Testing firewall rules

In my experience I've found many customers considering the act of writing firewall rules a trivial task.
Approaching this critical phase in the wrong way leads to 2 problems:

• risk of intrusion


• possible performances degradation

Let's just talk abou the first problem for this time: both issues should depend on your firewall technology but it's a common agreement to say that quite every enteprise firewall today has a top-down rulebase processing engine. What this means?

In this kind of processing engine packets are compared against the rulebase starting from the highest rule down to the lowest.
The matching procedure will stop as soon as it finds a rule describing the analyzed packet.

This behavior implies that a wrong placement of rules in your rulebase put in serious risk your network security, since, between 2 rules for the same kind of packet, you could place a less-restrictive rule on top of a most-restrictive.
Not all firewall products have a verification engine (like Check Point VPN-1) able to discover this kind of errors and prohibit to go on until you solve them.
In many cases you can simply install your rulebase without recognizing you just left a huge whole on your firewall.

You should doublecheck your rulebase trying all available ports to pass through the firewall. But you cannot simply grab a portscanner and start scanning the whole IANA ports range from outside, targeting an internal machine: it surely has not all ports opened and anyway you need an handful reporting system to speed up the whole process.

To help in this assessment we have 2 new free tools this month:

• InversePath FTester
  The tool consists of two perl scripts, a packet injector (ftest) and the listening sniffer (ftestd). The first script injects custom packets, defined in ftest.conf, with a signature in the data part while the sniffer listens for such marked packets. The scripts both write a log file which is in the same form for both scripts. A diff of the two produced files (ftest.log and ftestd.log) shows the packets that were unable to reach the sniffer due to filtering rules if these two scripts are ran on hosts placed on two different sides of a firewall. Stateful inspection firewalls are handled with the 'connection spoofing' option. A script called freport is also available for automatically parse the log files.



• StationX Firewall Test Agent
  This simple tool can be used to test and log the rules on a firewall. The Firewall Test Agent is able to open up any number of TCP and UDP ports on a windows machine and log any connection attempts. A port scanner or other such tool can then be used to scan through the firewall to find which ports have been allowed through in the firewall rule base. This tool is useful when you don't have access to the firewall rules.

As you can notice the first one, FTester, is much more complex to use, but is also much more flexible and can be used for intrusion detection systems (IDS) testing too.

Karspersky on the contemporary antivirus industry and its problems

Eugene Karspesky wrote a exhaustive insight of modern AV industry on November 2005.
I would consider it a must-read for every computer user, complaining about a product slowness or promoting another one just because it's free.

This article makes even more sense if you already read the massive antivirus products comparison I posted few days ago.

Computer security awareness videos

The EDUCAUSE/Internet2 Computer and Network Security Task Force and the National Cyber Security Alliance opened a contest for college students, called to create best computer security awareness videos.

Winners are now disclosed and you can see their videos here:

Broad Topic Category

1. Superhighway Safety - Savannah College of Art and Design


2. Wasteland - College of William and Mary and University of Virginia


3. The McCumber Cube - Idaho State University
   (I'm still laughing on this one)

Single Topic Category

1. Bob, You’ve Been Phished - Cal Poly Pomona


2. Computing in a Community Environment, Part IV: Back Yo Data Up! - Wake Forest University


3. Act Now, Stay Current - James Madison University
   (I've found this one very effective)

Gartner Magic Quadrant for intrusion prevention systems (IPS)

SourceFire, the company founded by the Snort creator Martin Roesch, is now distributing for free a Gartner research of November 2005, mapping today's market IPS in the famous Magic Quadrant.

It includes:

• 3Com/TippingPoint


• Check Point/Source Fire


• Cisco


• DeepNines


• ISS


• Juniper/NetScreen


• McAfee


• NFR


• NitroSecurity


• Radware


• Reflex


• StillSecure


• Symantec


• Top Layer Networks


• V-Secure Technologies

It's interesting but I have to disagree on Check Point placement: it's senseless reporting both SourceFire and Check Point on the quadrant for a couple of good reasons:

• Check Point Application Intelligence technology, embedded in InterSpect, isn't enough to call that device an IPS


• Check Point acquired SourceFire in October 2005 so, even if the acquisition isn't concluded, they aren't 2 different companies anymore

Please note that StillSecure, listed among Niche Players, is offering since few days a free version of its product, based on Snort, I already covered here.

Introduction to Microsoft InfoCard identity management and authentication system

A modern quest in IT Security is evolving from the authentication system based on password.
Passwords are insecure when used alone, prone to so called identity thefts, and are complex to manage in a world where you interact with tens of authenticated services from different vendors every day.

Microsoft approached the problem serveral years ago, trying to enforce existing authentication systems and to simplify it calling for Single Sign-On (SSO) with a technology called Passport.
Passport has been everything but a success, and Microsoft today admits it failed in the project, assuming users and service providers would trust a system which relies on proprietary database system (Passport accounts and login associations are stored in Microsoft servers).
Passport is today widespread but just because it's mandatory for MSN services, included Messenger chat service.

Today Microsoft tries again with a new identity management and authentication platform: InfoCard.

The technology mimics our real life system of authentication badges: driving license, credit card, frequent flyer membership, gym membership, etc.
InfoCards are digital representations (in XML language) of that authentication badges. Plain and simple.

In an InfoCard architecture there are Identity Providers (authentication providers issuing you an InfoCard, like banks, libraries, etc.), Relying Party (service providers or authorities asking for you InfoCard before according you a service) and obviously the user.
In other words your computer becomes an electronic wallet, holding several InfoCards issued by several Identity Providers:

(image from Indentity Weblog)

When a user ask for a service offered by a Relying Party (let's imagine accessing the authenticated part of Amazon), this one sends back a security policy, detailing what kind of authentication informations are expected to grant access.
At this point an engine on the user platform (which is embedded in the operating system, not to be downloaded from somewhere), the Identity Selector, chooses among all available InfoCards, selecting ones satisfying security policy requirements. User has the final word on which InfoCard, among selected ones, to present.
This point is identical to real life: to mitigate frauds some shops require you to provide credit card and national ID card or driving license, so the shop (Relying Party) is sending us a requirement (security policy) and we need to choose (Identity Selector) which document (InfoCard) to show.

What's next? When the user chosen what InfoCard to present another local system called Service Requestor contact Identity Provider, asking for a security token to offer to Relying Party.
The user must authenticate himself against the Identity Provider with standard username/password, a Kerberos ticket, a X.509 digital certificate (installed on OS or inside a smartcard), or a self-issued ticket (if the Identity Provider accepts it).
The Identity Provider answers back with the requested security token, which is presented to Relying Party. This one will finally provide access to its service.
In real life world things happen in the same way: a shopper (Relying Party) checks our indentity waiting a positive answer from our credit card institute (Identity Provider), which grants for us.

Now why this system should be less risky than the password based one? Isn't possible to steal InfoCards and obtain valid security tokens for Relying Party services access?
First of all: InfoCards are empty (well, a sort of). They don't contain any real user information, but the link to Identity Provider security token service (STS). To receive a working security token for Relying Party user needs to authenticate against Identity Provider. So if you even steal the password for authenticating against an Identity Provider, you still need the whole computer storing InfoCards.
Second: InfoCard system is isolated from userland desktop environment where viruses and trojans can hide. Reaching the Service Requestor and Identity Selector system for read, copy or hijack InfoCards is highly complex.

Users also receive protection from phishing in the InfoCard environment: when a Relying Party sends its security policy its also sends a signed X.509 digital certificate (showing company logo and URL), guaranteeing its identity.
The user sends back the security token required to satisfy Reliying Party security policy, encrypting it with the Relying Party public key embedded in the X.509 certificate.

As you can understand the whole system depends on a large interaction among several service providers (in real life a shopper must accept and trust credit cards institutes) and Microsoft is aware that can't revolutionize the whole world by itself. So it's seeking a large consensus and agreements with several major companies, from credit cards institutes to worldwide certificate authorities, without forgetting security vendors, called to action for implementing InfoCard support in all their products.

To obtain requested acknoledgement this time Microsoft planned the whole infrastructure on open standards (OASIS Web Services Security) so that every vendor can implement from itself the InfoCard part it needs.
And the acknoledgement isn't arriving in late: Verisign just announced will join the InfoCard crusade. And many other did, even if Microsoft won't disclose names until a more mature development stage.

InfoCard support will be implemented in the actual Windows XP (SP2) and Server 2003 (SP1 and R2), in the upcoming Windows Vista (expected for 2006 holidays) client operating system, in Internet Explorer 7.0, and in codename Longhorn Server (expected somewhere in 2007). The latter OS will provide InfoCard complete integration with Active Directory.

Be aware: InfoCard will be supported by Microsoft on its products, not owned by Microsoft. You'll no more see Microsoft in the middle of your transaction with your services providers or your customers.
You don't even need to see Microsoft at all if you don't want to, since InfoCard can (and possibly will) be supported on any operating system, on any browser, etc.

InfoCard is more than an ambitious project and implications are more than significant.
If you find the topic interesting you can start going deeper in a lot of places:

• The Laws of Identity whitepaper


• Introduction to Microsoft Identity Metasystem


• Microsoft Federated Identity and Access Resource Kit Sept 2005 Community Technology Preview


• A Guide to Integrating with InfoCard v1.0


• A Technical Reference for InfoCard v1.0 in Windows

The best place anyway is the Identity Weblog, maintained by Kim Cameron, Microsoft Identity and Access Architect behind InfoCard.
Be sure to check his interview on Microsoft Channel 9.


Update: InfoCard has been renamed Windows CardSpace (WCS) as unofficially announced here.

The definitive antivirus comparison

This is particularly interesting:

Virus.gr published a massive comparison between 50 antivirus products claiming the most accurate testing method available (based on 245.000 virus collection, while others have at maximum 20.000).

In their December comparison they selected just 113.334 virus from the whole database, updated and tuned up every AV program for best scanning rate, used both signature and heuristic scans.

Which product has won? Here the top ten list:

1. Kaspersky Personal Pro version 5.0.390- 99.46% (same results for Kaspersky 2006 beta version 6.0.15.222)


2. F-Secure 2006 version 6.10.330 - 96.92%


3. CyberScrub version 1.0 - 96.62%


4. eScan Virus Control version 2.6.522.9 - 95.21%


5. McAfee version 10.0.27 - 94.80%


6. BitDefender version 9 - 90.75%


7. Nod32 version 2.50.41 - 88.79%


8. AntiVir Personal version 6.32.00.51 - 86.55%


9. MKS_VIR 2005 - 86.16%


10. Norton Professional version 2006 - 85.17%

Read the whole list here.

Note that the famous free antivirus called AVG is at number 15 with 77.97% much lower than the other free product called AntiVir Personal with 86.55%.
Also note that CA eTrust (now powering also Check Point ZoneAlarm firewall suite) is in the shame at 26 with just 47.84%.

Finally note that some products are missing cause no trial was available.


Thanks to Thincomputing.net for the news.

SQL injection against SQL Server, Oracle and MySQL made easy

Applications for penetration testing are spreading at high rate these last 5 years. Here another example:
Francois Larouche, a french security engineer, developed a great tool for Windows plaftorms simplyfing SQL injection vulnerabilities check: SQL Power Injector.

The tool is really good cause for the first time (at least as far as I remember in a non-commercial tool) it groups attacks for most used database platforms together (with operating system indipendence) and it permits to automate queries for blind SQL injection.

Detailed features are:

• Supported on Windows, Unix and Linux operating systems


• SQL Server, Oracle and MySQL compliant


• Load automatically the parameters on a web page (GET or POST)


• Find automatically the submit page


• Single SQL injection


• Blind SQL injection


• Comparison of true and false response of the page or results in the cookie


• Time delay
• Response of the SQL injection in a customized browser


• Fine tuning parameters injection


• Can parameterize the size of the length and count of the expected result to optimize the time taken by the application to execute the SQL injection


• Multithreading


• Option to replace space by empty comments /**/ against IDS or filter detection


• Automatically encode special characters before sending them


• Automatically detect predefined SQL errors in the response page


• Automatically detect a predefined word or sentence in the response page


• Real time result


• Possibility to inject an authentication cookie


• Can view the HTML code source of the returned page


• Detect automatically generic SQL error in the returned page

Download it here and be sure to check the tutorial.

FreeBSD IPFW ported to Microsoft Windows

The large majority of firewalls for Windows has 2 characteristics: is application oriented and isn't free.

Being application oriented isn't a bad thing at all but sometimes you just need a plain easy packet filtering.
Windows Firewall could be a good candidate but it's still missing outbound filtering (to be implemented in the next operating system).
If you don't want to wait for Vista here a good alternative directly from the FreeBSD world: IPFW.

The Windows porting is still under heavy development (for example it still miss authentication for changing rules), is not supporting 64bit, and you should notice that has been ported just IPFW1, replaced by IPFW2 starting from FreeBSD 5.0. But is a good working free (BSD license) packeting filtering solution to play with.

Highly recommended to learning firewalling basics.

Download it here.

Microsoft ISA Server 2004 capacity planning

Correctly sizing a firewall infrastructure is critical, and is not an easy task.
Rarely firewall vendors publicily release tools to simplify this task, letting them for exclusive use of consulting partners.

Few know Microsoft released an extend document for sizing ISA Server 2004 servers. It's a bit complex to follow the first time but it's really needful.

Download it here: Best Practices for Performance in ISA Server 2004.

Sun Solaris 10 compliant to CIS security benchmarks

Finally Solaris 10 is benchmarkable with the CIS (Center for Internet Security) security measurement system already available for Windows, Apple MacOS, Red Hat Linux, HP-UX, IBM AIX and all previous Sun operating systems.

Sun reported it on this press release annoncing upcoming release of Solaris Trusted Extensions for Solaris 10 (expected in beta for April), to replace the Trusted Solaris distribution, as anticipated in October 2005.

The CIS tool is available here.

I already wrote (still to be translated from italian) about value of security metrics one year ago.

RSA Conference 2006 keynotes

This year RSA Conference is rising a lot of attention. Microsoft, Cisco, Sun, Check Point, ISS, Computer Associates, 3Com and obviously RSA did great annoncements till now.

Main topics are endpoint security and authentication.

If you are interested in listening at keynotes you can check the official archive.

Free Cisco online training for the new ASA 5500 appliance

Cisco is making another (small) step in putting PIX in End of Life.

They just published a large amount of free online training for the new ASA 5500 series, integrating firewall, VPN gateway and IDS (and adding antivirus and network virtualization features).
The first one on the list is a sound Migrating from PIX Security Appliance...

I strongly suggest you to check modules, even if you're still not migrating away from PIX.

Introduction to Microsoft Network Access Protection

As soon as codename Longhorn Server is approaching a beta 2 phase (probably after the Vista release) Microsoft start disclosing more details about upcoming features.

As I said from around one year, from a security point of view, the most interesting one is surely Network Access Protection (NAP), the Microsoft endpoint security solution.
NAP is pretty identical to Cisco Network Admission Control (NAC), Check Point Total Access Protection (TAP, based on acquired ZoneLabs Integrity technology) and other endpoint security frameworks that are popping out since one year or so.

As I said several times endpoint security is probably the biggest change in network security we'll see since years and IT professionals will have a hard work to face to redesign infrastructures and integrating different vendors products (even if at a point these endpoint security technologies will interoperate with each other thanks to 802.1X).

I would expect (and strongly hope to see) from Microsoft a brand new Microsoft Official Curriculum (MOC, the official classroom course format) about NAP, cause it involves so many different tiers and technologies (Active Directory, DHCP, 802.1X authentication, switches, access points, firewalls, RADIUS, WSUS, SMS, 3rd parties software integration, etc.) that it's hard to cover without attending 5-6 other courses.

So it's worth taking a look at documents MS released so far (but be sure to consider them as draft):

• Introduction to Network Access Protection


• Network Access Protection Platform Architecture


• Configuring Network Access Protection Policies in Windows Server codename Longhorn


• Internet Protocol Security Enforcement in the Network Access Protection Platform


• Network Access Protection FAQs

Note that several Microsoft production will be integrated in the NAP strategy day by day, starting from WSUS and SMS, and probably following with ISA Server, Data Protection Manager (DPM), and others. Big changes to come.

A free personal security advisor to surf safer

Do you remember the Microsoft Honeymonkey project? On August 2005 Microsoft Research disclosed a new tecnology dubbed Strider HoneyMonkey: a huge virtual machines farm, loaded with Windows XP clients, automated to browse the Internet, founding and recording malicious sites and 0day exploits for extended analysis.

Well, someone brought this concept even further: SiteAdvisor is a new company that, using the same automated browsing technique, browses Internet sites, downloads softwares, compiles registration forms and so on.
Everything to automatically analyze if a site, a software or an email newsletter is malicious or not.
The categorization ends up in a free software (actually in beta) available for today's major browsers that warn users about a malicious site while they are surfing:


The concept is fascinating. Even more if you think that SiteAdvisor already claims more than 90% of worldwide web sites coverage, 100,000 downloaded softwares screened, 800,000 newsletters checked. And growing.

If you are familiar with web sites categorization provided by solution like WebSense, well this is slightly different. SiteAdvisor is automated and covers more Internet interaction than just browsing.

Give it a try here.

Microsoft ISA Server 2006 goes public beta

Microsoft just launched the new ISA Server 2006 beta 1 for wide public.

This new version improves features on 3 areas:

• Secure Application Publishing


• Branch Office Gateway


• Web Access Protection

Among these areas I can underlying few interesting features like Single Sign-On, multiple authentication schemes (smartcards, OTP, SecurID, LDAP), web traffic priority (something not really comparable with QoS), denial of service (DoS) attacks mitigation.

But apart this there is nothing new in ISA Server 2006.

I spent several posts on this blog (soon to be translated from my discontinued italian blog) about problems ISA Server 2004 have on NAT and IPsec. And could spend a lot more on interface inconsistencies. And I could spend even more on customers wanted features not appearing in this beta. So I'm actually disappointed of what's new today.

As security professional I can't see anything real appealing for customers to upgrade their 2004 product. Maybe Microsoft is just aiming at new customers or maybe they are reserving more big news for beta 2.
In any case is a pity cause ISA Server 2004 represented a great leap forward for Microsoft in serious enterprise firewalling, disattended now with ISA Server 2006.

Microsoft ISA Server 2004 log reports powered by SQL Server Reporting Services

ISA Server 2004 is able to log packets details on a local plain file, on a local, remote unreachable, MSDE (SQL Server Desktop Edition) or on a stardard SQL Server 2000.

But a licensed SQL Server 2000 user can install for free SQL Server Reporting Services: a powerful platform providing tools to design complex reports for printed or web usage.

So when you're unhappy of ISA Server 2004 embedded reporting feature, you can configure logging towards your SQL Server 2000 and run your SQL Server Reporting Services designed report generator against databases.
Simply and powerfully....at least if you know where to start...

Today is a bit easier since Microsoft released a Sample Pack for the task.

StillSecure offers a free intrusion prevention system based on Snort

The company StillSecure just made an interesting move: they released a complete intrusion prevention system (IPS) based on the Snort engine: Strata Guard Free.

The IPS is made by a pre-hardened Linux OS, the Snort engine, some false positives reduction mechanisms, a painless Snort rules update system and a user-friendly web-based GUI.

You can configure it to act as IPS, by deploying it inline (as gateway for incoming/outcoming traffic), or as IDS, by deploying it out of band (as every network IDS sensor is usually deployed).

It comes for free download as ISO image (you'll need an empty machine to install it) or as pre-configured VMware virtual appliance.
(to know more about VMware virtual appliances read my other blog about virtualization: virtualization.info)

StillSecure has capped down this free version to monitor up to 5 Mbps but seems enough to be used in many small business.

Rootkit for Microsoft Windows mail servers

Totaly Sentry just released a major revision of its SMTPCommander.

The tool, which is free, permits to manage a Windows mail server box (IIS 5/6 and Exchange 2003) with simple emails, bypassing any kind of firewall (and you'll need to create special rules inside your IDS if you hope to recognize it).
So you'll be able to upload or download files or ask for task execution, receiving output directly by email, etc.

The tool comes with a configuration GUI and requires some work to be installed. It's not something you can use for backdooring.
But today Totaly Sentry released a second version, aimed to penetration testing, which is very quite and hard to discover. It has same feature of the standard tool plus:

• Single DLL


• No service to run, or tasks to show (runs under IIS)


• No eventlog entries, no errors logged to files


• Registry read quiet operation, no registry hits once started. Initial class key only observable hit using regmon.exe.


• Quiet operation, minimal files accessed, or registry reads.


• Manual install

Note that both versions are free but this second pen-testing one is also open source.

TCP/IP Guide from No Starch Press available online for free

If I should compile a FAQ list about what students and customers asked me during my career the first question would be: From where should I start to study to become a security professional? Firewalls? IDS? Hardening?
I always had one unique answer: Start from TCP/IP.

It's not a default or fast answer. It's a direct result of my experience: too many security professionals (but also IT administrators) simply do not consider necessary a solid understanding of TCP/IP. And I'm already afraid of what will happen when IPv6 will become a widespread standard...

If you feel weak on TCP/IP you should buy a book about it, grab Ethereal, and start analysing your own traffic.
Today you're lucky: No Strach Press published online its whole new 1616-pages book: TCP/IP Guide by Charles M. Kozierok.

It really is worth to read and bookmark. And possibly buy.


Thanks to TaoSecurity for the news.

Hardening Exchange Server

Microsoft just published a refreshed hardening guide for its enterprise mail server: Exchange Server 2003.

Hardening a mail server can be a complex task and hardening Exchange can be even harder, so I suggest you to take a look.

Remember that hardening any back-end server starts from hardening its underlying operating system, which in this case is Windows Server 2003.
So you could take a look at an article of mine published few days ago by (IN)SECURE Magazine about hardening Windows 2003 platforms with Security Configuration Wizard (SCW).

Introduction to the new wireless security standard: WPA2

Information Week published a very long article about the Wi-Fi Protection Access 2 (WPA2), ratified 802.11i by the Wi-Fi Alliance on June 2004, and considered the third generation of security protection for wireless networks.
It's a really good technical basic reading with explicatives diagrams. It also includes comparisons with first generation, WEP, and second generation, WAP.

Read it here.

BTW if you are interested in adopting WPA2 devices you should check the official Wi-Fi Alliance press release, annoncing certified products.

You could also check for fun a nice video of a 10-minutes WEP hacking with KisMAC. It is in very little resolution but you'll have an idea of how simple it can be.

GPS (illegal) tracking for masses

A new toy appeared on Digg few hours ago: TrackStick.

It's a small GPS receiver inside a standard USB 1.1 stick. Why it's so interesting?
Because this gadget records every single movement you do, tracking 12 satellites in its 1MB memory (which is enough for many days of tracking).
Then you can plug it on your PC via USB, download recorded paths and see them in wide-known satellite applications like Google Earth.

I have no idea of its price but I absolutely want one for Christmas :)
And just in case you are asking yourself: yes, tracking someone without permission it's illegal in a lot of countries.

Microsoft ISA Server 2004 Service Pack 2 released

Microsoft just released its second major update for ISA Server 2004.
This service pack fixes a lot of bugs as you can see from the Release Notes, extends support to Windows Server 2003 R2 and SQL Server 2005, but also introduces 3 new features:

• Support for BITS Caching
  ISA Server 2004 SP2 can cache and serve content downloaded with Background Intelligent Transfer Service (BITS)—a file transfer service used by Microsoft Windows Update to download updates and service packs. BITS caching provides a more efficient and effective rollout of updates and fixes by transferring data in small chunks, utilizing unused bandwidth as it becomes available, and reassembling the data at the destination.



• HTTP Compression
  HTTP compression allows ISA Server to request compressed content, and serve compressed content from its Web cache to clients. This enables faster serving of Web pages, which may be useful in branch office scenarios where clients access Web applications over slow links.



• Traffic Prioritization
  Traffic prioritization is a new global setting that can apply to all browser traffic that passes through ISA Server. ISA Server 2004 SP2 supports setting the DiffServ field in Internet Protocol (IP) packets based on Uniform Resource Locators (URLs). The DiffServ field is used to determine the quality of service (QoS) for an IP packet, allowing customers to give higher priority to important applications. DiffServ values for URLs can be configured at both the head office and branch offices allowing for traffic prioritization between locations.

For a deep explaination of these features be sure to check the related TechNet article.

As you may remember the Service Pack 1 was only for the Standard Edition. This time SP2 is for all editions, even if we still have two different binaries:

• ISA Server 2004 Standard Edition SP2


• ISA Server 2004 Enterprise Edition SP2

Nmap 4.0 released

The most needful tool inside every security guy toolbox, the Nmap portscanner, finally reached 4th generation after 2 years of development.

The whole amount of changes included in 4.00 release is too large to be quoted here, so I suggest you to reserve 1 hour of your time and carefully read them on the official announcement.
Then be sure to check out the new man page, which is very needed with so many options.

Federico Biancuzzi interviewed Fyodor, the Nmap creator, on behalf of SecurityFocus, providing a great insight of this release.
Among many things a couple of interesting informations for Windows users emerged:

• Windows version is still slower than the Linux one, but the difference is notable only when you're scanning local networks without firewalls or segment problems


• Windows version still misses some advanced features

Download it here.

Easy and free hashing for Windows users

Hash calculation is a typical task every security-aware computer user should do, whenever possible, immediately after downloading a file.
It's something so simple and fast, but critical at the same time, to do that should be integrated in every operating system and download manager.

There are a lot of free hashing calculators on the Net but I never found one really handy for Windows until today: from the same creators of the wonderful SyncBack backup utility, here it is HashOnClick.

This freeware tool integrates itself with Windows Explorer, permitting to calculate MD5, SHA1 or CRC32 hashs with a single right-click: