Functionality is the key point that allows a user to deploy a complete IDS/IPS System up and running out of the box within a few minutes, even for security beginners with minimal Linux experience.

Features

Snorby

• Metrics Metrics & Reports
• Classifications
• Full packet and session data.
• Settings Custom Settings
• Hotkeys

Suricata

• Native IPv6 Support
• Automatic protocol detection
• Multi threaded
• Native hardware acceleration support
• Passive OS and Portscan detection
• L7 Protocol awareness
• IP Reputation using scoring threshold
• Distributed blocking & feedback
• Global flowbits and variables

Details

Snorby login:

Snorby interface: https://ipaddress
Username: snorby@snorby.org
Password: snorby (please change this password after the firts login)

Ssh login:

Username: root
Password: the password you have chose during the installation

You can download Smooth-Sec here:

SmoothSec-1.1.iso

Or read more here.

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field.

Basically it’s a is a multi-threaded intrusion detection/prevention engine engine available from the Open Information Security Foundation

OISF is part of and funded by the Department of Homeland Security’s Directorate for Science and Technology HOST program (Homeland Open Security Technology), by the the Navy’s Space and Naval Warfare Systems Command (SPAWAR), as well as through the very generous support of the members of the OISF Consortium. More information about the Consortium is available, as well as a list of our current Consortium Members.

The Suricata Engine and the HTP Library are available to use under the GPLv2.

The HTP Library is an HTTP normalizer and parser written by Ivan Ristic of Mod Security fame for the OISF. This integrates and provides very advanced processing of HTTP streams for Suricata. The HTP library is required by the engine, but may also be used independently in a range of applications and tools.

You can download Suricata v0.9 here:

suricata-0.9.0.tar.gz

Or read more here.

Hackers are switching targets now, companies are getting too hard to break into due to the availability of decently configured perimeter kit like firewalls and IDS.

Plus the information they do get if they manage to break in is often worthless commercially and really not worth the effort.

So instead, they target the end user, home bankers, those who they can scam, con or phish!

Consumers are now on the main target of malicious hackers intent on enriching themselves through the misery of others. Vulnerabilities in desktop applications and the increased use of stealth techniques are on the rise among members of the digital underground, according to the latest edition of Symantec’s Internet Security Threat Report.

The report, which covers the first half of 2006, suggests that consumer security protection is weak, leaving Joe Public easy prey to identity thieves, botnet herders and other financially motivated criminals. Crackers are using a variety of techniques to escape detection and remain on infected systems for longer. Symantec reckons assaults against consumers account for 86 per cent of all targeted attacks. Banks and other financial sector organisations are the second most prevalent target for internet attacks. Phishing attacks almost doubled during the reporting period.

The information on your desktop could be valuable to someone…remember aswell spyware/adware companies are making tens of millions infecting users and just simply collecting information about Internet useage and surfing habits.

In the first half of 2006, 18 per cent of all malicious code samples detected by Symantec had not been seen before, indicating that hackers are trying harder to evade detection by signature-based anti virus and intrusion prevention systems.

Phishers are also attempting to bypass filtering technologies by creating multiple randomised messages. In H1 2006, 157,477 unique phishing messages were detected, 81 per cent more than the previous six months. The financial services sector was the most heavily phished, accounting for 84 per cent of phishing sites tracked by the Symantec.

This shows a BIG pickup in new and unique code, people are trying harder and getting smarter, phishers are starting to use the tricks spammers are already using. Loads of phishing.

Source: The Register

It’s good to see work on open source tools in the countermeasure department aswell as the attack and penetration arena.

It’s a shame since Snort and Nessus have gone semi-commercial.

I hope more people invest their time in good IDS, Firewall and IPS systems, I love things like IPCop and hope to see more products like HLBR.

HLBR is a brazilian project, started in november 2005, as a fork of the Hogwash project (started by Jason Larsen in 1996)

HLBR is an IPS (Intrusion Prevention System) that can filter packets directly in the layer 2 of the OSI model (so the machine doesn’t need even an IP address). Detection of malicious/anomalous traffic is done by rules based in signatures, and the user can add more rules. It is an efficient and versatile IPS, and it can even be used as bridge to honeypots and honeynets. Since it doesn’t make use of the operating system’s TCP/IP stack, it can be “invisible” to network access and attackers.

Since version 1.0, released in march 5th 2006, HLBR can use regular expressions to detect intrusion attempts, virus, worms, and phishing.

You can view the entire HLBR README file here.

Go to the HLBR Homepage for more information and downloads.

Another good tool updated! TCPReplay suite 3.0.beta10 has been released.

For those that don’t know Tcpreplay is a suite of BSD licensed tools written by Aaron Turner for *NIX operating systems which gives you the ability to use previously captured traffic in libpcap format to test a variety of network devices. It allows you to classify traffic as client or server, rewrite Layer 2, 3 and 4 headers and finally replay the traffic back onto the network and through other devices such as switches, routers, firewalls, NIDS and IPS’s. Tcpreplay supports both single and dual NIC modes for testing both sniffing and inline devices.

Tcpreplay is used by numerous firewall, IDS, IPS and other networking vendors, enterprises, universities, labs and open source projects.

Beta10 contains a number of major enhancements as the code continues to stabilize for the 3.0 stable release. The big changes include removing Libnet as a requirement, tcpprep and tcprewrite no longer requiring root access and improved packet timings for tcpreplay. There are also a number of smaller enhancements and bug fixes.

Also a lot of time has been spent updating the online manual on the wiki which covers most if not all the features of tcpreplay, tcpprep and tcprewrite.

This should be the final beta release and it’s expected to have the first release candidate in a month or so. Please download and test!

You can download it here:

TCPReplay

The new Wikified manual is here.

Download: http://prdownloads.sourceforge.net/tcpreplay/tcpreplay-3.0.beta10.tar.gz?download

What? New vulnerabilities in Internet Explorer?

You can hack Internet Exploder Explorer? Never!

3Com Corp’s TippingPoint division has discovered and disclosed two critical new vulnerabilities in Microsoft’s Internet Explorer through 3Com’s Zero Day Initiative (ZDI).

The vulnerabilities could have allowed an attacker to gain control of a PC if the user was logged in with administrative rights.

Sounds a bit like an advert for TippingPoint to me.

Under the ZDI, 3Com rewards researchers who, while keeping the vulnerabilities confidential, alert 3Com to these vulnerabilities.

3Com can in turn alert the software vendor so that a patch can be prepared, while IPS prepares the security filter and distributes it to customers.

Interesting initiative though.

Source: The Star