Message-Id: <7CADC254-BF17-4560-AF1D-F1CE14A35C9F@securitynow.us>
Date: Tue, 12 Feb 2008 10:14:12 -0500
From: Keith Kilroy <keith@...uritynow.us>
To: Tonnerre Lombard <tonnerre.lombard@...roup.ch>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Brute force attack - need your advice

Tonnerre,

My apologies if I suggested you did not have it setup right or  
anything bad about your abilities. That was not my intention.  I've  
just had good luck with it. That's the bad part of email as a medium.

You have earned my respect.

As far as Heat I was speaking more of kiln, molding into another type  
of object completely, which is overkill anyway.

Again, it's great to have a good debate. Servers are here to serve as  
you said and I too believe there is a line where security impacts  
productivity.

Thanks again for your responses, I like it when someone keeps me on my  
toes :)

Tonnerre--feel free to email me directly anytime. I would enjoy a  
voice conversation with you sometime as well.

Thanks
Keith

On Feb 12, 2008, at 9:16 AM, Tonnerre Lombard wrote:

> Salut, keith@...uritynow.us,
>
> On Tue, 12 Feb 2008 08:17:13 -0500 (EST), keith@...uritynow.us wrote:
>> been using since begining of project, but requires a lot of learning
>> to setup properly" and as I stated nothing is foolproof or totally
>> secure. Other measures need deployed as well such as an application
>
> I would not suggest that I have not set it up correctly, because it
> recognized all the background noise attack patterns just well (and did
> not notify), but nevertheless it was totally incapable of detecting
> anything which could really have been interesting.
>
>> It takes quite a bit of heat and even then some data can be
>> recovered, from magnetic residue, in labs. Usually cost prohibitive
>> unless someone really wants your data bad and has a big budget.
>>
>> But please state a config that someone with experience can not get
>> into, is more of a point that security is ever evolving.
>
> Well, you can take Flash storage and put 300-400V or so at the
> contacts - just enough to melt the core before the contacts. If the
> voltage is too high, only the contacts melt away and the core stays
> intact. That is the only really erasable medium I'm aware of.
>
> An alternative for the longer term is a PGP smart card with an 8192  
> bit
> RSA (not! DSA) key which you simply break apart as you get into
> trouble. It takes a while to reverse engineer the data.
>
> But as I said, this is pure populism, servers are here to serve, not  
> to
> be made inaccessible. It is possible to maintain reasonable security
> without achieving unusability.
>
>> Yup it is security by obscurity and it will help against a script
>> kiddie that won't take the time to scan all ports, thats why I
>> suggested move to a high non-standard port.
>
> That script kiddie won't find its way into a reasonably maintained
> server anyway, it takes someone clued to do it.
>
>> I'm not talking about downloading blacklists but dynamic firewall
>> rules and scripting to achieve a dynamic list based on ranking of
>> attacks against the box. Google does have a few references and
>
> Me too; there are e.g. scripts which evaluate failed logins from  
> syslog
> and ban them. Thus the mention of the user name with spaces, some of
> these scripts fall for that trick.
>
> 				Tonnerre
> -- 
> SyGroup GmbH
> Tonnerre Lombard
>
> Solutions Systematiques
> Tel:+41 61 333 80 33		Güterstrasse 86
> Fax:+41 61 383 14 67		4053 Basel
> Web:www.sygroup.ch		tonnerre.lombard@...roup.ch

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists