IDS mailing list archives

Previous By Date Next
Previous By Thread Next

RE: SSL and IPS (was RE: ssh and ids)

From: <Peter_Schawacker () NAI com>
Date: Thu, 1 Jul 2004 22:07:12 -0700
Mike,

Concerning your challenge, here's the decrypted URL:

        https://www.cryptolinux.org/kudzu

The page is no longer there, but it looks like it contained the page
source for the CryptoLinux homepage and an article about kudzu.  The
beginning of the page's source is below. If you have any further
questions or comments on this, let's take it off list.

   0x0000: 3c 48 54 4d 4c 3e 3c 48  [<HTML><H]
   0x0008: 45 41 44 3e 0a 3c 54 49  [EAD>.<TI]
   0x0010: 54 4c 45 3e 43 79 72 70  [TLE>Cyrp]
   0x0018: 74 6f 4c 69 6e 75 78 20  [toLinux ]
   0x0020: 2d 20 4c 69 6e 75 78 43  [- LinuxC]
   0x0028: 72 79 74 6f 20 2d 20 43  [ryto - C]
   0x0030: 72 79 70 74 6f 67 72 61  [ryptogra]
   0x0038: 70 68 79 20 6f 6e 20 4c  [phy on L]
   0x0040: 69 6e 75 78 3c 2f 54 49  [inux</TI]
   0x0048: 54 4c 45 3e 0a 3c 4d 45  [TLE>.<ME]
   0x0050: 54 41 20 6e 61 6d 65 3d  [TA name=]
   0x0058: 22 64 65 73 63 72 69 70  ["descrip]
   0x0060: 74 69 6f 6e 22 20 63 6f  [tion" co]
   0x0068: 6e 74 65 6e 74 3d 22 57  [ntent="W]
   0x0070: 65 6c 63 6f 6d 65 20 74  [elcome t]
   0x0078: 6f 20 43 72 79 70 74 6f  [o Crypto]
   0x0080: 4c 69 6e 75 78 2e 20 20  [Linux.  ]
   0x0088: 54 68 69 73 20 69 73 20  [This is ]
   0x0090: 61 20 72 65 73 6f 75 72  [a resour]
   0x0098: 63 65 0a 73 69 74 65 20  [ce.site ]
   0x00a0: 66 6f 72 20 61 6c 6c 20  [for all ]
   0x00a8: 74 68 69 6e 67 20 63 72  [thing cr]
   0x00b0: 79 70 74 6f 67 72 61 70  [yptograp]
   0x00b8: 68 69 63 20 6f 6e 20 4c  [hic on L]
   0x00c0: 69 6e 75 78 2e 22 3e 0a  [inux.">.]
   0x00c8: 3c 4d 45 54 41 20 6e 61  [<META na]
   0x00d0: 6d 65 3d 22 6b 65 79 77  [me="keyw]
   0x00d8: 6f 72 64 73 22 20 63 6f  [ords" co]
   0x00e0: 6e 74 65 6e 74 3d 22 4c  [ntent="L]
   0x00e8: 69 6e 75 78 2c 20 43 72  [inux, Cr]
   0x00f0: 79 70 74 6f 67 72 61 70  [yptograp]
   0x00f8: 68 79 2c 20 43 72 79 70  [hy, Cryp]
   0x0100: 74 6f 67 72 61 70 68 69  [tographi]
   0x0108: 63 2c 20 4c 69 6e 75 78  [c, Linux]
   0x0110: 20 4f 53 2c 0a 4c 69 6e  [ OS,.Lin]
   0x0118: 75 78 20 6f 70 65 72 61  [ux opera]
   0x0120: 74 69 6f 6e 20 73 79 73  [tion sys]
   0x0128: 74 65 6d 22 3e 0a 3c 2f  [tem">.</]
   0x0130: 48 45 41 44 3e 0a 3c 42  [HEAD>.<B]
   0x0138: 4f 44 59 20 42 41 43 4b  [ODY BACK]
   0x0140: 47 52 4f 55 4e 44 3d 2f  [GROUND=/]
   0x0148: 62 61 63 6b 67 72 6f 75  [backgrou]
   0x0150: 6e 64 73 2f 70 61 70 65  [nds/pape]
   0x0158: 72 2f 62 6c 75 65 5f 70  [r/blue_p]
   0x0160: 61 70 65 72 2e 67 69 66  [aper.gif]
   0x0168: 20 42 47 43 4f 4c 4f 52  [ BGCOLOR]
   0x0170: 3d 22 23 46 46 46 46 46  [="#FFFFF]
   0x0178: 46 22 20 54 45 58 54 3d  [F" TEXT=]
   0x0180: 22 23 30 30 30 30 30 30  ["#000000]
   0x0188: 22 20 4c 49 4e 4b 3d 22  [" LINK="]
   0x0190: 23 30 30 30 30 46 46 22  [#0000FF"]
   0x0198: 20 41 4c 49 4e 4b 3d 22  [ ALINK="]
   0x01a0: 23 46 46 30 30 30 30 22  [#FF0000"]
   0x01a8: 20 56 4c 49 4e 4b 3d 22  [ VLINK="]
   0x01b0: 23 35 35 31 41 38 42 22  [#551A8B"]
   0x01b8: 3e 0a 3c 69 6d 67 20 73  [>.<img s]
   0x01c0: 72 63 3d 22 2f 63 72 79  [rc="/cry]
   0x01c8: 70 74 6f 5f 74 75 78 5f  [pto_tux_]
   0x01d0: 6c 2e 67 69 66 22 20 61  [l.gif" a]
   0x01d8: 6c 69 67 6e 3d 6c 65 66  [lign=lef]
   0x01e0: 74 3e 0a 3c 69 6d 67 20  [t>.<img ]
   0x01e8: 73 72 63 3d 22 2f 63 72  [src="/cr]
   0x01f0: 79 70 74 6f 5f 74 75 78  [ypto_tux]
   0x01f8: 5f 72 2e 67 69 66 22 20  [_r.gif" ]
   0x0200: 61 6c 69 67 6e 3d 72 69  [align=ri]
   0x0208: 67 68 74 3e 0a 3c 43 65  [ght>.<Ce]
