Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Worms Security United States

Using Layered Defenses to Stop Internet Worms 148

Posted by michael from the belt-and-suspenders dept.
An anonymous submitter writes "Following last week's release of security configuration guidance for Mac OS X, the National Security Agency has released a paper on Internet worms and how to stop new worms using layered defenses (pdf). A good read - your US tax dollars at work."
This discussion has been archived. No new comments can be posted.

Using Layered Defenses to Stop Internet Worms More

Using Layered Defenses to Stop Internet Worms

Comments Filter:

  • Using ggv... (Score:5, Funny)

    by grub ( 11606 ) <slashdot@grub.net> on Friday November 05, 2004 @02:32PM (#10736142) Homepage Journal

    Hrmmm...

    There was an error while scaning the file: /home/grieder/WORMPAPER.pdf

    **** This file has a corrupted %%EOF marker, or garbage after the %%EOF.
    **** The file was produced by Acrobat PDFWriter 5.0 for Windows NT:
    **** please notify the author of this software
    **** that the file does not conform to Adobe's published PDF
    **** specification. Processing of the file will continue normally.

    Do I "notify the author" (malcodeteam@nsa.gov> or just assume that Echelon will do it for me when you read this?

  • Tax dollars. (Score:5, Funny)

    by The Old Burke ( 679901 ) on Friday November 05, 2004 @02:36PM (#10736171)
    What tax dollars?

    I'm rich.

  • This report cost $2 billion US taxpayer dollars (Score:4, Funny)

    by Anonymous Coward on Friday November 05, 2004 @02:37PM (#10736180)
    Stopping Worms:

    -Patch your systems.

    -Use a firewall.

    -Stop running web servers and other stuff.

    Thank You,

    Uncle Sam

  • my guide to avoiding worms (Score:3, Insightful)

    by 56ker ( 566853 ) on Friday November 05, 2004 @02:37PM (#10736190) Homepage Journal
    1) Always run antivirus software
    2) Automatically filter all emails with attachments into a seperate folder
    3) Only have one user/computer
    4) Always virus scan software first
    5) Always run a firewall
    6) Always have twice as much bandwidth on the website as you need
    7) Block virus/worm emails using filters
    • And *my* guide to avoiding worms :

      1) Use Linux

      • Re:my guide to avoiding worms (Score:2, Funny)

        by Anonymous Coward
        And *my* guide to avoiding worms :
        1) Use Linux

        Ha ha!! LOL!! ROFLMAO!!!1!! R0FFl3z!! That is S0 hill-ayreeous! Use Lunix becaz Micr0$0ft iz teh SUXXH0RZ!!!1! Yuo mad teh j0k3 abuot Micr0$0ft s0 u'll g3T m0dd3d UP!!! Lun1X T0rV@ld1s si teh MADMAN!!!1!

      • Re:my guide to avoiding worms (Score:5, Insightful)

        by RealAlaskan ( 576404 ) on Friday November 05, 2004 @03:00PM (#10736397) Homepage Journal
        And *my* guide to avoiding worms :

        1) Use Linux

        Well, the mods think it's funny, but I've been doing exactly that since 1997, and it's worked wonders for me. Linux was ready for my desktop back then, it was ready for the desktop of most clerical employees, and it's gotten nothing but better in the last seven years. For most folks, there's no reason not to use Linux except inertia.

        Of course, if you don't mind buying Apple hardware, there's always OSX. If your organization has an exclusive contract with Dell, that's not an option, though.

        • Re:my guide to avoiding worms (Score:4, Interesting)

          by Red Alastor ( 742410 ) on Friday November 05, 2004 @03:06PM (#10736440)
          Worked for my sister too and she is a typical non-technical user. Of course, she didn't installed it by herself and still have very little knowledge of what the system do (same level she had with Windows anyway) but she managed to do everything she was already doing with Windows.

          I switched her since I was tired of reinstalling her Windows system which she always found ways to break. So far, her Linux box works flawlessly.

