Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security Software

Missing Open Source Security Tools? 362

Posted by simoniker from the swiss-army-knife dept.
Kinetic writes "There are many great open source security tools out there, Nmap, Nessus, and DSniff, just to name a few. However, with the world of security constantly changing, this begs the question, what open source security tools are missing? What commercial security tools have no viable open source alternatives? When securing/testing/exploring networks (home or enterprise), what security tools/applications/functionality are lacking (or non-existent) in the open source world?"
This discussion has been archived. No new comments can be posted.

Missing Open Source Security Tools? More

Missing Open Source Security Tools?

Comments Filter:

  • Oh great (Score:3, Funny)

    by Anonymous Coward on Monday June 28, 2004 @05:35PM (#9554903)
    Here comes the "THAT'S NOT THE PROPER USE OF BEGS THE QUESTION [wsu.edu]" people. Get over it. English changes.

    • Re:Oh great (Score:2, Insightful)

      by Anonymous Coward
      Ya, but when I actually use beg the question properly people won't know wtf I'm talking about and think I'm an idiot when in fact they are the idiots!

      But I let it go cause I hate those stupid losers still whining about how hacker used to mean a guy who played with model trains at MIT or something...

    • Which begs the question as to its proper usage...

    • Re:Oh great (Score:4, Insightful)

      by Anonymous Coward on Monday June 28, 2004 @07:00PM (#9555734)
      I bet a lot of people would have enjoyed using that excuse in English class. Can you imagine an editor at the NY Times letting this slip by? In a comment by somebody who doesn't know better, sure, let it go.

      Languages evolve, but that fact is too often used as a cop-out for being too lazy to learn correct use of a language. As it is now, "begs the question" is used incorrectly on the front page of Slashdot, a large news site. The editors should know better and hopefully after being scolded, they learn. Unlike people who scoff at corrections because "English changes."

  • Security (Score:5, Funny)

    by Anonymous Coward on Monday June 28, 2004 @05:35PM (#9554906)
    Open source security tools are missing.. security holes?

  • Self Defending Networks? (Score:5, Funny)

    by Neil Blender ( 555885 ) <neilblender@gmail.com> on Monday June 28, 2004 @05:36PM (#9554914)
    Oh, wait, you probably mean stuff that actually works.

    • Re:Self Defending Networks? (Score:5, Interesting)

      by Master of Transhuman ( 597628 ) on Monday June 28, 2004 @09:12PM (#9556657) Homepage
      You think this is funny. Let me tell you a little story.

      I just took this past spring a course in "Network Security". The teacher got hold of a DARPA video on computer security and played it for us at one class session.

      You wouldn't believe this crap. The scenario was a country suspiciously similar to Iraq who set up a computer center with a bunch of Arab terrorist hackers and tried to drop America's infrastructure.

      So, of course, the brilliant and utterly boring (all these people looked like crew-cutted Republicans, it was unbelievable) used all sort of "cutting-edge technology" (that doesn't exist and won't for another two or three decades) to defeat the evil Arabs. It ended with them tracking the evil Arabs to their lair and a bunch of Special Forces guys busting in and shooting up the place (DIE, EVIL HACKERS! DIE!).

      The tech they showed involved a lot of voice-command and voice-response computer systems, all sorts of fancy graphics stuff, and of course something very much like Total Information Awareness that allowed them to know who everybody was no matter who the hell they were. They also had the ability to search out the source of any virus or hacker penetration in minutes and then commandeer the entire US infrastructure to repel the attack.

      Utter bullshit - and I told the teacher so at the end of the video.

      This was a DARPA "wish-list" video with absolutely no relevance to current computer security technology.

      At the end of the semester, I demo'd the Knoppix STD (Security Tools Distribution) to the class. One student asked if this stuff was "all command line". I said, well, it's all servers, and the servers all run UNIX, and servers usually are administered from the command line, so, yes, most of the tools (except for stuff like Ethereal and Nessus) was command line.

      It's a long way from there to DARPA's fantasy land.

  • So.... (Score:3, Insightful)

    by Dasein ( 6110 ) <tedc@nospam.codebig.com> on Monday June 28, 2004 @05:36PM (#9554920) Homepage Journal
    Are we searching around for a project to start? The best stuff comes when you're scratching your own itch.

  • Your favorite tools (Score:5, Interesting)

    by TLouden ( 677335 ) on Monday June 28, 2004 @05:37PM (#9554928)
    Also important, if you don't think anything is missing, or even if you do, what software do you use for security purposes? Anything obscure but useful or unusual uses of common software?

    • Re:Your favorite tools (Score:5, Funny)

      by Anonymous Coward on Monday June 28, 2004 @05:42PM (#9554977)
      I wrote this little app in C++ (so it's very efficient) that pops up a box every 5 minutes saying "all is well", regardless of what the relationship of that message to reality. Makes me feel very secure.
      • I wrote this little app in C++ (so it's very efficient) that pops up a box every 5 minutes saying "all is well", regardless of what the relationship of that message to reality. Makes me feel very secure.

        Reeeeeeeeeeally? What license is it under?

      • Re:Your favorite tools (Score:5, Funny)

        by Pharmboy ( 216950 ) on Monday June 28, 2004 @06:25PM (#9555426) Journal
        I wrote this little app in C++ (so it's very efficient) that pops up a box every 5 minutes saying "all is well", regardless of what the relationship of that message to reality. Makes me feel very secure.

        Now THAT sounds like something you should port over to Windows. Then again if you sold it, MS would just include it free in their next version...

    • Re:Your favorite tools (Score:5, Informative)

      by Lancer ( 32120 ) on Monday June 28, 2004 @05:43PM (#9554997) Homepage
      My favorite tool?

      knoppix-std [knoppix-std.org]

      Most every security tool a network admin (or script kiddie) could want in a convenient iso package.

    • Interesting... Just sent this mail to the author of jailkit [sessink.nl]. Enjoy.

      Thought I would share the fascinating setup I have managed to create using Jailkit.

      As I mentioned before, I am creating a public development environment, and want my users to be highly isolated from each-other. Each user gets their own whole jail, complete with Java, Apache Tomcat, and Postgresql.

      Outside the jail, Apache 2 and mod_jk2 forward requests to the Apache Tomcat container instance running inside the jail on a unique port. Web app

  • SIMS (Score:5, Interesting)

    by WwWonka ( 545303 ) on Monday June 28, 2004 @05:39PM (#9554942)
    ...what security tools/applications/functionality are lacking (or non-existent) in the open source world?

    How about an open source Security Information Management System (SIMS) Description, Article [securitypipeline.com].

    Something that lets us intergrate, collect, and correlate what the other great tools (Nessus, Snort, Nmap) find.

    • Re:SIMS (Score:5, Interesting)

      by gfunicus ( 633515 ) on Monday June 28, 2004 @06:00PM (#9555202)
      Have a look here... http://www.ossim.net/

    • sentinix is the siznit (Score:2, Informative)

      by Anonymous Coward
      and don't forget sentinix
      http://sentinix.org

      defiance

    • Re:SIMS (Score:2, Insightful)

      by kfg ( 145172 )
      Something that lets us intergrate, collect, and correlate what the other great tools . . . find.

      Pipes and regular expressions?

      KFG

  • Sniffer Pro (Score:5, Informative)

    by Nonesuch ( 90847 ) on Monday June 28, 2004 @05:39PM (#9554944) Homepage Journal
    Sniffer Pro has features which neither "ntop" nor "ethereal" come anywhere near, both in the realtime monitoring of traffic and also in some of the "expert" functionality.

    I've yet to find an open source tool that can show a "matrix" graph of source and destination talkers by MAC/IP/IPX name in realtime as found in Sniffer. Other tools show some of this information, but do not render the same graphical display (chords of a circle) as Sniffer.

    With ethereal there's to do this with snapshots using [ethereal.com] graphviz [att.com], but not realtime...

    • Etherape (Score:3, Informative)

      by Effugas ( 2378 )
      Does what you're describing.

    • Re:Sniffer Pro (Score:5, Informative)

      by pkey ( 651794 ) on Monday June 28, 2004 @05:56PM (#9555142) Homepage
      If I'm understanding what you're looking for (I've never seen Sniffer Pro in action), I think EtherApe [sourceforge.net] might do it. It hasn't been updated since January of 2003, but the current version works fine for me.

    • Re:Sniffer Pro (Score:3, Insightful)

      by X.25 ( 255792 )
      I've yet to find an open source tool that can show a "matrix" graph of source and destination talkers by MAC/IP/IPX name in realtime as found in Sniffer.

      Do you want a network monitoring system, or a sniffer?

      Even if I needed such a feature, I'd never expect it to be in Ethereal (and I use tcpdump/Ethereal daily, but not for graphs).

      If I needed (offline) graphs, I'd use netflow probes and collector. If I needed realtime stats, I'd use iptraf (well, I do use both of those anyway).

      However, I never needed t

    • Re:Sniffer Pro (Score:3, Interesting)

      by ralphus ( 577885 )
      I find that sniffer pro's expert is no replacement for a real expert. On the numerous occasions I've used sniffer pro I've found that the experts are just annoying and i wrote them off as an attempt to just "wizardize" protcol analysis. It seems useful for someone who is a beginner at protocol analysis, but i've been doing it for years and haven't come across a better tool for me than Ethereal. Ethereal gives me a woody. I do agree that sniffer pro has more realtime monitoring capabilities than ethereal

  • We're missing a great test bed (Score:5, Funny)

    by burgburgburg ( 574866 ) <splisken06@@@email...com> on Monday June 28, 2004 @05:40PM (#9554953)
    I've been working with a spectacular closed source test bed for viruses, trojans, worms and the like called "Windows". I'm able to explore and examine so much more of this malicious code as it really functions then I ever have with my OSS tools. It's like they were written for it.

    When we can create a truly fertile environment for elements like this in OSS, then we'll have arrived.

    • Re:We're missing a great test bed (Score:2, Funny)

      by Anonymous Coward
      I've found this 'Windows' you talk of and it is as good as you say: I had barely finished installing it and I had contracted a worm. Excellent work indeed.

      Unfortunately you fail to mention the license: it's awful. It appears to be a wierd GPL variant that forbids access to the source, the making of derivatives and redistribution. I must have misread it I think.
    • When we can create a truly fertile environment for elements like this in OSS, then we'll have arrived.

      You mean like this? [winehq.com]

  • An enterprise security console (Score:5, Interesting)

    by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Monday June 28, 2004 @05:40PM (#9554956) Homepage Journal
    Companies like CA and IBM are working to develop (or struggling to implement) single interfaces that will let you control and/or monitor the security of hundreds of systems at once, and monitor aggregates of the data so you can get both an overview and a detail view of the security status of your organization.

    These tools could "leverage" existing security tools which exist in the open source world (stuff like tripwire for example) to get cross-platform support.

    You don't have to just look at security, either; A multiplatform enterprise management suite with plug-in modules for filesystem, printing, security, scheduling, and good old monitoring would be a great thing to do for free. Software that does all that costs millions of dollars, single installs for sufficiently large sites can run upwards of US$10M.

    • Isn't that what Unicenter TNG is supposed to do?
    • >Companies like CA and IBM are working to develop (or struggling to implement) single interfaces that will let you control and/or monitor the security of hundreds of systems at once, and monitor aggregates of the data so you can get both an overview and a detail view of the security status of your organization.

      Badass, do they each come with their own clone of Penn Gillette to run them for me?

    • Re:An enterprise security console (Score:5, Interesting)

      by mo ( 2873 ) on Monday June 28, 2004 @06:29PM (#9555471)
      While I haven't had the pleasure of working with any of these $10M install of a network management suite, I've been able to accomplish much of what you talk about using an assortment of the following open source tools:

      OpenNMS [opennms.org]
      cfengine [cfengine.org]
      nagios [nagios.org]

      Granted, none of these have real slick guis, and there is a bit of a learning curve to get over before you master them. However, for somebody who knows how to use the above tools, it's amazing the number of machines can be administered by one person.

  • There are open security methodologies and tools! (Score:5, Informative)

    by bandrzej ( 688764 ) on Monday June 28, 2004 @05:42PM (#9554985) Homepage
    Sheez, post something of importance, and get a bunch of smart ass flack.

    If you are looking for a proven open standard methodology for performing security tests, then Open Source Security Testing Methodology Manual (OSSTMM) [isecom.org] is the way to go.

    In addition, there is the linux distro of Trinux [sourceforge.net], which includes most of the common linux open source security auditing tools.

  • Application Level Proxies (Score:2, Interesting)

    by eckes ( 19624 )
    Ever since the FWTK offered a semi free toolset, the community failed to develop real free simple, stable and secure application level proxies.

    There are some more now, but most have discovered bugs due to missing deffensive programming.

    That was one of the reasons I started freefire.org, even when the mailing list currently is not used.

    --
    www.eckes.org
  • I propose a fork of Apache that contains a complete implementation of all IIS functionality (circa 2001), preferably enabled by default. The application must operate as 'root'. This will ensure that certain IT positions will remain abundant for many decades.

  • Open source virus scanners (Score:5, Interesting)

    by IamTheRealMike ( 537420 ) on Monday June 28, 2004 @05:44PM (#9555011)
    I'm talking about an open source equivalent to things like Norton AntiVirus - at some point, at some time desktop Linux will be hit by viruses/spyware/other undesireables. Current security technologies are purely focussed upon preventation and none upon cure.

    Yes I know there are no viruses today. That's what wargaming is for. Be prepared. It's the only way.

    • Re:Open source virus scanners (Score:5, Informative)

      by Mc Fly ( 52238 ) on Monday June 28, 2004 @05:50PM (#9555070)
      Duh.
      Dude, you should see clamav [clamav.net], a full opensource antivirus for Linux, FreeBSD and even Windows, which integrates nicely with virtually every mailer out there.

      • As much as I admire the clam folks, it's just not there yet.

        AV is something that could really benefit from an open, distributed development model if we could find the right precautions to take. If users could report and characterise malicious attacks as they happen, I think we could start to offer an alternative to the big AV company's virus dictionaries (sort of like wikipedia compared to britannica).

        Obviously this would not be an easy thing to set up well (consider the. We would need some sort of "karma

        • As much as I admire the clam folks, it's just not there yet.

          I would agree. I use in on the mail server ( Fedora/MailScanner/Spamassassin/Squirrelmail box) and it lets a couple through a week. Its a great program, granted, and its about 95% effective, but not quite up to speed. Part of the problem with any free "as in beer" program will always be keeping up since you can't just sell a few more copies and hire someone else, and AV is one of those tasks that require a lot of keeping up.

          I certainly don't

        • Ask not whether it's there yet... (Score:5, Interesting)

          by prandal ( 87280 ) on Tuesday June 29, 2004 @03:14AM (#9558086)
          .. ask if its virus patterns are.

          A few friday nights back, our ClamAV started catching a little worm called W32/Zafi.b.

          McAfee's DAT files to catch this one came out 2 1/2 days later, on the Monday morning (UK time).

          Apart from the Nimda outbreak of 2001, this year is the only time I've seen viruses arrive at our email gateway (thanks ClamAV) before our official antivirus software updates catch them. Netsky, Bagle, and Zafi.b were all caught by ClamAV before McAfee had released DAT files for them.

          I'd recommend defense in depth, using multiple virus scanners. We scan all incoming (and outgoing) emails with ClamAV, Bitdefender (free for Linux boxes), and McAfee's uvscan.

          It's way too easy to fall into the mindset which says "we have antivirus software everywhere so we're safe". There will ALWAYS be a window of vulnerability between the release of a new virus and the availability of detection patterns. And don't forget that a lot of Windows viruses/worms disable any antivirus software they find running.

          Phil
    • The problem here is open source is usually written by volunteers (a few notable exceptions of course). People tend to devote their time to solving problems that affect them. As they're not bothered by viruses there's little inclination to write anti-virus software.

      That's why there's been so little progress with Open anti virus [openantivirus.org] but you can bet your life that if/when viruses do start to strike, people will be willing to dedicate their time and a FOSS anti virus solution will be available.

    • Re:Open source virus scanners (Score:5, Informative)

      by gmuslera ( 3436 ) on Monday June 28, 2004 @05:54PM (#9555124) Homepage Journal
      What about ClamAV [sourceforge.net] or OpenAntivirus or a lot in the same league?

      There are also a lot of integrity checkings tools, that if well don't count as "antivirus", at least they report changes that could mean something nasty running, and not to forget things like chkrootkit.

    • I'm talking about an open source equivalent to things like Norton AntiVirus - at some point, at some time desktop Linux will be hit by viruses/spyware/other undesireables. Current security technologies are purely focussed upon preventation and none upon cure.

      I believe that Lindows (Linspire) is especially susceptible to this. After all, the user operates as 'root' by default, thus compromising many of the local security principles inherent to the Linux/Unix philosophy. Lindows and the other "easy-to-use"
      • Actually, running as non-root provides almost no protection against viruses as most things they want to do can be done as user (send email, modify webpages using CSS/XBL, hijack programs etc). Root is a good security system on a server, but the security challenges facing the desktop are entirely different.
        • You're right.

          However, they also offer many daemons as "one-click downloads," and those were the subject of my response. They (did?) operate as root by default, too. Once they have been allowed to age sufficiently, these vulnerable daemons will become an excellent vector by which to propagate "auto-installing" malware.
    • ...at some point, at some time desktop Linux will be hit by viruses/spyware/other undesireables.

      What makes you think its impossible to design a secure system? What if the goal of the people designing the system is to design a secure and stable system instead of making a profitable business out of selling software and competing for market dominance? Sure, everything can be insecure, but what matters is what you do after you discover that it was implemented improperly, no? Do you scrap the old code and r
      • Here's a question for you then, in the the context of a desktop system, how do you define "secure" and "security"? A big chunk of the problems that affect Windows users ( the viruses/spyware/other undesirables mentioned above) do so because of their own ignorance, not because of some "security flaw". They are caused by programs that the users _choose to run_. How does the OS know that the user doesn't want their actions tracked by third parties? How does it know that the user doesn't want to be sending out
    • Yes, absolutely. I've written these before, but they're of limited usefulness unless you can keep up with them, and I had too much work to do. We still use one of my old ones here at work, though as a "something is better than nothing" approach.

      You need a many-pronged approach, and ways to deal with the fact that a compromised UNIX or UNIX-like system is one of the most fearsome anti-security tools there are. You need to be able to establish the state of system security WITHOUT knowing that it was secure w

  • Security by Obscurity (Score:4, Funny)

    by descil ( 119554 ) <teraten@hotma i l . c om> on Monday June 28, 2004 @05:45PM (#9555022)
    It seems to be that people who make security tools don't open source them on the normal channels because they don't want 5cr1p7 k1dd135 stealing them. For instance, I'm currently working on an SNMP scanner to analyze a fibre channel network - no way am I open sourcing it; it shows entirely too many holes. *shrugs*

    *black hat on*
    Besides, if the holes you find become fixed due to public notice, how are you going to exploit them in the future?
    *black hat off*

  • tcpdump is great (Score:2, Interesting)

    by SquadBoy ( 167263 )
    I use it every day all day long and could not do my job wihtout it. But I would really love a GUI better than ethereal for it. Something that implempents the more advanced features of Sniffer Pro or whatever they are calling it this week. Better searches, better ability to highlight and get data. Also the enahancement I would really like to see in tcpdump (and thus all the frontends for it) would be the ability to filter on x.x.x.x x.x.x.x in other words to be able to see traffic from or too a specific IP
    • like:

      tcpdump (options) | grep | grep

      It's a horrible kludge but it'd work.
    • You can do stuff like tcpdump -i xl0 src 10.0.0.1 and dst 10.0.0.2 and stuff like that.

    • Re:tcpdump is great (Score:4, Informative)

      by Nothinman ( 22765 ) on Monday June 28, 2004 @06:11PM (#9555307)
      You could also look at ngrep, but learning tcpdump's filter syntax should probably be your first priority since you use it every day and it's available on just about every system.

      Description: grep for network traffic ngrep strives to provide most of GNU grep's common features, applying them to the network layer. ngrep is a pcap-aware tool that will allow you to specify extended regular expressions to match against data payloads of packets. It currently recognizes TCP, UDP and ICMP across Ethernet, PPP, SLIP and null interfaces, and understands bpf filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.

    • Re:tcpdump is great (Score:4, Interesting)

      by UnderLoK ( 552056 ) on Monday June 28, 2004 @07:09PM (#9555801) Homepage Journal
      There are 3 things that piss me off to no end when using Ethereal.

      1) I can't sort logs by date (this drives me insane)
      2) I can't open more than one trace per session.
      3) It doesn't put the trace into memory. Every time you apply a new filter it re-reads the damn file! :(

      I've been using SnifferPro for about 4 years now and while it has its drawbacks I would say the inclusion of the above 3 options has more than paid for itself ;)

      The one thing all sniffers lack that is needed is a quick and easy method to take notes. I'm constantly jotting down reminders, line #s, and ips on sticky notes. GIVE ME COPY & PASTE!

      note: It's been called SnifferPro since I started using it.

      • Re:tcpdump is great (Score:4, Interesting)

        by Guy Harris ( 3803 ) <guy@alum.mit.edu> on Tuesday June 29, 2004 @12:53AM (#9557664)
        I can't sort logs by date (this drives me insane)

        "Sort logs by date" in what sense? Presumably something other than sorting by clicking on the title of the "Time" column if it's configured to display absolute time or absolute date and time.

        I can't open more than one trace per session.

        Non-trivial to implement - doable, but we'd need to make a lot of state information per-trace (i.e., attach it to a capture file structure) rather than global.

        It doesn't put the trace into memory. Every time you apply a new filter it re-reads the damn file!

        Every time you apply a new filter it:

        1. generates a complete protocol tree so that it can run the filter;
        2. generates the column data so that it can add a row to the display;

        and, as I remember from the last profiling runs done when running filters, that takes more time than does re-reading the raw packet data. A version of the Wiretap code to memory-map the capture file being read (with a mapping window so that files bigger than the amount of address space available for mapping can be read) might be interesting, although it wouldn't necessarily improve things much, as indicated. It'd also have to deal with gzipped capature files.

        The one thing all sniffers lack that is needed is a quick and easy method to take notes. I'm constantly jotting down reminders, line #s, and ips on sticky notes. GIVE ME COPY & PASTE!

        That's not "copy and paste"; "copy and paste" would be the ability to copy stuff from the capture dissection (some analyzers do that; Ethereal currently doesn't). That might let you copy line (packet?) numbers and IP addresses from captures into a text file, but not arbitrary notes.

        What you're asking for sounds more like the ability to insert notes into the capture file itself. Some capture file formats support that, as do the analyzers using that format (I think Microsoft Network Monitor might). Ethereal's native format (libpcap) doesn't; the next generation of libpcap is intended to be extensible, and one extension would be comment records with arbitrary text in them.

  • See Lumeta and sourcefire products.

    Bonus if it can be passive and list OS, services, ...

  • Give me reporting tools! (Score:5, Insightful)

    by Bubblehead ( 35003 ) on Monday June 28, 2004 @05:50PM (#9555076) Homepage Journal
    I am constantly trying to improve the security of my home network, and the available tools are pretty powerful. My biggest problem has been to find powerful reporting tools. I use iptables as a firewall, tripwire for intrusion detection, etc. But it's not always easy to see what's going on in the system. Tripwire produces decent reports; but there is no easy way (afaik) to get a list of intrusion attempts, network traffic, port scans, etc. Sure, the information is in the logs - but the log information is hard to parse and often not as complete as it should be.

  • This Question should be reversed. (Score:4, Insightful)

    by Pros_n_Cons ( 535669 ) on Monday June 28, 2004 @05:51PM (#9555080)
    A ton of tools are available for nix boxes, take a look at the live cd security distros. Tons of perl scripts or .c files. infosec geeks don't need fancy GUI's we need little scripts that can be piped or molded for different needs. look at all the tools that have been ported to win32 from linux/bsd like hping, nmap, nessus, ethereal, netcat, nemesis, datapipe, fport, lcrzoex, snort, etc. It's the closed source guys who need to get cracking. Look at Foundstone all they do is port stuff cause the win32 crap sucks. OSS tools are the ones leading the pack on this front. That being said perhaps Snort could be a bit easier/less prone to false positives, I couldn't grasp it completly until getting a book on it.

  • Network Forensics (Score:5, Interesting)

    by mplex ( 19482 ) on Monday June 28, 2004 @05:51PM (#9555090)
    This probably is a very good project for the opensource community, but it sure would be cool. I want to see an opensource version of the old SilentRunner product, now carried by Computer Associates.

    eTrustTM Network Forensics captures raw network data and uses advanced forensics analysis to identify how business assets are affected by network exploits, internal data theft, and security or HR policy violations. Its patented technology allows IT and security staff to visualize network activity, uncover anomalous traffic and investigate breaches with a single, convenient solution.

    http://www3.ca.com/Solutions/Product.asp?ID=4856 [ca.com]

    • Re:Network Forensics (Score:4, Interesting)

      by El Volio ( 40489 ) on Monday June 28, 2004 @07:44PM (#9556042) Homepage
      There are actually a lot of good starts on that. tcpdump and tcpreplay, combined with etherape, are a good start to the old SilentRunner Collector. The Analyzer could be replicated with something based on graphviz [att.com]. Some work has been done in this area. Granted, more is left (SilentRunner had an infrastructure to move packet data around from collectors to analyzers and such), and n-gram analysis would be useful (I just found a project, Text::Ngrams [mit.edu], that does it in Perl), but we're not actually that far away. SilentRunner might have been uber-cool before, but now it's actually well within the reach of the free software community. I've been thinking about this a lot for almost a year; if anyone's interested in working on this, let me know (my email address is on my website), this would be a great project (so would several of these listed, actually).

  • WPA support (Score:3, Insightful)

    by FU_Fish ( 140910 ) on Monday June 28, 2004 @05:55PM (#9555139) Homepage
    To my knowledge there is no, or perhaps very limited, support for the WPA standard. Granted, this isn't a tool, but it's security related.

  • user (Score:5, Interesting)

    by scrotch ( 605605 ) on Monday June 28, 2004 @05:55PM (#9555141)
    Here's one I just thought of. Maybe it's been made, and maybe 16,000 people will point out why it isn't necessary or that it's built into find or emacs or something. Here goes anyway:

    Write an app that takes a username as input and shows me all the files/directories that user can read or edit or execute. If I run it as root, it shows me All files. If run as me under my account, all of my files that that user could play with. For example:
    shell% sudo fileSecurityCheck -www /
    will show me all files that are deleted when my webserver gets hacked.

    • Re:user (Score:5, Informative)

      by DaveAtFraud ( 460127 ) on Monday June 28, 2004 @06:30PM (#9555481) Homepage Journal
      find already does most of what you're looking for:

      find . -perm u=xrw,g=xrw,o=xrw -print

      finds all mode 777 files under the current directory (the initial ".", substitute a path like /var/www if that's where you want to look). If you run it as root (probably required for what you want to do), you can use -user or -uid to find all of the files owned by a particular user name or UID.

      Play with the -perm or +perm flags if need be to refine the result.
    • man find
      especially the -user, -group, and -perm flags
      Writing the shell script around find that asks for the username, checks the users group memberships, and prints the matching lines is an exercise left to the reader.
  • http://www.gentoo.org/proj/en/hardened/

  • Knopix STD all the security all the time (Score:5, Interesting)

    by phreak03 ( 621876 ) on Monday June 28, 2004 @06:01PM (#9555212) Homepage Journal
    Get Knopix STD (always a copy in my backpack) A live linux distro aimed at security with up to date packages for the following areas (From the Knopix STD site) http://www.knoppix-std.org/ * authentication * encryption * forensics * firewall * honeypot * ids * network utilities * password tools * servers * packet sniffers * tcp tools * tunnels * vulnerability assessment * wireless tools Turn it into a firewall, a web server, an IDS box, a honeypot. Use it to do data recovery on an dead or locked computer, perform a vulnerability assessment, a penetration test, perform an autopsy on a compromised machine, test your incident response team. Listen to your MP3 collection and play gnugo while waiting for that nessus scan to complete.
  • Ad-Aware and Spybot of course!

  • Encryption "Umbrella" (Score:5, Interesting)

    by macemoneta ( 154740 ) on Monday June 28, 2004 @06:10PM (#9555303) Homepage
    A tool for managing the various aspects of encryption on a system would be useful:

    1- Setup and administration of VPNs (PPTP, IPSEC)
    2- Administration of secure remote access (SSH)
    3- Partition encryption
    4- File encryption
    5- Email encryption

    YES there are bits and pieces, some distributions have more than others, but no control point for system-wide administration and enforcement that can be implemented across distributions.

  • The user-friendly/visually appealing interface (Score:5, Insightful)

    by DeepDarkSky ( 111382 ) on Monday June 28, 2004 @06:11PM (#9555310)
    Most open source project focus on utility, not on appearance. The most powerful tools are often the simplest ones (in appearance). However, the ability to visualize and/or put a user-friendly interface is usually a good next step. Some may call this approach the "Microsoft dumbing down" approach, since it is Microsoft who usually put deceptively simple user-interface in front of a much more complex and powerful tool.

    However, that doesn't mean these tools couldn't benefit from good visual front ends (and I'm sure people will point out there are plenty). Human's ability to make sense of well designed visual information (a la Edward Tufte) cannot be understated.

    I also seem to recall reading a slashdot story a long while back about Infineon (I think) that had a hardware sniffer that is able to reconstruct TCP/IP traffic/session/connections that are captured, and it recognized hundreds of protocols/applications.

    Bring all of that together: open source software being able to visually display security information in a meaningful way, using some kind of open standard like, say, OpenGL. Adding more to the existing foundation tools that we already have, that's where some contribution can be useful.

    But that's just what I think, by no means do I think it's the best answer.

    • Re:The user-friendly/visually appealing interface (Score:4, Insightful)

      by cbreaker ( 561297 ) on Monday June 28, 2004 @06:59PM (#9555726) Journal
      I think the "GUI is for dummies" mentality is slowly fading away. Anyone with half a brain can see the power in being able to visualize complex systems. At-a-glance monitoring is a wonderful thing.

      The thing I like about Unix stuff is that when there is a good GUI interface for something, that usually doesn't mean you're locked out of the nitty gritty back-end as with some.. other GUI systems. I think a good GUI can compliment a system quite well and I enjoy using them when they are well constructed.

  • A short list (Score:3, Insightful)

    by Theatetus ( 521747 ) * on Monday June 28, 2004 @06:13PM (#9555322) Journal
    1. Antivirus software (openav is getting there, but isn't there yet)
    2. Antimalware software
    3. Antivirus software
    4. Activity auditing software for multiple LDAP/auth schemes
    5. A firewall for windows
    6. Antivirus software

    #5 is a Windows-only deficiency, but the rest aren't. I mentioned Antivirus software 3 times because I think it's at least 3 times as important as the others. As more and more (read: dumber and dumber) people migrate to non-Windows platforms, viruses and malware are going to start to be more of a problem for those of us on Better Platforms.

  • Password auditing (Score:4, Informative)

    by siliconjunkie ( 413706 ) on Monday June 28, 2004 @06:13PM (#9555324)
    I am unaware of open source software that meets the functionality of PWSEX [elcomsoft.com] or LC5 [atstake.com].

    • Re:Password auditing (Score:3, Informative)

      by pegr ( 46683 ) *
      I am unaware of open source software that meets the functionality of PWSEX or LC5.

      Then you're gonna love this [antsight.com]. Why brute LM hashes when you can precompute password/hash pairs then look them up from a database? Initial db generation takes a while, but you can customize the keyspace to whatever you want. When you're done, query a hash, get a password. This stuff works extremely well...

  • A needed tool (Score:3, Interesting)

    by brennz ( 715237 ) on Monday June 28, 2004 @06:15PM (#9555336)
    I haven't heard of an open source tool with the same functionality as the former Raytheon SilentRunner, now CA eTrust Network Forensics [ca.com]
    or the similar tool Niksun [niksun.com]

    An open source tool with similar capabilities would be an excellent project

    • Re:A needed tool (Score:3, Insightful)

      by keefus_a ( 567615 )
      I second that motion.

      Granted Niksun's NetVCR is basically a glorified tcpdump with a pretty interface, but it's also a functional interface. Sure you can preach "use the command line" all you want but you'd be underestimating the value of being able to present simplified data to the rest of the IT department that usually rings your phone, or visits your cubicle, or sends you and email every time some site can't do their work because their circuit is too slow.

      Sure, give me an open source tool that I can p

  • monolithic network management tool (Score:5, Interesting)

    by bhsx ( 458600 ) on Monday June 28, 2004 @06:15PM (#9555341)
    Something that can premiscuously detail a LAN. It should use netcat, nmap, ethereal and the other standards to map, in real time, you LAN traffic. It should also have the ability to intercept and decode any stream on your network.
    So, let's say Billy is reading Slashdot when he's supposed to be doing data entry. You see a red (for example) line leading from Billy's box to the firewall with the line labelled "slashdot.org" and the IP address. Click on Billy's box and "zoom" to focus the GUI to Billy and right click menu to "intercept and decode" to pop-up a konqueror window that follows Billy's URL jumps and shows you what he's reading. The same would be true of mpegs he's watching or mp3s he's downloading.

    Other functions would be to show all nodes in the LAN as well as OS versions, all traffic in and out of each node, and any services running per node. Servers running things like ntlogon, apache or SMB would be marked as such. A "bookmarking" type feature could also be implemented as well as a sticky-note feature for notation and easy navigation.
    You could call it knetsec, but I actually like a bastardization of that... Knutsac.
  • Don't forget host-based tools - one of my favorite that will help keep you OUT of trouble is sudo [www.sudo.ws] which is a way of controlling and logging root access. Been around forever - tastes great AND less filling! ;-)

  • Number One Missing Security Tool (Score:3, Funny)

    by craXORjack ( 726120 ) on Monday June 28, 2004 @06:35PM (#9555523)
    However, with the world of security constantly changing, this begs the question, what open source security tools are missing?

    It would solve 99.9% of security problems: The MS-Windows-to-Linux-Upgrade-Wizard

  • ZoneAlarm features (Score:3, Interesting)

    by mebon ( 634191 ) on Monday June 28, 2004 @06:54PM (#9555683)
    I would like to see a firewall with features like ZoneAlarm that has the ability to notifiy you when programs try to access the network and allows you to stop them.

    Being notified that a program is trying to connect to the network can clue you in that you have been infected by a worm, virus, trojan, or spyware. Sure, Linux has relatively few malicious programs now but in the future it may become a bigger target.

    Mebon

  • Fluke Network Analysis (Score:3, Insightful)

    by Linegod ( 9952 ) <pasnak@warpedsys ... a ['ms.' in gap]> on Monday June 28, 2004 @07:37PM (#9556003) Homepage Journal
    I was blown away by the Fluke Network Analysis Tools [flukenetworks.ca].
    Given enough time, everything could be replicated with FLOSS, but nobody has. Somebody should....

Slashdot Top Deals

Understanding is always the understanding of a smaller problem in relation to a bigger problem. -- P.D. Ouspensky

Close