   0x0210: 6e 74 65 72 3e 0a 3c 48  [nter>.<H]
   0x0218: 31 3e 43 72 79 70 74 6f  [1>Crypto]
   0x0220: 4c 69 6e 75 78 20 2d 20  [Linux - ]
   0x0228: 4c 69 6e 75 78 43 72 79  [LinuxCry]
   0x0230: 70 74 6f 3c 2f 48 31 3e  [pto</H1>]
   0x0238: 0a 3c 48 32 3e 41 6c 6c  [.<H2>All]
   0x0240: 20 54 68 69 6e 67 73 20  [ Things ]
   0x0248: 43 72 79 70 74 6f 67 72  [Cryptogr]
   0x0250: 61 70 68 69 63 20 6f 6e  [aphic on]
   0x0258: 20 4c 69 6e 75 78 3c 2f  [ Linux</]
   0x0260: 48 32 3e 0a 3c 48 52 3e  [H2>.<HR>]
   0x0268: 0a 50 6c 65 61 73 65 20  [.Please ]
   0x0270: 65 78 63 75 73 65 20 6f  [excuse o]
   0x0278: 75 72 20 64 75 73 74 2e  [ur dust.]
   0x0280: 2e 2e 20 20 54 68 69 73  [..  This]
   0x0288: 20 73 69 74 65 20 68 61  [ site ha]
   0x0290: 73 20 6a 75 73 74 20 6f  [s just o]
   0x0298: 70 65 6e 65 64 20 61 6e  [pened an]
   0x02a0: 64 20 74 68 65 20 70 61  [d the pa]
   0x02a8: 67 65 73 20 61 72 65 0a  [ges are.]
   0x02b0: 73 74 69 6c 6c 20 75 6e  [still un]
   0x02b8: 64 65 72 20 6d 61 6a 6f  [der majo]
   0x02c0: 72 20 63 6f 6e 73 74 72  [r constr]
   0x02c8: 75 63 74 69 6f 6e 2e 3c  [uction.<]
   0x02d0: 42 52 20 43 4c 45 41 52  [BR CLEAR]
   0x02d8: 3d 41 4c 4c 3e 0a 3c 48  [=ALL>.<H]
   0x02e0: 52 3e 0a 3c 2f 43 65 6e  [R>.</Cen]
   0x02e8: 74 65 72 3e 0a 3c 50 52  [ter>.<PR]
   0x02f0: 45 3e 0a 3d 3d 3d 3d 3d  [E>.=====]
   0x02f8: 3d 3d 3d 3d 3d 3d 3d 3d  [========]
   0x0300: 3d 3d 3d 3d 3d 3d 3d 3d  [========]
   0x0308: 3d 3d 3d 3d 3d 3d 3d 3d  [========]
   0x0310: 3d 3d 3d 3d 3d 3d 3d 3d  [========]
   0x0318: 3d 3d 3d 3d 3d 3d 3d 3d  [========]
   0x0320: 3d 3d 3d 3d 3d 3d 3d 3d  [========]
   0x0328: 3d 3d 3d 3d 3d 3d 3d 3d  [========]
   0x0330: 3d 3d 3d 3d 0a 0a 20 20  [====..  ]
   0x0338: 20 20 20 20 20 20 50 68  [      Ph]
   0x0340: 6f 74 6f 63 6f 70 69 65  [otocopie]
   0x0348: 73 20 6f 66 20 74 68 69  [s of thi]
   0x0350: 73 20 68 61 76 65 20 62  [s have b]
   0x0358: 65 65 6e 20 20 6b 69 63  [een  kic]
   0x0360: 6b 69 6e 67 20 61 72 6f  [king aro]
   0x0368: 75 6e 64 20 6f 75 72 20  [und our ]
   0x0370: 20 6f 66 66 69 63 65 0a  [ office.]
   0x0378: 66 6f 72 20 20 61 67 65  [for  age]
   0x0380: 73 2e 20 20 20 49 74 20  [s.   It ]
   0x0388: 20 68 61 73 20 6e 6f 20  [ has no ]
   0x0390: 61 75 74 68 6f 72 27 73  [author's]
   0x0398: 20 6e 61 6d 65 20 61 74  [ name at]
   0x03a0: 74 61 63 68 65 64 20 6f  [tached o]
   0x03a8: 72 20 61 6e 79 20 70 75  [r any pu]
   0x03b0: 62 6c 69 63 61 74 69 6f  [blicatio]
   0x03b8: 6e 0a 69 6e 66 6f 72 6d  [n.inform]
   0x03c0: 61 74 69 6f 6e 20 73 6f  [ation so]
   0x03c8: 20 49 20 68 61 76 65 20  [ I have ]
   0x03d0: 6e 6f 20 69 64 65 61 20  [no idea ]
   0x03d8: 20 77 68 65 72 65 20 20  [ where  ]
   0x03e0: 69 74 20 20 6f 72 69 67  [it  orig]
   0x03e8: 69 6e 61 6c 6c 79 20 20  [inally  ]
   0x03f0: 63 61 6d 65 20 20 66 72  [came  fr]
   0x03f8: 6f 6d 2e 0a 54 68 69 73  [om..This]
   0x0400: 20 6d 61 79 20 62 65 20  [ may be ]
   0x0408: 61 20 6c 69 74 74 6c 65  [a little]
   0x0410: 20 6f 75 74 20 6f 66 20  [ out of ]
   0x0418: 73 65 61 73 6f 6e 20 62  [season b]
   0x0420: 75 74 20 66 72 6f 6d 20  [ut from ]
   0x0428: 77 68 61 74 20 49 20 67  [what I g]
   0x0430: 75 65 73 73 2c 20 79 6f  [uess, yo]
   0x0438: 75 20 63 61 6e 0a 70 6c  [u can.pl]
   0x0440: 61 6e 74 20 6b 75 7a 75  [ant kuzu]
   0x0448: 20 61 6e 79 20 74 69 6d  [ any tim]
   0x0450: 65 20 6f 66 20 74 68 65  [e of the]
   0x0458: 20 79 65 61 72 20 61 6e  [ year an]
   0x0460: 64 20 65 6e 6a 6f 79 20  [d enjoy ]
   0x0468: 69 74 20 66 6f 72 20 20  [it for  ]
   0x0470: 67 65 6e 65 72 61 74     [generat ]

Peter Schawacker, CISSP
Technical Evangelist
McAfee
Office 760 200 4258
Mobile 760 880 4258
ps () nai com

-----Original Message-----
From: Michael H. Warfield [mailto:mhw () wittsend com] 
Sent: Wednesday, June 30, 2004 4:29 PM
To: Schawacker, Peter
Cc: shoten () starpower net; focus-ids () securityfocus com;
security () brvenik com; mhw () wittsend com
Subject: Re: SSL and IPS (was RE: ssh and ids)


On Wed, Jun 30, 2004 at 01:39:38PM -0700, Peter_Schawacker () NAI com
wrote:

Rob,


        :


I think we've taken this topic as far as we can on this list.  There 
is no question that the technology works -- we've had it in beta in 
real world networks. The most important question is, "How will the 
market value this technology?"  Only real-world implementations and 
time will tell.  Let's just let the market decide the value of IPS 
decryption, shall we?


        You're right...  Let's test it.

        I've put up the challenge.  I'll set up a secure web server
on a separate IP address and secure with a cert.  I'll provide you with
the private key, with no password, and the certificate, and a tcpdump of
all the traffic to and from that IP address.  You just provide back all
the clear text.  That should be simple.  Yes? If you can do that, given
the private key of the server, then you have proven your point.  And
THAT'S real world.  I can have it done tonight.


Thanks, Mike (ISS), Marty (Sourcefire) and Jason (Sourcefire) for your



questions and comments.  Let's have this chat again six months from 
now.
;-)



Over and out.



Peter Schawacker, CISSP
Technical Evangelist
McAfee
Office 760 200 4258
Mobile 760 880 4258
ps () nai com


        Mike
-- 
 Michael H. Warfield    |  (770) 985-6132   |  mhw () WittsEnd com
  /\/\|=mhw=|\/\/       |  (678) 463-0932   |
http://www.wittsend.com/mhw/
  NIC whois:  MHW9      |  An optimist believes we live in the best of
all
 PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!

---------------------------------------------------------------------------

---------------------------------------------------------------------------
Previous By Date Next
Previous By Thread Next

Current thread: