was kind of a good segue into the main topic tonight.
Alright, so, it is also good to know that people are still listening to the archives,
I know, um, we do get email occasionally of somebody replying to something from even
early episodes, or, or months old, several months old episodes, it's great that people
are still listening to those, I do still believe, I occasionally will go back and listen to an
old episode, or look for something specific, and I am surprised and proud of how well they
stand up.
A lot of that stuff has not expired, it hasn't changed a whole lot, so the principles and
the things that we're trying to explain and hopefully teach about, the concepts don't
really change that much, so really, you can start listening to some of those old episodes,
even starting with one and try to catch up sequentially, or listen to the newest one while you start
to catch up and keep up to date, and there's still a lot of good information, so please feel
free to take advantage of the archive, don't worry about the bandwidth, I'll cover that,
that comes out of my wallet, so, um, I'm glad to do that if you're enjoying and learning from
the show.
So, that being said, Quine, how about we kind of segue here into the main topic, which again
is open source security tools.
Now, first of all, why are we, we're talking about open source tools, not free tools, not
freeware, not whatever, I mean, open source tools, which obviously means the source code
being available.
The source is available, and generally you can modify it, um, of course, with some licenses
there are constraints that suggest that you should, should I talk, suggest that you should,
um, redistribute that, that source, the modified source, uh, with the same license or with
acknowledgements that are defined within the, uh, the license.
So, this is very, very specific.
This is what the man told me I needed to talk about.
Oh, so, so, well, see, the thing is we could, honestly, we need to limit it because there's
so many security tools out there we could spend episode after episode, we could spend an episode
on each individual one if we really wanted to try to focus on details of each individual
tool, which actually may be good shows to do at some point.
Now, open source, of course, referring to open source code, the source code being available
that you can view the source and see exactly what the program's doing and how it's doing
it.
Now, why are we, when you say open source tools, why are we focusing just on open source
tools?
We're not covering freeware, right?
Right.
This is, this is software for which the, the source code is available for you to view, uh,
generally, we're, we're referring to ones that you can modify and redistribute, uh, some
of the licenses, of course, say that you need to redistribute it with the same license, um,
for everyone else to see, uh, that source code as well and modify it and do the things
that you did to it.
Well, and, and licensing is an interesting term to bring up because there are lots of different
types of licenses on open source software.
Yeah, there, there are a ton and there are a few that are pretty, um, adaptable, uh, one
of which being the artistic license, uh, usually won't find, uh, the official definition of
an artistic license.
People are allowed to kind of adapt that, um, to, to, you know, how they want, uh, to come
up with their own constraints or licensing terms, but it kind of falls under this artistic
license umbrella.
Uh, ones that other people are most familiar with, of course, are like the GNU general public
license, the GPL, uh, the LGPL BSD license, Mozilla public license, uh, and of course Apache,
um, and there are a few others that, uh, could be used as an open source, or, uh, excuse
me, an open source license like Creative Commons.
Um, yeah, and you know what, I'm kind of thinking to myself, we really could go into a whole episode
just about that, so we probably shouldn't spend too much time here, except obviously knowing
that there are several different types of licenses, but all work well with open source
software.
So maybe we'll do another episode about licenses separately one day.
I'm not going to put you on the spot now to do it, um, but...
I thought I wiped the sweat from my brow.
But we do, it is worth mentioning, of course, that there are, the licenses exist on these,
because sometimes people that don't understand open source don't realize there is a license,
it's just that the license allows you to redistribute the source code, look at it, modify it,
et cetera, whatever the limitation, but there is an actual license.
It doesn't mean there's no license, there's just a very liberal license on what you can
do with that source code.
Right.
Now...
Within the context of the presentation, really what we mean by open source, um, is, uh, the
one that goes by the jargon file, which is, um, and I quote, term, open source is a term
point in March of 1998 that, uh, followed the Mozilla release to describe software distributed
in source under licenses guaranteeing anybody rights to freely use, modify, and redistribute
the code.
So just keep that in mind.
That's really what we mean when we say open source.
So textbook definition, so to speak.
Now, what are some other factors?
Like, let's say you're looking at open source software.
Now, again, we're, you know, from a hacker standpoint, a lot of this stuff, quite frankly,
we don't care about to a certain extent, like, we just want to download it, compile it, and
it works, but a lot of listeners of the show do have to be concerned with things like licenses.
What other concerns would somebody like that have?
I mean, and, and maybe even hackers to a certain extent might find some of this.
I mean, like, for example, for example, is it important, like, the, who's writing the
software?
Like, whether it's some, you know, 13-year-old kid who's writing his first application.
I mean, is, is stuff like that even come into play?
Well, yeah, I mean, you want to take into consideration, is this piece of software you're
looking at, is there a community behind it?
Is, is, does it have a good reputation?
I mean, if you're going to be running, you know, a project on the side, you know, that
you're, you're hosting something, you know, your website or your content management system,
as an example, what is the reputation of this software?
Or is it frequently, uh, known to have vulnerabilities reported in it?
Um, is it stable?
Is, is the team behind it, uh, core team as in the case of something like OpenBSD?
Or is it just a bunch of, of loose-knit, uh, contributors who are just contributing pieces
of code, uploading things, you know, uh, submitting things, um, into subversion or committing things
in CBS, you know, left and right with no real sanity checks here, you know?
Is, is there someone who's reviewing this code, so to speak, or is it just kind of people
throwing, um, snippets here and there and putting it together, hacking it together?
Kernel hackers.
Yeah, absolutely, you know, as an example.
As a good example, yeah, I think so.
So, another thing is maybe, is this, is this a mature piece of software?
Has it been around for a while?
Um, or is it just, is it, is it, is it an alpha, or pre-alpha, and has it been sitting
there for a long time now, or did it just come out last week, and is the, is the, does
it have kind of a, uh, exposure to the field, so to speak?
Now, and I kind of said this as a joke earlier, that hackers might not care, but to a certain
extent, we do care.
Does, is it work?
Is it going to do what we expect it to do?
Or is it going to give us false information?
So, we care to that extent, obviously, and if it's something that, again, some, some
13-year-old kid could have written, and it could be brilliant, you know, user feedback
and stuff like that comes into play.
You can, other people that have been testing it, beta testing, forums, things like that,
where they're giving you some feedback.
Yeah, I mean, you want to look at, is there a community behind this?
Is there a mailing list, um, or a forum, or a wiki, or something where people have information
available, and feedback, uh, user feedback available?
What do other users have to say about things like this, uh, about this piece of software?
Or, or is there, is there some resource you can go to, someone that you know that's used
this, um, software, and can vouch for its, for its stability, for its reputation?
Uh, well, and, and that actually brings up another good point, that, um, let's, again,
and this kind of goes back to maybe if you're using this in an office environment, or, or
again, even as a hacker, for the most part, hackers provide their own support, I guess you
would say, but sometimes you'll find a, a problem or a bug, or let's, again, shift to
the office scenario if you're actually wanting to use this as a security professional, and we
all know how much I love them, um, but seriously, you do, sometimes you need official support,
and you, okay, so let me phrase it as a question, you can or cannot get support for any, some,
or all of the tools that we're about to talk about?
Uh, some of these, well, most of the ones that we're going to talk about, um, are generally
not, there are a few of them that do have support available.
In the cases of ones that, uh, don't have official support from the developers, or from
the people who, who manage or control this piece of software, there are some organizations
that do offer third-party support for open source applications.
So let's say you go to Red Hat, and you buy, well, or you download, you know, you get Red
Hat Linux.
They'll offer commercial support from there.
Well, Fedora.
Um, well, no, you can still get Red Hat Enterprise.
Uh.
For free?
I mean, you could download the source.
Really?
Uh, hmm.
Well, you can get the binaries as well, but, like, to do updates, you have to be, you have
to, oh, yeah, from where you can register one box, basically, per email address.
Um, but you can get commercial support from them for certain pieces of software that they
may, uh, sell.
But there are organizations, there are companies that basically devote themselves to supporting
open source software that might not otherwise have a support team behind it.
Again, this kind of goes back to getting support from the user community, from the developers,
um, from any other, or just learning about it yourself and kind of being self-sustaining.
Right, and that's, that's the hacker side.
Right.
That's the hacker, the hacker methodology, unfortunately, because part of it is, part of it was from
the hacker side where it's just like, my experience with support of any and all kinds that I've
ever had is that the person on the other end of the line knows less than I do about the
software.
And that gets really frustrating, or I can't understand what they're saying to me, no offense,
but they can't speak the language, and they want to walk me through the level one stuff.
Oh, turn on your computer, you must restart your computer.
Okay, look, I've done that, and I've done taking a look at the code, and I've sniffed the
packets, and it looks like they're being malformed.
Can I talk to somebody a little bit higher up?
Okay, buddy, hold on just a minute.
Did you reboot your computer?
Yes, I rebooted the computer, shut up.
Yeah, so yeah, I find that support for open source software is infinitely better than commercial
software, because of commercial software vendors, that comes with, as part of the price of the
software, with the open source, it's more community feeling.
Like, what jumps to mind for me for that is, well, besides Linux, which has got so much
support all over the place, and I know some of the listeners are kind of tired of hearing
about this piece of software, but Asterisk is like that as well.
So, it's got a lot of aftermarket support, and actually, the other thing that I have to
say I like about the way they work there is that they do provide the software and make
their money on the support, but so do a lot of other outside third-party companies provide
support for it.
A lot of free forums, mailing lists that are free provide some sort of support for it.
Even our forums, a lot of Asterisk stuff gets worked out and debugged through the bin rev
forum.
I mean, so many different ways that you can get support, so obviously, I guess the bottom
line is the more, the better.
Well, yeah.
As long as it's reliable.
Well, you've got to take into account that a lot of organizations, a lot of companies, it's
all well and good that you can get free support for this piece of open source software via
forums and user communities, but they kind of have to CYA, so to speak, and cover their
own butts and have official commercial support so that their customers, you know, they can
kind of give this warm and fuzzy to their customers and say, oh, well, if we do have a problem with
such and such piece of open source software that we run, we can refer to company XYZ that
supports it.
So we don't have to be, you know, scrambling to look through docs to figure out why this
is doing this.
Well, and something else kind of funny and an interesting way, and an interesting and
a funny sort of way is there are some tools out there that are perpetually in a state of
beta.
Yeah.
Right.
Because they never want to officially release anything, possibly that being one of the reasons
because then they have to support it, then they have to answer for this being final,
fully tested code and things like that.
And in their license, they can say, hey, this is, and this is very common, as is, we
hold no responsibility or liability and stuff, those kind of clauses that you'll find a lot
of open source software because they're not a company, they're not making big money, so
they're not going to take that liability.
But I actually, a lot of commercial software has been putting those clauses in there as
well, so maybe that's because they're stealing a lot of open source code and putting it in.
But that's a whole other topic.
That's a show in and of itself.
Exactly, we won't go there, although there's been some great stories.
I know a friend of mine, well, Abaddon, better known probably these days as Mike Lynn, had
one of the funniest stories of that that I ever saw.
It was over on meme streams with the, oh, now help me out here if I can't remember the
name, but it was, I think it was Pear OS or something, the Apple, where it was a copy
of Apple, and he decompiled and found actual evidence of source code that was ripped off
where the byte code matched or something along those lines, it was hilarious.
I think it was Pear OS complained that Cherry OS had taken code from them.
That's what it was.
And it was like all the, I mean, it was identical.
And they were saying that, you know, we never, Cherry OS was like, we never took anything.
Yeah.
I think that, you know, I could be, yeah, we are not held off, don't hold us liable if
that's a little bit off, but I do think that's accurate.
That's the gist of the story.
Exactly.
Without wasting time going and looking it up on the proverbial interweb.
And there is one other thing that I think is important to mention before we start going
and listening and talking about some individual tools, and that is the other big, big, biggest,
and I would almost say the biggest benefit.
I really would say the biggest, well, I guess realistically the biggest benefit is that they're
generally free.
Let's be honest.
I mean, that's why a lot of people are using them.
But the biggest benefit, in my personal opinion, is the fact that because you have the open source,
that makes them infinitely flexible.
If you need it tweaked or changed, you have the source code.
You can recompile and make it do what you want.
So flexibility, I would say, is a big thing.
Now, do you think, that being said, the majority of people are just compiling it as is, or even
downloading binaries.
Even though it's open source, they'll still download the binaries of it and not mess with
it.
Do I think that's the case?
Yeah, I think it usually is the case, but there still is a vast number of people who are fixing
bugs in this software.
Could there be more?
Yeah.
And I think a lot of people don't contribute back to these projects.
They don't submit bug changes.
They don't.
That's why so many projects die.
It's because the one or two people who started them and maintained them have lives, too.
And they can't devote all their time to this.
So they need people to contribute changes back and contribute fixes, give feedback, take the
helm when it's needed.
My world and welcome to it.
Yeah.
Right.
All right.
So we're going to actually, is there anything else that you want to talk about before we
get into, like, glisting through some tools and discussing some of the specific tools?
Well, no.
I just, I think we can segue into kind of what do we mean by open source security tools.
Okay.
And then we can kind of go into the tools themselves.
All right.
So what do we, you know, we talk about what open source is in the context of this talk.
Now we want to talk about what we mean by open source security tools, because even that
in and of itself is kind of nebulous.
Right.
I mean, that can mean a lot.
That can mean different things to different people.
Right.
And so actually there's kind of a misconception that people have on, and again, I'm not going
into a rant about security professionals, but people don't realize that they think that
if you become a security professional, you get paid to hack or pen test or stuff.
Right.
And a lot of that work is boring writing up of, well, I mean, not to insult it, but it's
writing up a lot of password policies and rules for the company that you have to follow.
You're only allowed to use this VPN client, or you're only allowed to use this type of
antivirus, and you have to update it, and you have to change your password.
You have to do a lot of policy work, and that is, that's a lot of what most people, anybody
who thinks they're going in are going to have exciting pen testing and lots of tools and
playing.
A lot of it's writing and, well, again, security is just in the same vein that you can do a
lot of different things related to hacking, because hacking means different things to
different people, so does security.
Security or information security, computer security, network security, whatever you want
to call it, has so many different aspects to it, and there's so many different paths you
can take.
Exactly.
That's what I was alluding to.
Right, right.
So, now, you broke these down into three different categories, or do you want to go there yet,
or did you still want to?
No, I still want to just kind of clear the air, just so everyone's on the same page, so
to speak.
What we mean by open source security tools in the context of the talk is software or applications
that are covered under an open source license that are designed to either test or enhance
one's security posture.
That could be an attack in one case, or, you know, testing and security testing, or defense.
Also, we have some other things that may not actually be security tools, just security
tools, but may have an application to security.
I think, for example, OpenLDAP, which we'll get into a little bit later.
I'm sure some people are familiar with that.
We'll go over that a little bit more later in the talk.
So, we're going to cover, without further ado, we're going to actually dive into the tools
themselves.
And you broke them down as far as, and I like that.
I think this is a good flow to the presentation that you're going to give, as well as for the
show, is breaking them down into, and kind of what you're just alluding to, but tools
of attacking, tools of defending, and then other, I guess, miscellaneous, other things
that aren't quite as easily categorical.
And actually, I found it interesting that some of these you classified in a group that I really
didn't think that was where it would go at first glance, but you did it for a different
reason that I didn't really think of at first.
So, I guess we'll just kind of go through the list, and as that comes up, we'll...
Right.
Okay.
Yeah, like I said, we're going to start with attack tools.
And again, as we said before, this is just scratching the surface.
I mean, this is not representative of all the tools that are out there.
Of course.
I mean, this could...
We have so much time to fill and talk, but we could go on and have a year's worth of
shows just dedicated to this.
I mean, we could branch this off into its own radio show.
Yeah.
We're probably going to talk about, what, 10, 15, 20 tools in this whole thing.
Right.
And each one of those...
That's not an exaggeration.
Each one of those could probably be an episode.
Exactly.
They really could.
They're going to the depth, especially because they're open source.
We can talk about how they do it, why they do it, talk about source.
I think that might be dry radio to listen to, but...
Yeah.
But, you know, it is...
This is just scratching the surface.
But hopefully, with this information, people will kind of get motivated to learn more about
them or say, oh, I never knew about that tool.
I didn't know this tool did that.
And again, some of these tools, our listeners are going to be very familiar with.
Others, maybe not.
So, I guess, let's just kind of go through them.
Enough about that.
Starting with...
Let's get running.
...attacking tools.
So, we're going to talk first about Edercap.
And for those of you who aren't familiar, Edercap is an active and passive protocol analyzer
or sniffer, as it's commonly referred to.
It has a variety of features.
Most notably, and what a lot of people who are familiar with Edercap know, is that it
does ARP poisoning, address resolution protocol poisoning, which, for those of you who aren't
familiar, are familiar, ARP is what maps IP addresses to MAC addresses or hardware addresses.
And using that technique, we can effectively do man-in-the-middle attacks on switch networks
and get in between hosts and capture traffic that would otherwise only go between them.
It also supports data injection so that we can actually inject data into the traffic stream that we might have control over on, say, a
switch network or in a shared network where we really have to do man-in-the-middle or ARP poison.
And we can just inject the data into the traffic stream.
And as do a lot of other tools, Edercap also has OS fingerprinting or operating system fingerprinting to let us know what operating system the target host might be running.
This is passive, of course, as opposed to NMAP, which is actually sending traffic to the host and is a little more detectable.
This isn't completely stealthy, especially if you're doing ARP poisoning, then traffic is actually being sent out.
And don't a lot of intrusion detection systems.
I think you were telling me this when we were doing this at the meeting about a lot of intrusion detection systems, IDS or IPS,
they look for an unusually large amount of ARP packets, and that triggers some of them, right?
There are some IDSs that have that capability, but bear in mind that most intrusion detection systems typically look at layer 3 and up,
which would be the network layer, for example, IP.
They would look at IP traffic and up.
ARP poisoning occurs at layer 2, or the data link layer.
Now, also, and I've got to, this is actually one of the ones I referred to a few minutes ago where I wasn't sure,
I was kind of surprised at where some of you classified some of these enter cap as an attack tool,
because I've always thought of it, I guess I never really thought too much about the ARP poisoning or the data injection,
I've always thought about enter cap as a completely passive tool, a sniffer, like you said,
that's what they're commonly referred to as, I've always thought of it as simply a quiet, passive tool
that's just sniffing the data, doesn't let anybody know it's there, doesn't send anything out,
it just stays in the middle, quietly sniffing all the traffic and either redirecting it to you or saving it
so that you can come look at it or get it later, or whatever, so I never really considered that an attacking tool.
Well, it really could be, I mean, there are plugins for enter cap that do different things,
one of them, for example, would be to find other nodes that are doing ARP poisoning.
Another one could be the Banshee plugin that was in there for a while, and I believe it's still in there,
that actually just kills connections over and over again.
So that's, of course, a little more of a denial of service, but a lot of these tools may feed into one another.
I mean, if you're sitting there capturing traffic, that could be data that you could use later,
such as, you know, usernames and passwords, or you could inject data in there
and cause something else to occur, which would, you know, be a type of attack.
So a lot of these tools may be chained together to formulate one big, giant attack, so to speak.
Better cap is covered under the GPL, so...
Well, and every one of these, I don't know if we want to mention the license for all of them,
if it's too much, but, um, yeah, these are all under some open source.
Your mileage may vary. Go check out the individual ones, and...
A lot of these, a lot of these, of course, will tell you what license they're covered under.
Sandy, naked pictures of your boobies license, is that all under artistic?
I don't know, that's, um...
It's an artistic license, huh?
Yeah, it's definitely an artistic...
Well, what do you call it? What do you consider art, you know?
Well, that's not even... Let's not go all Mappletharp here or anything.
That's a whole different show.
Well, I don't know what show that is, but it's not different.
Um, now, sticking with... Staying on topic here, um, Ettercap, there is a GUI for that, right?
Well, there's the, uh, there's a Curses interface, which is a console menu-driven interface,
but there's also an actual GTK, uh, interface for it, so you can actually point and click.
Right, Curses is what I mean, that's your...
Right, it's, it's...
It's not a Windows, it's not a windowed GUI, like, uh, uh, an ex-Windows, or, uh...
Right, it's a, it's a character-driven menu interface.
But there is also a, a GTK, or, you know, you know, GIMP Toolkit, uh, interface.
Now, is there much difference between the two? Are they pretty...
No, they look pretty much the same.
Really?
Just, um, a little, you know, cleaner for some people.
So, so, alright, well, Ettercap, again, it's kind of an interesting that you put it into attack tools,
but, um, since I always think, I think of all Sniffers, the whole category, as a passive tool,
so it gives me a new way to, to look at it and to think about it.
Now, what else, what other kind of attacking tools do you have in here?
Uh, the next one that we're gonna talk on, uh, touch on is Yersinia.
Um, Yersinia is really, well, I think we called it at the BR-407 meeting, uh,
the network fuck you up the ass tool.
That was, that was how it was...
Well, it's easier to pronounce than Yersinia, Y-E-R-S-I-N-I-A,
just in case we're not enunciating.
Right.
It's a very unusual name.
Um, so Yersinia is a multi, it's a multi-protocol attack...
It's an accurate name, too, by the way.
It really, that's an accurate name for the tool.
Network fuck you up the ass tool.
Exactly.
Yeah, and the reason that being is, um, whereas a lot of other tools,
tools, the network attack tools, or packet crafting tools, um, do just that.
They craft packets.
Uh, Yersinia really does more, does, like, layer two frames.
It does layer two attacks.
Uh, some of those include Spanning Tree Protocol, um, CDP or Cisco Discovery Protocol,
uh, DHCP, um, HSRP, which is Hot Standby Router Protocol.
It also does VLAN Trunking Protocol, and 802.1Q, which is also used for VLANs.
Um, so what this allows us to do is, uh, to give you an example, Spanning Tree Protocol is used, uh,
to eliminate, uh, loops within massive switch networks, uh, and within STP, or Spanning Tree Protocol,
it, it also allows, uh, switches to know where other switches are located,
so that traffic can get from one switch to the other, um, and in, in the case of switches being interlinked,
it will, it will cause these, these crazy traffic loops, uh, so within STP, our, we have what's called the root bridge,
or the root roll, and that is kind of like the core, that's, that's the switch that knows, kind of the, the infrastructure,
that knows the, right, there's one, the topology.
There's one that's a, everything kind of goes, an official, yeah, right.
And there's all these other, uh, Spanning Tree is, is, is a mathematical, um, network, a mathematical tree,
and it uses these, the Spanning Tree Protocol uses these different, uh, these different path costs
to determine where, where the traffic needs to go, and what the shortest path is, and everything.
Well, Yersinia, as an example, with, with regard to STP, allows us to do things, um, like, become the root roll,
so that all traffic kind of goes to us.
Instead of whatever the other root roll, right, and it also allows us to send out, um, raw, uh, topology updates,
so that we can tell STP that the network topology has changed, and it'll have to go recalculate all these, uh, path costs and everything.
Which can be bad, because it can kind of bring down a network, do you think?
Um, in some cases, as, as STP has to, uh, learn, relearn the network.
Um, it also, Yersinia also allows us to manipulate VLANs in a Cisco environment via, uh, VLAN trunking protocol.
We can add VLANs, we can delete VLANs, and what that would allow us to do is, um, just that, create, create our own virtual LAN.
Uh, Yersinia can also be used to actually hop VLANs, which has commonly been something that people have, have, have this misconception that VLANs can be used for security.
They were designed for security. They were really designed more for management, more for, uh, creating virtual networks within, uh, a physical, for, within, uh, a physical switch.
So, we can have virtual LANs that are physically on the same, uh, network device.
So, Yersinia can be used to actually hop VLANs, or to have all VLANs come to one port, uh, when they would otherwise not be, uh, sent to that port.
Yeah, but, uh, but the, the STP is my favorite part of it.
Right.
And, and actually, I had not heard of this tool. This is one of the ones that I said I, I was not familiar with.
So, this was a new tool to me, and I found it very cool. Now, this also uses Curses, is that right?
Yeah, there's a Curses interface. There's also, you can also, um, do it via the command line and just have, have it execute a particular attack.
Yeah. There's also, uh, you can, it can run in what's, kind of a server mode, where you can connect to it as though you were connecting to, like, an iOS device and kind of, uh, uh, run commands that way.
Um, they really touched on this a lot in, uh, hacking Cisco Networks Exposed.
Because the guys over at Arhant, uh, Arhant Security went really in depth with this, uh, with this utility. And they, they did a bang-up job talking about it.
And that, what was that again?
That was?
Uh, Hacking Cisco Networks Exposed, or Hacking Exposed Cisco Networks.
Okay.
It's a book.
No, that's why I wanted to make sure the listeners heard it.
And it, is that the, that's not from Singres, is it?
No, that's actually from, um.
They do the Black Hat series.
Right.
Who is it that does the Hacking Exposed?
Is it?
Oh, my goodness.
Okay, well, I guess we'll let the listeners figure out.
McGraw-Hill.
No, it's not McGraw-Hill, is it?
I don't think so.
I don't remember.
You know what?
You guys can look that up, you lazy bastards.
Alright, anyway, next tool.
Since I can't remember it, I shift blame to the listener.
See, it's easy as that.
Um, I, gosh, but it's gonna bug me for the rest of the show now.
It's sitting in the back of my head.
If I remember it before the show is over, I will let you know.
Right.
So, it would be great if we could somehow access information through some sort of a browser or something
online where I could look stuff up when I need to find the answer.
If they ever invent a technology like that, some sort of, like, inter-web-connected network of a worldwide
something like that, that would be really handy right about now.
So, yeah, Yersinia, I mean, the, these, these STP BPDUs, as they're called, bridge protocol data units, um, can cause massive
problems in, uh, networks that use Spanning Tree, um, or they can be used to make you the root roll, as I said before, and have a lot of traffic sent to you.
Now, of course, you need a machine that can, that can handle that, otherwise, you're, you're gonna be noticed when the network slows to a complete crawl.
Well, or maybe not, depending on how your network might be, that might be normal for your network.
Again, we could do an entire show on Yersinia, and, um, you know, maybe one day, maybe, maybe we will.
Also, uh, if you go to Yersinia.net, there's, uh, there was an entire, there was a presentation done at Black Hat 2005 that might be
really, really useful if you want more information on Yersinia. It's a, it's a really good presentation.
Yeah, if you want more, more detail on it, that's definitely.
About the attacks and how they work.
Right, because we're, we are glossing over these, um, talking about them from a, you know, give you a general idea of what a lot of these do,
and some of the features and stuff on them, and, um, but certainly, again, I've, gosh, this is like the third time I've said it,
any one of these could be an episode in and of themselves, but for this particular one, check out that Black Hat presentation.
Did you go to that Black Hat that year?
Uh, I did not.
Oh, five?
No, no.
Alright, so, this next tool, like, this is, what is this, NMAP or something? Do we know? Is that?
Well, it, I've never heard of this tool before. What exactly is this NMAP?
No, I'm just joking. Actually, um, what about, what, we're not going to,
we're not going to mention NMAP because I think, yeah, I think our listeners know that.
I was just joking around, but what about, and I was going to say this is a joke,
what about Metasploit? Will we, will we talk about that, you think, or, um,
I mean, a lot of our listeners probably know Metasploit, too.
Should we go into that one, or do you want to?
Well, I think we should just, um, I'm going to explain what it is.
Well, okay, so Metasploit Framework is, uh, for those of you who aren't familiar,
is an exploit development, um, framework.
Or, uh, it's also an exploit testing and execution framework.
Um, one, one of the most notable things about Metasploit or Metasploit Framework,
uh, really need to be more specific that it is the framework,
because Metasploit is the project.
Right.
Metasploit Framework is what most people refer to as Metasploit.
Right.
Uh, so Metasploit Framework, um, separates the exploits from the payload.
Everything is, is a module.
So you've got an exploit module for, say, MS04, 0011, as an example.
That's just the first one that comes to mind.
Uh, so you have an exploit that, that attacks that.
Well, then, once you've exploited that vulnerability,
you can then have a, have a certain action occur, a payload.
So, let's say you, you exploit that, or you exploit, uh, a vulnerability in Samba,
for which there's a corresponding Metasploit Framework module, exploit module,
and then you want to add a user, or you want to return a, uh, a shell, or execute a particular command.
You can kind of have different, you know, payload than going to PacketStorm
and downloading something that already has a, the exploit code, the shell code,
and, you know, everything already there.
You can, you can decide what you want to do.
Right, so like, if you had, like, if the exploit that you developed
gets you total root access to the box,
you could actually write three or four different payloads of what you wanted to do.
Do you want it to pop up a shell where you have root access?
Do you want it to upload a file that's owned by root?
I mean, you could write whatever payload, or is that...
Well, the, the, you, you can have, um, you can have multiple exploits for each payload.
You can have multiple exploits that have the same payload.
They'd be written, they're independent from each other, but they do the same thing.
But you can also have one exploit with multiple payloads.
That's what I'm trying to say.
Can't you have multiple payloads for each?
Essentially.
Essentially, essentially.
So, you know, like, like I said, you would have, you would choose the exploit.
I'm trying to think of one example off the top of my head,
and I can't come up with a good one, but, um,
it, the important thing being that it separates the two stages, the two phases.
Exploits being one separate part, and payload being a different separate part.
They're not independent, exactly.
There is a relationship between the two of them.
Um, but, they are two separate things.
Right, so, like, as an example, let's say, you, you encounter an IIS box, um, which, you
know, what are the odds of that, right?
Right.
Uh, and it's, for whatever reason, it's, you know, let's say, as, here's an example.
So, you have a Windows 2000, um, IIS box, so it'd be IIS 5, and, for whatever reason,
lazy admin hasn't updated his, his box, and he's running, uh, front page, uh, he's running
front page extensions, and, I'm, I'm, I'm, like, reading what, what, one of the examples.
It gives a specific example, sure, sure.
So, this particular one would be MS-03-051, and that was a buffer overrun in, uh, in front
page extensions.
So, you would say, you would choose that particular exploit, uh, target that particular server,
and then you decide what payload you want after that.
Um, so, let's say you could, uh, you could have it return a shell, a command shell to
you, you could have it add a user, uh, execute a specific command, or, in the case of Windows,
uh, actually inject the VNC DLL and have it return a VNC Desk Comp to you.
So, or, you could have, have it, um, you could write your own payload that did something
with you.
Right.
Even though the exploit, using an exploit that's already there, write your own payload for it.
Right.
And that's, that's, it's kind of hard to put that in, that's exactly what I was trying
to explain earlier, it's hard to put that into words.
Or, or write your own exploit and use a payload that's already there.
Yeah, see, that's, they're, they can be independent, but they don't have to be independent, and
it's, I don't know, I guess it's one of those things that, it is easier to see in real life.
That's a more visual thing, so, unfortunately, we can't do too much justice to it on the radio,
but, um, so, like, the current stable version of, and just for those of you who are familiar
with the current stable version of Metasploit Framework is, it's written primarily in Perl.
Um, that's version 2.6?
2.6 is the current version.
Uh, but the new beta version, which is 3.0, uh, is written, has been ported to Ruby.
Yuck, Ruby!
Don't, don't say yuck Ruby.
So, Ray, I'll say yuck Rails, I can say that.
I have, I'm not a web guy, so.
Um, and there, there are multiple interfaces for Metasploit Framework.
There's a, a Curses interface, um, well, actually, it's not, not really, no, it's not a Curses
interface.
It's a, it's a, a, can you term, read line interface, but, uh.
But it's a similar.
It's a shell kind of interface.
I don't, I don't know why I said, I said Curses interface.
I'm thinking, I'm thinking you're sitting at a Nettercap again.
Yeah.
Um, I don't, I don't have my, my notebook with me.
Um, but there's also a, um, there's also a web interface for this as well, right?
There is a web interface, uh, it comes with a, a web, a little web server, um, and you
can kind of point and click at your target, select.
You can filter by OS, filter by application, filter by architecture, um, pick what exploit
you want, pick the, the payload, fill out a, fill in a few fields, and click, and there
you go, and it's attacking your host.
So, you have to have done a little footprinting ahead of time to know about your target system
and what they might be running, what vulnerabilities they might have, that sort of thing?
Generally, yeah.
That would be advisable.
And that would come back to Nmap, which we glossed over, and maybe we should have.
Right, yeah, we, we, yeah.
Yeah, I, I, I think that, I think our listeners know what, yeah, they know Nmap, and they know
MetaSplight pretty well.
There are some cool features, uh, in newer versions of Nmap, and there are some cool add-ons
that are coming out, uh, one being like the Nmap scripting engine, um, but that's, that's
something we can go over in another show, or even on, on the forums.
Well, it's, it's still being developed, right?
That's not out officially, is that a beta, or is that?
No, Nmap scripting engine is out, I'm not sure what the status is right now.
It's interaction with MetaSplight?
No, this is.
No?
Okay, separate, okay.
I don't see why you wouldn't be able to script it in there, have these things interact, as
in the case of something like Biddy Blah, by, uh.
Alright, well, and let's see, we talked about the web interface for it, so point and click
and hack the intar web.
That's always good.
Um, I should give this to, um, I should give this to, um, uh, Verbal, because I think he
sucks at the internets, right?
Uh, he sucks at the online.
At the online, I'm sorry, that's what he sucks at.
At the online, yes, our listener last week said that he sucks at the online, so maybe
he could use this.
Now, you know, here's, here's another tool I see here on your list, which I'd be tempted
to skip over, because some people might know this, but I actually, I would rather at
least mention it briefly, and that is HYDR, or actually, it's what, THC?
THC, uh, the hacker's choice, um, that's a, uh, European hacking group that's been around
for many, many, many, many years, and they've, uh, they've written a variety of tools, they've
had such a profound influence, and they've done so much for the community, um, they've
written war dialers, they've written, uh, we, um, they, they, they've written a lot of
tools.
Yeah, they, the, the HYDR, though, is, is something, the THC HYDR, I, should I say THC every time
I refer to it, what's proper, okay?
