SAMAEL and NARC: Autonomous Encrypting Linux

Architecture and Background

dr.kaos: SAMAEL (Secure, Anonymous, Megalomaniacal, Autonomous, Encrypting Linux) and NARC (Network Analysis Reporting Console) Abstract: From the 1337 hax0rs that brought you Anonym.OS, kaos.theory/security.research presents SAMAEL (Secure, Anonymous, Megalomaniacal, Autonomous, Encrypting Linux), the natural evolution of our secure, automagicically anonymizing operating system, Anonym.OS into a kick-ass anonymizing server! When kaos.theory released the Anonym.OS at ShmooCon in January of this year, we received many requests for features we had already planned to implement: media players, smaller distribution size, office suites, better speed, USB functionality, etc. "Sure," we collectively replied, "we'll get right on that." But we didn't. We tried, but we realized that maintenance releases aren't 1337. Instead, we're back to release SAMAEL, a blackbox gateway that creates -- in a few simple steps -- a secure, anonymizing, transparent firewall and proxy server, protecting its users' love of sex, drugs, and rock and roll from embarrassing public disclosure (even better than the Kennedys).

Vulnerability Analysis

Making use of Gentoo, Transocks, Tor, and sweet, sweet Python, SAMAEL provides all of the services expected in a modern Linux firewall, including DHCP, a Captive Portal, and Web-Based Administration! The guiding principle of Anonym.OS and its derivative projects has remained "Anonymity for Everyone;" kaos.theory's SAMAEL takes that motto to the next level. But there's one more thing. And it doesn't involve sweatshop labor or black turtlenecks. Getting useful, attractive reports out of scanning tools is a bitch.

Exploitation and Demonstrations

People pay vendors thousands just for some slick charts and graphs. Why? Because SQL is hard for a boot-camp MCSE. So get your 'Security for Dummies' books and your free Nessus downloads ready, folks, because we've got scripts and queries all packaged up as pretty as your mom on a Friday night. kaos.theory's newest member, jonathan white, joins atlas and crew to introduce NARC, the Network Analysis Reporting Console.

Remediation and Defensive Strategies

In its initial release, NARC can utilize output from common security tools like Nessus, Paros, and NMap to populate a database via automated scripts for reporting purposes. Version 0.DC14 also includes rudimentary reporting capabilities. Bios: dr.kaos Across the past 9 years, Taylor Banks (aka dr.kaos) has written and delivered training and provided security consultation to thousands of security engineers, architects, managers and executives from hundreds of organizations including Bristol-Myers Squibb, Ernst and Young, FedEx, IBM Global Services, PricewaterhouseCoopers, and VeriSign as well as the US Department of Defense, Federal Bureau of Investigation, the US Marine Corps Computer Emergency Response Team (MARCERT) and the National Security Agency. Prior to 1997, he worked as a network and security consultant for Benedict College, the Environmental Policy Center, Georgia Institute of Technology, Georgia State University, Sodexho Marriott, and SunTrust Equitable Securities. Taylor currently manages the Southeast Systems Engineering group at Caymas Systems. Taylor holds his CISSP and has been certified by CheckPoint, ISECOM, ISS, NAI, Nokia and VeriSign. He is a contributor to the EFF and a member of Usenix, SAGE, ISSA and ISACA as well as an active participant in, and contributor to, numerous open security forums and user groups. He is the organizer for the Defcon Atlanta Group, the founder of kaos.theory/security.research, and has presented at Defcon, ShmooCon, InterZone, LayerOne and numerous ISSA, ISACA and Infragard events.