[SecurityRatty] tag: decaffeinatid

DecaffeinatID Intrusion Detection System ver. 0.08

Fri, 19 Sep 2008 20:36:46 +0000

I changed how DecaffeinatID checks for file changes in the firewall log. It seems the under Vista Autoit does not return the correct information about when the log file has changed its size or its time stamp, so I look for line count changes instead. This really is not the best way to do things, but it's a workaround for the moment. DecaffeinatID now also tries to detect if you are running Vista, and if so set's the default path to the firewall log in the ini to "\System32\LogFiles\Firewall\pfirewall.log" instead of "\pfirewall.log".

DecaffeinatID Intrusion Detection System ver. 0.08

Fri, 19 Sep 2008 20:36:46 +0000

Setting up a Tarpit (Teergrube) to slow worms and network scanners using LaBrea (The "Sticky" Honeypot and IDS)

Wed, 25 Jun 2008 21:14:22 +0000

New Video:Setting up a Tarpit (Teergrube) to slow worms and network scanners using LaBrea (The "Sticky" Honeypot and IDS)
A network Tarpit, sometimes know by the German word Teergrube, is a service or set of hosts that deliberately try to slow malicious network connections down to a crawl. The idea is to put up unused hosts or services on the network that respond to an attacker, but do things to waste their time and greatly slow their scanning (or spreading in the case of Worms). For this video I’ll be using a package called LaBrea by Tom Liston and tarpitting unused IP addresses on my home LAN.

Also, DecaffeinatID Intrusion Detection System ver. 0.07 is out.

Setting up a Tarpit (Teergrube) to slow worms and network scanners using LaBrea (The "Sticky" Honeypot and IDS)

Wed, 25 Jun 2008 21:14:22 +0000

New Video:Setting up a Tarpit (Teergrube) to slow worms and network scanners using LaBrea (The "Sticky" Honeypot and IDS)
A network Tarpit, sometimes know by the German word Teergrube, is a service or set of hosts that deliberately try to slow malicious network connections down to a crawl. The idea is to put up unused hosts or services on the network that respond to an attacker, but do things to waste their time and greatly slow their scanning (or spreading in the case of Worms). For this video Iâll be using a package called LaBrea by Tom Liston and tarpitting unused IP addresses on my home LAN.

Also, DecaffeinatID Intrusion Detection System ver. 0.07 is out.

Setting up a Tarpit (Teergrube) to slow worms and network scanners using LaBrea (The "Sticky" Honeypot and IDS)

Wed, 25 Jun 2008 21:14:22 +0000

New Video:Setting up a Tarpit (Teergrube) to slow worms and network scanners using LaBrea (The "Sticky" Honeypot and IDS)
A network Tarpit, sometimes know by the German word Teergrube, is a service or set of hosts that deliberately try to slow malicious network connections down to a crawl. The idea is to put up unused hosts or services on the network that respond to an attacker, but do things to waste their time and greatly slow their scanning (or spreading in the case of Worms). For this video I'll be using a package called LaBrea by Tom Liston and tarpitting unused IP addresses on my home LAN.

Also, DecaffeinatID Intrusion Detection System ver. 0.07 is out.

Setting up a Tarpit (Teergrube) to slow worms and network scanners using LaBrea (The "Sticky" Honeypot and IDS)

Wed, 25 Jun 2008 21:14:22 +0000

New Video:Setting up a Tarpit (Teergrube) to slow worms and network scanners using LaBrea (The "Sticky" Honeypot and IDS)
A network Tarpit, sometimes know by the German word Teergrube, is a service or set of hosts that deliberately try to slow malicious network connections down to a crawl. The idea is to put up unused hosts or services on the network that respond to an attacker, but do things to waste their time and greatly slow their scanning (or spreading in the case of Worms). For this video I'll be using a package called LaBrea by Tom Liston and tarpitting unused IP addresses on my home LAN.

Also, DecaffeinatID Intrusion Detection System ver. 0.07 is out.

Ironkey at the Kentuckiana ISSA meeting on June 27th 2008

Mon, 23 Jun 2008 20:33:58 +0000

Steve Tonkovich from Ironkey will be giving a talk at the ISSA-Kentuckiana Chapter Meeting on Friday June 27, from 11:30 am to 1:00 pm. Ironkey’s discussion will be on securing mobile data. The meeting will be held at their new location: Innovative Productivity / McConnell Technology
Hopefully I can convince Steve to give me a demo unit of the Ironkey thumb drive to test for a review on my website.

As a side note, DecaffeinatID ver. 0.06 is out.

Ironkey at the Kentuckiana ISSA meeting on June 27th 2008

Mon, 23 Jun 2008 20:33:58 +0000

Steve Tonkovich from Ironkey will be giving a talk at the ISSA-Kentuckiana Chapter Meeting on Friday June 27, from 11:30 am to 1:00 pm. Ironkeyâs discussion will be on securing mobile data. The meeting will be held at their new location: Innovative Productivity / McConnell Technology
Hopefully I can convince Steve to give me a demo unit of the Ironkey thumb drive to test for a review on my website.

As a side note, DecaffeinatID ver. 0.06 is out.

DecaffeinatID Updated to ver. 0.05

Sun, 22 Jun 2008 20:24:33 +0000

Several major improvements have been implemented. The various monitoring functions are now set off via a timer. This allows the event loop to be looser, the GUI more responsive and DecaffeinatID to be less of a hog on the CPU. This caused a change in the way that the sleep parameter in the INI file is interpreted. Now the sleep parameter specifies the amount of time in milliseconds between each monitor function (ARP cache, Firewall and Event Log). For example, with the new default of "sleep=1000", DecaffeinatID waits about one second between each monitor function, so to go through one cycle takes about three second with the default setting (I've taken it down to "sleep=100" without major problems). The only downside to this is that some alerts may be skipped if several happen at nearly the same time, but since DecaffeinatID's main function is just to alert you of network shenanigans this is a worthwhile compromise (when DecaffeinatID warns you about something, you really should check your logs for more details anyway). I've also fixed a problem with ARP cache parsing that was caused by the word "invalid" in the output of the "arp -a" command.

DecaffeinatID: A Very Simple IDS / Log Watching App / ARPWatch For Windows

Wed, 18 Jun 2008 20:37:16 +0000

DecaffeinatID started because I wanted a simple ARP Watch like application for Windows. In a short matter of time, feature creep set in. DecaffeinatID is a simple little app that acts as an Intrusion Detection System (more of a log watcher really) to notify the user whenever fellow users at their local WiFi hotspot/ LAN are up to the kind of "reindeer games" that often happen at coffee shops and hacker cons.