We could just, we could just call it HYDRA, um, HYDRA is a, is a multi-protocol brute force
cracker, and it's parallelized, parallelized, parallel, parallelized, so it can run, uh,
multiple jobs at once, um, it performs, uh, 36 different, uh, attacks against 36 different
services, including, uh, Telnet, FTP, SSH, uh, Oracle, uh, SNMP, uh, the one thing about
this is, it's very noisy, so, I mean, you're, you're, all brute force tools are, bear in
mind, this isn't brute force, this isn't your typical offline password cracker, this is actually
attempting username and password combinations actively against a service, um, well, there
are command line, there's a command line version, and also a, a GUI version as well.
Well, and, and actually, speaking of that, maybe that's a transition, a transition to
another tool that I had heard the name of, but hadn't really seen too much until you showed
me more about it, and that is WebScarab.
WebScarab is by OWASP, which is the Open Web Application Security Project, um, OWASP, O-W-A-S-P.org.
Uh, WebScarab is a web application security testing framework that's written in Java, so anybody
who has, who has an aversion to Java should probably just either get over it or avoid
this tool, um, but I like this tool, so as much as I like to get over it, I actually did
like this tool a lot, so, even though I hate Java.
Right, uh, it, it's got a, it's got a variety of features, um, including an HTTP proxy, which
doesn't seem like much, but that allows you to, uh, do, like, manual request interception,
so you kind of, you, you know, connect back to yourself before you go back out, or connect
to a box running this and go back out, and manual request interception will allow you
to actually manipulate, um, HTTP headers, add HTTP headers, uh, remove HTTP headers.
Uh, it also has a web spider, so you can spider a site and crawl it.
Uh, it also has SOAP interaction, um, for anybody who's doing, like, a lot of web services-based
stuff.
Uh, one other thing that's, that's really...
I wonder how good that actually works, though, because that seems like it'd be very difficult
to, to really step, well, I guess, maybe not, I guess you can follow the logic along just
as much as, as anything else.
I, I, I, I want to see it in action, doing something SOAP-related, if there's such a phrase.
Yeah, and, and, and web services is a huge deal right now, and it's going to be big for
a while, so this might be something, if you're doing a lot of web, uh, web services development
or web application security testing, this would be a helpful tool.
And one other thing to mention is it has a, um, and this is just a few of the features,
it has a, a fuzzer built in, so you can do automated substitution of values, uh, which
might help expose, like, cross-site scripting attacks or SQL injection attacks.
Um, and it also has another scripting interface, uh, via Bean Shell, so you can do, like, some
built-in sort of Java scripting, not JavaScript, but Java-based scripting within the web scare
of application.
Yeah, and, and, the word fuzzer is actually something I wanted to go into on the show,
and maybe we will, again, on a separate show, that's another, I'm getting a lot of ideas for
some topics for upcoming shows, that's for sure.
Um, fuzzing, or fuzzers, or fuzzing, was a term I heard a lot at DEFCON this year.
There were some presentations, and there were, some of them were about fuzzing directly, and
even the ones that weren't used, the term fuzzing, and used it in some of their,
research to develop whatever their presentation was about fuzzing was something they used in
the process.
That was a word I heard frequently this year.
Right, and fuzzing is doing some generalized, automated, um, attacks, well, or, not attacks
so much as, it's really testing.
It's really, it's really automated, kind of general automated testing to cause software
faults, or to cause application faults, which can later then be investigated, or, or dove
into a little bit more to determine if there's, uh, an exploitable condition in a piece of
software.
Right, and, and it's very much, um, less, well, I won't say less, but it's very, something
that's extremely useful, regardless, or, or, not in relation necessarily to hacking.
It is for hacking for obvious reasons, um, but really fuzzing is a technique that really
is just, in programming, and debugging, and testing, unit testing, you run fuzzers against
your own code to see if there's any holes to it, if there's any flaws, if it's gonna, if
you're gonna send something to it that's either gonna, not only exploit it, but break it all
together, uh, cause bad data to get inserted or updated somewhere.
So just from a testing, software testing standpoint, it's valuable in that aspect, and it's kind
of creeped into the hacking community for the same reason, because from an outsider using
those, cause if you didn't do it when you developed your software, somebody on the outside, a hacker
may be doing it to get into it, so.
Right, and it's, it's a way of doing some kind of general, broad, uh, tests.
Um, some other things, some other fuzzers that people might be familiar with are Spike, uh,
or Peach Fuzz, those are some fuzzers that are available.
Uh, WebScarab, of course, is, the fuzzer built into that engine is geared towards web applications
specifically.
Um, a lot of people might, might be familiar with protocol fuzzers, which are helpful for
seeing how certain protocols, unknown application-level protocols, act under certain conditions,
under some general conditions that might otherwise cause adverse effects.
Alright, well, I tell you what, let's, um, I guess shift gears here a little bit, if we
can, um, we've still got a little bit of time left in the show this week, so let's spend
some time and kind of shift from offense to defense, if you will, from attacking tools
to some defending tools or some defense tools.
And again, you've got, um, some tools that you mentioned as defense tools that I hadn't
really thought of in that way before, and really the first one that I think you were going to
talk about, which was Snort, which a lot of our listeners are probably very familiar with
as well.
Right.
Snort is, um, often referred to as the, as a lightweight intrusion detection system.
Uh, it has capabilities to do just general packet capture and analysis, but, uh, it's used often
as a network intrusion detection system.
Um, so you build these rules that have an attack signature, uh, or protocol anomaly, um,
like certain, certain header comment, certain header values that might be, uh, you know,
it might be consistent with an attack.
Um, and it goes, that goes into the Snort, the core, the core, Snort core engine, and then,
you know, certain actions are taken, such as logging the packet, blocking it, if you have
Snort set up as an IPS, which it has that capability as well, um, with certain add-ons.
Yeah, and, and actually, I'm feeling kind of stupid now, because I got my notes out of
order there, it's actually the next tool that I was thinking more from attack, not from this
one, so I, I made a, kind of got my slides mixed up, but we're going to keep going with
Snort anyway.
Right, so, with Snort, um, we have a, a bunch of different pre-processors, which is another
thing that's important about it, that normalize certain traffic, um, right, before it gets
passed off to the, the main engine, and there are a variety of output plugins as well,
uh, it can log to a database, it can log to a flat text file, uh, it can log to, uh, you
know, raw, uh, PCAP or, uh, packet capture files, um, or it can log to syslog, as an example,
it can fire off an SNMP trap, uh, Snort is another topic in and of itself, and it's been covered
at, you know, at infinitum, so.
And, and, uh, you mentioned the output plugins, and I think that's actually worthy of discussing
for a moment, is, you know, these tools traditionally were developed by a lot of different, most of
this stuff has been developed by hackers, and may be adopted and used by a lot of the security
community, and some of the security community had a lot of, security community, security
professionals had a lot of input and assistance with a lot of these as well, but as they're becoming
more and more widespread use in corporations who are actually taking security seriously,
it's not, traditionally a lot of attention hasn't been paid to the output or displaying
or organizing of output so clearly, and I think that something else is starting to come around
in a lot of these tools, not especially defense was the first ones that really made it in a more
readable fashion, but even attacking tools now, if you want to do pen testing of your own boxes
or internal testing and stuff, that it's starting to generate output in cleaner, nicer, prettier,
whatever you want to define format, so that it's easier to read for upper management, we'll
say.
Right, and in the case of something like Snort, when you have it set to say, log, you know,
log to a database, um, and, you know, like a MySQL or Postgres back in, or Oracle back
in, where these, the IDS alerts are actually being sent to, they could then be displayed by
something like Base, um, which is, which is, uh, a front, a web-based, a PHP-based web front
end for those alerts, and it can generate graphs and, and all sorts of pretty reports,
um, for, you know, the, the higher-ups.
Upper management.
And it's kind of a, a little more of a, easier to manage, uh, format for intrusion analysts.
Um, Squeal would be another, another good engine, uh, SGU-I-L.
Yeah, I, I'm saying that kind of as a joke, upper management.
Right, right.
No, it's, it really is helpful to anybody.
It saves a lot of time, how you present information.
If you don't, if I don't have to spend five minutes digging, searching, grepping to find
the lines or the information that I want, you know, I'm not, I don't, I don't mean to
belittle it.
Generating output that's user-friendly and easy to maintain and find and search through
is, is definitely a, a very important factor to add in there.
It is, unfortunately, probably the least important behind general functionality of the tool itself.
Well, again, Snort is something that we can, we can talk about for four shows.
Right, right, absolutely.
Just the, the flexibility of, of this app.
Yeah, so, and actually, now I'll, I'll kind of explain what I was saying earlier.