        • *BSD (Score:2, Insightful)

          by Anonymous Coward
          FreeBSD and OpenBSD make damn good worm-resistant webservers too.

        • Re:my guide to avoiding worms (Score:1, Insightful)

          by Anonymous Coward
          ya, lets ignore the rest of the world, that uses MS solutions...

          write me some real full blown solutions, that will install without a week or month of rewriting cfg files, recompiling, and it has to be compatible with the cabinet full of other software used...or go back to the corner and whine some more.

          MS is not the single solution to any infrastructure, and neither is Linux, so get off the soapbox already! Use the best tool for the job, never put all your eggs in one basket.

          Don't follow zealots, they a

        • Re:my guide to avoiding worms (Score:4, Interesting)

          by Lost Race ( 681080 ) on Friday November 05, 2004 @04:30PM (#10737347)
          I've been using mainly Windows and DOS since 1985 and never had a worm, virus, spyware, or any other sort of computer "infection". I don't even use "anti-virus" software, except maybe once a year or so just out of curiosity.

          Security isn't about the OS, it's about awareness and prudence. I don't run software of unknown provenance or whose capabilities I don't fully understand. I keep Linux-based firewalls between the (mostly unpatched) Windows machines and the Internet. I don't use Internet Explorer or Outlook.

        • Comment removed based on user account deletion

      • Re:my guide to avoiding worms (Score:5, Insightful)

        by dfj225 ( 587560 ) on Friday November 05, 2004 @03:14PM (#10736501) Homepage Journal
        I know this was meant to be funny, but I think it is this type of thinking that could one day lead to other operating systems being exploited or filled with worms as much as Windows is now. I don't care what operating system you run, if you do not patch a hole it is still exteremly dangerous to your system. I think that this problem afflicts Mac users more than linux ones as I've often heard one too many Mac lover say how Apple's machines never get viruses or suffer from security problems. (Don't get me wrong, I love my Mac, but I know the importance of keeping it patched.) If someone honestly thinks that simply running an operating system other than Windows will keep them safe, then I fear the future will be much dimmer.

        • I know this was meant to be funny, but I think it is this type of thinking that could one day lead to other operating systems being exploited or filled with worms as much as Windows is now.

          Get back to us when "one day" comes, then. Like the people who play the "Windows marketshare ensures it is the most exploited" game, your logic is flawed. Alternatives to Windows all start from a different base and evolve in a different manner, so you can't assume that what trouble 95% of users today will necessar

      • *cough* Ramen *cough*
      • Actually, if you RTFA, several of the advanced worms that this group study affected Linux. Considering how much stuff comes pre-installed on commercial Linux distros, I wouldn't be surprised if a desktop Linux user got hit with one of these:

        ETAP/SIMILE [18] - Cross-platform worm that affects both Windows Portable Executable (PE) and Linux Executable and Linkable Format (ELF) executables. Uses an entry-point obscuring technique and sophisticated polymorphic file infector to avoid detection by anti-virus p
    • Converse of Author's guide

      1) Don't use Windows NT
      2) Don't feel compelled to write "WORMPAPER" guide
      3) Don't publish broken Acrobat file
      4) Prof....er...retain profits!
    • Ok, here's mine:

      Use OS X.
      Run Software Update every once and a while.
      Make sure the firewall stays on.
      Back up.
      Watch Slashdot for malware that isn't just FUD.

    • Re:my guide to avoiding worms (Score:4, Insightful)

      by Wolfger ( 96957 ) on Friday November 05, 2004 @02:54PM (#10736346)
      3) Only have one user/computer
      Yeah. That works real well. I'll just tell my boss that right now. Which one user should we allow on our server?

      A more useful list would be shorter yet:
      1) Make sure all users are intelligent with regards to computers.
      ...hard to implement, though. That's why IT Security exists.
    • Ah Antivirus software.

      This is actually the biggest virus I know of. It kills my work machine when I am trying to do anything useful, although I am fine reading /.

