full-disclosure - Re: Brute force attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080212151640.54f6fde7@wssyg114.sygroup-int.ch>
Date: Tue, 12 Feb 2008 15:16:40 +0100
From: Tonnerre Lombard <tonnerre.lombard@...roup.ch>
To: keith@...uritynow.us
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Brute force attack - need your advice

Salut, keith@...uritynow.us,

On Tue, 12 Feb 2008 08:17:13 -0500 (EST), keith@...uritynow.us wrote:
> been using since begining of project, but requires a lot of learning
> to setup properly" and as I stated nothing is foolproof or totally
> secure. Other measures need deployed as well such as an application

I would not suggest that I have not set it up correctly, because it
recognized all the background noise attack patterns just well (and did
not notify), but nevertheless it was totally incapable of detecting
anything which could really have been interesting.

> It takes quite a bit of heat and even then some data can be
> recovered, from magnetic residue, in labs. Usually cost prohibitive
> unless someone really wants your data bad and has a big budget. 
> 
> But please state a config that someone with experience can not get
> into, is more of a point that security is ever evolving.

Well, you can take Flash storage and put 300-400V or so at the
contacts - just enough to melt the core before the contacts. If the
voltage is too high, only the contacts melt away and the core stays
intact. That is the only really erasable medium I'm aware of.

An alternative for the longer term is a PGP smart card with an 8192 bit
RSA (not! DSA) key which you simply break apart as you get into
trouble. It takes a while to reverse engineer the data.

But as I said, this is pure populism, servers are here to serve, not to
be made inaccessible. It is possible to maintain reasonable security
without achieving unusability.

> Yup it is security by obscurity and it will help against a script
> kiddie that won't take the time to scan all ports, thats why I
> suggested move to a high non-standard port. 

That script kiddie won't find its way into a reasonably maintained
server anyway, it takes someone clued to do it.

> I'm not talking about downloading blacklists but dynamic firewall
> rules and scripting to achieve a dynamic list based on ranking of
> attacks against the box. Google does have a few references and

Me too; there are e.g. scripts which evaluate failed logins from syslog
and ban them. Thus the mention of the user name with spaces, some of
these scripts fall for that trick.

				Tonnerre
-- 
SyGroup GmbH
Tonnerre Lombard

Solutions Systematiques
Tel:+41 61 333 80 33		Güterstrasse 86
Fax:+41 61 383 14 67		4053 Basel
Web:www.sygroup.ch		tonnerre.lombard@...roup.ch

Download attachment "signature.asc" of type "application/pgp-signature" (825 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/