MozDef: The Mozilla Defense Platform

https://github.com/jeffbryner/MozDef

by adamnemecek • 12 years ago

118 19 12 years ago

github.com

maximux• 12 years ago

I'm happy to see more tools being developed for the defending side.

chankey_pathak• 12 years ago

Awesome

theon144• 12 years ago

It's a proof of concept and it's already making rounds at HN, reddit, G+... Geeze, guys, give it time!

adamnemecek• 12 years ago

One of the ways a proof of concept can become a full blown project is by attracting contributors. A project attracts contributors if the project is talked about.

sigvef• 12 years ago

Seems like a cool initiative, but I'm having trouble understanding what it actually does.

killerpopiller• 12 years ago

me to. Screenshots would've helped.

Is it webapp which informs me about new vuln. for my websites (parsing my logfiles)?

cones6883• 12 years ago

That's what the SIEM does, see ones such as IBM QRadar [1]; aggregates all the logs and network flows from across your estate and then uses rules/algorithms to determine threats and security events.

From my limited understanding MozDef is more targeted at ticketing/following through from intelligence gleaned from a SIEM as most times, people then just stick it in Remedy or Jira.

[1] http://public.dhe.ibm.com/common/ssi/ecm/en/wgd03021usen/WGD...

oelmekki• 12 years ago

And now, there's an other public facing service on your server than can be tried for vulnerabilities :)

Joke aside, I like the initiative, security is still something that seems to me not taken seriously enough by day to day sysadmins and developers.

From what I understand, its main use it to report it when attacks were attempted. Does it also check for what is probably the biggest security concern on the wild, aka outdated softwares that have updates available (better safe than sorry)?

riffraff• 12 years ago

one? """ MozDef is based on open source technologies including: Nginx (http(s) based log input) Rabbit-MQ (message queue) UWSGI (supervisory control of python-based workers) bottle.py (simple pyhon interface for web request handling) Elastic Search (scalable indexing and searching of JSON documents) Meteor (responsive framework for Node.js enabling real-time data sharing) Mongo DB (scalable data store, tightly integrated to Meteor) .. """

OTOH, maybe it's not public facing :)

fvt• 12 years ago

I hope this project will get traction. It's always a nightmare for sysadmin (and developers) to discover on Friday nights that most of their apps will require an upgrade in the next couple of hours because an exploit is out (of nowhere most of the time).

And in any case, the architecture put in place is interesting. I'm eager to see how they made use of Meteor.

easy_rider2• 12 years ago

> The inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis. Defenders are usually limited to wikis, ticketing systems and manual tracking databases attached to the end of a Security Information Event Management (SIEM) system.

I read this as: attackers are usually one step ahead at least, and "defenders" (sic: developers (?) ) do not like pentesting? These tools are available to anyone..

bazzargh• 12 years ago

No amount of pentesting with tools that are 'available to anyone' will help you with the attacks that aren't invented yet.

MozDef is about incident handling. You still need to do this, even if you do pentesting.

cones6883• 12 years ago

"defenders" (sic: developers (?) )

Defenders are usually companies or a consultancies ERT (emergency repsonse team) or in their SOC (Security Operations Center) to monitor real time security threats to their business and Triage, mitigate, investigate, block etc.

Some of the enterprise tools (QRadar, Arcsight, EnVision) for these are really advanced but run into the 100's of thousands cost, so I think MozDef is an open sources initiative for smaller teams who don't have the resources for the above.

easy_rider2• 12 years ago

Ah, should not comment before the coffee kicks in... That's actually an awesome concept. Thanks for the explanation.

SunboX• 12 years ago

Is this equal to OSSEC, an Open Source Host-based Intrusion Detection System? http://www.ossec.net/

jvehent• 12 years ago

No. MozDef analyzes logs and events that are shipped to its data pipeline by servers and applications.

cones6883• 12 years ago

That's an IDS, a specific security measure, akin to firewalls, AV, IPS, Vuln Scanners.

MozDef seems to be trying to make a relevant/niche ticketing system to run over the top of a SIEM (Security Information and Event Manager) which in turn runs over the top of IDS/IPS/AV/FW etc etc this allows single view and correlation between events i.e remote login from contracter over VPN using chinese IP address, escalating privileges on a unix box, new admin account on DB, increase in data flow outbound from DB, none of these events is individually significant but together its pretty obvious something might be wrong, thats why you pay good money for a SIEM.

The issue most companies face is they have awesome security intelligence platforms or SIEMS but then have to translate it into awful business process ticketing systems (like Remedy or Jira) not designed to handle such critical and quick moving issues.

skrowl• 12 years ago

IMO, the only CORRECT way to assure that you're not vulnerable to all the "attacker" tools is to test USING those tools yourself.

MozDef: The Mozilla Defense Platform

Related Stories