Hardware Firewall On a USB Key

An anonymous reader writes "An Israeli startup has squeezed a complete hardware firewall into a USB key. The 'Yoggie Pico' from Yoggie Systems runs Linux 2.6 along with 13 security applications on a 520MHz PXA270, an Intel processor typically used in high-end smartphones. The Pico works in conjunction with Windows XP or Vista drivers that hijack traffic at network layers 2-3, below the TCP/IP stack, and route it to USB, where the Yoggie analyzes and filters traffic at close-to-100Mbps wireline speeds. The device will hit big-box retailers in the US this month at a price of $180." Linux and Mac drivers are planned, according to the article.

Not really a hardware firewall

[dreamchaser (49529)]

A true hardware firewall wouldn't have to hijack traffic via a driver. It would have it's own ethernet port and would inspect data before it even touches the network stack on the host OS.

A bit hyped up if you ask me.

Re:

[nine-times (778537)]

Yeah, that was my thought. If you're plugging the ethernet into your computer and relying on software to route traffic to this device in the first place, how is this better than software firewalls?

Re:

[bobo mahoney (1098593)]

It might not offer better protection than a software firewall, but it will offload the work to it's own processor freeing up cycles on your computer. If you are pushing your machine this could be a fairly inexpensive way to squeeze a little more life out of an older /underpowered box.

Re:Not really a hardware firewall

[TheRaven64 (641858)]

Why not just put an ethernet controller into it, and use it as a USB network adaptor?

Re:Not really a hardware firewall

[kasperd (592156)]

Why not just put an ethernet controller into it, and use it as a USB network adaptor?

I think that is exactly the point the grandparent was trying to make. If it had an actual ethernet interface you would only have to transfer the packets over the USB interface once, thus you'd reduce the load on the machine. You'd also get better security since the machine would no longer be connected to the network without going through the firewall. You'd avoid hacking the network stack, and the result would be something working on more systems without the need for special drivers. And you'd free up the ethernet port on the machine, so it could also be used in situations where the machine did not have exactly as many ethernet connections as you'd want. Basically adding a real ethernet interface to this gadget would have increased its value by at least a factor of two.

Re:

[hattig (47930)]

Basically adding a real ethernet interface to this gadget would have increased its value by at least a factor of two.

and useless when the laptop user connects to the internet via their GPRS card, or their Bluetooth enabled phone, or via wireless ...

This device works with all of them, it could only be better if they made it in an ExpressCard format, which I'm sure is in their plans.

Re:Not really a hardware firewall

[larkost (79011)]

Except that all of your traffic is now going over your USB port twice... and the USB port is your most processor-intensive I/O. I have no idea how the numbers will work out... but there is a good chance that this will eat a lot of processor time.

It's just Killer.NIC on USB

[DrYak (748999)]

They just basically just invented the USB equivalent of the Killer.NIC :
a small embed router + a driver that directly taps into the WinXP TCP/IP stack (instead of having the packets go through the whole stack then over a short "virtual" network link to the router then up to TCP/IP again, then routing, then back to Ethernet then on the "actual" cable).

My only though : Is it programmable ? Could it be reflashed to function as something else more creative and be powered from a wall-socket USB 5v power brick ?

C

Mod up.

[Ayanami Rei (621112)]

(*eyeroll*)
The point of the article (if anyone bothered to read it) was the miniaturization feat... 12 LAYER PCB!

Why?

[csnydermvpsoft (596111)]

As another poster has suggested, this isn't truly a hardware firewall - it hijacks the network traffic from the host OS, after all. Since the network traffic is already in the network stack, how is this any better than a software firewall? Software firewalls are hardly performance hogs.

Marketing Gimmick

[dreamchaser (49529)]

It's a marketing gimmick. At the very best it's a software firewall with a (not really needed) co-processor to do packet inspection.

Personally it looks like a waste of money to me.

Re:Why?

[rickkas7 (983760)]

Software firewalls are hardly performance hogs.

You've obviously never used Norton Internet Security 2007 [symantecstore.com] or McAfee Internet Security Suite 2007 [mcafee.com].

Re:

[jafiwam (310805)]

There is a niche for this tool, but it is a small one and not one that will pay $180 for this thing.

For example, I run no firewalls whatsoever on my home network, instead relying on my NAT router to keep inbound traffic out, and configuration / backups to keep risk to acceptable levels elsewhere.

Taking a laptop to a cafe or hotel or something, or a gaming machine to a LAN party means I'd have to muck around with a Firewall before (or just go without) going.

So I would use this thing there. But, probably not

odd

[otacon (445694)]

Did anyone else find it odd that it runs linux, but doesn't actually work with a linux box, but only with a windows one?

Re:

[BosstonesOwn (794949)]

Odd or ironic ?

I find it Ironic personally that the linux device can easily hijack packets from a windows stack but the driver to hijack the traffic from the mac or linux boxes are still not ready.

The true question at this point is who can't steal hijack packets from a windows box.

Re:

[zappepcs (820751)]

Apparently just about anyone... ergo the need for such a device? :-/

Re:

[Deadplant (212273)]

Perhaps, but the US, Israel, Russia and China together manage to do a startling amount of shady shit.
Their efforts really do put the rest of the world to shame (er, maybe i mean the opposite of that)

That being said; the fact that this product was developed in Israel is not a reason to avoid it.
*That* being said; the fact that this security product relies on closed-source binary drivers and runs on XP *IS* a reason to avoid it.

I would trust this product about as much I would trust Norton or Mcafee.

Re:odd

[Josiah_Bradley (867692)]

If it's running Linux then you can probably get the same apps it's running and install them on your Linux machine. And if your already running Linux you probably don't need a firewall for windows anyway...

Re:odd

[jcgf (688310)]

It's not as odd as you think. There have been several routers and such which either require you run a config program on a windows box or access them using a browser which had to be IE, despite the router itself running Linux.

Re:odd

[Ant P. (974313)]

Not odd at all. Windows is the only desktop OS in use today that needs a device like this.

Why would I want this?

[morgan_greywolf (835522)]

I mean, increasingly, firewalls are being combined into multipurpose devices that provide NAT, Web serving, DMZ, VPN, media streaming, wireless access, etc. I mean even the lowly Linksys WRT54G, available for ~$50 USD almost anywhere, supports VPN, provides NAT, DMZ, UPnP capabilities, rudimentary web filtering, and has a built-in wireless access point. I mean, this thing doesn't even support wireless, which would make it useful for laptops, etc.

IOW, someone tell me why I should care?

You shouldn't

[dreamchaser (49529)]

It's a hyped up device that nobody really needs. We're posting in a Slashvertisment thread after all.

Re:

[toleraen (831634)]

Because you can plug it into your laptop if you're at a local hotspot? Think mobility + offloading processing. Not exactly the most useful of devices, but for someone who's constantly at the mercy of free/public wifi it could be convenient.

Re:

[dreamchaser (49529)]

A software firewall is more than enough for those situations. Heck, for half that price you could buy a little router and carry it with you! I'm being a bit facetious here, but I really don't see a good niche for this product as you can tell from my previous posts in this thread.

Re:Why would I want this?

[Kam Solusar (974711)]

Heck, for half that price you could buy a little router and carry it with you!

And in many parts of the world you could even get a little guy to carry it for you too!

Re:

[StarfishOne (756076)]

My laptop IS a local hot spot! ;XD

(sorry, could not resist)

Re:Why would I want this?

[richardtallent (309050)]

Just like software firewalls, this is just snake oil for feeble-minded people who don't realize that firewalls are for blocking access *between* networks, not for closing ports that shouldn't be open in the first place on individual machines.

Re:Why would I want this?

[fishybell (516991)]

According to their nifty flowchart [linuxdevices.com] it supports whatever windows supports. It takes the inbound traffic after the hardware receives it, but before the TCP/IP stack. It sits in the same place as a software firewall, but offloads the calculations and filtering to the dongle's cpu.

Why would anyone want this? Well, a router that combines firewall, nat, vpn, etc. is fine for home use, but what about the coffee shop? For a mobile computer having a on-computer firewall is a must. As far as why anybody would choose to use this over any software firewall... I can only assume it's for people who don't want yet another piece of software hogging their cpu. Most software firewalls aren't that intensive, but if you're looking to free up that 3-5% of your resources, hardware is the way to do it. Of course, without a benchmark showing a difference, the actual performance increase is lost in the market speak.

Re:

[Vicegrip (82853)]

I suspect the main appeal would be for laptop owners on public networks where they don't own the router or control them-- rather than just trust their Windows firewall to protect them. It'd be like having your own private router protecting your laptop on a public network. Not be a bad idea.

The device has sex appeal in terms of form factor accomplishments. But the OS level filter driver requirement turns me off.
A device like this needs to be totally independent of the OS to be attractive.

I won't be buying t

Not too bad

[NickisGod.com (453769)]

My favorite is the "Layer-8" security engine (Patent pending).

That's where all of my clients' problems come from.

-Nick

100Mbps on USB?

[cravey (414235)]

I keep wondering how they put such a fast processor on a usb stick and then squirt bidirectional 100Mbps over the USB port. Sounds a lot like my former boss trying to convince me that our building would give us 100Mbps internet for only $50/month. I dislike misleading articles and I dislike misleading product descriptions even more.

It seems much more likely that there's an app on the USB stick tht is run by the windows machine making the USB stick just a different delivery mechanism than a CD/DVD. Probably way cheaper to produce, update and ship.

USB2, yes.

[RingDev (879105)]

Uhh, USB2 runs at 480Mbps and in practice can push 40MBps (320Mbps) for bulk transfer (ie USB Hard drives).

So for them to claim that this device can push 100Mbps really isn't that surprising. So long as the little processor can burn through the logic checks fast enough, the bus can definitely handle the load.

-Rick

Re:

[theRiallatar (584902)]

Assuming there isn't one or more of the following also attached to the same USB Bus. Wired/Wireless Mouse Printer Keyboard Digital Camera USB Flash Drive etc

from the article

[MarcoAtWork (28889)]

Once running, the Pico establishes an SSL (secure sockets layer) http connection to Yoggie's central servers, where it checks for updated firewall policies and rule sets, Touboul said. It subsequently checks every every five minutes, by default.

so basically this means allowing a black box to hijack completely my IP stack, a black box which phones home every 5 minute and arbitrarily downloads software updates... just think if this company's server was compromised even for an hour, given that all of the devices update every 5 minutes you could compromise pretty much all of them at the same time.

Not to mention that if this device can insert a 'low level driver' that hijacks the IP stack, I'm sure a virus will come up sooner or later that will re-hijack this and compromise it. The only really 'safe' hardware firewall is, guess what, a completely separate hardware firewall (like my custom LEAF install on my old p3-500), this sounds like those 'one time pad, guaranteed!' crypto products we often lambast here on /.

Huh? That's not a hardware firewall!

[gnuman99 (746007)]

It is just another type of a software firewall. A hardware firewall has at least one input and one output jack (unless it is some weird VLAN firewall). The firewall then checks the packets *before* they get to the hardware that processes them.

Here we have a software layers shunting packets for filtering to another "device" and then they are probably reinjected. The software layer that does this shunting and re-injecting of packets makes this not a hardware firewall.

Or are we saying that iptables is a hardware firewall as well?

something similar but better...

[i.r.id10t (595143)]

I read (here on /. IIRC) a few years ago about a gumstick sized machine that had 2 ethernet ports on it. Possible to use Linux on it (or other embedded OS), have a dhcp client on one port and a dhcp server (or just static addy on "real" machine) with gateway/NAT/etc. on the other port. Would allow you to plug into any ethernet connection and then provide NAT, etc. (and some degree of protection and trust) to your laptop, etc.

Anyone remember this, maybe have a link?

Re:

[Dan Ost (415913)]

http://www.gumstix.com/ [gumstix.com] might be what you're thinking about.

Intel?

[TheRaven64 (641858)]

Intel sold the XScale line to Marvell Technology Group in June 2006. It was only a year ago, so it probably counts as news by Slashdot standards, but can we try to keep the summaries slightly accurate please?

Wait

[Tarlus (1000874)]

But does it run Li... oh, sweet.

Compare this USB device to a software firewall such as Zonealarm. It costs $180 whereas you can get free versions of Zonealarm. It routes your network traffic via USB, which makes me shudder. That would be a nightmare on older pre-USB2.0 machines. It requires software drivers in order for network traffic to be directed through it. That's more "moving parts" than should be necessary. Because, of course, the more moving parts there are, the more there is that can break.

Now if t

Hardware firewall definition

[sverrehu (22545)]

Eh, could someone please define the term "hardware firewall"?

Re:

[griffjon (14945)]

RTFA - it's obviously any doohicky that plugs in to your computer-thingamajig.

I mean, it's a cool idea/system, but... uh, not really a "hardware" firewall if it needs client system software to route to it..

Re:Hardware firewall definition

[by Anonymous Coward]

A hardware firewall is a firewall that runs on separate hardware from the hosts that it protects. In other words, it's a software firewall on a dedicated machine, which may or may not have specialized packet-filtering hardware. The "hardware/software" distinction made by marketeers isn't really important; more significant is the distinction between "network firewalls" and "host firewalls". Network firewalls are separate devices that are capable of filtering all traffic entering or leaving a network of multiple computers; host firewalls are limited to the traffic entering or leaving a single host, and are normally tightly integrated with that host's operating system.

This gimmick consists of a coprocessor and some low level operating system drivers, and appears to be primarily designed as a host firewall. It might be useful in a network firewall, it the operating system components could be ported to an operating system adequate to the task.

Re:

[qwijibo (101731)]

A piece of hardware that plugs in between your computer and your internet connection. Ie, not this product.

sorry, needs to be ENTIRELY outside the pc

[TheGratefulNet (143330)]

else its NOT a hardware firewall. ..no matter what the slash-vertisement tries to say.

now, take that neat usb form factor, put 2 rj45 jacks on it and THEN we'll talk.

Close but no cigar

[PHPfanboy (841183)]

Funny, a good friend of mine almost worked there.... Anyway, I thought this device would only be any good if: 1) it had a wifi chip in the device and 2) connected via ethernet port as a mini and compact external network element that 3) would do encryption for SMB non-VPN customers 4) in unencrypted hotspots. 5) to prevent snort wifi sniffer attacks But it doesn't. Still, from what I understood they're trialling at some large enterprise IT departments who think it's super, so maybe I missed something. Nic

holy hackable hardware, batman!

[radarsat1 (786772)]

firewall schmirewall, I can't wait to see what "wrong" things people do with this.. a Linux machine on a USB stick? For 180$? Awesome.

Lotsa useless negativity

[ushering05401 (1086795)]

There is a niche for this thing... a very small one, but it is there.

I, for one, might look into owning one of these. After all, I spend a shitload of time working on client machines trying to isolate and diagnose problems. Being able to plug in a USB key to emulate the hardware firewall the client *should* have would be helpful. Notice, I said emulate, not duplicate.

Just because it is on the front page of /. does not mean it is supposed to save the world.

Regards.

I am from Yoggie: Critial information disclosed

[SST (1108891)]

Dear All, Yes, I am from Yoggie and its a pleasure and honor for me to provide some "internal" information: Some of you mentioned that you need 2 network ports to make a "real" Firewall. True, please refer to our web site: www.yoggie.com and find the Yoggie Gatekeeper. This product released few months ago comes with two network ports running same processor, same memory, OS and 13 application. Some of you, view Yoggie as a Firewall and compare it to Routers and access points: Please note that Yoggie is by far more than just a Firewall and in fact its like a set of enterprise security appliances packed in a miniature computer. Lets see what's in there: 1. FireWall, NAT, DHCP Server and client 2. Full snort implementation including IPS on top. VRT updates will come soon. 3. 4 transparent proxies: 2 for web: HTTP, FTP and 2 for email: SMTP and POP3 4. True File-Type detection agent so file type are detected by content analysis and not based on MIME or file extension! Compressed file - are uncompressed in real time before scanning!!! 5. Anti Virus agent - Kasperski! 6. Anti Spyware agent - both signature based and behavior based! 7. Anti Phishing - since it sees the web and email traffic - it can "close the phissing loop" and verify content/url. 8. anti SPAM - based on Mailshell engine. 9. URL CAT and parental control - based on SurfControl. 10. Layer 8 agent - performs content scanning to "above layer 7" applications, AJAX, VBS, JS, etc. to detect new and unknown virus (not based on signature). 11. MLA - Multi Layer Security agent - a new invention - event correlation in REAL TIME for all event from all other modules - to drastically reduce false positive of IPS and Layer 8 agent. 12. VPN Client. These applications take 35% - 45% of PC Windows CPU. More, one cannot find a commercial implementation of all these applications in one security appliance, even when it comes to a 1U, 2U or 4U appliance. Simply, no one yet managed to integrate layer 2/3 security with layer 7 and above layer 7 content analysis. Yoggie is a unique combination of 7-8 commercial different security appliances. Why did we come with the Yoggie PICO? and why after Gatekeeper: First, we wanted to provide the experts with a 2 network ports solution: we launched the Yoggie Gatekeeper. After we came with this great invention that one can implement an *almost* identical solution using *s-route driver* at the lowest level that still NAT (yes, this is the first NAT and DHCP service inside a protected driver and in between network layers) IP address so external IP address is different from IP addresses Windows application gets. This unique implementation is the only one capable stopping attacks such as "ARP cache poisoning" - something only hardware based firewalls can do. (will go via software firewalls). We absolutely agree that Yoggie Gatekeeper using two network interfaces provides the ultimate separation and isolation but we also know that Yoggie PICO unique "S-Route driver" is by far better than software firewall. Why we didn't add network port to PICO ? - we let this choice with the Gatekeeper (for people that absolutely requires two ports) and made an alternative with almost same security level but with a much smaller form factor (easy to carry)and using the existing network port in the laptop. Your comments and suggestions are welcome. SST.

Re:Troll!

[Pojut (1027544)]

They are like you in every way, except for one thing: They remember to actually click "Post Anonymously"

Re:

[Mr. Roadkill (731328)]

How can it possibly duplicate the functionality of regular AV software that has hooks in the file system and email clients? It can't possibly do all that.

You're quite correct about the filesystem checks... it can't do those.

For email, though, it could be quite decent - provided the signatures are kept current, and/or are broad enough to pick up new variants of some of the more common varieties. Many AV products set up POP, IMAP and SMTP proxies (although this looks like it only does SMTP and POP)... yo