Raesene's Ramblings

Slashdot | Dan Kaminsky Suggests Having Fun with DNS
There's a story over at slashdot covers a presentation from Dan Kaminsky (of paketto Keiretsu fame) covering some... very interesting ideas about using DNS as a communications channel for arbitrary data (in a similar fashion to things like httptunnel ).
Cool stuff this 'cause it drives home the point that it is wrong to think of a network service as just a means of transferring a specific type of data, as many can transfer any type of data you like , it's just usually used for a given type of data. Which does make the point that traditional security measures like firewalls become a lot less effective as soon as you allow even on protocol across them....
One other thing that occured to me when reading the slides about transmitting ISO images using TXT records, is I wonder what would happen if you caused a caching DNS server to run out of disk space by requesting lots of these records...
I would hope that it would just start purging the records in oldest first order, but I suppose it might DoS some servers...

A interesting article at LURHQ presents - Scanrand Dissected. It's a great explanation of how scanrand works and also a speed comparison between it and nmap, although the author does point out that nmap has far more functionality than scanrand....
Looks like a great tool for quickly scanning networks for rogue servers....

An interesting article at nwfusion give us The scoop on security policies. There are some good points in the article about keeping the policy short and to the point, although I've tended to find that in larger companies it is a real challenge to convey all the information that you need to, to your userbase in a very short policy. There are other alternatives of course, like splitting the information up over multiple documents, but that can lead to people reading the first one and none of the rest.
One other point to note, is that even more important that the security policy itself is the communication method and the periodic reminders. If you only give someone the policy once and then never revisit it, most people WILL forget whats in it.......

There's a good list of wardriving tools over at The Official WorldWide WarDrive site...
Also there are some interesting stats about the number of Wi-fi networks around.

As Details emerge of first cell phone worm, it shouldn't really be a suprise to anyone that this has happeneed as more and more functionality is added to phones and the codebase size increases, we can expect to see more malicious code taking advantage of those vulnerabilities (I wonder when we'll see the first mobile phone A-V software ;op)
Whilst the current virus hasn't really had a huge impact, it is quite easy to see how one could be pretty devastating. For example the current one is spread via bluetooth which is fairly short range, however if a virus was able to cause a phone to dial all the numbers in it's phonebook and transmit itself over this channel (or perhaps via a text message) you could see a pretty fast and wide spread....
One point that, at the moment, mobile phones have in their favour over the PC world is that there is no one dominant OS or vendor, so any virus would automatically have a limited spread...

I came across an interesting site called Linux-Forensics.com. It's a good resource dedicated to the use of Linux in computer forensics
Whilst in general I like the idea of using Linux in alot of places, it'll have a uphill struggle in this area, I think, up against the likes of Encase . One reason for this is that, at least in the UK, Encase is recognised by the police and the courts as being a reliable forensic tool, the evidence from which can be admissable in court. So it would be a brave forensic investigator who used something else, which he would doubtless have more trouble justifying in court.
That said not every forensic analysis ends up in court and encase is a tad on the pricy side.....

Web Services Are Biggest Security Challenge
An interesting article reporting on Netsec 2004, it focuses on some of the challenges facing web services security. I definately agree with the point that's made in the article about the problem of how contracts between web services will be negotiated. Initially when I saw information about UDDI I thought it looked cool for internal applications, but for external B2B, there needs to be something more, as suppliers will inevitably want to charge for their webservices and customers will inevitably want some guarantees about the service they'll be getting....

Wi-Fi Networking News
Handy site, I like the little hotspot locator in the corner...

Here's another article around the idea of policy enforcement, this time on Switches.
As I said previously I think that this is the right way to go about it. If it is possible to block a machine from getting on the network if it doesn't meet certain criteria, then it would be possible not only to reduce the incidence of virii/worms in corporate networks, it might also provide some defence from non-corporate machines being placed on the network.

SecurityFocus HOME Infocus: Wireless Attacks and Penetration Testing (part 2
Second part of an interesting article on Wireless Pen Testing.