Secure VPN Gateway a new solution to InterNet Security

Secure VPN Gateway a new solution to InterNet Security
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Computer Software Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Secure VPN Gateway a new solution to InterNet Security David Gempton 06-01-2006
Posted by all mail refused on June 6, 2006, 2:20 am
If you were  Registered and logged in, you could reply and use other advanced thread options

> 2) Using some sort of spy ware (and not one you've written just for this
product) can you
> automatically capture the ssh2 rsa file, username & password. Then use these
to access any
> network services on the VPN gateway ?

Why the artificial restriction "not one you've written just for this product"?
Do you think attackers don't write attacks against specific products?

--
Elvis Notargiacomo master AT barefaced DOT cheek
http://www.notatla.org.uk/goen/
One of my other 11 computers runs Minix.

Posted by David Gempton on June 6, 2006, 5:48 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
all mail refused wrote:
>
>
>>2) Using some sort of spy ware (and not one you've written just for this
product) can you
>>automatically capture the ssh2 rsa file, username & password. Then use these
to access any
>>network services on the VPN gateway ?
>
>
> Why the artificial restriction "not one you've written just for this product"?
> Do you think attackers don't write attacks against specific products?
>
Thats a fair point.

I guess I was thinking along the lines of public Internet places (like Internet
cafes)
where the spyware that may be installed is going to be more general. Like
key-logging
software.

Im sure that given a little information about how my software handles security
it would
not be difficult to write a very targeted application that could obtain a copy
of the
security details.

This is an area that I am currently working on improving. My aim is to come up
with a
connection model that mutates every time its used. So even if you get a copy of
the
security details they will be of no use if you try and use them again.

- David Gempton.

Posted by Nico Kadel-Garcia on June 6, 2006, 7:55 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> all mail refused wrote:
>>
>>
>>>2) Using some sort of spy ware (and not one you've written just for this
>>>product) can you automatically capture the ssh2 rsa file, username &
>>>password. Then use these to access any network services on the VPN
>>>gateway ?
>>
>>
>> Why the artificial restriction "not one you've written just for this
>> product"?
>> Do you think attackers don't write attacks against specific products?
>>
> Thats a fair point.
>
> I guess I was thinking along the lines of public Internet places (like
> Internet cafes) where the spyware that may be installed is going to be
> more general. Like key-logging software.
>
> Im sure that given a little information about how my software handles
> security it would not be difficult to write a very targeted application
> that could obtain a copy of the security details.
>
> This is an area that I am currently working on improving. My aim is to
> come up with a connection model that mutates every time its used. So even
> if you get a copy of the security details they will be of no use if you
> try and use them again.

Ahh. Security through obscrutityy, *AND* violation of the GPL of the
SmoothWall Express software you're pirating. (And you're blatantly in
violation of the GPL on their software, by your own admission of using it
and your failure to publish your source code along with your downloads.)

And this guy wonders why no one will take it seriously as the "ABSOLUTELY
SECURE VPN" he advertises it as. Sheesh!



Posted by Nico Kadel-Garcia on June 2, 2006, 7:25 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> Walter Roberson wrote:
>
>> - In other words, posting a private letter to Usenet "probably" IS
>> a copyright violation
>
> Damn, no. The reason is a quite simple one: You cannot expect the sender
> to be unwilling to allow publishment unless he explicitly stated so. By
> posting a letter to someone you're actively putting it into public domain.
>
> The reason why it's illegal under _zivil_ rights is that's an
> unreasonable violation of privacy to publish someone else's private
> information without even asking him first.

Off-topic, and I Am Not A Lawyer, but a followup. The questions of email and
Usenet copyright are quite old, and pretty well described at this antique
FAQ:

http://www.faqs.org/faqs/law/copyright/faq/part3/

In particular, this note makes sense to me:

3.8) Are Usenet postings and email messages copyrighted?

Almost certainly. They meet the requirement of being original works of
authorship fixed in a tangible medium of expression (see section 2.3).
They haven't been put in the public domain; generally, only an
expiration
of copyright or an unambiguous declaration by an author is sufficient to
place a work into public domain.

There is then considerably more detail about what constitutes a violation of
the existing copyright. My nose is completely clean due to the "fair use"
doctrine, for reasons better described there. Admittedly, this probably is
not New Zealand law, but I'm sticking with my own country's laws for
safety's sake.



Posted by Darren Tucker on June 3, 2006, 12:32 am
If you were  Registered and logged in, you could reply and use other advanced thread options
> I just double-checked the license of OpenSSH, which states:
>
> * All rights reserved
> *
> * As far as I am concerned, the code I have written for this software
> * can be used freely for any purpose. Any derived versions of this
> * software must be clearly marked as such, and if the derived work is
> * incompatible with the protocol description in the RFC file, it must be
> * called by a name other than "ssh" or "Secure Shell".

Actually that's just the license for a subset of the files. The copyright
is held by a number of people (including, for recent Portable versions, me)
and while each file has its own license, a summary is available in the
file "LICENCE". It says, in part:

"The licences which components of this software fall under are as
follows. First, we will summarize and say that all components
are under a BSD licence, or a licence more free than that.

OpenSSH contains no GPL code."

[...]
> So I submit among its other weirdness, it's a violation of the very generous
> OpenSSH license, since the software is closed source and makes no such

Their use of OpenSSH is probably OK (I say "probably" because I'm not a
lawyer and am not the copyright holder of most of it).

A more interesting question is: what about the other components that
they use? They appear to be using at least the Linux kernel which most
definitely *is* GPLed (and most Linux-based systems use many other GPLed
components in addition to just the kernel).

I downloaded the zip file and it contains only vmware images and no source
code. Can someone who has run it confirm whether or not the source for
the GPL'ed (and LGPL'ed) parts is available?

(Followup-To: set)

--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

Similar ThreadsPosted
Secure VPN Gateway using multipart authorization January 2, 2007, 7:06 pm
Security cable lock solution for SFF August 15, 2006, 4:36 pm
Re: Internet Security Software.(computer internet security) April 27, 2008, 7:43 am
Implenting a wireless (utilizing IPSec) gateway on FreeBSD September 13, 2005, 8:33 pm
Internet & Network Security October 16, 2005, 2:55 pm
Norton Internet Security February 19, 2006, 2:04 pm
using wireless internet without security December 8, 2006, 4:02 am
Clean XP Pro = the solution for a faster systeem! read here September 5, 2005, 12:25 pm
Home Depot - social security numbers - secure? I think not. November 21, 2007, 7:04 pm
New reporting solution for Active Directory and Network Infrastructure July 30, 2008, 8:41 am

The site map in XML format XML site map

Contact Us | Privacy Policy