    • Re:my guide to avoiding worms (Score:5, Funny)

      by Eric Giguere ( 42863 ) on Friday November 05, 2004 @03:18PM (#10736532) Homepage Journal

      8) Don't dig into the ground
      9) Step carefully after it rains
      10) Stay away from bait shops
      11) ....
      12) Profit!

      (Sorry, couldn't resist...)

      Eric
      Why the Vioxx recall reduced spam [ericgiguere.com] (humor)
    • my addendum 8)disconnect all computer from the network
      • Technically no - as you have problems with floppy disk, CD-ROM etc - I suppose you could just remove all media devices and make the hard drive read only - but where would the fun in that be! Anyway anyone worth their salt could write their own worm anyway - on that computer - a floppy disk or CD-R worm.
    • You're missing most of the important methods. A sample list;

      * Turn off or uninstall what you don't absolutely require.
      * Don't use unsafe software.
      * Scan all systems using internal external tools for known system exploits.
      * Restrict abuse by enforcing permissions and security policies.

      Properly secured, most of the items on your checklist aren't necessary or can be given fewer system resources. Also, some of the items on your list implicitly trust the tool to do the job for you...though you should be awar

  • what is this? (Score:5, Funny)

    by Anonymous Coward on Friday November 05, 2004 @02:38PM (#10736195)
    wormpaper.pif?

  • har har (Score:1, Funny)

    by scaaven ( 783465 )
    I didn't know the internet had worms. maybe it needs to flush its system with some colon cleaner or wormwood.

  • Tech report (Score:5, Funny)

    by October_30th ( 531777 ) on Friday November 05, 2004 @02:46PM (#10736285) Homepage Journal
    Heh. Such a typical government tech report. No pics, just text and tables.
    • No, typical government reports ares, even tech, are powerpoint with no relevant info. A nice common ground though wouldn't hurt.
      • typical government reports ares, even tech, are powerpoint with no relevant info

        Huh? Presentations are never supposed to yield in-depth, relevant info. A presentation that does that is torture for the audience. It's just supposed to give an overview on the topic. If you want relevant, in-depth info, you're supposed to read the report, but as you say, a common ground would be nice.

        The best way to achieve common ground is that when you give a presentation, you hand out a 1-6 page summary with plenty of f

  • Just Makes Sense (Score:5, Insightful)

    by TheFlyingGoat ( 161967 ) on Friday November 05, 2004 @02:47PM (#10736287) Homepage Journal
    Obviously multilayered security is a solution to many problems. A worm would have to exploit problems at multiple levels before being able to do what it wants. This would make it much harder for the average script kiddie to write a worm, and would force an excellent programmer to write a much larger program. It also has the benefit of stopping worm variations by applying a security fix at any one of the security levels, since it's unlikely for that complex a worm to include multiple attacks for every level.
  • http://www.nsa.gov/snac/support/WORMPAPER.pdf.exe [nsa.gov]

    But it is good to see the government is adopting some standards that are actually useful. but who wants to guess how much this cost them and how much it should have really cost?

  • Good greif (Score:3, Insightful)

    by jedkiwi ( 825683 ) on Friday November 05, 2004 @02:48PM (#10736295)
    Odviously this is aimed at the average american, as all the IT people and geeks out there already know this. But tell me, what average user is auctually going to take the time to read this?

    • Re:Good greif (Score:5, Funny)

      by peacefinder ( 469349 ) <alan.dewitt@gmAA ... inus threevowels> on Friday November 05, 2004 @03:21PM (#10736560) Journal
      [...] what average user is auctually going to take the time to read this?

      The average user? No.

      The average manager needing justification before buying new security tools? Heck yeah! The clever ones will append the NSA document to their budget proposals.

    • Re:Good grief (Score:2, Insightful)

      by lifeblender ( 806214 )
      From their own report, it doesn't look like it:

      "It is unrealistic to assume that users will become cautious about running unknown files."
      p. 6, last line of second paragraph

      Even the NSA thinks ordinary people won't get smart about computer security.
      • "It is unrealistic to assume that users will become cautious about running unknown files."
        p. 6, last line of second paragraph

        Even the NSA thinks ordinary people won't get smart about computer security.

