text:
Wednesday, March 30, 2005
New National Centers of Academic Excellence in Information Assurance Education
Thoughts on New Cyber Security Report
I was pleased to see the report list the following as some of its ten research priorities, as they are near to my own interests:
- Monitoring and Detection. Regardless of progress made in the preceding research areas, unanticipated events will still occur. When they do, tools to monitor and understand what is happening are needed to enable the proper deployment of appropriate defensive measures. The ability of current tools that monitor irregular network activity to rapidly identify the underlying cause is primitive. The current advantage that adversaries enjoy will increase as they become more knowledgeable and as the Internet becomes larger and more complex. Research subtopics include:
-- Dynamic protection that can react when attacks are detected, possibly by increasing monitoring activities
-- Global scale monitoring and intrusion detection
-- Monitoring of systems to ensure that they meet declared security policies
-- Better tools based on improved models that characterize "normal" behavior
-- Real-time data collection, storage, mining, and analysis during a crisis
-- Usable presentation interfaces that allow operators to better understand incidents in progress
- Cyber Forensics: Catching Criminals and Deterring Criminal Activities. The rapid arrest and conviction of criminals is a primary goal of law enforcement and also serves as a deterrent. When potential criminals believe there is a strong chance that they will be caught and convicted, they are more reluctant to commit crimes. Current capabilities to investigate cyber crime, identify perpetrators, gather and present evidence, and convict criminals are woefully inadequate. Compounding the problem, we do not really know how to deter cyber crime. Very few of the thousands of cyber criminals active today are being caught. There is a pressing need to develop new tools and techniques to investigate cyber crimes and prosecute criminals. Robust cyber forensic methods are also needed that will prove capable of withstanding the burden of proof in court, whether employed to prosecute criminals or exonerate the innocent. Research subtopics include:
-- Identifying the origin of cyber attacks, including traceback of network traffic
-- Identifying attackers based on their behavior
-- Collecting evidence in uncooperative network environments
-- Tracing stolen information used in the growing traffic in fraud, identity theft, and intellectual property theft, including tools and protocols for recovering trace evidence from volatile and incompletely-erased computing media, disks, cell phones, PDAs, and embedded systems
-- Tools and protocols to search massive data stores for specific information and indicators, possibly while the data stores are in use
-- Fundamental research to develop forensic-friendly system architectures that are more amenable to investigation when incidents occur
I intend to keep my eyes open for institutions looking for researchers to pursue these areas.
Tuesday, March 29, 2005
Cisco Routers Run Tcl
"Tcl is part of Cisco's IOS router operating system, and as such is included in all high-end Cisco routers and switches."
What's that? Tcl on my router? A quick Google for "tcl cisco ios" revealed two helpful resources: Cisco IOS Scripting with Tcl by Cisco and TCL'ing Your Cisco Router by Peter J. Welcher. Cisco's document revealed that Tcl 8.3.4 was introduced in Cisco IOS 12.3(2)T. Sure enough, it's on my Cisco router:
gill#sh ver
Cisco IOS Software, C2600 Software (C2600-ADVSECURITYK9-M),
Version 12.3(11)T3, RELEASE SOFTWARE (fc4)
gill(tcl)#puts "Hello world"
Hello world
Peter Welcher's article expands on Cisco's document to show some of what can be done with Tcl on the Cisco router.
This absolutely blows my mind, and I can't believe I haven't heard of this before. I found a 2001 email mentioning the Tcl shell as "undocumented," although there is a reference in the Cisco IOS Configuration Guide Master Index, Release 12.1. Imagine what might be possible with this; you might be able to run arbitrary code -- Sguil even? -- on Cisco routers.
Speaking of Tcl, the newest versions of Salvatore Sanfilippo's Hping rely on the language. I reported on this last year. Salvatore has been working on a Tcl interpreter called The Jim Project, which he says "will likely merge with Hping." Salvatore is also writing a book on Tcl, some of which is online as TCLWISE: An introduction to the Tcl programming language.
Monday, March 28, 2005
The tool is very easy to use. By default, the tool is easy to use. Specify a range of IPs in the boxes and start the scan. Results appear in the window at right:
SQLrecon provides plenty of customization via options as well.
Thank you to Special Ops Security for releasing this free and helpful tool!
Sunday, March 27, 2005
FreeBSD 5.4 Schedule Updated
"First public test release build. Note that the release build name is 5.4-BETA1 but newvers.sh RELEASE name remains 5.4-PRERELEASE. This is because the name BETA often confuses the users who are using the STABLE branch."
"5.4-RC1" is slated for 31 March, but then we read the "First release candidate" is scheduled for 2 April. 5.4 is listed as having a 19 April availability date.
This information is a lot more specific than what I see from most commercial operating systems. :)
Latest Snort and IDS News
"The stated goals of the OSSRC are to:
- Establish metrics and standards for Open Source Snort rule development and documentation.
- Provide a forum for the sharing of research and information for the development of effective Snort Rules.
- Ensure continuous support for a Snort Ruleset licensed under the GPL."
Sourcefire and Bleeding Snort will hold most of the power in the new group:
"One representative from each of the founding member organizations, Sourcefire and Bleeding Snort, will serve in the role of co-chair of the OSSRC. Co-chairs will serve as managers of the OSSRC, working as they deem necessary to uphold the mission of the OSSRC. They will hold veto power over any vote of the membership, though any such veto may be overturned by a vote of three-quarters (_) of the membership."
I'm not sure why I see "(_)" several times in the document, but I reproduced it above.
To get involved, become a general member:
"The primary role of general members will be to share research information, rule development, testing facilities, etc with the consortium. In addition, they will be provided the opportunity to discuss and vote upon proposals introduced or sponsored by the officers. Proposals may be passed by a simple majority of the voting members of the OSSRC."
I plan to join the OSSRC. If you'd like to as well, email jennifer dot steffens at sourcefire.com or matt at infotex dot com.
The second piece of Snort news is a Bleeding Snort announcement: Demarc is now sponsoring the Bleeding Snort project. According to news on Demarc's Community Portal:
"Demarc is pleased to announce our official sponsorship of the Bleeding Snort Project. Bleeding Snort has long proven itself as an authority in cutting edge snort rules. Demarc is proud to add the support of our Threat Research Team behind this project and we're excited to be able to help Matt and the rest of the Bleeding Snort team continue their excellent work in creating and bringing together the most up to date Snort-based rules for the entire security community."
I guess it took three weeks for Demarc to realize they weren't getting any traction with their initiative to maintain a separate Snort rule base. Their so-called "Demarc Certified Open Signatures" are still posted without appropriate copyright notices, as far as I can tell.
The last bit of Snort news comes in the form of a new Gigabit IDS Group Test from The NSS Group. You would think that at least six year's worth of commercial Web presence would merit a more modern Web page and less underlining of all text! In any case, their new report is interesting as only products from Sourcefire and ISS are mentioned. Why? The report states:
"For this significant group test we invited all the major vendors in the Network IDS market place (if anyone reading this is a vendor who was not invited, please do let us know). Five agreed to take part and be tested using our latest methodology, including:
Internet Security Systems, Inc.
Sourcefire, Inc.
Three of the five devices submitted for testing failed one or more of the tests and were not awarded NSS Approved. They do not appear in this report, leaving the two listed above, both of which achieved NSS Approved status. Others were not able to submit products in time for this round of testing, and will thus be included in Edition 4."
I would like to know which three failed, although I guess NSS is letting them save face by remaining anonymous. I intend to take a close look at the NSS testing methodology when I have more time.
Thursday, March 24, 2005
IISFA Announces Vendor-Neutral Forensics Certification Test
Since I don't see any notice of this news on the IISFA Web site, here's the significant parts of Mr. Moore's email:
"I am very pleased to formally announce the final release date of the Certified Information Forensic Investigator examination through Thompson Prometric.
The exam will be available at over 2500 testing centers worldwide on April 18th, 2005. The exam fee will be $150 USD and registration for the exam will be completed through the Thompson Prometric website located at www.thompson.com. The exam will be 125 random questions with a minimum passing score of 70%. Results to the candidate will be immediate. The IISFA will receive monthly reports and certifications will be sent out on a monthly basis...
1) This test is open to anyone. However, only active members in good standing who pass the exam will be awarded the CIFI. CIFIs must maintain CEUs to keep their certification current.
2) The testing centers are not IISFA locations. Thompson Prometric is an independent testing entity.
3) All testing centers are proctored and required picture ID for candidate prior to taking the exam.
4) You may take the exam as many times as you wish, however the examination fee is $150 USD for each instance.
5) The exam is available worldwide in dozens of countries, however, the test is only in English as this time.
6) There are study suggestions on the IISFA website (www.iisfa.org) and several CIFI study guides in preparation by various IISFA members.
7) Currently there are approximately 100 CIFIs in the world that have taken the exam or grandfathered. There is still opportunity to be one of the very first CIFIs with a low badge number.
8) Badges are available by purchase from a third party. This vendor is not part of IISFA and all transactions are between the vendor and the purchaser. All certifications are verified by the vendor before they will complete the transaction and create your badge. Each badge will be stamped with your badge number.
9) James Moore (me) is not the Director of Certification. I am not the correct person to ask about your certification status (present grandfather applicants excluded), your badge status, how to study for the exam, and so on. You need to direct those inquires to the Director of Certification and Director of Education.
10) There is a committee who will maintain the exam question pool and will review it twice per year. All members will be under non-disclosure and must be CIFIs. If you wish to join that committee, contact the Director of Certification (Dione Hodges).
11) No, James Moore does not get residuals, funds, compensation, free trips, or thanks you for the exams from any party living or dead, real or imagined. All exam fees go to Thompson Prometric and the IISFA. However, donations to the James Moore Vacation fund are warmly welcomed (please send cash only).
This marks a new phase in the development of the CIFI as the leader in our field. I'm very proud to see this event come to pass. Thanks to all those who helped."
I support the CIFI because it is a vendor-neutral forensics certification with a Code of Ethics. The CISSP Code of Ethics is the only reason I support that certification. I took advantage of the IISFA's original grandfathering option in 2003 to acquire the CIFI. The GIAC Certified Forensics Analyst (GCFA) requires candidates to adhere to its GIAC Code of Ethics. I attended the first SANS Forensics, Investigation, Response and Education (SANSFIRE) in 2001, the precursor to the GCFA, but never tested for any SANS certification.
For an in-depth discussion of the merits of forensics certification, consider reading Computer Forensics: The Need for Standardization and Certification (.pdf) by Matthew Meyers and Marc Rogers.
