Comments for Quasi una fantasia (Mac's Blog)

Comment on Setting up Encryption in Arch Linux by How to use GnuPG in cPanel? | hostmanager.info

How to use GnuPG in cPanel? | hostmanager.info — Fri, 25 Jun 2010 07:04:45 +0000

[...] Setting up Encryption in Arch Linux [...]

Comment on Setting up Encryption in Arch Linux by Amit Agarwal

Amit Agarwal — Mon, 21 Jun 2010 17:06:14 +0000

Script to add all the partitions to the fstab….

I found your entry interesting thus I’ve added a Trackback to it on my weblog …

Comment on Defending from the Evil Maid Attack by Mac's Blog » Blog Archive » Setting up Encryption in Arch Linux

Mac's Blog » Blog Archive » Setting up Encryption in Arch Linux — Mon, 21 Jun 2010 06:58:45 +0000

[...] worth it unless you really want to (mostly) defend against the Evil Made Attack, which I’ve written about before. I’m not that paranoid. Additionally, there is concern about /tmp. If you set up /tmp to be a [...]

Comment on A nice way to automate website updates by the main health and beauty secrets

the main health and beauty secrets — Sat, 12 Jun 2010 01:56:12 +0000

the main health and beauty secrets…

the main health and beauty secrets…

Comment on FeX by mollison

mollison — Thu, 22 Apr 2010 22:14:44 +0000

I did use FeX today to produce a document, and it made it a much easier/smoother process. There was very, very little debugging to do, and what debugging I did do, went towards modifying the FeX source, so that it won’t be necessary again. So far, my little experiment is making it a breeze to write beautiful documents in LaTeX, whereas it was kind of a pain in the past (for me).

Comment on go back in bash by Bash下的目录回退 - Nine Rivers 九河下稍

Bash下的目录回退 - Nine Rivers 九河下稍 — Thu, 01 Apr 2010 15:14:25 +0000

[...] 1. http://www.mollison.us/blog/2009/08/24/go-back-in-bash/ 2. http://stackoverflow.com/questions/245406/how-do-i-delete-a-bash-function Tags: [...]

Comment on Wachovia Security Badness by Tweets that mention Mac's Blog » Blog Archive » Wachovia Security Badness -- Topsy.com

Sun, 28 Mar 2010 06:32:40 +0000

[...] This post was mentioned on Twitter by Mac Mollison. Mac Mollison said: a pretty poor wachovia customer experience: http://thurly.net/hgo [...]

Comment on Funny story by Maia

Maia — Sun, 21 Feb 2010 03:35:34 +0000

Comment on Verizon Slowing Linux Access to Website? by mollison

mollison — Wed, 17 Feb 2010 03:25:05 +0000

Thanks for the info on OS fingerprinting. Makes sense.

I think comparing verizon.com to the logged in user experience is apples to oranges. My problems only happen after I log in to “My Verizon”.

Comment on Verizon Slowing Linux Access to Website? by Drew

Drew — Wed, 17 Feb 2010 02:49:56 +0000

Standard Verizon.com works fine on my machine – Ubuntu 8.04, using Firefox. Only issue was having noscript running (which you should consider using, if you don’t already), easily solved.

From what I understand, there are 2 forms of OS fingerprinting, Passive and Active. Passive, what would be used in this case, basically uses information it gleans from the IP and TCP headers in the packets it receives. Stuff like TCP sequence numbers and flags. There is also active OS fingerprinting, which involves sending strange packets to a host, to see what it returns. See my blog post, http://glimpseintoentropy.blogspot.com/2009/10/iptables-stealth-scan-detection.html – it briefly discusses scans that send TCP packets with malformed flags. The scans work off of what data is returned by the OS. My post discusses making the linux firewall, iptables, reply or not, based on what you want the scan to reveal.

Now, if you’re using a hardcore firewall, like OpenBSD’s PF, then it can take care of most of this for you. pfSense is a great firewall package, that has the power of pf and FreeBSD, with the simplicity and web-interface of a standard home router. This firewall can block all OS fingerprinting, both active and passive, as well as stop SYN flood DOS attacks in their tracks.

Intentional or not:
Well, this may be a moot point, since it works fine for me. I’d guess it’s unintentional – probably a network engineer thinking they’ve found a clever way to block some sort of attack. You may want to run wireshark on one of your sessions with Verizon.com and see what it reveals.

Try your VM in bridged mode and tell me what happens.