1998 Feds develop freeware app to foil hackers By William Jackson GCN Staff Shadow combines monitoring with statistical assessment to detect events that filters cannot decode. A consortium of agencies and private organizations has released a free network intrusion detector to combat about 40 types of cyberattacks. The intrusion detection team at the Naval Surface Warfare Center at Dahlgren, Va., primarily developed the Shadow freeware using Energy Department code. To help develop and test the software, the center worked with the Defense Information Systems Agency, Defense Logistics Agency, Army Research Laboratory, Centers for Disease Control and Prevention, Space and Naval Warfare Systems Command, Geological Survey and DOE's Los Alamos National Laboratory. Md. Although a Navy server hosts the code, users must obtain documentation from the Sans Institute before downloading the software.
Sans also presents two-day training programs in several cities.
Shadow's developers call it the first cooperative, public-domain tool of its kind. Intended to combat joint efforts by hacker groups, it uses TCPdump, a DOE program that monitors and filters TCP activity, and Network Flight Recorder freeware from Network Flight Recorder Inc. of Woodbine, Md., for monitoring, archiving and alerting tools. The current version runs only under Unix. The developers said if an agency has large log files, it will likely need several gigabytes of drive space to run the software. It needs to work in conjunction with something like a network intrusion device.