        And why wouldn't they? Have you worked with these "ordinary people"?

        I laugh everytime the computer guys send an email out warning about not open strange attachments and then I stop. That's because I know A: somebody probably already did it (hence the warning) and B: The network is about the get slow.
  • I know you guys/gals will see this, so thanks!

    It's cool that an agency with the worlds best IT infrastructure has the gumption to spend it's tax money and help bring the industry forward to solve practical problems.

    Tragically none of the other government agencies will read your paper and the next worm will take down a half dozen of them...

    Oh yeah, while were at it, we'd like to apologize for Jake 2.0...

  • What happened to Darwinism? (Score:5, Insightful)

    by DeepFried ( 644194 ) * on Friday November 05, 2004 @02:51PM (#10736320) Homepage
    I wish they could just come out and clearly advocate diverstity among OSes. The biggest threat IMO is the ubiquity of holes, not severity.

    In my perfect world they would advocate open standards and address the flaws in the system not just individual "patients." As these plagues come and go, if we all have the same immune systems, our collective odds are not good.

    I am glad they are putting good info out there. I guess I am hoping that in each case they identify the larger problem so we can all keep our eye on the ball.
    • I wish they could just come out and clearly advocate diverstity among OSes. The biggest threat IMO is the ubiquity of holes, not severity.

      Following the diversity mantra would require me to install Windows on some servers and run IIS. I doubt that this increases security of my systems, especially because I don't know much about Windows server administration.

  • NSA vs. l33t h4x... (Score:5, Insightful)

    by Sebastopol ( 189276 ) on Friday November 05, 2004 @02:52PM (#10736325) Homepage
    Does anyone else find it pretty cool that this battle is NSA vs script kiddies? I mean, a $2B a year cost is equvialent to a small terrorist attack, this is a big problem. I'm glad to see people from all walks of life attempting to combat the little punks.
    • In "Good Will Hunting" Matt Damon's character didn't want to work for the NSA. That pretty much saids it all.

      It's not a place where next generation tech-elites will submit their resume. Every techie I knew working for the NSA was better with politics than technology.

        1. It's not a place where next generation tech-elites will submit their resume. Every techie I knew working for the NSA was better with politics than technology.

        Excellent! The machines are working properly! Muhahah! Muhahahahh! Muhahahahahahahah!

    • Indeed. I wish our goverment thought the same. It's really great too see these kind of things coming from yours. The nsa linux distro/patches, this pdf. It's not necessarily a (complete) solution, but at least it shows that they're actually doing something useful with the money.

  • I Kind of Wish (Score:5, Funny)

    by Greyfox ( 87712 ) on Friday November 05, 2004 @02:53PM (#10736336) Homepage Journal
    They'd examined a few more Linux worms. They've looked at like 30 Windows worms and just one Linux worm, which exploited a Bind hole that's been known about and patched for years now. I mean, I know Windows has way more desktops installed so it should get the most scrutiny, but they could have at least chosen a current Linux worm from the multitude of worms that are out there! For example...

    Um...

    Hmm... Nevermind.

  • Since you guys killed the server last time (Score:2, Informative)

    by Anonymous Coward
    ...and I'm still upset I haven't gotten to read the OSX paper ;)

    Here's a mirror. Don't hammer too hard, k?

    http://seraphim.ecsis.net/~gregday/WORMPAPER.pdf [ecsis.net]

  • /.ing the NSA!!?!?!! (Score:5, Funny)

    by Monf ( 783812 ) on Friday November 05, 2004 @02:58PM (#10736382)
    I can't believe you /.ed the NSA - http://www.nsa.gov/snac/support/WORMPAPER.pdf [nsa.gov]

    we're all screwed now...

  • Following strings direct from report!

    Information Assurance Directorate
    Worm Information Center
    life functions
    attack attributes
    worm technology
    defense matrix
    Applied Defensive Methodology
    defense-in-depth strategy
    layered defense solution
    worm infection vectors
    zero day tactics
    blended threats
    worm life cycle
    infection life function
    operator incuded amnesia
    tortoise mustard
    knick knack paddy whack
    worm analysis (tell me how being a worm makes you FEEL)
    ad nauseum
  • They never seem to stay the same. They take advantage of things that no one previously thought of, which is why they are so damaging. Defense in depth is great and all, but the next killer worm will probably blow through all of it...
    • ``They take advantage of things that no one previously thought of''

      From what I can tell, holes exploited by worms are often just common vulnerabilities. Buffer overflows, format strings, cross-site scripting vulnerabilities, are all old news.

  • If this story about worms ... (Score:1, Insightful)

    by Anonymous Coward
    ... why is there a picture of a caterpillar?
  • Anyone else think they made the worms seem a bit too alive in the paper?

    A little creepy.
    • Anyone else think they made the worms seem a bit too alive in the paper?

      ...hold a funeral [slashdot.org] for all the old worm code once it's dead.

    • Re:Alive? (Score:5, Insightful)

      by Twanfox ( 185252 ) on Friday November 05, 2004 @04:03PM (#10737016)
      Considering there is a complete cycle that the worms take to propagate and persist, without user intervention, I would say that you could (not have to) consider them akin to what kinds of life you would find in biological viruses. They're pretty stupid. They generally stick to doing one thing. Once they're known and decoded, a defense can be formed.

      However, reading the article, the advance of programming technology is getting pretty sneaky. Self-decrypting program code (hmm.. similar to DNA, only the parts in use are exposed), Self-modifying code (probably close here, though with VB's capacity to recompile on any windows machine...), Command and Control, built in analytical heuristics (worms using scanners and 'decision making' on how to propogate), and even getting to the point where they start to operate at less than full throttle to avoid the common detection method, interference in the host's performance.

      The similarity between computer worms and viruses and biological viruses is very close, just on different platforms. While these aren't 'alive' in the common sense, they sure have the capacity to act like it on occasion.

      Wonder what's next. Worms that record where it sends itself to in order to form a distributed AI Network?

      • Re:Alive? (Score:2)

        by Tom ( 822 )
        Wonder what's next. Worms that record where it sends itself to in order to form a distributed AI Network?

        No, we (the worm researchers) are beyond that stage already (it makes countermeasures too easy). I expect the kids to catch up within the year.

        There are lab setups with very intelligent and frightening worms. Distributed, anonymous zombie network creation with fail-safe, encrypted communication channels. Fancy stuff. I've not yet seen any of the papers published. Some of it isn't practical for the Int

  • Why I don't want a "secure" OS (Score:5, Insightful)

    by RealProgrammer ( 723725 ) on Friday November 05, 2004 @03:26PM (#10736622) Homepage Journal
    There is a regular discussion (or flame war) over which operating system is more "secure": Windows, Linux, the BSDs, Mac OS X, or whatever. Anyone with a bit of understanding knows that there's no answer to that discussion, except if you ask which one is easiest to secure, and even then you have to ask who the securer is and what tasks will be performed. But that's not what I want to talk about.

    Telling less experience users that a particular OS is "secure" leads them to think they don't need to be vigilant. Same thing with telling them a firewall will solve their worm problems, or that as long as they keep up with patches they're safe from attacks. All of these are important, but no single one of them is a panacea.

    I didn't RTFPDF, but it's common wisdom that a multi-layered approach to security is best. No individual step fixes everything, nor usually even stops all of the attacks it's designed to stop. All we do is raise the bar, and hope attackers will go elsewhere.

    So don't tell me that an OS is "secure". I know there isn't such a thing. Tell me what its soft spots are, so I can layer other defenses around them. Maybe the bad guys will pass me by for a while.
    • Very-well put. While a staunch advocate of the OS X platform vs Windows, I always do my best to emphasize that security only exists in relative terms. Lemme know what you think of this little rant [blogspot.com] i put out back in june.

    • Re:Why I don't want a "secure" OS (Score:4, Interesting)

      by jd ( 1658 ) <imipak@ y a hoo.com> on Friday November 05, 2004 @04:38PM (#10737437) Homepage Journal
      I'm not convinced. Let's take the following fictional setup:


      Firewall box is running something like OpenBSD (or some other heavily-audited OS), with a pro-active NIDS that detects abnormal network behaviour and shuts down the offending connection.


      User box is running some sort of B1-class "Trusted OS". (A1 would be nicer, but there aren't any commercial A1-certified OS'.) The OS has file-integrity checkers, such as Tripwire, to screen for infections. All externally-originating connections are host-authenticated. RSH and other "vulnerable" protocols are totally disabled. All passwords are validated as "strong" and kept in a secure file or database. Again, all software is heavily audited. Anything considered potentially "unsafe" is run with strict bounds-checking and in a highly controlled environment (eg: a chrooted "jail".)


      In practice, I don't know of any user who actually has a setup of this kind, but let's suppose someone did. Would they still need to be vigilent? Is there anything that is likely to be able to bust through that kind of security? Even if a potential exploit existed somewhere along the chain, isn't the chain sufficiently extensive that nobody could ever make use of it?


      And even if someone could bust through and seize control of such a machine, isn't the threshold so high that the only people able to do it would likely not be stopped by anything you as a user could possibly do? No matter how vigilent you were?


      I believe that "secure" computers can exist, that there is nothing fundamentally impossible about having a setup that is, to any practical degree, uncrackable but still useful to users.


      I don't believe any such systems exist for home users. (I don't consider a top-end SGI box, running the latest and greatest version of IRIX, to be a device you could really call a home computer.) However, equally, I don't believe there is any law of nature which prevents such systems existing for home users.


      When (not if) such systems are developed for the home user, I think it would be very safe for such users to cut back on security patches and eternal vigilence. The combination of holes required to breach such a system would be unlikely to exist, so letting a few holes slide shouldn't be a problem.


      And if someone was good enough to get through all those layers of automatic defence, they'd likely be good enough to get past any defence a mere individual could put up, no matter how vigilent they were.

      • [Setup is a firewall and locked-down OS]. Would they still need to be vigilent? Is there anything that is likely to be able to bust through that kind of security? Even if a potential exploit existed somewhere along the chain, isn't the chain sufficiently extensive that nobody could ever make use of it?

        My point is that you need to have that kind of situation, which is a multi-layered approach.

        But to answer directly, yes, they still need to be vigilant. They're still being a client, unless the box i

      • I don't believe any such OS *can* exist for home users.

        Think about it. I send HappyFunScreenSaver.exe to someone. He runs it. The OS locks down and puts it in a chrooted jail, and HappyFunScreenSaver.exe prints "Oh No! It looks like I'm in jail! I can't run from inside jail. If you want to play the HappyFunScreenSaver game, just type in your password so I can get out of jail!"

        Note that this "type in your password" option is going to have to exist somewhere in the OS. It's a user OS. The user's going to wa
    • Say it with me...
      DAC is DAC is DAC.

      http://www.dyadsecurity.com/papers/rbac.html
      ht tp://www.nsa.gov/selinux/papers/inevitability
      htt p://hissa.ncsl.nist.gov/rbac/paper/rbac1.html
      htt p://www.radium.ncsc.mil/tpep/library/rainbow/52 00.28-STD.pdf

  • Make MS security a point of nat;l security (Score:5, Insightful)

    by gelfling ( 6534 ) on Friday November 05, 2004 @03:29PM (#10736650) Homepage Journal
    I really don't understand that if the government spends billions of dollars a year on IT products and billions more in house fixing the holes why they don't simply create a master RFP for Microsoft clearly articulating what the security requirements are and that if they are not met they lose pieces of the bid until it is. I mean if the DoD doesn't have the clout to bash these lazy slackers in Redmond upside the head then we're all wasting our time worrying about security.

    MS annnounced yesterday that they are seriously considering ending FREE security patches in order,

    now listen real carefully -

    NOT to provide better or worse security, but to wield an effective blunt object against counterfeiters.

    Microsoft views YOUR security as nothing more than a convenient tool to blackmail the entire known world into paying for MS's product. It doesn't matter that you or I never actually stole any of their product - we WILL be threatened with cyber terrorism for the criminalities of other people until WE ALL cough up more money to pay.

    And at the end of the day MS makes zero warranty that patches that cost real money will be any better than the FREE updates we already get.

    Seriously, in other countries and in other industries this why industries get nationalized by an irate fed up underserviced populace.

  • I really want to see a proper worm anlysis (Score:3, Funny)

    by Timesprout ( 579035 ) on Friday November 05, 2004 @03:31PM (#10736668)
    So, when you start feeling like a worm?

    Do you feel like people are always looking down on you?

    Do you feel segmented and isolated from society?

    Do you worry about cholesterol given you have 8 hearts.

    Are you always this slimy or are you just pleased to see me?

    This is the sort of stuff we really need to know because to borrow the immortal words of that famous philosopher, John Rambo "To survive worm you must become worm".

  • thank you (Score:2, Interesting)

    by dJOEK ( 66178 )
    I, as a European, would like to thank our American friends for funding this information for the entire world

    It's very nice to see that an organisation such as NSA makes this info Globally Accessible.
    This is important, especially with your current president.

    Of course, the US benefits from the fact that worms do not spread to the nation of freedom

    So once again, thank you for knowing we exist!

    PS Slashdot is America-centric ! ;-)
    • I, as a European, would like to thank our American friends for funding this information for the entire world

      It's very nice to see that an organisation such as NSA makes this info Globally Accessible.
      Actually, you weren't supposed to see that; it was intended for our eyes only. Could you please forget everything you read? Thank you.

  • Just Wondering... (Score:4, Interesting)

    by Jameth ( 664111 ) on Friday November 05, 2004 @03:38PM (#10736753)
    On this topic of layered defenses:

    Is it possible to use the Xen VM that was on Slashdot earlier today to run multiple OSes and use one OS on the machine as a firewall for the other?

    Could you rig the setup of one so that it couldn't crash the hardware, it could at most make itself crash and reboot without the computer going with it?

    • Re:Just Wondering... (Score:5, Informative)

      by Spoing ( 152917 ) on Friday November 05, 2004 @05:15PM (#10737842) Homepage
      1. Is it possible to use the Xen VM that was on Slashdot earlier today to run multiple OSes and use one OS on the machine as a firewall for the other?

      If you mean stacking VMs up to filter traffic...no...that won't work.

      If you mean stacking VMs so that only specific VMs 'see' each other at the network level, yes. That works with VMs or connected systems with properly configured routers.

      The reason? Firewalls are not designed to block the network. Firewalls are designed to allow access for specific ports in specific ways. If you chain systems together, and each hands off the allowed packets to the destination system, you've just punched a hole through the firewall to that final system.

      By isolating systems so that only ones that are required to 'see' each other can 'see' each other, you've added a meaningful level of protection. This does not require a firewall. It requires router configuration even if the router is software running in another VM and routes for VMs on the same machine. It also requires that you design services and apps to work in this environment; seperate the web server from the DB for example. If it is a web server, and you just remap the default web server port 80 to another port, you've done nothing; the data still passes both ways and the destination is still potentially exposed.)

  • After having a couple of beers, I read this as "Using Defense Laywers to Stop Worms"... I'm still ROTFL... poor Worms!

  • Tax Joke? (Score:5, Insightful)

    by MicroBerto ( 91055 ) on Friday November 05, 2004 @06:17PM (#10738329)
    I'm not sure if "Your tax dollars at work" was a joke or not, but even as a Libertarian, I have no problem with this. If the government spends resources to educate some people and it ends up saving them hundreds of thousands in the long haul, then that is worth my taxdollars if you ask me.

    Then again, they should already know how to do this and learn for themselves, but a dollar saved is a dollar earned. Damn worms!

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close