US Army Releases Code For Internal Forensics Framework 37
An anonymous reader writes: The U.S. Army Research Laboratory in Maryland has released on GitHub a version of a Python-based internal forensics tool which the army itself has been using for five years. Dshell is a Linux-based framework designed to help investigators identify and examine compromised IT environments. One of the intentions of the open-sourcing of the project is to involve community developers in the creation of new modules for the framework. The official release indicates that the version of Dshell released to Github is not necessarily the same one that the Army uses, or at least that the module package might be pared down from the Army-issued software.
Is Encase worried yet? (Score:2)
Being produced by the Army, this has the chance to be taken seriously enough by companies that are currently beholden to Encase. I know Autopsy and the Forensic Toolkit have been around for quite a while, but I haven't seen them really take off as a serious competitor.
Re: (Score:3)
This looks like less Encase and more WireShark/pcap post processing.
Re:Is Encase worried yet? (Score:4, Insightful)
Yeah, the more I dig into it, the more it looks like an investigative tool than an evidence analysis tool. That's pretty cool, but as you say, it looks a lot like Wireshark. Still, when you're facing an unknown attacker, it may not hurt to have a couple different views on the problem.
Re:Is Encase worried yet? (Score:4, Interesting)
That being said, it also includes some features for tracking continuous sessions based on L7 filtering, provides a limited GeoIP resolution, and so on - and it at least provides a framework for developing more advanced analysis.
As others have said since this release, it is at least an open source, base framework for developing more advanced stuff, and it provides library integration points for other software. As basic as it is, it might provide a common framework for an open development of an advanced traffic analysis tool that'll be open (after careful reading of the code, any relatively good expert would be able to provide a similarly capable code in a matter of days and probably has, as an interesting case study/exercise previously - I know I did, limited to HTTP analysis but still). That can only be a good thing, if only to regroup efforts in that direction to provide a universal traffic analysis tool for forensics and so on.
Any code being released open source is always a plus
Re: (Score:2)
There goes the Government again! (Score:1)
Destroying free enterprise by releasing stuff for FREE that was paid for by EVIL taxes!
Don't they remember the words of our Founding Fathers who said "Four Score and Seven Years ago, we asked what can our country do for us that would show e have nothing to fear except death and taxes, but would instead create a more perfect capitalism for Tippacanoe and Tyler too!"
Re: (Score:1)
Well, I suppose a free-market capitalist ought to be offended by this project, if he or she were a caricature living in your head...
Trust (Score:5, Funny)
I'm not sure that I trust this "open source" code from, of all places the US Army, available on Github. Does anyone have a compiled binary for Kubuntu that I could try?
Re: (Score:2)
Re:Trust (Score:5, Funny)
GP was probably joking, what with the request for a compiled, black-box binary. At least, I hope to god so. Sufficiently advanced stupidity is indistinguishable from satire, after all.
Re: (Score:1)
Wooosh.
Re: (Score:3)
There are summaries? What are these "articles" you speak of?
Re: (Score:3, Funny)
Fucking Python? Is that different than regular Python? Does it have new language features?
Re: (Score:3)
It's like having a super-long prehensile finger with a tongue at the end. You do the math.
Re: (Score:2)
FWIW, Python *does* compile the code it executes, and saves it as *.pyc files. True, it's only compiled for the Python virtual machine, but it's still compiled...and difficult to read.
Re: (Score:2)
Re:thats right, you too can help! (Score:5, Funny)
Wow, the same guys? I didn't know Python coders were that active. Color me impressed.
Re: (Score:3)
Well, if it's on GitHub they won't be the only people who benefit. You might as well argue against building hammers because the army uses some. (OK, that's not *quite* fair. It is a specialized tool. But not *that* specialized.)
What a bunch of crap (Score:1)
A string of open source tools marginally better than Wireshark?! This is the state of forensics in the Army? I'm fucking horrified.
Go look at commercial solutions from Blue Coat or RSA for full packet capture and analysis.
This dshell stuff sucks rocks.
it would have been nice... (Score:5, Interesting)
Hard up (Score:2)
The most bloated budget in the history of the world wants freebies from software developers? Really? Domain/framework-specific freebies? Thank you for your contribution to open source, US Army, but judging by the fact Slashdot can barely muster the will to snark, I don't think you're going to get a lot of contributions.
Navy version (Score:2)
That's nice and all but when can we get the NCIS version. I've been watching their weekly documentary and they have some damned impressive software.