Wednesday, March 23, 2005
Review of The Art of Intrusion Posted
"Over two years ago I read and reviewed The Art of Deception also by Mitnick and Simon. I thought that book was 'original, entertaining, [and] scary.' Those same adjectives apply to The Art of Intrusion (TAOI). While I also add 'disappointing' and 'disturbing' to the description of TAOI, sections of the new book make it an absolute must-read. If you want to understand the consequences of systematic, long-term compromise of your enterprise, you must read and heed the lessons of TAOI."
Monday, March 21, 2005
Red Cliff Releases Web Historian
Prior to using Web Historian, I had used Scott Ponder's IE History and Keith Jones' Pasco. Previously IE History was free, but required sending an email to the developer. Now IE History costs $50 and is "limited to Law Enforcement and Corporate Security." Web Historian improves upon Pasco, and the new tool probably benefitted from Keith Jones' input, as he now works for Red Cliff.
I downloaded and installed Web Historian. The program prompts the user for a Web history file to parse, or gives the option of searching a specified location for Web history files. I chose the latter option and directed Web Historian towards the c:\Documents and Settings folder where I expected to find Web history files.
After searching the folder, Web Historian presented its results in an Excel spreadsheet. It showed one tab for each Web history file it parsed. First it showed results from a history.dat file generated by Firefox.
The second tab showed Internet Explorer history.
This sort of information is incredibly useful. Web Historian is built to accommodate forensic investigations as it can parse whatever Web history file you specify, within the limits of its ability to recognize the format. I expect people to begin migrating to this new free tool as they learn more about it. Web Historian is packaged with a help file that explains program usage and other functions. Try it out!
FreeBSD 5.4-BETA1 Available
Friday, March 18, 2005
Latest Pre-Reviews
First is Windows System Programming, 3rd Ed by Johnson M. Hart, published by Addison-Wesley Professional. This book looks promising because it does not dwell on Windows GUI issues. Instead it focuses on core system services like the file system, memory, processes and threads, synchronization, communication, and security. The 3rd edition is updated to address Windows XP and Windows Server 2003, and it also covers 64 bit issues. I asked for this book to learn more about Windows internals and programming Windows systems. The author is said to take more of a "UNIX-like" approach to Windows programming, which should be a blessing for me.
Next is Cisco Router Firewall Security by Richard Deal, published by Cisco Press. I absolutely cannot wait to read this book, given the attention I've paid to IOS this month. This book is an exhaustive examination of the security features available in IOS 12.3. I am looking forward to trying out the firewall feature set, intrusion detection capabilities, and network-based application recognition, context-based access control, and other IOS goodies. Rather than discuss them at length in my next book, I intend to refer readers to this one.
Last we arrive at Inside Network Perimeter Security, by Stephen Northcutt, et al, published by Sams. I did not read the first edition of this book, but I am happy to see a second edition in an age where everyone says the "perimeter is dead," along with the IDS, and so on. I intend to take a close look at this book and the subjects it covers well, so as to avoid duplicating topics in my next book. Thumbing through the book it seems to be more discussion and less configuration syntax, which may make implementing its recommendations difficult. We'll see -- stay tuned for reviews at Amazon.com once I get to all three books.
SearchSecurity.com on Snort Rules
Bookpool Publishes My Ten Favorite Computing Books
Security Insights from Microsoft Security Architect
Dean said that the patching approach to security is becoming a "second or third line defense, like backups. You patch regularly but hope you don't need them." As evidence he cited the decreasing window of time between announcement of a vulnerability and release of an exploit. Patches are still the best way to fix a vulnerability in broken software, so Microsoft has been pursing multiple initiatives to improve their patches.
First, Microsoft is migrating from multiple update sites (e.g., Office Update, Windows Update, and Microsoft Update Center) to a single future "Microsoft Update" site in late 2005.
Second, Microsoft realized their seven profit and loss centers support eight different software installation methods. This year they will move all software installation to two methods. Operating systems will use update.exe and applications will use MSI 3.0. This will make using Microsoft Baseline Security Analyzer, Microsoft Systems Management Server, and Microsoft Software Update Services (migrating to Windows Update Services) more predictable and effective.
Third, Microsoft has worked to make their patches better. They have a standardized naming convention to ease management. They use binary diffs to reduce patch size. They are also "actually inspecting system configuration" (as opposed to pretending to do so?) to determine what patches are really needed.
Dean next discussed Security Configuration Wizard. This seemed like a fairly impressive way to lock down systems. It automatically detects and configures Microsoft services and their options, Microsoft client applications and their options, third-party applications, IPSec policies, registry settings, audit features, and IIS. Essentially you can apply all of Microsoft's recommended configuration options via an automated tool. I was disappointed to see Dean's demo fail, but I see the promise of the technology.
Dean mentioned a related tool called Microsoft Application Compatibility Analyzer. The idea behind this program is to run it for a week or so on a host to determine what applications users employ. This helps administrators learn if XPSP2 will break any of the user's applications. I hope to see more of this sort of tool for future Windows upgrades.
Speaking of XPSP2, Dean gave a behind-the-scenes look at the reasons for its development. Apparently the Blaster worm had a huge effect on Microsoft. They "took almost all developers off Longhorn for a year to work on XPSP2." The theme of XPSP2 was applying good default configurations. For example, XPSP2 enables the Microsoft firewall by default. It denies inbound connections to help prevent intrusions. XPSP2 also denies null sessions by default. Dean said XPSP2 has been downloaded 150 million times.
One of the ISSA attendees complained that XPSP2 features were not available for Windows 2000. In fact, Dean said Internet Explorer 7.0 will only be available for XPSP2 (at least at present). The ISSA attendee said it was too expensive for customers to upgrade to XP. I wanted to say that the best update to Windows 2000 is Windows XP, but I kept quiet. Dean replied to the other ISSA attendee that most big Microsoft customers with Windows 2000 installations "already own Windows XP" by virtue of their Microsoft Enterprise Agreement. He said getting these customers to upgrade to Windows XP is one of Microsoft's biggest problems.
Dean pitched four efforts Microsoft sees as being "beyond patching." Since he spent so much time on the earlier issues, Dean had to briefly describe each. The four efforts are:
1. Isolation and resiliency
2. Network segmentation
3. Rights Management Services
4. Smart cards for remote access
I found his network segmentation discussion interesting. Microsoft is pushing for an all-IPSec internal network. All Active Directory-managed hosts would speak IPSec, and anything that doesn't is considered untrusted. I believe Dean said this is how Microsoft operates its internal network.
Regarding Microsoft's internal practices, Dean encouraged listeners to visit the IT Showcase site. There Microsoft publishers papers on how it secures its own network. He said that Microsoft operates the largest wireless 802.1x deployment in the world. They have also run Network Access Protection for two years for VPN clients.
I found Dean's short description of Rights Management Services to be intriguing. It will use eXtensible rights Markup Language and AES 128 encryption to protect individual documents. Only those operating rights management-enabled programs should be able to read RM-protected documents. I welcome the idea of a data-centric approach to security, but I am sure someone will figure out how to break this system.
Beyond the four efforts already in production, Dean pointed to three future area for Microsoft:
1. Network quarantine
2. Vulnerability assessment
3. Active protection
First, Microsoft Network Access Protection will work with Cisco Network Admission Control. Initially they did not want to cooperate, but their alliance was a result of customer pressure. Network Magazine profiled the two technologies recently. At first glance I prefer Cisco's 802.1x switch port-centric approach, rather than Microsoft's DHCP-centric method. Who cares if I don't get a DHCP server to provide an IP, when I can steal what I need from another host?
Dean's quarantine slide said NAP is "not designed to protect against malicious users." Somehow I think the Microsoft marketing drones will end up twisting NAP to be useful against malicious users. Again referring to Blaster, Dean said 70% of his customer's compromises were caused by VPN users, and 30% by "walk-ins." Microsoft believes that if NAP can quarantine these sorts of users, then it will help contain future Blaster-like problems.
The second step, vulnerability assessment, is code named the "Geneva feature set." Microsoft seems to want to offer continuous internal vulnerability assessment services. These will make further inroads to the security space, given Microsoft's Malicious Software Removal Tool, Microsoft AntiSpyware, and SpyNet. I didn't really hear much about the third step, code-named Mako.
All of these are slated for Longhorn, due some time in 2007. He said a beta should be available by Q4 2005. However, Microsoft now says "it's ready when it's ready." Customers will need to do a lot of testing for these features, especially network quarantine. Dean recommended the following processes need to be considered: rollout and change process control planning; success matrices and measures; exemption analysis; host health modeling; health policy zones; secure network infrastructure analysis; RADIUS implementation; and zone enforcement selection. What does all of this mean? Figuring it out is probably the first step!
One of my responses to this was to consider the complexity of all of the steps Microsoft is taking to implement security for hosts running Windows. With complexity comes opportunity for misconfiguration, plus vulnerabilities introduced by new code and processes. Microsoft might say their new systems will prevent rogue insiders or malicious outsiders from attacking Microsoft services. It seems to me that the opportunity to attack the authentication and encryption services still exists. Why bother to fool, bribe, or otherwise subvert a guard if you can silently kill him?
I had a similar thought with respect to the IPSec-everywhere approach. This will help preserve confidentiality and integrity within the enterprise. However, most internal intruders are probably rogue insiders. They will already have the authorization needed to access internal documents. Independent network-based systems trying to audit internal activity will be blind to IPSec-encrypted traffic. Is this trade-off worth it? I'm not sure.
As an aside, Dean mentioned a Windows feature of which I was unaware: Server Message Block signing. I plan to look more closely at this.
I find these ISSA meetings very useful and I plan to join my local chapter.
Thursday, March 17, 2005
Join Me for NSM at USENIX 2005
I am looking forward to teaching this class. It will equip participants with the theory, tools, and techniques to detect and respond to security incidents. Network Security Monitoring (NSM) is the collection, analysis, and escalation of indications and warnings to detect and respond to intrusions. NSM relies upon alert data, session data, full content data, and statistical data to provide analysts with the information needed to achieve network awareness. Whereas intrusion detection cares more about identifying successful and usually known attack methods, NSM is more concerned with providing evidence to scope the extent of an intrusion, assess its impact, and propose efficient, effective remediation steps.
According to the registration details, attending a single day of training costs $625. Discounts for attending more days of training and technical sessions also apply.
I hope to see you in Anaheim! If you can't make it, let me know if you would be interested in this sort of training by sending an email to taosecurity at gmail dot com.
Tuesday, March 15, 2005
SecureLogix Enterprise Telephony Management
As Voice over IP becomes popular, interest in voice security seems to be picking up. The new SecureLogix product can monitor and control traditional POTS voice and also VoIP (SIP and H.323v2). I found this note in one of the reviews alarming:
"The ETM 1090 system can capture digital recordings of any call and record up to eight simultaneous calls off one voice span. The 5.0 production release captures calls only off of a voice T1. SecureLogix is prepping VoIP recording for the next release.
The ETM 1060 caches audio at a rate of 57 MB per hour from up to 32 simultaneous calls, yielding roughly 2,000 hours capacity on the appliance, and it automatically uploads the recorded calls to your target server drive as .wav files.
ETM gives no indication to call participants that they are being recorded; check with your legal department before implementing any recording scheme."
"Check with your legal department" indeed! This is clearly a wiretap if there ever was one. I recommend using such a system to implement voice policies, and tread very carefully when considering call monitoring.
Banks Also Fighting the Last War
This reminded me of my blog entry As Always, .gov and .mil Fight the Last War. I guess it takes too long to implement and fund initiatives in these huge organizations. It's like changing the course of an oil tanker. I'm sure the security staff recommended two-factor authentication five years ago and has only now received funding. Unfortunately, that strategy applied to older threats and cannot address the current problem. Two-factor authentication would probably have helped Paris Hilton remain in control of her T-Mobile account, though!
Update: It looks like Microsoft is jumping on the bandwagon. I think two-factor authentication is still an improvement over usernames and passwords, but it won't solve world hunger.
BSD Certification Web Site Launched
First Impressions of Lancope StealthWatch
The following is my impressions of the system, based on three assumptions. First, I did not try to stress-test or attack the system to gauge its performance under load. I placed it on a production network as any other client might. Second, I did not validate its findings independently. In other words, I did not collect information on another system to test if a StealthWatch "high traffic" alarm truly corresponded to a "high traffic" event. Third, I did not fully configure the system as one might as a Lancope customer. Full utilization of this or any security product usually demands a fair amount of local customization and tuning. Given these assumptions, here is what I thought about the StealthWatch.
StealthWatch provided me a great deal of information with an out-of-the-box configuration. The only real changes I made when I deployed the system was defining which hosts were part of the "inside" network. If I had disabled an unused sniffing interface as recommended by the StealthWatch sales engineers, I would not have seen the "traffic lost" alerts that appeared in the introductory screen. I did not need to make any special adjustments for my deployment using a Net Optics tap. I simply plugged the two TX lines coming out of the tap into two free sniffing interfaces on the StealthWatch. This means I deployed the system in a passive mode; it did not block traffic based on its findings. After performing some simple configuration on the local console, I remotely accessed the device using a HTTPS-enabled Web server.
Introductory Screen
The introductory screen summarizes concern indices for inside and outside traffic, and provides links to alarms. The left hand size of the interface allows easy access to a variety of reporting and configuration options.
Alarms Screen
The alarms screen allows the user to view events StealthWatch considers odd or problematic. The screen shown above lists all priorities together, but the user can filter to just show Critical alarms, Major alarms, and so on. These alarms are not based on sigatures for malicious events. Rather, you are more likely to see entries for unusually long traffic flows, unrecognized operating systems, and other network features not corresponding to StealthWatch's profile for normal activity. For demonstration purposes I investigated an outside (external) IP address that StealthWatch believed was sending a high amount of traffic.
Host Summary
I saw that the host in question was responsible for a number of high total traffic alarms. At this point I wanted to know more about the characteristics of these suspicious flows. Luckily I was able to use the StealthWatch to perform two types of deeper analysis.
Flow Analysis
I was able to perform flow analysis on data that StealthWatch already collected. The partial screen capture above shows that port 500 UDP is involved. This means the traffic is probably IPSec key exchange. To find out for sure, I moved to the second additional form of analysis -- packet analysis.
Packet Analysis
StealthWatch does not log full content data by default, but users can configure it to do so. I set up a packet capture filter to log traffic associated with the IP of interest in my investigation. Although users can collect data in a text-format, packet-by-packet manner, I specified collecting full content data in libpcap format. After several minutes I stopped the capture process, copied the data via the Web GUI to my local workstation, and opened it with Ethereal. I do not show a screen capture of this here, but there are many options for recording full content data available in the Web GUI.
Service Profiles
One of the most powerful aspects of systems like StealthWatch is its ability to build profiles of normal network activity. Deviations from these profiles are reported as anomalies. These alarms can be viewed from the network security monitoring standpoint as indications of suspicious or malicious activity. The screen shot above shows the service profile built for hosts on the monitored network. These can and should be tuned for each system, allowing the security and network staff to spot the appearance of new and potentially unauthorized services.
Traffic Profiles
In addition to profiling services on hosts, StealthWatch offers a number of ways to profile traffic to and from those hosts. I have selected one profile showing bandwidth usage, but many more options exist.
Because I promised not to expose the entire StealthWatch interface on this blog, I will end this discussion by mentioning other features I found useful. StealthWatch reports on new hosts and inactive hosts, helping networking staff keep an inventory of their systems. The interface and recorded data allows a fairly thorough analysis of hosts and their activity. Because this data is not based on signatures, you are likely to acquire evidence of activity you wouldn't find using other means.
My main complaint, based on experimenting with the product, is not unique to StealthWatch. A common criticism of anomaly-based systems is their potential inability to explain why they consider an event to be problematic. I did not find StealthWatch to be difficult in this respect, since an alarm for a "long flow" is unambiguous.
Getting to a deeper level of analysis can be a challenge for certain events. In the previous example, I was able to use flow analysis to identify IPSec key exchange. Getting down to the nitty-gritty via packet analysis required setting up a new packet capture process, however. In this respect, StealthWatch resembles intrusion detection systems that do not provide at least a sample packet from the unusual activity. I understand that giving the user a packet can be difficult when the event in question is a "long flow" or "multiple operating systems." I think such data is useful, even if not all alarms provide it. Giving the analyst one or more sample packets with a "long flow" alarm would enhance his investigative arsenal and reduce the likelihood of ignoring "false alarms."
Overall I found the StealthWatch to be a powerful appliance. I could see engineers deploying this system to provide indications and warnings on networks already monitored by traditional IDSs. I think the utility of the system increases as the owner spends time tuning and configuring it, but the StealthWatch provides plenty of interesting data straight away. From the network security monitoring perspective, StealthWatch provides alert data via its alarms, session data via flow analysis, statistical data via profiling, and full content data via packet collection. I welcome this sort of functionality in commercial systems!
Thank you to Jason Anderson at Lancope for shipping me this demo appliance. Feel free to contact Lancope for more information. You might also want to attend one of their Webinars or see them at an upcoming event.
Update: Jason Anderson adds the following good news:
"In our upcoming release, we will now include ~100 bytes of packet data with every flow. It will include the initiating packet header and 40 bytes of payload data from the first packet in each direction."
This helps address my earlier point about giving analysts the information necessary to investigate and validate events.
Monday, March 14, 2005
SANS Ends Practical Requirement for Certifications
GIAC was originally the Global Incident Analysis Center, a Web site to disseminate information on Y2K rollover threats. From a February 2000 archive of the site:
GIAC began December 21, 1999 as a service to support Y2K watchstanders all over the world, watching for cyber attacks and Y2K problems. We've come a long way since then, but the orignial pages are archived here.
I was an original incident handler and had some of my work posted. I also taught the IDS track several times, until I decided their material was too out-of-date and irrelevant to IDS practitioners. I was tired of scrapping SANS material on stage (aside from some of Judy Novak's TCP/IP slides and Marty Roesch's Snort tutorial) and teaching what students really needed to know.
SANS turned the Global Incident Analysis Center into the Global Information Assurance Certification when they realized they had created a powerful GIAC brand.
The SANS announcement states the following:
"Starting immediately, all new students will be authorized to the exam only GIAC Certification.
The forces that drove us to this change are numerous, but the single most important is the need to move to more modular, adaptable, courseware and certificates and certifications to stay abreast of the current threat. Additionally the marketplace has voted with its feet in favor of exam based certifications.
No practicals or drafts will be accepted after April 15th, 2005."
My take on this statement, and my conversations with SANS faculty, leads me to believe that grading practicals simply became too onerous for the SANS staff. Their margins are higher when they can automate the certification process.
This next statement is disappointing:
"We will issue a new logo design for all future 'exam only' certifications so that there will be less chance of confusion between 'exam only' and the more prestigious, original, practical oriented certifications."
In other words, SANS has admitted to devaluing its certification -- the new 'exam only' certifications are not as 'prestigious' as the original.
SANS has now created a market where holders of the "original" certification are more highly valued than those that follow.
SANS will also no longer be able to offer practical assignments to the community. Although the original practicals will remain online, that source of knowledge will dry up. This is doubly unfortunate as SANS practicals were one of the best aspects of the certification from the perspective of other security students.
While I believe that viable exam-only certifications exist (like the CCNA, CCNP, etc.), I fear SANS has removed a feature of their certification that made it unique and valuable.
Sunday, March 13, 2005
Ethereal Development and Support News
- Ethereal Essentials 1 (two days): Introduction to Ethereal and network troubleshooting
- Ethereal Essentials 2 (three days): Advanced network troubleshooting with Ethereal
- Development Using Ethereal (three days): Coming soon!
The second and third classes look very interesting.
So who is Ethereal Software? Their site says they were "formed by Network Integration Services to provide value-added services for the Ethereal network protocol analyzer." There is no name associated with either Ethereal Software or NIS, but the contact phone number and street addresses belong to Ethereal founder Gerald Combs.
I confirmed this by looking at these results from FindOpenSourceSupport.com. This is a cool Web site where those who need help with open source software can hire those who provide commercial support.
Saturday, March 12, 2005
Latest Pre-Reviews
First is VoIP Security by James Ransome and John Rittinghouse, published by Elsevier. I'm looking forward to reading this book because it explains Voice over Internet Protocol, and then explores security issues associated with this increasingly popular technology. This protocol is going to be used everywhere, and I don't think security professionals are ready for it.
Next we have the first of two new books from Syngress: Intrusion Prevention and Active Response: Deploying Network And Host IPS, by Michael Rash, et al. Regular blog readers know I see any system which blocks traffic to be an access control device, also known as a firewall. This book will not see the world in the same way, but I think it will be intriguing nonetheless. Several of the authors have written for Syngress before on subjects like Snort and Ethereal.
The second Syngress book is Aggressive Network Self-Defense, by Neil Archibald, et al. This is a follow-on to Tim Mullen's article When Striking Back is The Best Defense. The book is divided into two parts. The first presents eight fictional stories of system administrators striking back at intruders. The second part describes real technologies that could be used to implement "hacking back." I am usually skeptical about security fiction, but Syngress' history with the "Stealing the Network" series has been good.
We now turn to a book from McGraw-Hill/Osborne, called Hardening Network Security, by John Mallery, et al. This is a fairly hefty book that appears to cover a multitude of security disciplines. I liked this publisher's Hardening Windows Systems.
We conclude with another Elsevier book, The Internet and Its Protocols by Adrian Farrel. This is another computer science textbook, but as a protocol junkie I think it will be interesting. A look at the table of contents shows that it presents a variety of protocols, all with headers explained. It's a recent publication, which helps when one wants to learn about a protocol not addressed by Stevens and others.
Keep an eye out for Amazon.com reviews as I plug through these. I'm currently reading Kevin Mitnick's new Art of Intrusion and hope to finish in the next few days.
Argus Documention
"Knowing of a break in after the fact, while undesirable, is much better than not knowing of the break in at all... With Argus you at least have the data; with only an overwhelmed IDS or firewall you don't (or at least not all of it). Something to think about, especially in terms of insurance."
More Snort News
Speaking of Bleeding Snort, Matt Jonkman announced Friday work on a new "Open Source Snort Rules Consortium." He says:
"The OSSRC will be a group that any company or organization will be welcome to join. The members will share research on new threats and rules to handle those threats, with the goal of creating a unified community-based ruleset. Each member may post these rules wherever they choose, distribute them to their clients or customers, or use them in their own subscription services according to the provisions in the GPL. The goals of the group are still forming, but initially will be to:
1. Maintain a fast moving and GPL-licensed Snort ruleset
2. Avoid rule duplication amongst community rulesets, both in terms of content and SIDs
3. Improve and enforce quality standards for rules (documentation, etc.)
4. Possibly move to a Stable and Unstable rule 'vetting' process"
It will be interesting to see how this rule set progresses. If you visit the Snort rules download page you'll see three sets of rules:
- Sourcefire VRT Certified Rules - The Official Snort Ruleset (subscription release)
- Sourcefire VRT Certified Rules - The Official Snort Ruleset
- Community Rules
The first are the latest and greatest, available to subscribers. The second are the five-day-delay version of the first set, available to registered users. The third are new, and include:
- community-exploit.rules
- community-ftp.rules
- community-game.rules
- community-inappropriate.rules
- community-mail-client.rules
- community-sql-injection.rules
- community-virus.rules
- community-web-cgi.rules
- community-web-client.rules
- community-web-dos.rules
- community-web-misc.rules
A look at the sid-msg.map summarizes the rules included in this first community rule set. Observe that some of the files (community-web-dos.rules, for example) are empty:
# Copyright 2005 Sourcefire, Inc. All Rights Reserved.
# This file is licensed under the GNU General Public License.
# Please see the file LICENSE in this directory for more details.
# Id SID -> MSG map
100000100 || COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow Flowbit || cve,2004-0629 || bugtraq,10947
100000101 || COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow Exploit || cve,2004-0629 || bugtraq,10947
100000102 || COMMUNITY GAME Halocon Denial of Service Empty UDP Packet || bugtraq,12281
100000103 || COMMUNITY GAME Breed Game Server Denial of Service Empty UDP Packet || bugtraq,12262
100000104 || COMMUNITY GAME Amp II 3D Game Server Denial of Service Empty UDP Packet || bugtraq,12192
100000105 || INAPPROPRIATE lolita sex
100000106 || COMMUNITY SQL-INJECTION Microsoft BizTalk Server 2002 rawdocdata.asp || bugtraq,7470 || cve,2003-0118 || url,www.microsoft.com/technet/security/bulletin/MS03-016.mspx
100000107 || COMMUNITY SQL-INJECTION Microsoft BizTalk Server 2002 RawCustomSearchField.asp || bugtraq,7470 || cve,2003-0118 || url,www.microsoft.com/technet/security/bulletin/MS03-016.mspx
100000108 || COMMUNITY SQL-INJECTION OpenBB board.php || bugtraq,7404
100000109 || COMMUNITY SQL-INJECTION OpenBB member.php || bugtraq,7404
100000110 || COMMUNITY VIRUS Dabber PORT overflow attempt port 5554 || MCAFEE,125300
100000111 || COMMUNITY VIRUS Dabber PORT overflow attempt port 1023 || MCAFEE,125300
100000112 || WEB-CGI Readfile.tcl Access || bugtraq,7426
100000113 || COMMUNITY WEB-CGI HappyMall Command Execution member_html.cgi || bugtraq,7530 || cve,2003-0243
100000114 || COMMUNITY WEB-CGI HappyMall Command Execution normal_html.cgi || bugtraq,7530 || cve,2003-0243
100000115 || COMMUNITY WEB-CGI PHP-Nuke Web_Links Path Disclosure Null CID || bugtraq,7589
100000116 || COMMUNITY WEB-CGI PHP-Nuke Web_Links Path Disclosure Non-Numeric CID || bugtraq,7589
100000117 || COMMUNITY WEB-CGI VBulliten Remote Command Execution Attempt || bugtraq,12542
100000118 || WEB-CLIENT Internet Explorer URLMON.DLL Content-Type Overflow Attempt || bugtraq,7419 || cve,2003-0113 || url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx
100000119 || WEB-CLIENT Internet Explorer URLMON.DLL Content-Encoding Overflow Attempt || bugtraq,7419 || cve,2003-0113 || url,www.microsoft.com/technet/security/bulletin/MS03-015.mspx
100000121 || COMMUNITY WEB-MISC Test Script Access
100000122 || COMMUNITY WEB-MISC mod_jrun overflow attempt || bugtraq,11245 || cve,2004-0646
100000123 || INAPPROPRIATE preteen sex
100000124 || INAPPROPRIATE girls gone wild
That's only 24 rules at the moment. Let's look at the first two:
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow Flowbit";
flow:to_server,established; pcre:"/.{1050,}/U"; flowbits:set,uri.size.1050;
flowbits:noalert; reference:cve,2004-0629; reference: bugtraq,10947;
classtype:attempted-user; sid: 100000100; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow Exploit";
flow:to_client,established; content:"Content-Type|3A|"; nocase;
vnd\x2eadobe\x2exfdf|vnd\x2eadobe\x2exdp+xml|vnd\x2e\ adobe\x2exfd+xml)/smi";
flowbits:isset,uri.size.1050; reference:cve,2004-0629; reference:bugtraq,10947;
classtype:attempted-user; sid:100000101; rev:1;)
When I met with Marty on Thursday, he said that rules like the first one that invoke PCRE but do not use a content match really slow down the detection engine. The second rule also uses (complicated) PCRE, but there is a content match.
Given the limited number of rules in this community set, I can see why a company like StillSecure decided to sponsor Bleeding Snort. StillSecure's IDS is built on Snort, so they have an incentive to sponsor signature research.
Thursday, March 10, 2005
BSDCan 2005 Registration Opens
Visiting Sourcefire
We started our conversation with Marty by discussing the new VRT Certified Rules License Agreement. Marty said that Sourcefire isn't a "nameless, faceless company. Real people work here." He demonstrated Sourcefire's commitment to the security community by mentioning the change to the Audit clause, previously reported here. Marty reported that many companies, several of which he was previously unaware, have reported interest in Snort Integrator licenses. As of this afternoon almost 2,000 people had already registered for the new rules system. The revenue collected from those who choose to subscribe and those who purchase Integrator Licenses will be reinvested in rule development. Sourcefire employees seven people on its Vulnerability Research Team to create and test rules. They include Judy Novak, who I had not seen for several years.
Besides helping to pay rule developer salaries, revenue from the new rules system will also help pay for the equipment Sourcefire uses to develop and test Snort. At right is a picture of one of the racks of networking and testing infrastructure Sourcefire owns. The racks holds $500,000 worth of Spirent Avalanche and Spirent SmartBits network traffic and load generation gear. When Sourcefire develops a new rule, they don't just run Tcpreplay to pass traffic and test Snort's ability to trigger an alert. (I'm not faulting Tcpreplay -- it's a great tool and I use it often. In fact, Aaron just announced the release of Tcpreplay 3.0beta1, with many new capabilities.)
Sourcefire tests that Snort is able to trigger an alert while watching a loaded network. I would like to see someone replicate this setup in their basement! In other words, it's not going to happen at anywhere near the same level of quality assurance. This is the problem I have with ventures like those of Demarc and the mysterious Mr. Alternative Ruleset. Users should always be able to create their own rules, as that is one of the strengths of an open system like Snort. However, they must be exceedingly careful not to cripple their IDS by writing poor rules.
At left is a picture of some of the racks containing servers Sourcefire uses to develop Snort and associated components. Marty said the company has over 26 racks with more than 300 servers. They maintain gear for every version of their appliance they've shipped. They also have target ranges and plenty of development systems. When Sourcefire develops a new rule, for example, they perform 6.8 million regression tests to ensure the new rule does not adversely affect the rest of the rule base. Sometimes these tests take up to four hours per change, even with the load distributed across multiple servers. Sourcefire takes great care to ensure that their rules will not cause Snort to waste excessive time processing packets. Marty told how a rule developed by an external Snort user once made such poor use of PCRE that it took Snort 3 seconds to process each packet!
After looking at Sourcefire's server room, we toured the workspace. Marty employees over 60 people in his Columbia, MD location at over 100 worldwide. In addition to meeting with Judy Novak, who works on the VRT, we also spoke with Snort rule uber-creator Brian Caswell. I mentioned that the Snort 2.3.1 ruleset had new rules not in the 2.3.0 distribution. bmc told me that 2.3.1 packaged all of the new rules up to the date of the new licensing structure, which was 7 March. We discussed having a future DC Snort Users Group meeting closer to Columbia, MD to accommodate the schedules of Marty and Brian. I was surprised to see so many people working on Snort -- you can see in the picture the row upon row of cubicles. There were two engineering meetings happening when I took the photo, so many desks are empty.
After touring the floor we spoke to Marty about the future of Sourcefire. He is excited about the new IS5800 appliance. "This will take the performance issue off the table, and leave detection technology as the key metric," Marty said. Previously companies like Sourcefire were criticized for not being able to keep up with offerings by Tipping Point. Marty reminded us that the ability to process packets per second was more important than a device's "Gigabit" rating. I saw the IS5800 myself, so it is not just marketing hype. I think it will be an amazing piece of gear for those who want to run Snort at speeds over 1 Gigabit.
Near the end of our visit Marty made some interesting points about market pressure on the security scene. He said Sourcefire felt the heat from Gartner's declaration that IDS is dead. (Incidentally, I reported in 2003 that the Meta Group countered Gartner's worldview by saying "network and host intrusion detection systems (IDS) [are] high on the shopping list" of big businesses. Unfortunately, their point of view died when Gartner acquired Meta for $162 million in December 2004.) The integration of the Snort-inline code gives stock Snort the capability to do IPS, which is currently the "hot topic" for security purchasers. Apparently security commentators and reporters want nothing to do with intrusion detection; it's all about IPS now. Unfortunately, we all know that prevention eventually fails.
Keith and I thanked Marty for spending nearly two hours with us. We drove down the street and met Tenable Security founder and CTO Ron Gula for lunch. Ron made some good comments concerning the state of security certifications when he heard I passed my CCNA exam. He said that no one can agree on how to approach the security problem. He divided the world into people that "do" firewalls, IDS, vulnerability scanning, code audits, and a few other categories. Each buys the product and/or service that fits their world view. No one can agree on a standardized methodology to secure a network. Some people think the CISSP meets this need, but anyone who has taken the test knows the CISSP fails miserably in this respect. I posted in 2003 some thoughts on good certification features, and I wrote in The Tao that the best aspect of the CISSP is its code of ethics.
At some point in the future I would like to spend some time at Tenable to get a better look at their operations as well. Thanks to both Marty and Ron for spending some time with us today!
Snort 2.3.1 Released, Audit Clause Modified
drury:/usr/local/src$ diff snort-2.3.0/rules/backdoor.rules
< # $Id: backdoor.rules,v 18.104.22.168 2005/01/17 23:52:48 bmc Exp $
> # $Id: backdoor.rules,v 188.8.131.52 2005/03/01 18:57:08 bmc Exp $
> alert tcp $EXTERNAL_NET any -> $HOME_NET 31337
(msg:"BACKDOOR BackOrifice 2000 Inbound Traffic";
flow:to_server,established; content:"|31 6a d0 d9|";
classtype:trojan-activity; sid:3155; rev:1;)
> alert tcp $EXTERNAL_NET any -> $HOME_NET 3127:3198
(msg:"BACKDOOR mydoom.a backdoor upload/execute attempt";
flow:to_server,established; content:"|85 13 3c 9e a2|";
depth:5; classtype:trojan-activity; sid:3272; rev:1;)
Here's an example of a rule upgrade:
drury:/usr/local/src$ diff snort-2.3.0/rules/exploit.rules
< # $Id: exploit.rules,v 220.127.116.11 2005/01/17 23:52:48 bmc Exp $
> # $Id: exploit.rules,v 220.127.116.11 2005/03/01 18:57:08 bmc Exp $
< alert udp any 4000 -> any any (msg:"EXPLOIT ICQ
SRV_MULTI/SRV_META_USER email overflow attempt";
content:"|05 00|"; depth:2; byte_jump:2,0,relative,little;
byte_test:2,>,128,0,relative,little; content:"|12 02|";
within:2; distance:5; byte_test:1,>,1,12,relative;
content:"|05 00|"; distance:0; content:"n|00|"; within:2;
distance:5; content:"|05 00|"; content:"|DE 03|"; within:2;
distance:5; byte_jump:2,18,relative,little;
classtype:misc-attack; sid:2446; rev:4;)
> alert udp any 4000 -> any any (msg:"EXPLOIT ICQ
SRV_MULTI/SRV_META_USER overflow attempt"; content:"|05 00|";
depth:2; content:"|12 02|"; distance:5; within:2;
byte_test:1,>,1,12,relative; content:"|05 00|"; content:"|6E 00|";
distance:5; within:2; content:"|05 00|"; content:"|DE 03|";
distance:5; within:2; byte_test:2,>,512,-11,relative,little;
classtype:misc-attack; sid:2446; rev:5;)
Sourcefire has also responded to the complaints of its users by modifying the VRT Certified Rules License. The Audit clause has been replaced by the following:
"11. License Compliance.
You may be requested by Sourcefire to provide a certificate, signed by your authorized representative, that you are using the VRT Certified Rules consistent with a Permitted Use. In the event your use of the VRT Certified Rules is not in compliance with a Permitted Use, or if you otherwise violate the terms of this Agreement, Sourcefire may, since remedies at law may be inadequate, in addition to its other remedies:
(a) demand return of the VRT Certified Rules;
(b) forbid and enjoin your further use of the VRT Certified Rules;
(c) assess you a use fee appropriate to your actual use of the VRT Certified Rules."
I think this is much more reasonable. You may want to still run it by your corporate counsel before agreeing, if you want to use Snort in your environment as a registered user.
Wednesday, March 09, 2005
Passed My CCNA Test
I cannot say enough about the CCNA class I took with Todd Lammle at GlobalNet Training. He was not kidding when he said students need to know everything he writes in his slides and says while teaching. I was amazed how much of my knowledge Cisco managed to test with a 55 question exam. Also, if I did not know Todd's block size method of IP subnetting, I do not think I would have finished the test in time.
If you want to pass the CCNA, I recommend the following:
1. Take GlobalNet Training's CCNA class. I do not think you will find another training source who provides as much gear for each student to configure. The labs are first-rate.
2. Read Todd's book.
3. Practice using Todd's CertSim software. This was invaluable because it taught me to slow down and be more careful. I learned this lesson even though I only had a chance to use the software once, 2 hours before my test. I blazed through the simulation and scored only a 749 -- 100 points too low to pass! I vowed to be more careful on the real exam, and it payed off.
4. Practice configuring real Cisco gear, and use Todd's RouterSim Network Visualized software. I did not get a chance to play with this much outside of class, but it's a great way to build, configure, and test Cisco gear in a virtual environment.
5. For deeper knowledge, check out Alex Zinin's book.
Later this year I plan to start working towards the CCNP.
Tuesday, March 08, 2005
Review of Cisco IP Routing Posted
"With my CCNA exam date staring straight at me, I decided to finally read my copy of Alex Zinin's Cisco IP Routing. This book clearly exceeds the level of knowledge to pass Cisco's entry level certification. It is aimed more at CCNPs or CCIEs who need a deeper understanding of Cisco routing. Nevertheless, I found the book's explanations of certain subjects to be absolutely outstanding, even for a CCNA candidate. I recommend anyone wishing to learn Cisco router operations read Cisco IP Routing."
ourcefire VRT Rules License Audit Rights
"11. Audit Rights.
You will, from time to time and as requested by Sourcefire, provide assurances to Sourcefire that you are using the VRT Certified Rules consistent with a Permitted Use, and you grant Sourcefire access, at reasonable times and in a reasonable manner, to the VRT Certified Rules in your possession or control, and to your books, records and facilities to permit Sourcefire to verify appropriate use of the VRT Certified Rules and compliance with this Agreement.
Sourcefire's non-exercise of this right, or its failure to discover or object to any inappropriate use or other breach of this Agreement by you, shall not constitute its consent thereto or waiver of Sourcefire's rights hereunder or under law.
In the event your use of the VRT Certified Rules is not in compliance with a Permitted Use, or if you otherwise violate the terms of this Agreement, Sourcefire may, since remedies at law may be inadequate, in addition to its other remedies:
(a) demand return of the VRT Certified Rules;
(b) forbid and enjoin your further use of the VRT Certified Rules;
(c) assess you the cost of Sourcefire's inspection and enforcement efforts (including attorney fees); and/or
(d) assess you a use fee appropriate to your actual use of the VRT Certified Rules."
The snort-users poster said "our corporate counsel had apoplexy when he saw the license terms." I would have to agree. I can not see any corporate lawyer agreeing to these terms. Does anyone know of any similar licensing agreements for other projects or products?
I have not yet registered to receive the VRT rules, and at this point I am not sure I am willing to subject my company to this level of intrusiveness.
Update: Does Marty read this blog? Maybe -- he's looking at this audit provision, according to his recent snort-users post: "Any time you get lawyers involved things sometimes don't work out quite like you were planning." Stay tuned!
Monday, March 07, 2005
Book Featured by Net Optics
New Snort.org Web Site Launched
The new site features a comprehensive FAQ that links to the VRT Certified Rules License Agreement. I encourage everyone to read the documents themselves, but here's my summary:
- If you absolutely must have the latest rules, as soon as Sourcefire's Vulnerability Research Team (VRT) develops them, you should subscribe. "Introductory pricing" is $195/month, $495/quarter, or $1795/year. You are not allowed to redistribute these rules outside of your organization.
- If you can afford to wait five days after a new rule is deployed, you should register. This is free, but again you cannot redistribute these rules outside of your organization.
- If you don't want to subscribe or register, you can remain anonymous and receive new rules with every new Snort point release. In other words, if/when Snort 2.4.0 or 3.0.0 arrives, you'll get a new batch of rules with it.
Where does this leave the companies with products like Lucid Security's ipANGEL or services like Versign's (previously Guardent's) managed intrusion detection, that use Snort as their IDS? Sourcefire calls these organizations Snort Integrators: "any company that distributes Snort or Snort rules in their commercial offerings. This includes vendors bundling Snort or Snort rules, MSSPs and SIMs." These companies will need to buy a Snort Integrator License. I have emailed the listed point of contact to find out more about this.
The last item I'd like to mention is the Snort rules themselves. There are now two "flavors:"
"Sourcefire VRT Certified Rules are the official rules of snort.org. Each rule has been rigorously tested against the same standards the VRT uses for Sourcefire customers. These rules are distributed under the new VRT Certified Rules License Agreement that restricts commercial redistribution."
"Community Rules [are] rules submitted by members of the open source community. While these rules are available 'as is,' the VRT performs basic tests to ensure that new rules will not break Snort. These rules are distributed under the GPL and are freely available to all open source Snort users."
It looks like Bleeding Snort will be the focal point for the new Community Rules, although this has not been confirmed.
Stay tuned for more commentary as I figure out how this is all working. I am meeting with Marty on Thursday at the Sourcefire HQ, so expect a good follow-up Thursday or Friday.
Review of CCNA: Cisco Certified Network Associate, Deluxe Edition (640-801), 4th Ed Posted
"Last week I attended Todd Lammle's CCNA class, where I received a free copy of his 'CCNA: Cisco Certified Network Associate, Deluxe Edition (640-801), 4th Ed' (CCNADE4E). Todd's class was excellent, and his book is almost literally Todd in written form. There is hardly a wasted word in this book. If Todd mentions a detail concerning a protocol or a certain default value in a configuration parameter, it's important. If he calls out that same item in a 'Note', it's definitely important. This is not 'teaching to the test' -- it's ensuring students and readers are familiar with material Cisco considers relevant. Cisco started its certification program to ensure administrators could properly configure and deploy its gear. By reading CCNADE4E, you will gain that knowledge."
I test Wednesday afternoon. I'll report the results.
Sunday, March 06, 2005
Use FTP Instead of TFTP to Transfer IOS Images
gruden#copy tftp flash
Address or name of remote host [192.168.2.7]?
Source filename [c2950-i6k2l2q4-mz.121-22.EA3.bin]?
Destination filename [c2950-i6k2l2q4-mz.121-22.EA3.bin]?
Accessing tftp://192.168.2.7/c2950-i6k2l2q4-mz.121-22.EA3.bin...
Loading c2950-i6k2l2q4-mz.121-22.EA3.bin from 192.168.2.7 (via Vlan1):
%Error reading tftp://192.168.2.7/c2950-i6k2l2q4-mz.121-22.EA3.bin (Transfer aborted)
Luckily the switch was not hosed at this point. I still had my command prompt and normal functionality. For some reason TFTP kept failing. The image stored on the TFTP server appeared good, since its MD5 hash matched that provided by Cisco. What to do?
I remember Michael Lucas describing how to use FTP to transfer IOS images, so I tried that:
gruden#copy ftp://richard:firstname.lastname@example.com/c2950-i6k2l2q4-mz.121-22.EA3.bin flash
Destination filename [c2950-i6k2l2q4-mz.121-22.EA3.bin]?
Accessing ftp://richard:email@example.com/c2950-i6k2l2q4-mz.121-22.EA3.bin...
Loading c2950-i6k2l2q4-mz.121-22.EA3.bin !!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2867200 bytes copied in 256.536 secs (11177 bytes/sec)
I then reloaded the switch and it came up without any problems. Thanks Michael!
Switch to Router-on-a-Stick Communication
My router had this configuration on the interface facing the switch:
interface FastEthernet0/1
description Connection to gruden, Cisco switch
no ip address
duplex auto
speed auto
interface FastEthernet0/1.1
encapsulation dot1Q 10
ip address 10.10.10.1 255.255.255.0
interface FastEthernet0/1.2
encapsulation dot1Q 20
ip address 172.27.20.1 255.255.255.0
I assumed that if I assigned a management IP to my switch with either a 10.10.10.0/24 or 172.27.20.0/24 address, the switch would be able to speak to the router. I assigned 10.10.10.100/24 to the switch. Because switches do not receive IPs on individual ports, I applied the IP to VLAN 1:
gruden(config)#int vlan1
gruden(config-if)#ip address 10.10.10.100 255.255.255.0
gruden(config-if)#no shutdown
gruden(config)#ip default-gateway 10.10.10.1
Unfortunately, this did not work. I could not reach the router from the switch and vice-versa.
I decided to try assigned a new IP address directly to router interface fa0/1, and give the switch an IP in the same netblock:
gill(config)#int fa0/1
gill(config-if)#ip address 192.168.168.1 255.255.255.0
gill(config-if)#no shutdown
Here's how I configured the switch:
gruden(config)#int vlan1
gruden(config-if)#ip address 192.168.168.2 255.255.255.0
gruden(config-if)#no shutdown
gruden(config)#ip default-gateway 192.168.168.1
That did it. Now I can reach both devices. Apparently the switch can only communicate with the router when the address on the switch is outside of the VLANs in use. I believe Todd Lammle refers to this sort of setup as a management overlay network, where certain IPs are used solely for device management.
If anyone can comment on this design or suggest an alternative, I welcome feedback. I think the wrinkle in my setup involves the router having to pass traffic between VLANs 10 and 20.


text:
拉菲2登陆线路Gain the in-demand skills you need to break into a new career field like information technology or data science. No prior experience is required to get started.
PROGRAM HIGHLIGHT IT support is projected to grow 10% between 2018 and 2028 — faster than the average of all other occupations, BLS (2019)
Overview拉菲2登陆线路 Your launchpad to a career in IT. This program is designed to take beginner learners to job readiness in about six months.
This program is for Anyone that wants to start a new career in IT support. No experience is necessary.
Related Job Roles IT Support Specialist, Technical Support Engineer, Desktop Support Engineer, IT Support Engineer, Technical Support Specialist, IT Desktop Support
Hiring Consortium Bank of America, Best Buy, Cognizant, GE Digital, H&R Block, Hulu, Infosys, Intel, Sprint, The Home Depot, Walmart, Google and more.
Prerequisites None
PROGRAM HIGHLIGHT Data scientist was once again named the best job in America for the third consecutive year, Glassdoor (2019)
Overview Gain the latest job-ready skills and techniques covering a wide array of data science topics. Complete hands-on projects in the IBM Cloud using real data science tools and real-world data sets.
This program is for Anyone interested in developing skills and experience to pursue a career in Data Science. It is suitable for both learners who are entering the workforce and industry professionals looking to up-skill/re-skill and enter the exciting field of Data Science.
Related Job Roles Data Scientist, Data Analyst, ML Engineer, Data Science Analyst
Hiring Partners IBM
Prerequisites No prior computer science, programming, or statistics knowledge required to get started.
PROGRAM HIGHLIGHT拉菲2登陆线路 SAS® Analytics skills are the most valuable skills a candidate can bring to the job market, Money and PayScale (2016)
Overview拉菲2登陆线路 Demonstrate skills in manipulating data, combining SAS data sets, creating reports, and identifying and correcting data, syntax and programming logic errors. These skills prepare you for the SAS® Base Programmer certification exam.
This program is for Those who want to learn how to write SAS programs to access, explore, prepare, and analyze data. SAS programming is a useful skill in a variety of careers, including business analyst, researcher, statistician, or data scientist.
Related Job Roles SAS Programmer
Prerequisites No prior programming or SAS experience is required.
Arizona State University
PROGRAM HIGHLIGHT拉菲2登陆线路 Learn how to teach English at home or abroad. Meets all standards outlined by the TESOL International Association.
Overview You will receive an ASU Professional Certificate in Teaching English to Speakers of Other Languages. Be ready to get a job teaching English!
This program is for This course is designed for anyone who wants to teach English anywhere in the world. If you want to become a teacher, polish your teaching skills, or add a credential to your resume, this is the course for you! Get certified by a nationally-ranked university.
Related Job Roles Teacher in a school or language institute, online teacher, literacy mentor for a non-native English speaker, English tutor, English specialist for refugees
Prerequisites We recommend an English proficiency level of B2 on the CEFR. If you are looking for a position in an established school, they often require a bachelor's degree in addition to a TESOL Certificate.
PROGRAM HIGHLIGHT One of the hottest areas with high demand is in IT customer service and support.
Overview拉菲2登陆线路 Customer Engagement is the perfect entry point to start your career in IT, with a multitude of job openings ranging from onsite or remote help desk work to customer care or client support.
This program is for Anyone that wants to launch a new career in customer support.
Related Job Roles Customer Support Agent, Customer Relations Agent, Client Success Agent, Help Desk Agent, Field Sales Support Agent, Technical Support Agent, Desktop Support Agent, Patient Services Representative
Hiring Partners IBM
Prerequisites None
Build your skills and advance your career in high-demand fields like cloud architecture, applied AI, and more. Many programs also provide a pathway to industry-recognized certification.
PROGRAM HIGHLIGHT Over 530,000 U.S. job postings require Python proficiency, including 75,000 entry-level jobs, Burning Glass (2018)
Overview拉菲2登陆线路 You'll learn how to program with Python with no previous knowledge of coding required, how to use Python to automate common system administration tasks, and learn how to use Git and GitHub to troubleshoot and debug complex problems.
This program is for拉菲2登陆线路 Whether you're just starting your IT career or you already have work experience under your belt, this program is designed to provide IT professionals with in-demand skills that can help you advance your career.
Related Job Roles拉菲2登陆线路 This program can help prepare you for a variety of IT roles, like more advanced IT Support Specialist or Junior Systems Administrator positions.
Hiring Consortium拉菲2登陆线路 Bank of America, Best Buy, Cognizant, GE Digital, H&R Block, Hulu, Infosys, Intel, Sprint, The Home Depot, Walmart, Google and more.
Prerequisites Familiarity with basic file/directories usage, file permissions, basic process management, software installation process, servers, requests, clients, IP addresses, basic networking protocols (DNS, DHCP, FTP, SSH), basic understanding of the cloud. Command line (Linux) recommended.
Google Cloud
PROGRAM HIGHLIGHT The Professional Cloud Architect certification was ranked one of the top paying IT certifications, Global Knowledge (2019)
Overview Launch or advance your career in cloud architecture. Learn to design, develop, and manage cloud solutions. Prepare for the Professional Cloud Architect certification.
This program is for Engineers looking to advance their career in cloud architecture and learners interested in preparing for the Google Cloud Professional Cloud Architect certification exam.
Related Job Roles Cloud Architect, Junior Cloud Architect, Cloud Solutions Architect, Solutions Architect, Cloud Engineer
Prerequisites拉菲2登陆线路 Proficiency with with command-line tools and Linux operating system environments and systems operations experience; 3+ years of industry experience including 1+ years designing and managing solutions using GCP recommended for the certification exam.
PROGRAM HIGHLIGHT AI is expected to generate over 50 million net new jobs in the next few years alone, World Economic Forum (2019)
Overview By the end of this comprehensive 6 course Professional Certificate, you will have completed several projects showcasing your proficiency in Machine Learning and Deep Learning, and become armed with skills for a career in AI.
This program is for拉菲2登陆线路 This Professional Certificate is suitable for learners from a variety of backgrounds, including students looking to enter the workforce and existing professionals looking to future proof themselves with in-demand AI skills.
Related Job Roles Machine Learning Engineer, Deep Learning Engineer, AI Engineer, Senior Data Scientist
Hiring Partners IBM
Prerequisites Requires foundational AI or Data Science skills including Python programming, as well as proficiency in High School level math. If you are new to AI and data science, check out the IBM Applied AI Professional Certificate or IBM Data Science Professional Certificate.
PROGRAM HIGHLIGHT拉菲2登陆线路 AI is expected to generate over 50 million net new jobs in the next few years alone, World Economic Forum (2019)
Overview By the end of this Professional Certificate, you will have completed several projects showcasing your proficiency in Applied AI, Machine Learning and Deep Learning.
This program is for Whether you are a seasoned industry professional such as a developer or a data scientist, a student looking to enter the workforce, or an existing AI practitioner interested in learning the latest in AI innovation and technologies, this AI Professional Certificate from IBM will enable you to future proof your career.
Related Job Roles AI Developer, AI Application Developer, AI Builder, Chatbot Developer
Hiring Partners IBM
Prerequisites No prior knowledge of AI or programming is necessary.
拉菲2登陆线路Google Cloud
PROGRAM HIGHLIGHT拉菲2登陆线路 Data engineering is projected to grow by 39% with an average salary of $115,000, The Quant Crunch (2017)
Overview拉菲2登陆线路 Launch or advance your career in data engineering within the cloud. Learn to design, build, operationalize, secure, and monitor data processing systems. Prepare for the Google Cloud Professional Data Engineer certification.
This program is for Engineers looking to advance their career in data engineering and learners interested in preparing for the Google Cloud Professional Data Engineer certification exam.
Related Job Roles Data Engineer, Technical Lead, Data Scientist, Technical Solutions Engineer, Data Analyst
Prerequisites One year of experience with one or more of the following: A common query language such as SQL, data modeling, machine learning and/or statistics, programming in Python; 3+ years of industry experience including 1+ years designing and managing solutions using GCP recommended for the certification exam.
Google Cloud
PROGRAM HIGHLIGHT拉菲2登陆线路 There are over 100,000 open cloud computing positions available worldwide today, Forbes (2018)
Overview Launch or advance your career in cloud engineering. Learn to deploy applications, monitor operations, and manage enterprise solutions on the Google Cloud Platform.
This program is for Engineers looking to advance their career in cloud engineering and learners interested in preparing for the Google Cloud Associate Cloud Engineer certification.
Related Job Roles Cloud Engineer, Technical Lead, System Administrator, IT Manager, Technical Solution Engineer, Technical Support Associates
Prerequisites拉菲2登陆线路 Proficiency with with command-line tools and Linux operating system environments and systems operations experience; 6+ months hands-on experience with GCP recommended for the certification exam.
PROGRAM HIGHLIGHT拉菲2登陆线路 PMP® credential holders in the U.S. earn about 15% more than non-credentialed peers, Project Management Institute (2017)
Overview The Project Management Certificate Program covers A Guide to the Project Management Body of Knowledge (PMBOK® Guide), which serves as the fundamental knowledge base for project management. Upon completion, you will satisfy the education requirements to sit for the Project Management Professional® Exam. Recognized domestically and internationally, the PMP® certification sets the standard for excellence in project management.
This program is for拉菲2登陆线路 Professionals who are interested in pursuing careers in project management.
Related Job Roles Project Manager
Prerequisites 3-5 years of work experience
PROGRAM HIGHLIGHT拉菲2登陆线路 84,000 open mainframe positions are expected by 2020, Zip Recruiter (2019)
Overview拉菲2登陆线路 Mainframes are fundamental to how we do business, and all modern mainframes run on the IBM Z systems environment. This certificate demonstrates your ability to begin your journey as an IBM Z System Administrator.
This program is for拉菲2登陆线路 This certificate is for anyone that wants to start a career in IBM Z. You'll have skills to start on-the-job training from day one.
Related Job Roles Mainframe Systems Programmer, Mainframe Systems Administrator, Mainframe Application Developer, System Programmer, System Administrator, DBA Practitioner
Hiring Partners IBM
Prerequisites拉菲2登陆线路 Ideal candidates will have some background in computer programming or system administration.
PROGRAM HIGHLIGHT The brain processes visual information 60,000x faster than text. (3M, 2001) Visualizing data is essential to understanding the story behind the numbers.
Overview拉菲2登陆线路 Using SAS Visual Analytics, you will learn to access and manipulate data, analyze data with a variety of interactive reports and graphics, and design and share dashboards to visualize your data.
This program is for Those who want to learn how to use SAS Visual Analytics to explore data and create interactive reports.
Related Job Roles SAS Visual Analytics is a useful skill in a variety of careers, including business analyst, researcher, statistician, or data scientist.
Prerequisites No SAS experience or programming experience is required, although you should have basic computer experience.
PROGRAM HIGHLIGHT拉菲2登陆线路 Your clear path to earning SSCP certification.
Overview拉菲2登陆线路 Pursue better IT security job opportunities. This program shows employers you have the IT security foundation to defend against cyber attacks – and puts you on a clear path to earning the SSCP certification.
This program is for拉菲2登陆线路 This program is for IT administrators, managers, directors and network security professionals.
Related Job Roles拉菲2登陆线路 Network Security Engineer, Systems Administrator, Security Analyst, Systems Engineer, Security Consultant/Specialist, Security Administrator, Systems/Network Analyst, Database Administrator
Prerequisites None
Professional Certificates on Coursera help you get job-ready for an in-demand career field in less than a year. Earn a career credential, apply your knowledge to hands-on projects that showcase your skills for employers, and get access to career support resources. Many programs also provide a pathway to an industry-recognized certification.
Accessible learning from top companies and universities拉菲2登陆线路 Get job-ready with affordable, career-aligned training programs taught by expert instructors from top companies and universities. Start pursuing your career dreams today with programs starting at $39 USD per month and a 7 day free trial.
Learn at your own pace, whenever and wherever it's most convenient for you拉菲2登陆线路 Get started right away and learn on your own schedule with flexible online courses. Build your network and share advice in the as you work through the program.
Create work samples that showcase your expertise Apply your new skills with real-world projects that you can share in interviews to demonstrate your job-readiness to potential employers.
Earn a career credential and unlock resume and interview support resources Upon completion, earn a Professional Certificate to share with your network and unlock career support resources, including resume development help, interview preparation, and more. Many Professional Certificates also have hiring partners or a hiring consortium that recognize the Professional Certificate credential.
I had the confidence upon leaving this program to throw myself at the world of IT headlong.Daniel A., Google IT Support Professional Certificate Alumnus
After my supervisor saw my coursework, she was confident that I was the right person for the job. Thanks to the Google IT Support Professional Certificate, my family gets to see me finally achieve my dream of being in IT.Tristen A.Google IT Support Professional Certificate Alumnus
This Professional Certificate taught me a lot of valuable skills in my industry, gave me hands on experience, and not only helped me get interviews, but also gave me projects to discuss in those interviews.Sarah S.IBM Data Science Professional Certificate Alumna
As a single working mom, I'm incredibly proud to have been able to complete this program. It's enabled me to take on additional responsibilities, work on exciting and impactful projects, and even get a raise.Danielle B.Google IT Support Professional Certificate Alumna

subset: commoncrawl


text:
Calfstronaut's computer is being attacked by vicious viruses! Help Calfstronaut by clicking on the viruses to destroy them, but be careful not to click on malicious code segments that make you lose the game.
Calfstronaut and the Computer Bug Infection is an intuitive point-and-click game that is fun for the whole family.
The Mad Magician was fired and has cursed Lucky's Puzzle Carnival! To bypass the curse, you must solve diabolical puzzles before each stop on the world tour.
Patient B-145A is under attack by armies of germs! This is a Breakout game where the "bricks" are germs that slowly descend to destroy you. Keep the ball moving and gather power ups to destroy the germs that have infected your patient before it's too late!
Copyright (C) 2007-2019 Orbital Cows Software. All rights reserved.


text:
Snackin' Pumpkin Hummus
This delicious snack takes only minutes to prepare. Try this pumpkin hummus coupled with warm pita bread or crisp vegetables and you're sure to fall in love with this creamy dip, perfect for both snacking and entertaining.
Prep Time
Cooking Time
Skill Level
servings, 2 tablespoons each
In this recipe
- 1 can (15.5 oz.) chickpeas or garbanzo beans, rinsed and drained
- 3/4 cup LIBBY'S® 100% Pure Pumpkin
- 3 tablespoons lemon juice
- 1 tablespoon water
- 1 clove garlic, finely chopped
- 1/2 teaspoon salt or more to taste
- 1/4 teaspoon ground black pepper
- 2 tablespoons chopped fresh parsley
PLACE chickpeas, pumpkin, lemon juice, water, garlic, salt and pepper into food processor; cover. Blend for 1 minute or until smooth. Additional water, a teaspoon at a time, can be added if a smoother consistency is desired. Stir in parsley. Serve immediately or refrigerate in tightly covered container for up to 4 days. Makes about 2 cups.
SERVE along with pita triangles or raw vegetables.
SERVE along with pita triangles or raw vegetables.
Nutritional Information
Serving Size 16
Calories Per Serving 20
Calories from fat 0
% Daily Value *
- Total Fat 0g 0%
- Saturated Fat 0g 0%
- Cholesterol 0mg 0%
- Sodium 125mg 5%
- Carbohydrates 4g 1%
- Dietary Fiber 1g 4%
- Vitamin A 30%
- Vitamin C 4%
- Calcium 0%
- Iron 2%
- Sugars 1g
- Protein 1g
* Percentage Daily Values are based on a 2000 calorie diet.


text:
As a genealogist, it's frustrating to me that apparently all my ancestral lines lead back to European peasants—records are scarce and entries in history books, even local history, uncommon. Acknowledgement and documentation of an ordinary life of hardship doesn't often make it into print for descendants to discover and exclaim, "here's my ancestor, and what he did and how he lived."
For this reason, I was thrilled to read F. Warren Bittner's recent article, a winner of the 2011 Family History Writing Contest, "Without Land, Occupation, Rights, or Marriage Privilege: The Büttner Family from Bavaria to New York."1 Bittner does an outstanding job of mining records and applying a knowledge of local social history and laws to those records, resulting in an enhanced and documented picture of one Bavarian family's life in poverty.
Bittner chooses the Büttner men's efforts to marry as his springboard for examining property, occupations, and rights of village residency. Despite couples' attempts to legally wed, restrictions put in place by village, guild, and district authorities resulted in illegitimate children; towns disputed each other over which must take responsibility and allow the family group to settle within the community. Repeatedly members of the Büttner family attempted to break down barriers to a marginally better life.
In the course of the article Bittner discusses sexual mores, the amount of land needed to support a family, the social status of weavers, a change in laws and courts in the aftermath of the Napoleonic wars, the disadvantage of being bound to the land and the far greater disadvantage of being landless. He draws on tenancy records, maps, land files, marriage hearings, military papers, and the usual church registers in the course of his research. Footnotes refer to what appears to be a definitive library of eighteenth and nineteenth century Bavarian social history, including titles such as Property, Production, and Family in Neckarhausen: 1780-1870; and German Home Towns: Community, State, and General Estate, 1648-1871; and The Village in Court: Arson, Infanticide, and Poaching in the Court Records of Upper Bavaria, 1848-1910; and "Village Spinning Bees: Sexual Culture and Free Time among Rural Youth in Early Modern Germany."2 The result is a broad picture of the miserable social and legal conditions in which the Büttners struggled to exist. Bittner sums up their situation well when he writes, "Leonhard and Margaretha lived in a different world in the same villages as their neighbors with higher status."3 Bittner shows us that world.
There are two take-aways from this article: one, it is possible to learn—and say—much more about those who lived "at the bottom of the village hierarchy";4 and two, it takes a good deal of work. The pay-off however is huge, for both the subjects' descendants and others researching the geographical area. This article is a model, an inspiration, and a bench-mark. Thank you, F. Warren Bittner, for showing us so thoroughly and so elegantly that it is indeed possible to document, describe, and honor the lives of our peasant ancestors.
1 F. Warren Bittner, "Without Land, Occupation, Rights, or Marriage Privilege: The Bütnner Family from Bavaria to New York," National Genealogical Society Quarterly 100 (September 2012): 165-187.
2 I marked twenty-eight of the titles he refers to with the notations "read" or "look up"; I have Bavarian lines of my own to research!
3 Bittner, "The Büttner Family from Bavaria to New York," 187.
4 Bittner, "The Büttner Family from Bavaria to New York," 169.


text:
Available ebook formats: epub mobi pdf rtf lrf pdb txt html
I live every day to fulfill my ambition of being the best at what I do and creating is what I do best.
my writing is in the form of poetry, short stories, feature script writing and shorts.
At the moment I am in the process of taking all my feature scripts and transforming them into novels
it will take some time :)
Please enjoy all that I can share with you, thus far!


text:
For 22 long years while residing at Maui, a simple chef named Mark Ellman and his beautiful wife Judy, along with their daughters Michelle, Ariana and Tina, have opened up a chain of restaurants in Hawaii. The restaurants Mala Ocean Tavern, Maui Tacos, and Penne Pasta Cafe are all the fruits of the family's hard work and dedication.
Before all the success, Mark was originally working in a Calabasas-based Mexican restaurant as a cook, while Judy was a bartender. It was love that brought them together, and from this love their pioneer restaurant in Sherman Oaks known as Cuisine Cuisine was born. Italian cuisine was their main offerings, with their homemade pasta gaining them both great friends and reputation. Not too long after that, they needed to move to Colorado in order to get better environment, but they found the place too cold, which is why they decided to finally move to Hawaii in 1985. It was in Maui that they found a place they can call home.
Two years after arriving at Maui, the couple did not waste any time and opened up the now famous Avalon Restaurant and Bar located at downtown Lahaina. It was in this time that Mark created a chain of Pacific Rim Cuisine, in which eleven skilled chefs joined him to assemble what is now known as the Hawaii Regional Cuisine Movement. It was in this revolutionary body that granted each chef their own chapter and a delectable array of recipes.
After quite some time, they were feeling the cravings for Mexican food from their place in Los Angeles, which is why in 1993 they started opening up small taco stands named Maui Tacos. They were able to add eight more taco stands all over the three islands of Hawaii, with a concoction of Mexican and Maui cuisines. All their meals were so affordable, that no meal was beyond $8.95. Seeing the success of their Maui Tacos, they decided to focus here more and ultimately decided to close down Avalon.
Mark Ellman did not want his Italian heritage to go down the drain, and in 2001, Penne Pasta Cafe came to life. It is here in Penne Pasta, which is now in its 6th year, where Mark and his customers get to enjoy savoury roast chicken, fresh island fish, lamb osso bucco, salads, and of course, what is Italian cuisine without those paper-thin pizzas and "al dente" pastas? Mala Ocean Tavern was not too far behind, opening up in 2005, and is mainly offering Pacific Rim and Mediterranean cuisine – even a few Latin-themed dishes.
One of the secrets of Mala Ocean Tavern was in the standards of Mark and Judy in hiring their employees – this is also very evident even in Penne Pasta and Maui Tacos. The couple's business partners, Sergio and Pepe, have worked well as a team in providing excellent management in their food chains. The restaurants would also not be what it is today if not for GM Lisa Chappel and Master Chef Gregory Denton, who are both considered the restaurant rock stars.
Lisa's charms and savvy has brought about exceptional personnel and customer relations, while chef Denton's dedication and love for cooking has given life and unique taste to all his dishes, especially his soups and sauces. He is a very aggressive guy, always bringing new ideas to the table and ready for any challenge. It is for this reason that the couple wants to help him open up his own place too, where they know he can be far more successful. It has been the couple's objective to always make people happy with their great food, which is made only from the freshest and healthy organic ingredients.
The couple also enjoys sitting by the Mala Wharf – a well-known pier, especially to sailors, famous for its view of the whaling town Lahaina. In Hawaii, Mala means garden and simply gazing at the breathtaking views of the ocean and the Molokai and Lanai islands can easily blow you away. It is from this place that the couple got the name for one of their restaurant, which is Mala – a place they consider to be their own little heaven on Earth. There is so much to enjoy – the inspiring stories, the sumptuous dishes and the warm and relaxing ambiance of Maui.


text:
We are highly ranked on Google and receive thousands of visitors a day who are looking for tournaments, leagues and camps/clinics to participate in. Find the perfect solution below and advertise your product or event today for total exposure.
Postings and Upgrades
Posting in our directories are free but if you want your event to stand out from the competition, featured event upgrades are available.
- Default - Free
- Silver - $125/event
- Gold - $350/event*
Required Sizes
- The sizes are shown in the samples below.
* Background color is determined by sport, basketball gold upgrade is shown here.
Directory Banner
The directory banner ad is at the top of directory pages, and is the first ad a user will see but they also appear in the directory results also.
Regular Prices
- All Directories - $2500/yr or $500/month
- State/Region Directory (6) - $1000/yr or $300/month
Exposure Certified Prices
- All Directories - $2000/yr or $400/month
- State/Region Directory (6) - $700/yr or $250/month
Required Sizes
- 1456x180px
- 400x400px
- 640x100px
Exposure Organizations
Exposure organizations are listed on every directory page or state specific directory page and requires an Exposure account.
Regular Prices
- All Directories - $600/yr or $250/month
- State/Region Directory (6) - $500/yr or $200/month
Exposure Certified Prices
- All Directories - $500/yr or $200/month
- State/Region Directory (6) - $400/yr or $150/month
Required Sizes
- Any size, but must be the organization logo.
Note: Prices and ad placements may change without affecting visibility and exposure. We also have the right to deny an ad request.


text:
Video Sources 400 Views
what going on?
ESPN, Inc., The Worldwide Leader in Sports, is the leading multinational, multimedia sports entertainment company featuring the broadest portfolio of multimedia sports assets with over 50 business entities. Based in Bristol, Conn., with 4,000 employees (7,000 worldwide) ESPN Plaza includes 950,000 square feet in 16 buildings on 123 acres (116 contiguous), with additional office space (400,000 sq. ft.) rented nearby. The company is 80 percent owned by ABC, Inc., an indirect subsidiary of The Walt Disney Company. The Hearst Corporation holds a 20 percent interest in ESPN.


text:
Here's what students have to say about majoring in English.
English students at SBU don't just walk away with a list of literary facts and a set of language skills. They learn to logically and intelligently build on their knowledge. They learn to ask more complex and pressing questions. And, most importantly, they learn to take their highly developed skills and apply them to our world in a wonderful and socially relevant way.
—Christopher Radey
Being an English major at St. Bonaventure has been such a rewarding experience. Reading well, communicating effectively, writing coherently, and analyzing critically are just some of the measurable traits I have learned to hone and perfect, but the insight I have gained from my English courses has been immeasurable. The English department is full of intelligent, witty, and passionate people, and I'm so fortunate to be a part of it!
—Matt Laurie
I loved being an English major at SBU. The professors are not only experts in what they teach, but they are passionate about sharing their knowledge. It made me more enthusiastic about classes and allowed me to explore new ideas with their guidance.
—Francesca DeCillo
I loved everything about the English Department! Most of all it was the professors that I loved!
—Hope Gardner
The wide range of required and elective English classes allowed me to experience a survey of English literature while giving me the opportunity to explore the topics and areas that interest me the most. The relatively small class sizes made it possible for me to get to know my professors, who are genuinely caring people that helped and encouraged me.
—Monica Edwards
My favorite thing about being an English Major is the incredible amount of knowledge I have gained. I absolutely love learning about the people and cultures of different historical movements.
—Cassie Fearing


text:
I love making mosaics using random watercolor squares. Here are a couple from my Saturday art making. #worldwatercolormonth
Happy Sunday!
Size: 5″ x 6.5″ watercolor and watercolor pencils
mosaic squares are 1″ x 1″
Size: 6″ x 9″ watercolor, mosaic squares 1″ x 1″.
The sky was patted dry with a paper towel and an added bonus the paper texture was left in the paint.


text:
- WiFi
- Car park
- Air conditioning
- Sports
- Business
Choose your room
- Hotel
Year Built - 2010
Additional Property Description -
The hotel is located in the prosperous commercial area
of Xian Jiefang Road, the geographical condition is
superior, the traffic is very convenient. It is close
to Xian railway station and the airport shuttle bus
point, ruins of ancient city wall is only 100 meters.
Hotel is away from Wanda plaza only 100 meters,
paradise pedestrian street adjacent to the Clock Tower,
Gulou, Muslim flavor snacks. Outside the hotel, more
than 40 buses to the Wild Goose Pagoda, Datang Lotus
Park, Terra Cotta Warriors and other attractions. All
the rooms are equipped with independent temperature
control system, safe and reliable electronic locks,
free Internet system and international and domestic
telephone, digital television devices, and a conference
room, free parking and other service facilities.


text:
What is Exact Searching?
When you search for a Greek or Hebrew word in Accordance, Accordance ignores any breathing marks, accents, or vowel points. We do this because we don't want a search to fail just because you entered a rough breathing mark instead of a smooth one, or a sere instead of a seghol.
To see how this works, open the tagged Greek New Testament (GNT-T) and do a search for εις. When the search is complete, choose Analysis from the Details pop-up menu.
An Analysis of your search will open in a new zone and list every lexical form that was found by your search. Note how it finds εἷς (with a rough breathing mark) and εἰς (with a smooth breathing mark). Accordance doesn't require those kinds of characters to be specified for a search to be successful.
Now, suppose you only want to find the lexical form εἷς and do not want to find εἰς? As I mentioned earlier, Accordance ignores vowel points and breathing marks, so even if you enter εἷς and re-run the search, you'll still find both εἷς and εἰς. Try it yourself to verify this behavior. Copy εἷς from the Analysis window and paste it into the argument entry box of your Search window. When you click the Find button, you'll notice that the number of hits remains the same and the Analysis window still lists both εἷς and εἰς.
So what do you do when you want Accordance to consider accents, breathing marks, and vowel points? How do you get it to stop ignoring them? You do it simply by placing an equals sign (=) in front of the word you're searching for. The equals sign tells Accordance to do an exact search for the word as you've entered it. This means of course that you have to get all those little marks right for the search to be successful. Try putting an equals sign in front of εἷς and running the search again. Now you'll see that all occurrences of εἰς are excluded.
Most of the time, you won't need to worry about accents, breathing marks, and vowel points; but on those occasions when you do want them to be considered, just remember the equals sign.