Why Are We Talking Philosophy Instead of Technology

I still believe that the presentations and panels being selected for most information security events are much too far removed from the “roots” of the art. Often times to the extent that there is a full slate of presentations where most sessions turn out to be less glorified keynotes with little more than feelings, whether warm fuzzies or cold pricklies, to take home with them. This is a negative thing for many reasons, but before we start lets makes sure we’re speaking the same language.

Do We Want Better Spam Detection on Social Networks?

The question sounds crazy, especially for someone who’s spent a fair amount of the last year working on making spam and other malicious message detection on social networks better. But we do a disservice to tools geared for protection when we don’t think long term about the consequences of them. Does better spam detection on say twitter for example reduce the total amount of spam that users see, or does it just change the signal to noise ratio?

The More Connected the More Vulnerable

The Facebook data team released some interesting data a few days ago focusing on the connectedness of their social graph, taking six degrees of Kevin Bacon and looking at how many connections away from each other any two people on the network are. From their research it seems like more than 90% of people on the network are seperated by only four degrees, meaning that any person A has a friend that knows a friend of Person B.

Oisf Meeting and the Next Generation of Open Source Intrusion Detection Systems

Last week I had the opportunity to attend the first public planning/brainstorming session for the DHS seeded Open Information Security Foundation and their next generation IDS project. Lots of good discussion, with the first couple hours focusing on the foundation itself, and the rest of the day was spent discussing various features that would be required by the IDS and roughly prioritising them into “version 1″ or “later” categories.

For those of you who aren’t familiar with OISF, they were created primarily to build this next generation ids, and license it under GPLv2, but also allowing less restrictive licensing to vendors who don’t want to reveal/publish proprietary additions/plugins, and providing a safeguard against taking a source tree private/commercial. Something that has happened in many community projects in the past and left a lot of sour feelings from volunteer developers.

Automatic Fuzzer Generation

Following up my last post on fuzzing an unknown proprietary protocol, we’ve now got a collection of packet captures to start ripping through to get some semblance of a fuzzer going to send packets to our target. Theres a few routes we can go, something as simple as flipping bits and putting garbage data into the stream all the way up to building a network model. I’m not big on either of the extremes. Flipping bits definitely works, but it tends to take a long time and you have a ton of crashes to dig through, and building a full protocol model can sometimes lead to great results and sometimes lead to terrible ones because you built something that works too well.