What I meant to be saying was I thought that our next tool coming up was, and what it is
now is Kismet.
And that's the one I was saying that I kind of think of that more as an offensive tool
than a defensive tool, because I'm thinking of it from the war driver standpoint.
Right, and, and typically it is associated with that.
A lot of people think Kismet, they think, you know, detecting and, and, and, and doing
war driving, detecting wireless networks, collecting traffic on these networks.
Um, right.
But it can also be used for, like, site surveys to see where your access points might be, uh,
where, you know, where, where their, their limits are, um, or doing distributed wireless,
uh, intrusion detection.
Uh, one of the things that Kismet has is it has some basic wireless IDS or WIDS capability.
That's another, another acronym that's, that's popular is WIDS, wireless IDS.
Um, it has some basic signatures to see if other people are, are sending out, uh, or, are
out, you know, probing for wireless networks.
Um, one of the things is, like, it'll, it'll say, uh, such and such a node is, is probing
networks but never participating, so that might be someone running NetStumblr.
Um, it also has the capability to, uh, to...
And, and actually, we talked about, we briefly talked about the difference between NetStumblr
and Kismet on the first episode of Hack TV about how noisy NetStumblr is.
Right, because NetStumblr is active, where Kismet is, is passive.
Kismet will actually watch other people beaconing and, and watch other, watch for traffic on
a certain channel and pick that up rather than actively sending out probes.
Um, it also, the, has the capability to watch wireless networks and capture the traffic and
write that to, say, like a socket from which something like Snort could read.
So you could have a, uh, Kismet sensor watching for, you know, wireless networks that aren't
necessarily your own or watch an access point through, you know, which Kismet is not necessarily
actively associated, but watching the traffic on there and then have it sent back to a Snort,
uh, an instance of Snort that's reading from a socket or something, uh, actually watching
the, the traffic.
Yeah, and that's another, you know, any, any...
That, that brings up another interesting point, and that is, we're addressing these as, um,
as separate, independent tools, but when combined together, there's, when you get some interaction
between a lot of these, they become even more powerful when they cooperate and work together.
They're being developed independently, but some of these groups are actually actively working
with each other, either whether it's providing XML output formats that then this, in turn,
uses, or sending it out to a common database that they both decide to use for ungod, unpronown,
godly reason, MySQL, or something like that, that they can share, and, you know, they're sharing
information back and forth, but if they're not directly connected, you can write your
own Perl scripts, custom scripts, things like that, um, but just the general nature of them
that I see, anyway, is that they're starting to come together where they have that common
ground in cooperating with each other, instead of being standalone, independent tools.
Yeah, and there are initiatives going on right now to try and come up with common language,
so to speak, so that tools, uh, intrusion detection tools and vulnerability scanners can all kind
of talk the same language, um, now, I actually just said that, I just said language, so talk
the same language, so that they can all interact, so that, uh, vulnerability scanner that said you're
vulnerable to X, uh, XYZ, uh, when you see that attack corresponding to XYZ on your network
intrusion detection system, it kind of gets flagged just a little bit higher because, you know,
you're known to be vulnerable to that. Right. So, so, yeah, and I, and this, you know, this is
another one of those tools our listeners are very intimately familiar with, um, Kismet is very common
and, and it's, and it's cousin Kismak. So, um, now, I actually, I may, I don't want to, I don't want to
put you on the spot with this question, I don't know how familiar you are with Kismak, but is Kismak
very far behind Kismet as far as functionality, I wonder? No, it's, uh, and maybe that's something
a listener, yeah. I'm not intimately familiar with Kismak, and if anyone wants to, you know,
chime in on that, uh, on the forum or. Yeah, radio at binrev.com and let me know, I'd like to,
this is just me throwing out a question to the audience, actually, so. But I don't know how,
how it is on, in terms of, uh, doing some of the defensive things, doing, like,
distributed wireless IDS, um, I don't know, so. So, yeah, I, I might, and actually, I guess I could
probably go to both sites and do a feature comparison list or whatever, but. You could,
yeah. Or, I could post it out to the listeners who already have done that work for me, send
it in, let us know. Um, all right, how about a couple other defense tools here? Some of
these, again, these are some, some that I have not heard of in our next one here. So, Packet
Fence, um, is an open source network access control system. If anyone's familiar with, uh,
things like Cisco NAC, uh, network admission control, uh, this is an open source implementation,
so to speak. This, uh, runs on Linux, um, because it does a lot of things with net filter
or, uh, IP tables. Mm-hmm. So, what you do is, is this has, uh, registration capability
via an HTTPS web portal. So, you would register your, your system with that, uh, once you first
plugged in and got handed out an IP address. Uh, it would watch for any traffic you're emitting
using Snort, uh, to see if you were scanning other hosts, uh, anything that might be consistent
with Worm Activity or other malware. Uh, and it would also scan your host to see if you
have any known vulnerabilities or missing, um, or anything that might be associated that
could be addressed via a patch or simple configuration change. Uh, it will isolate any host that may
be infected or, or otherwise insecure via IP tables. Um, or, and it would also redirect them
to an appropriate URL, uh, or web page or website that would have information on how to download
patches or remove any, you know, any malware that might be on their system. Uh, and once
that's all done, they would re, you know, re-initiate these scans and, and, uh, traffic analyses.
Uh, until you finally meet the criteria. Until eventually you met the criteria and it either
adds a rule or drops a rule that thus grants you access to the rest of the, the network.
Yeah. And, and, and the first application that jumps to mind of this for me is at, well, I
guess companies would be, you know, uh, people that bring in their personal laptops or something
and plug into the network. Contractors. You want to be careful. But the first one that jumps
my mind and maybe this is just because of my background is higher education. Universities
are famous for this. You got kids in the dorms, you got kids with their laptops, you got people
coming in and making them, you know, make sure they have cause, you know, I only say, you
know, college students don't really take the best care and aren't the most secure people
with their laptops. And actually Packet Fence was, was originally, uh, developed, um, at a,
uh, at a, a higher education facility to address some of the things with students, things
like students in dorms who have, you know, their one, their one little laptop they got
when they went off to college and they're not updating patches. They're not updating their
antivirus signatures. They're still on Windows 95. They're downloading who knows what from
Kazaa. Uh, so. And, um, it's, but this one is an open source one. So. Right. This is, this
is free. Now actually I'm going, I am going to ask and question the license on this one
because if you're using this at a, a large university, this is not just the person using
it privately, which generally open source is kind of the way they go is normally a one
person or a small business or whatever using it. But this, if you're running this at a large
university or at your company, what license is this actual one? What type of license is
this? This is a GPL. It's a GNU general public license. So this one, um, this one is the
license with which most people who use things like Linux are a little more accustomed. Normal
GPL. Um, so there are no, you're, you know, you're, you're, you're fine to use it. Uh, if
you can use other GPL software, generally you shouldn't have a problem. Yeah. All right. Now
that one was another one that I had not heard of, but I didn't, the next one actually, and
I'll, I'll actually, you know what, I'm going to slide one in of my own here because, um,
one thing that I think is important to everybody is antivirus and antivirus. There's lots of
free ones or free versions or even online scanners out there, but there is clam antivirus and there's
also it's bastard cousin clam win, which is just the windows version of clam antivirus.
But, um, again, we'll kind of gloss over cause I think this is one that's very common, but
for people out there that are ever looking for an open source, um, antivirus engine, I
think clam is certainly worth mentioning in this and it seems to me it would be obviously
defensive. Yeah, definitely. So, and I don't, I don't want to tie into a lot of other tools
as well, so you can, you can have it do, uh, you know, well, content filter, malware filtering,
you know, and virus filtering via, you know, through send mail. Yeah, I was going to say
it plugs in and scans the mail coming through, so that's, that's really handy to have in there.
Um, but it also, again, you know, really clam win and I'm not like endorsing it or anything,
but, um, cause I use ABG free. I have several antivirus and spyware scanners running at any
given time on all my machines. So, um, I definitely liked, uh, both of those ABG free,
which is not an open source thing, I don't believe, but clam maybe is. So, but one thing
that people have to keep in mind is, you know, just because they run Linux or, or one of the BSDs
and are a little, let's just say less susceptible to, um, viruses, it's still, for best practices
and for things like defense in depth, it's still advisable to run antivirus and have automated,
you know, have, have scheduled jobs that scan or scan incoming, um, mail, or even in the cases
of products that do support on-access scanning, uh, in Linux and BSD to use that when possible.
Even if, even if you're not vulnerable to, or, or susceptible to, you know, common viruses,
it's still just good practice and getting habits so that when something does come out,
you're not, you know, you, you've already beaten it to the punch.
Okay. All right. Well, did you have any other defensive tools that you wanted to bring up?
Um, there's another one.
Or we can move on to the quote-unquote other.
One, one other thing is, um, the OSSEC project, OSSEC, uh, has, uh, host-based intrusion detection
system called OSSEC HIDS. It's a host-based IDS as opposed to network-based IDSs that, um,
look at traffic on the network. This looks at aspects of the host itself, uh, which can include
things like log analysis, um, integrity checking, uh, like file integrity, um, or to make sure
the host is, is, there aren't any, like, bad modules loaded. Uh, it also does rootkit detection,
uh, it can, has multiple ways of alerting email, uh, log, other log entries, things like that.
And one thing that's, uh, neat about OSSEC HIDS is it also has active response. So you
can, you can have it execute a command or script out certain things that it can do based on
certain log entries that it sees. Um, yeah, that just, that name gets me.
OSSEC, OSSEC HIDS.
It's, it's just awkward. OSSEC HIDS. It just sounds awkward coming, it's not, it just, I feel
like I have Down syndrome. OSSEC HIDS. I don't know what the hell, it just sounds weird.
Uh, also OSSEC HIDS has, uh, you can write these correlation rules so that based on different
kinds of events, it can kind of assemble what maybe a certain attack was. So it sees a bunch
of failed logins and then a successful login, uh, within a certain time window. That can
be indicative that, you know, maybe somebody was brute forcing an account and eventually
got in. So that it can, you know, send maybe a high priority alert to you. Uh, it also,
one cool thing about OSSEC HIDS is it also supports, uh, Windows in addition to, you know,
various Unix platforms. Um, but on the, on the Nix platforms, it has both the agent and
the server because it has centralized reporting. On Windows side, it's just the agent only.
So, all right. That's another one that we can talk about at, really, I mean, every, really,
every single one of these. And actually, you know what, I, I guess we do have a few other,
other tools, a few other miscellaneous tools or whatever we're going to call this. But, um,
before we do, I'll go ahead and say to the audience and normally I'll wait till we're all
done to say this, but, um, if there are any of these specifically that you would like someone
to go into more detail, if you'd like us to do an episode, I hope I don't get emails
from everybody saying every one of those go into more detail. But if there are some that
are, that you're more curious about than others, like, I don't think anybody would really want
us to do a full episode on, like, Kismet, for example, because I think so many people are
already familiar with it. And some of the, you know, InMap, well, but see, InMap's got so
many, I, I don't know, I don't know. So I'm saying to the listeners, you know, what do
you, what, what of these tools has really piqued your interest, if any of these, and
that you'd like to hear more detail. Like, again, we're just going through a list and
giving you an overview of some of these. So if there's any that you would like to hear
on more detail, please email us and let us know. And we'll see if we can't put that on
the upcoming schedule to, you know, go into a few, go into some more detail on a few specific
ones.
And see, that's one thing I'm trying to do is not go, is not spend too much time on one
of these.
Right.
And so that we can kind of just, okay, so this is what it does and let's move on to
the next one.
So, yeah. And then that's kind of what I said earlier. I'm getting a lot of great ideas
for upcoming show topics, which is always, you know, the people that have done the show
in the past, that's the one common thing they've said to me is, it's difficult to come up with
topics or how do you come up with all these different topics? Well, there's, there's really
a lot of them out there. It's just how much depth you want to go into it. So doing a show
like this, where we can open the doors and say, here's a lot of different tools. Here's generally
what they do. And people will either go into it by themselves and do their own research
and find some things, or they'll ask us our opinions or, well, can we go into some more
detail on it? And we can certainly do that, but we don't want to go through the detail
on every single one of these because, yeah, I mean, I mean, I'm not even counting how many
we've done so far, but what, we've been 10, 15 episodes by the time we're done with this.
Yeah, so I don't want to sound like a banana head, like I don't know what I'm talking about
with these tools, but I don't want to spend too much time on one of them. I'm sorry,
a banana head? That's, that's from Empire Records, actually. Oh, okay, I didn't, yeah,
you got me on that reference, I was, you caught me on that one. Okay. I like that word, banana
head. Banana head, alright. So. I like banana phone. Ring, ring, ring, ring. No, no. Okay.
Alright, well, how about some miscellaneous tools? We do have a few minutes to talk about
a couple other miscellaneous tools, so what do you think, so again, some of these, I
think we won't, I think, as a matter of fact, I think we'll skip over. Yeah, we're going
to skip over. Open SSH, people know Open SSH pretty well. Right. But, I mean, a lot of
people need to know also that Open SSH is not just an SSH client, it can be used to wrap
otherwise insecure protocols, or protocols that might otherwise be in clear text. Right, and you
know what? And build SSH tunnels. Funny, you know, this is, that's going to be a good
segue into episode two tonight, the second of our back-to-back episodes, where we go
and talk about tunneling. So, that's going to be a good segue into that. So, that's
perfect, Tommy. Now, how about, you mentioned earlier, I think you mentioned Open LDAP?
Yeah, I just gave it as an example. Open LDAP is an open source implementation of LDAP,
Lightweight Directory Access Protocol. So, it's a directory server, an LDAP library, and it
has client components. One thing that this, how this applies to security is we can create
like a centralized authentication service. A lot of people might be familiar with Microsoft
Active Directory, which is also LDAP-esque, and you can do, you can perform certain LDAP
operations on Active Directory. So, the reason I just mentioned Open LDAP, again, is to do like
centralized authentication so that we don't have usernames and passwords, user stores
and username and password stores on multiple systems. We can have one consistent centralized
authentication server to which all these things, you know, to which all users are authenticated
regardless of what system they're longing. Now, a lot of people can argue, too, that, well,
now you've got one central place that people need to break into to get your username and
password. That's, that's a gray area. It's debatable. Yes, that might be true, but in
terms of management and administration, that, that cuts back so that you, you don't have
accounts, stale accounts on multiple systems that you didn't know were there.
Right, right. And that, well, it's, you know, it's that balance of ease of use and convenience
versus security. So, yes, you are putting them all in one, you're putting all your eggs
in one basket, so to speak. And I think I've said this about, I think my example one time
was talking about Microsoft Passport being a single sign-on, but that is also a single
point of failure. I mean, not necessarily in regards to OpenLDAP, but having all your
authentication coming from one area. However, you also, to play the other coin of that is
now that you've got it all in one spot, you can concentrate all your security efforts on
that one spot as well, so. Yeah, it's, it's, it's an argument. It's, I mean, it can be
argued. Yeah, back and forth, yeah. It's basically just an opinion and however you feel either
way on it. And, and actually, I don't, I, I see both sides of the argument, so I don't
really have, like, I don't pick a side per se in that argument. I see both sides at the
point. Yeah, as do I. And it's a balance, so. You know, for people looking for an
alternative. Yeah, don't send us hate mail, we're not endorsing either side. Right. For people
who are looking for, you know, an open source alternative to something like Active Directory
or Novell eDirectory or something similar, this, this would be a good example. So, and it, you
know, or, or if you just want an LDAP-based address book. I don't know. Well, hey, whatever.
So, another thing that we can touch on real quick is OpenVPN. VPN, of course, virtual private
network. A lot of people are familiar with IPsec-based VPNs or PPTP if you're ever so
unlucky. But SSL VPN, secure socket layer VPNs are a big thing too. OpenVPN is a user space
SSL VPN implementation that is, of course, open source. It'll run on most, you know, NICS
platforms, BSD, Linux, Solaris, so forth and so on, but also on Windows as well. It takes
advantage of OpenSSL, which is the open source secure socket layer library, which also does
a variety of other cryptographic functions. And it is open source. It is open source. OpenVPN
authenticates users through PAM, pluggable authentication modules, which can in turn be
extended to a number of other authentication mechanisms such as LDAP or SMB, you know, through
Active Directory or whatever, Pick Your Poison, MySQL, any number of backends. It has load
balancing and failover capabilities and there are GUIs for it. So, for anyone who's accustomed
to, like, Cisco's pretty VPN client or AT&T or anything like that, there is a front end
for this. This could be helpful if you want secure access into your, you know, home network.
Yeah, and this is also going to be, this is a great segue into the second episode tonight
too, where we get into a lot of details about VPN in relation to tunneling and obvious reasons.
So, and a whole other episode in and of itself VPNs. And it, and it, yeah, and it will be.
Stick around. All right. So, uh, one of the last tools that I've really kind of got on my,
my laundry list here, uh, is FreeRadius. Um, Radius is, uh, remote authentication dial-in user
service, uh, and that was, that's used a lot for authenticating, like, traditionally was
for authenticating, like, dial-in users on, uh, for modem pools and things like that.
Okay. Or for remote access. Okay. Yeah, dial-in.
Remote access dial-in user service. Uh, it's a, a free open source implementation of Radius.
Um, it's one of the top five Radius servers worldwide based on, uh, number of users that are
authenticated to it, you know, every day, uh, and based on deployment, uh, it's deployment base.
Um, supports a variety of backends, including LDAP, uh, MySQL, PostgreSQL, and Oracle.
Yay, Oracle, right? Yay! Um, one thing that's, that's cool about FreeRadius is if you're familiar
with, uh, 802.1x authentication, uh, a lot of people know it, uh, as one of the implementations,
which would be, like, Cisco Leap, um, which would be, like, Layer 2 authentication, 802.1x,
uh, you can authenticate users before they're, they're really on, you know, given an IP address
or, or before, port-based authentication is what it's sometimes called.
Right. Now is that...
FreeRadius supports that. Of course, your client needs to support that, um, but FreeRadius
can be used to do that. Uh, it doesn't tie into something like, like, necessarily like the
in the packet fence, because packet fence is, uh, layer three and up. Um, but FreeRadius,
if you're looking for an alternative to, like, uh, Cisco's, uh, like, Cisco's, uh, authentication
server, this would be an example. Um, this supports multiple, uh, extensible authentication
protocol types, EAP, uh, including Cisco Leap. Uh, it supports proxying, uh, failover, load
distancing, so if you're worried about, you know, my FreeRadius server went down, well,
this has the capability to have, um, um, you know, failover radius servers.
Okay. Uh, again, this is a whole nother topic unto itself, but, you know, this is just planting
the seed for people who want to kind of learn more about these tools, and, um, like you said,
if anyone wants to, us to cover these more in depth, uh, they can. There's also another,
um, there's an entire presentation, uh, or, uh, how-to, rather, on doing 802.1x port-based
authentication, um, via FreeRadius. That's at, uh, the Linux documentation project, tldp.org.
Um, you can find that there, and that'll give you all you need to know how to do 802.1x
authentication with FreeRadius. So, um, that's, that's really all I've, uh, I've got for the
tools, um, I just, you know, think there's a lot of great open source, uh, security tools
out there, and people need to contribute back to open source projects.
Amen. So that, that's a huge thing. A lot of these, that's why a lot of these projects
die, or don't really go anywhere, is because people...
Or stagnate, yeah.
They, they take, they take the code, they use it, but they don't really give any
feedback, they don't contribute fixes, they don't, uh, contribute enhancements or features.
Um, and that's, that's, um, something, someone in IRC used a perfect word one time
when, when I was, we were having a conversation about this, and they just admitted up front
that they are a consumer. They're not giving back, they're not contributing, they are a
consumer, they are using the product. And there's nothing necessarily wrong with it, but just,
if you do find something useful, or if you can think of ways to enhance or help a project,
or even if it's just feedback, a bug report, anything as small as that, or spreading the word,
spreading the word, getting, um, you know, getting other people to come and, and embrace
the project, then maybe if you can't contribute directly back, maybe they can, so spreading
the word indirectly helps out, so, so that's always a good thing.
Um, or if, if, if by chance you have any, you know, free money lying around, a lot of
these developers...
I don't think they turn down...
Right, no, they, you know, if you can contribute, uh, in the case of things like open, open BSD,
contributing hardware, or testing things out yourself, um, that always helps too.
I know, in the case of a lot of operating systems, people, they can really use hardware donations.
Alright, well, I think that's, um, I think that's gonna about do it for this episode of
the show, um, if there's anything, I think that's pretty much all we really had to...
Again, I mean, it's one of those shows where it's kind of, and we've said this many times
during the show that we could go into more detail about any of these, but I think this
was a good overview of a, of several tools.
The way we limited was to only focus on open source tools this time.
We have, in past episodes of the show, gone into other tools in more detail, and in the
future we will go into some in more detail.
But if any of these specific ones that you'd like to hear, or if you've got some information
that you want to add to what we've already talked about, by all means, email us at radio
at binrev.com.
Um, our site of the week is, uh, actually completely unrelated to the show, but in an article that
I read in one of my magazines this week.
I think this was from, I almost want to, no, I don't think this was in Popular Science.
I don't remember, there was some magazine that I read this week.
What is this right here?
It is, it was Popular Mechanics, not Popular Science.
And the site is spudtech.com, that's S-P-U-D-T-E-C-H, spudtech.com, which is everything you wanted to know,
some directions, how-tos, advice, pictures, projects on making your own potato gun, which
we do not have any liability whatsoever with anything that you may do, especially after
I read that story.
I think it was somebody, the guy won a Darwin Award.
Did you ever remember that?
This is probably going way off topic for the show, but there was a great Darwin Award
probably four or five years ago about a kid who thought it would be funny to put a frog
in the potato gun and shoot it, and it misfired.
It didn't shoot the frog out.
So being the brilliant person that he is, he looked down the barrel of the thing, and
it accidentally shot off and threw shrapnel of frog bone through his skull, and killed
him.
That's sort of poetic justice in a way.
Isn't it?
I mean, it was just brilliant.
The brilliant Darwin, maybe you should meet the Darwin Awards, the site of the week.
And actually, since we have another episode coming up in a few minutes, you're going to
get two sites of the week this week, so lucky, lucky you.
And we're also going to split up the shouts this week, so any shouts that you have, I'll
go ahead and stall a moment so you can think, and I will give shout outs to Savant, who I've
been talking to a lot lately, and I think you'll back me up on this, to everybody at BR407.
BR407.
Yeah.
So, anything else you wanted to add to that?
I can give a few shout outs now that I think about it.
Okay, go for it.
I want to, if these people are, you know, some room, even if they're listening, I don't
even know.
Of course, they're going to listen because you're on the show.
Right.
Of course.
Thanks.
And the old NOP crew.
If you're out there.
Contact me at radio.binrev.com and maybe I'll forward some information on maybe.
Maybe.
Or, you know, pretend to be me.
Or not.
Or respond to them.
There you go.
Um, and, uh, let's see.
Closing music tonight is The New Pornographers.
It is a song called Use It.
So, I think that's going to be it.
Unless, did you have some more shouts before we close out?
That's, that's all the shouts I have.
Um, again, like you said, if anyone has any questions, they can email you, uh, email
the show at radio at binrev.com.
And I'm committing you to a future show.
I will gladly be on a future show.
If somebody comes in on some of these topics so we can go into more detail.
So, so that people will actually know that I know what I'm talking about and can go
in more in depth on some of these tools.
I take, yeah, I'll take responsibility because I purposely reined you back and said, let's
do overview stuff, which I know is difficult because you don't know where to draw the line
and stop and going into too much detail or not enough detail.
So, I'll take the credit that I caused you.
I reined you in.
So, future episodes, we'll pick a few of these and go into a lot more detail on it.
So, I think that'll, something you're more comfortable with since you know these much
more intimately than I do, obviously.
And, that is going to do it for us this week.
So, Quine, thank you for being on the show.
Thank you for having me.
And, for the rest of you, we will see you in a few minutes, actually.
Slightly different hack time.
Slightly different hack channel.
No.
Same hack channel.
I think.
Something.
I'm confused.
Here's the music.
The cat calls through the night.
The two chicks in the parking lot cry.
Why it's on the price of fame.
They stood to gain.
Phone books in the dark.
And, two chicks in the dark.
Across the way.
No.
The price of fame.
No.
The price of fame.
No.
The cat calls through the night.
The two chicks in the parking lot cry.
Why it's on the price of fame.
They stood to gain.
Phone books in the dark.
And, two chicks in the dark.
Across the way.
No.
The price of fame.
They stood to gain.
Phone books in the dark.
And, two chicks in the dark.
Across the way.
No.
The price of fame.
It's weight and size.
If you've got something.
That sheds some light.
Use it tonight.
Tonight.
Heads down.
Thumbs up.
Two sticks from the cup.
Of human kindness.
And, two chicks in the dark.
It's weight and size.
If you've got something.
That sheds some light.
Use it tonight.
Tonight.
Heads down.
Thumbs up.
Tonight.
Today.
Tonight.
house.
Today.
Use it tonight, tonight
You had to send a wrecking crew after me
I can't walk right
You had to send a wrecking crew after me
I can't walk right
The center of the heart
Four beats from the party line
Been mine since I was a child
It just blew their world
So heads down, thumbs up
Four beats from Saturday
Get set to exercise your right
Use it tonight
There's a choice between a chance and play
Choose it tonight, tonight
You had to send a wrecking crew after me
I can't walk right
You had to send a wrecking crew after me
I can't walk right
Use it tonight
Tonight
Night
Tonight
Two
Tonight
hm