bugtraq - Re: Firekeeper - IDS for Firefox available

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.21.0703131857370.11867-100000@linuxbox.org>
Date: Tue, 13 Mar 2007 18:59:38 -0500 (CDT)
From: Gadi Evron <ge@...uxbox.org>
To: Jan Wrobel <wrobel@...es.ath.cx>
Cc: Jex <hewhohuntscats@...il.com>, focus-ids@...urityfocus.com,
	bugtraq@...urityfocus.com
Subject: Re: Firekeeper - IDS for Firefox available

On Sun, 11 Mar 2007, Jan Wrobel wrote:
> On Fri, 9 Mar 2007, Bob Beck wrote:
> 
> > * Jex <hewhohuntscats@...il.com> [2007-03-09 13:27]:
> > ...
> > > >rules similar to Snort ones to describe browser based attack
> > > >attempts.
> > > > All incoming HTTP and HTTPS traffic is scanned with these
> > > >rules. HTTPS and compressed responses are scanned after
> > > >decryption/decompression.
> > 
> > 	So the next snort style overflow/format string/etc bug from all that
> > string bashing code going on in the ids can now let the attacker
> > compromise a process with access to my https stream decrypted -
> > probably on an already convieniently open descriptor. Yeah. Baby.
> > 
> > 	"Web Browers are Bloated Fscking Monsters that are full of bugs"
> > 
> > 	"Lets add more code to look for people exploiting the bugs - of
> > course this code won't have bugs.."
> > 
> 
> Isn't it the case with every software created to add some protection
> to you computer? Firewalls, antiviruses, IDSes etc. are all adding
> code to your operating system that may, in the future, be found
> vulnerable to some attack. It is just the question whether protection
> they provide compensates additional threat they may introduce.

Guys, I agree. The guy created something very cool. Use it if you like,
otherwise, now that we understand the risks, let's move on.

I am not hoping to stop the general useless chatter (and I find it useful
for community development), I am hoping to thank the guy and make him feel
good about what he created.

Thank you for creating this.

> 
> Jan Wrobel
> 

	Gadi.

--
"beepbeep it, i leave work, stop reading sec lists and im still hearing
gadi"
- HD Moore to Gadi Evron on IM, on Gadi's interview on npr, March 2007.