SOURCE Boston Advanced Linux Firewalls Talk Slides
17 March, 2008
At the SOURCE Boston conference in Boston
last week I gave talk entitled "Advanced Linux Firewalls"
(slides). The conference
attendance was good considering that this is the first year the conference was
offered, and I look forward to next year.
I managed to see a few talks, and two that stood out from the crowd were
Roger Dingledine's talk "How To Make
Tor Play Well With The Rest Of The Internet",
and Andrew Jaquith's talk
"Not Dead But Twitching: Anti-Virus Succumbs to the
Scourge of Modern Malware". Roger highlighted several technology research
and development areas for the Tor project,
including the ability to use UDP instead of TCP for Tor virtual circuits.
This is of particular interest to me, since it would mean that
SPA packets could be routed over the Tor network without having to resort to
the establishment of full TCP connections (which breaks the "single packet" part
of "SPA"). Andrew gave some interesting perspectives on malware trends, including
the fact that malware over time is becoming more targeted while at the same time
exhibiting high variability. The end result is that malware authors are able to
attack the weakest link in the creation of signatures for malware detection - the
people that reverse engineer malware. Because human resources are scarce and slow
when it comes to reverse engineering (there is no fully automated mechanism for
this yet), malware authors are able to essentially perpetrate a DoS against
vendors that offer malware detection.
