Free Open-Source vs. Commercial Security Tools? 234
sahirh asks: "I work as a penetration tester and recently started writing a whitepaper on the benefits of free, open-source security tools over commercial tools. Through my own experiences, I've found that many free tools such as Nessus and Kismet are more reliable and have better features than expensive commercial alternatives like ISS Internet Scanner or Airopeek. I've also noticed that tools like Ettercap have no commercial alternative. Further, the flexibility offered by the open-source nature of such tools is a great benefit. I'd like to ask for Slashdot's experiences and opinions on why you don't need to spend thousands of dollars on an expensive tool to perform a professional security assessment." Update: 02/07 11:15pm EDT by C : Thanks to all who wrote in to let us know the proper URL to the Kismet site.
I want his job (Score:5, Funny)
I have no joke here, I just like saying, I work as a penetration tester ...
Re:I want his job (Score:4, Funny)
You want to work as a penetration tester? (Score:2, Funny)
Re:I want his job (Score:2)
Re:I want his job (Score:2)
An anonymous coward said:
Well, duhhhh. My sisters have six children and four grandchildren between them. I am sure in their day they were MILFs to someoneSnort (Score:4, Interesting)
Re:Snort (Score:2, Informative)
Re:Snort (Score:3, Informative)
Actually we found that Sentarus is a much better snort-based product. We kicked Sourcefire out after 2 weeks, they just don't get the concept of a GUI. Talk about butt ugly and unmanagable.
Re:Snort (Score:4, Informative)
For pen-testing, check out the Metasploit framework [metasploit.com]. It's truly cool.
Also, have a look for scanrand, part of paketto keiretsu (doxpara.com appears to be having trouble right now, so don't go looking right now).
There's always the old standbys, as well, like dsniff.
Re:Snort (Score:2)
Ummm...'cause tools with the same functionality are available for free? Seriously, I think part of it's just social...the hackers who write the tools tend to be more the open-source mentality than the corporat
Valuable Open Source Security Assement Tools? (Score:5, Informative)
Re:Valuable Open Source Security Assement Tools? (Score:3, Informative)
Re:Valuable Open Source Security Assement Tools? (Score:4, Interesting)
Re:Valuable Open Source Security Assement Tools? (Score:2, Interesting)
"But I thought my firewall blocked that stuff!!!"
-Scott
Re:Valuable Open Source Security Assement Tools? (Score:2, Informative)
Agreed (Score:3, Insightful)
Re:Agreed (Score:2)
Aside from that, last time we tested retina it wasn't very good atall and was especially bad at detecting known vulns in unix machines, it was more windows oriented.
Re:Valuable Open Source Security Assement Tools? (Score:5, Informative)
Heh, recommending a security tool that OpenBSD removed because the Ethereal team does not care about security [openbsd.org]
Just because something is open source does not imply that it's secure.
Re:Valuable Open Source Security Assement Tools? (Score:5, Informative)
I was just thinking about structural ways to work around this in ethereal (like priv sep) -- in the meantime, I would point out that the biggest difference between ethereal and it's commercial equivalents is is that, with ethereal, you find out about the security problems quickly -- whereas with commercial equivalents, you might not find out for a while (if ever), and you'll probably end up paying for the upgrade to make it secure.
Another point is that it's most often the newer disectors that contain the holes. If you're worried about security and working in a 'hostile' environment, you're probably best to disable any disector that you're not intending to use. -- in fact, that might be a good idea to do in Ethereal, generally: Disable all but the most common dissectors and wait for the user to enable them explicitly.
Re:Valuable Open Source Security Assement Tools? (Score:3, Interesting)
Part of the nature of ethereal is that just about any hole is going to be a remot hole, since it is pretty much only dealing with remote (network) data. This is made worse by the fact that it's usually run as root and has no privelege separation (that I know of). OBSD, on the other hand has the luxury of separating remote holes from local holes when they carp about OpenBSD's security.
This, however, does not excuse the ethereal community
Accountability (Score:3, Insightful)
However, for protecting yourself, I think there are ethical reasons to use Free Software - Stallman argues that you should choose software for those reasons alone, and not technical reasons. If you listen to Linus, however, he tells us that technical reasons are valid reasons to choose to software. Your decision on this issue is the first step to your overall decision.
Re:Accountability (Score:4, Interesting)
I'm on our network security team and when doing audits we do have a few commercial tools, but we also use OSS tools like Nessus because IME they're better overall.
Re:Accountability (Score:4, Insightful)
Passing the buck is standard corporate politics. It's true that this leads to a lot of dysfunctional organizations and bad decisions. But if you choose to fight this trend, you better be very good at what you do. And at covering your ass.
Re:Accountability (Score:2)
Re:Accountability (Score:2)
B
Re:Accountability (Score:3, Interesting)
Why can't you? The law on this is untested in many areas. What makes you so sure you couldn't make a case against them?
What a pile of shit? (Score:5, Funny)
I know Microsoft readily accepts monetary responsibility for their products being crap and causing crashes, viruses and trojans in my system.
In fact, Bill and Steve cut me a check weekly.
Re:Accountability (Score:5, Interesting)
Re:Accountability (Score:2, Funny)
Re:Accountability (Score:2)
Re:Accountability (Score:2)
Re:Accountability (Score:2)
Re:Accountability (Score:2)
How does this work in the real world, exactly?
IME, it's always your fault, as it should be, mostly.
Accountability vs Responsibility (Score:5, Insightful)
Your responsibility is to protect your company AND get it back on its feet after a breakin. You can't rely on a lawsuit to do that in any timely fashion, only after the company has gone out of business and everyone has long since gotten new jobs. Even then, you'd be lucky to get pennies on teh dollar in restitution. So what good does it to sue the developer or seller?
You have to get the company going again as quickly as possible. It just might be helpful to have sources to what failed to see how it failed and how the breakin occurred. Proprietary software is useless there.
Re:Accountability vs Responsibility (Score:2)
I'll wait until the law is clearer, but the idea that EULA's absolve a company of guilt simply is not correct (yet).
Re:Accountability vs Responsibility (Score:2)
If there is a vendor that provides open source solutions then they should be able to support them just as a proprietary vendor would.
The issue isn't a point of how you can legally screw them over, its how you can speak to your boss in terms that he understands. If your boss knows you screwed up or didn't know something you were supposed to then its harder for him to pass that up through management than if you used a canned app
Re:Accountability vs Responsibility (Score:2)
While you are right in PHB terms, this does you no good whatsoever if your business relies on the Internet and you suffer a major security breakin.
I'
Re:Accountability -- Reminde me not to hire you (Score:5, Insightful)
I mean, it's not like most commercial vendors take any responsibility for their software, anyways -- have you read your EULA's recently?
At least with open source software, you have the option of fixing any bugs yourself if the vendor refuses to. With Proprietary code, your only choice is to grin, bend over and wait for your bill.
Re:Accountability -- Reminde me not to hire you (Score:3, Insightful)
Commercial is not the same as inferior. MANY MANY commercial products are better than the open source version. Your bias is showing.
Re:Accountability -- Reminde me not to hire you (Score:2)
Re:Accountability (Score:2, Informative)
Um, check the EULA. Unless you've written a change into your contract, it's unlikely that the vendor actually is responsible.
Free software relieves you of the burden of believing the vendor's got your back. For the most part, they don't.
Re:Accountability (Score:2)
I have a similar job. (Score:4, Funny)
That's your day job... (Score:5, Funny)
Hmmm (Score:3, Interesting)
Re:Hmmm (Score:2, Funny)
You're new here, right?
Go to SANS training. (Score:5, Informative)
We were reviewing everal six-figure pieces of equipment and found the same thing - we knew they saw traffic they didn't like, but we didn't know WHY.
Now that everybody uses snort rules, the training is still helpful to show you WHAT you're seeing and IF it's truly bad or just another false positive.
FWIW, why get the snort stuff one vendor removed? Just go straight to the source.
Re:Go to SANS training. (Score:4, Informative)
I dig Snort, been using it a while. The SANS training made it USEFUL. The course filled in gaps in my knowledge at a rapid rate, and I usually HATE computer training courses precisely because the bandwidth is too low.
Richard Beijtlich wrote "Tao of Network Security Monitoring" which is a really, really good next step.(http://www.bookpool.com/.x/kzaxqc7ob1/sm/03
It covers the use of a variety of different types of intrusion indicators to quickly get to the meat of the matter. He's critical of the SANS course as too bit-addled. I can see what he means - you do spend 2 days (of 6) on tcpdump, vs. just one on Snort per se, but that gives you a great background to use tons of other tools. Once you have that, the other tools are easy.
SANS also has security auditing, incident handling, firewall + VPN, and some PHB type classes.
I'm a fanboy.
Re:Go to SANS training. (Score:3, Informative)
I took the IDIC course a while back (i.e. my analyst number is less than 100) and noticed the same thing. The layout was a bit different then, but I caught myself thinking "why are we spending a day and a half reviewing TCP/IP?" After listening to
One problem in SANS ids methodology (Score:3, Interesting)
S = (C + L) - (HCM + NCM)
Where:
S = severity
C = Criticality (how important the target host is)
L = Lethality of attack
HCM = Host-based countermeasures
NCM = network-based countermeasures
They use different variable names, I think.
Assign a value from 1-5 for C,L,HCM, and NCM
Remember ordinal numbers? You can't multiply them (or do other operations on them) and get a
Re:Go to SANS training. (Score:3, Interesting)
Wild idea. It'll never catch on.
Penetration Tester (Score:3, Insightful)
OSSTMM (Score:2, Informative)
Now with more link-y goodness (Score:2)
The Open Source Security Testing Methodology Manual is here [isecom.org].
VIsa / MC Compliance (Score:5, Informative)
In order to comply you must have various levels of security testing done and certified by an approved vendor [visa.com].
Don't Forget (Score:3, Insightful)
There is security implied simply by the fact that the product is open source. That is to say that its failings and potential security weaknesses have been evaluated by a community beyond the original developers and is always open to scrutiny.
Re:Don't Forget (Score:2)
That being said, security is more *knowable* in open source software. Sendmail vs. Postfix etc. is a good case in point. Someday I am going to get around to patching that local exploit in Qmail... Until then, that security issue can be blocked by not giving anyone local interactive access to the mailserver...
besides the obvious (Score:5, Informative)
one commercial one that I _really_ like is Languard Network Scanner from GFI.
While it is closed source, it has 30-day full functionality, and has limited functionality after that. Still even with the 'limited' functionality, it provides the full scanning capabilities, it just doesn't let you use some of the features that I never use anyways (scheduling, etc).
I'd really recommend giving it a try, its pretty slick.
Anything, as long as... (Score:3, Insightful)
b) see a.
I do not see the need to stick to ideals in a world of security, use the best tool for the job, and stay vigilant (if OS is the best tool, then only merit it on this, not the fact that it is OS)
Re:Anything, as long as... (Score:2)
1. Open source does not mean a product was "developed essentially in public and reviewed by many" but rather that the source is open. Assuming code has been vetted just because it's open source (especially when discussing security) is the height of incompetence.
2. Commercial does not mean a product was "developed behind closed doors and reviewed by none outside the selling company" . That's as bad as the first assumption.
Wow OSS everywhere (Score:2)
Excellent the porn industry is on our side, there is no way we can lose now!
Assumed a thief (Score:5, Interesting)
They provide a remote collection agent that can be monitored with the licensed full version. That was not good enough in our instance due to the layout of our network and needing to install our licensed copy, at the work site, fix the problem and then uninstall the software. After much desk pounding they finally gave in and let us have unlimited installs of the same number. But only after threatening a move to open source.
Our take on the issue is, we need to install the product how we see fit. We payed for it. It doesn't matter to us if we aren't using the software how they "envision" it should be used. We were due a refund if they refused to let us use a product we payed for.
Hardly unique (Score:2)
Quark is a classic for that. The app *scans* *the* *network* for other instances with the same license key. I bought 6 licenses, why the heck can't I deploy with disk images?
In Quark's case, the answer is "you can if you buy a site license and run a license server". Of course, in exchange for the ability to use your software more practically, what do you get? The same prices, and a new requirement to upgrade all licenses to a new version at once. That's right - less flexibility
The advantage of creating your own security (Score:3, Insightful)
Take physical security as a metaphor. You want to secure your physical plant, so you hire a security specialist. You hire his services and he peruses your building. He suggests locks here, cameras there, and a whole plan on making your business less prone to break-ins and the like.
However, what's so great about this? Two things. One, everything is transparent. It's not like joe security officer is selling you a security package and not telling you where he's going to put that $50,000 you just paid for. He has to give you a full plan (the code!) that you approve of. Plus, the plan is customized for you. It's your plan, not someone elses. It's based on your requirements and your specifications. If a security company comes to you and says they'll put a camera in every room and be done with it, is that really enough for you?
Tie that back to open source. The code for open source security solutions are that plan you need. You can provide input on it and change it as much as you want to match your individual needs. And the code will be more unique than a commercial security program, which is the same from site to site.
I can't say that open source is necessarily for everyone. Maybe a camera in every room is all you need. Maybe you just need a security guard out front. The advantages I see here are businesses where security is an important part of business, and where companies don't want control of their own data in the hands of anyone but themselves.
Counter-point instead (Score:4, Insightful)
Basically, most people (including CEOs and the like) think that the more something costs, the better it must be. After all, if Product A costs you $100 and Product B costs you $5, then there must be a lot more features and hard work put into Product A to make it cost more than Product B.
Plus, when people hear 'open source', they think of crackers/evil people getting their hands on the source code and exploiting all sorts of 'holes'. Since they can find out how it works, it must be really easy for them to exploit it.
I wouldn't be surprised if many people, on first look, would rather pay $10 for a Linux distro rather than get it for free because 'free' has all sorts of bad connotations locked in with it this day and age. They assume it's the difference between going to a 12-year old's lemonade stand and going to starbucks for a smoothie. "You get what you pay for."
Re:Counter-point instead (Score:2)
Deploying Software (Score:5, Interesting)
1. Personnel changeover. DoD loves to move people around between departments and installations. It's hard to find people savvy enough to run open-source software and keep them in one spot. It's much easier to give whoever is holding the position a phone number and tell them to call tech support with problems.
2. Personnel skills. DoD is huge. Because of this, the chances of getting skilled and motivated people at all of your sites is slim. Again, the phone call seems to make everything better.
3. Contracts. Things are usually purchased in bundles and as part of a big plan. It's much easier to brief to a non-tech boss that you have the support of another company and not that "I'm sure we can figure it out."
4. Uncle Sam's pockets are deep.
I agree that open source software is often better. But it doesn't give the non-tech group that warm fuzzy it needs to. In the end, the boss doesn't want to up a creek without a paddle. Having that phone number to call adds a much wanted security blanket, even if it's only a facade.
Re:Deploying Software (Score:5, Insightful)
Linuxcare and the like flamed out for poor core business practices and poor market targeting (do not ever, I repeat do not EVER, try to make money directly supporting end users). MySQL AB, Best Practical, Trolltech, &c seem to be doing pretty well though....
Re:Deploying Software (Score:2, Insightful)
Thank you very much for wasting my tax dollars, cretin! Seriously, I think this attitude that the "government has lots of money!" is going to be the downfall of the US... here's a subtle reminder: all the money is taken from hardworking citizens, at gunpoint if need be. Or borrowed against future taking from citizens...
Read your contract with your vendor. Fact is, most commercial software contracts don't protect against anything more than refunding the purchase price, even i
Re:Deploying Software (Score:2)
Nobody's slamming you for the year you spent in Iraq. (I'll slam Bush for the year you spent in Iraq, but I'm not going to slam the low schmoes who have to deal with the dust and the bombs -- unless they personally do something really damaging and/or stupid. .. but that's a different discussion).
What this points to is not that OS isn't appropriate to the DOD, but rather that the DOD hasn't
Re:Deploying Software (Score:2)
Re:Deploying Software (Score:3, Interesting)
Having that phone number to call adds a much wanted security blanket, even if it's only a facade.
My first though on reading this was, "well their must be dozens of security firms that will offer support for such popular tools." I mean surely IBM if no on else will be happy to take your money and answer calls about nmap or snort or ethereal? So I did what anyone would do, and googled a bit. I could not find anyone in 2 minutes of searching. Perhaps my google-fu is weak. Is this really an untapped mark
Re:Deploying Software (Score:2)
how can you be sure of quality of closed source ? (Score:3, Insightful)
Re:how can you be sure of quality of closed source (Score:2)
Right Question? (Score:3, Interesting)
"I'd like to ask for Slashdot's experiences and opinions on why you don't need to spend thousands of dollars on an expensive tool to perform a professional security assessment."
It sounds like you're already set in your opinion and just asking for justifications. That doesn't usually develop any new insights or make good comparisons. If you really want to sell people on Open Source, do a fair and un-biased comparison. An obviously biased comparison is easily detectable and loses credibility. I really don't think Open Source needs biased comparisons to look good.
Re:Right Question? (Score:2)
Asking for comments on what's out there that's better than Open Source is one way to broaden your horizon. (and what better place to ask than SlashDot, where you'll probably get comments from people who work for, and/or use, much of the proprietary competition).
Docmentation (Score:4, Funny)
Re:Docmentation (Score:3, Funny)
I'm thinking of writing a how-to for "penetration testers". It'll be titled "Locating Unprotected Backdoor Entrances" or more aptly, "Lube"
Don't forget a section on avoiding Trojans. Although they sometimes help with L.U.B.E., they can often get in the way of a successful test.
Why pay? Features and UI (Score:2)
Depends on the business (Score:2)
Likewise on the other end of the same thing, while I think I could configure iptables/snort etc. to be equally if not more secure than commercial packages -
Don't forget SING.... (Score:2)
Sure, obviously nmap, tcpdump, and snort, (plus ethereal and etherape if you like pretty pictures). Another I don't see mentioned here is SING [sourceforge.net] (which stands for "send ICMP nasty garbage").
It's a command line tool (sort of like netcat) for fabricating ICMP packets.
Talk to Dug Song or the phenoelit guys about m-i-t-m attacks, and ARP or ICMP level hacking, and you might find some uses for SING.
Different markets (Score:3, Insightful)
Also, a number of commercial products are not written with just the user in mind - the larger ones also involve things like generating pretty reports for use in the CTO's bonus negotiations and suchlike.
Finally, lots of the commercial products try to be competitive by doing everything at once, whereas the OSS tools tend to be more focused on specific functionality, following the traditional unix approach.
Of course, all these points are generalisations and there are exceptions to them all, but that's what you get for asking such a general question.
"I work as a penetration tester..." (Score:3, Funny)
There is commercial free/open source software (Score:4, Informative)
What if some of the developers of those F/OSS packages are paid money to code free software? MySQL comes to mind when I think commercial free software, although it isn't related to the software you search. There has been always money to be made in free software business. Your question should be about free vs. non-free.
Quoting RMS:``Free software'' does not mean ``non-commercial''. A free program must be available for commercial use, commercial development, and commercial distribution. Commercial development of free software is no longer unusual; such free commercial software is very important.
Ettercap? (Score:2)
Check the license first (Score:4, Insightful)
And that is a bigger problem for our lawyers then the efficacy of the tool itself.
Otherwise, why must it be an either/or decision? Why can't you have a mix of open and commercial and achieve a balance of cost and effectiveness?
Also consider the total lifecycle costs. A $30,000 appliance out of the box may be cheaper than an open source tool running on an 'extra' server you have laying around plus 250 hours/year of your time fucking with it. Sometime the best security is the security that makes the most rational sense for you to afford.
If you're a real professional... (Score:2)
Incorrect link (Score:2)
For wireless security... (Score:2)
The one place I do not agree is with wireless security monitoring. I have not seen any open source offering, or combination of offerings, that can hold a candle to Airmagnet [airmagnet.com]. I test various open source offerings as I hear about them, and to date have seen nothing with the power and flexibility Airmagnet provides. It was worth every penny we paid for it.
Interesting Business Card (Score:3, Funny)
Bad link (Score:3, Interesting)
Re:Bad link (Score:2, Interesting)
There is one commercial tool (Score:2)
Because that's what the bad guys use (Score:2)
It seems much more likely that the black-hat types are either going to use freely available tools, or will write their own custom jobs before they will submit to using some fancy point-and-click GUI that attempts to hide complexity from them (even if their employer provides it). It's dangerous to assume that no one will attack you with commercial t
Nessus new (weird) plugin licensing terms (Score:3, Informative)
I just received e-mail from Fyodor and had this bad bad news [nessus.org].
Nobody mentioned that here.
(and probably nobody will read that since I'm stuck at 0
Nessus is not quite free anymore (Score:4, Informative)
Check it out for yourselves, there are three feeds now. The main feed which used to be free is now on a seven day delay. While this doesn't affect a lot of the scanning efforts it is nice to know about the vulnerability that just came out.
Often when a new serious vulnerabilty makes news a company would like to know how they are affected right away. Now they will have to wait 7 days!
I don't think that there is anything wrong with this, I mean the developers at nessus (tenable lightning) have to eat too. But calling it free just seems sort of inaccurate now. Scanners without updated signatures work about as well as razors without the blades.
A 'Direct Feed' is commercially available which entitles subscribers to the latest vulnerability checks. Customers who purchase a Lightning Console or NeWT Pro scanner receive access to this feed with their annual product maintenance.
A 'Registered Feed' is available for free to the general public, but new plugins are added seven days after they are added to the 'Direct Feed'. To obtain access to the 'Registered Feed', users are required to enter contact information for tracking and also agree to Tenable's license agreement for the plugins.
The 'GPL Feed' does not require registration, and includes plugins written by the user community. As manager of the Nessus project, Tenable continues to accept plugins written from the Nessus and NeWT user communities. Plugins accepted with a copyright under the GNU Public License will be distributed to the Direct, Registered and Public feeds at the same time.
Pricing
The access to the GPL feed and to the Registered Feed is free. Pricing for the 'Direct Feed' is based upon the number of Nessus or complimentary copies of NeWT in use within your organization, consultancy or service. The cost is $1200 per scanner per year. For more information, please contact Tenable's sales staff.
vuln scanners (Score:4, Interesting)
Now one can also take the Open Source approach here and write their OWN signatures but many companies just don't have the staff for that type of thing. The vulnerabilty details are so sparse these days (not so open disclosure rules) that recreating the actual exploit never mind finding a way to detect it remotely is beyond the skill of most teams in the limited timeframe that it's of vital importance. A team will have around 24-48 hours after a patch is released until some evil doer[s] have reverse engineered the patch and created an exploit out of it, slipped in a pre packaged payload and owned 3 out of your 7 class B segments. Sometimes less. I think the ISS worm last year was the record, something like > 20 hours from patch to worm [witty worm i think].
Some intersting article [zdnet.com] on scanning here [64.233.161.104] and here [nwc.com]
Just one other side note about the articles, Foundstone was purchased by McAfee last year so disregard those.
Re:Huh? (Score:5, Funny)
Re:Penetration Tester? (Score:2)
And that's the sound of another thousand after wondering just what that phrase referred to.