Intrusion Detection Systems
4
votes
2answers
245 views
Detect changes in /boot when using full disk encryption
When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
2
votes
1answer
780 views
Snort & Logging
I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me.
I would like to use Snort to perform a trace, which, after it ...
5
votes
2answers
575 views
Snort Sensor Placement
I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
2
votes
4answers
341 views
Detecting malware hidden in P2P traffic
Consider a network situation involving (only) Peer to Peer traffic in medium sized network.
For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
2
votes
4answers
255 views
Writing exploit code that bypasses IPS detection
Suppose that Network IPS/IDS can detect an exploit, however, the application server itself is still vulnerable to that exploit.
If I modify the exploit code, are there IPS/IDS which will still ...
2
votes
2answers
227 views
How are signatures for IPS determined
For example , how do Snort's VRT team or some one who gives us the signatures, determine them at all ?
I would be more interested to know , how are the traffic patterns analyzed against some known ...
4
votes
1answer
255 views
Outbound TFTP request to 255.255.255.255
Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255
Anyone have a clue as to what this may ...
1
vote
0answers
114 views
AD authentication with high amount of ICMP traffic [closed]
We have an IPS in place and it's constantly triggering ICMP / Ping flood signatures between workstations and AD server; or AD to workstation. I understand that ICMP is used for AD authentication. ...
4
votes
1answer
737 views
Bench marking Snort and other IDS/IPS
I am looking for facts and figures of research or surveys done which have bench-marked Snort with other IDS/IPS on various parameters like overall performance, accuracy, speed, documentation, ...
3
votes
2answers
445 views
C&C domains used by Flame/Skywiper trojan
I'm trying to figure out if any of our clients have been infected by the recent trojan/worm Flame.
I have access to our proxy logs, so I want to search for any requests made to the "known" C&C ...
1
vote
1answer
158 views
SNMP trap by legitimate program?
Is there any way to tell if this SNMP trap is something created by a legitimate program?
Update: Hex Dump
0000000: 30 82 00 ec 02 01 00 04 06 70 75 62 6c 69 63 a4 82 00 dd 06 82 00 09 2b 06 ...
5
votes
3answers
8k views
Testing a Snort IDS installation
What is the easiest way to test Snort IDS after installing? Would using and writing a rule that captures all of the traffic work?
alert ip any any -> any any ( msg: "ICMP packet detected!"; sid: ...
1
vote
2answers
301 views
Published data sets for IDS/IPS evaluation
I am looking for data sets published by researchers or freelancers which can be used for the purpose of IDS/IPS testing and evaluations. The data sets may be for portscans, DoS attacks, Remote to ...
1
vote
1answer
145 views
WEB long basic authorization string/Buffer Over Flow
I have a external user getting a weird error in the middle of using my website. The user authenticates, post a search for information, and then with the address of the search results page they get a ...
0
votes
1answer
96 views
Tracing The Source Of IDS/IPS Alerts
This may be more of a routing question than a security one but I am asking for the reason of security.
I monitor an IPS on a remote network and there have been high alerts triggered recently that ...
0
votes
2answers
474 views
What IDS Do you recommend? [closed]
I am running a Debian Squeeze VPS and need a good IDS. I have used snort before and it was quite good but i am wandering if there are any other good ones out there.
Preferably compatible with ...
6
votes
3answers
1k views
HIDS detection system and registry changes
I use OSSEC HIDS to monitor XP and Windows 7 Operating Systems.
When OSSEC flags changes in the Windows registry, I have no idea where to go for to look for information and identify if the changes ...
0
votes
2answers
1k views
Snort false positive?
I've set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off:
GPL SHELLCODE x86 inc ebx NOOP
The payload is as ...
1
vote
3answers
162 views
will all instrusion dectection will become host-based? [closed]
Will all intrusion detection become host-based once all network packets have been encrypted?
3
votes
3answers
232 views
Is there an IDS based on process patterns?
After reading what Metasploit is able to do my grey hairs got even more.
From my understanding current attack methods are being done without tampering with any file in a filesystem - thus rendering ...
2
votes
2answers
458 views
Is traffic sent by Mouse Without Borders encrypted?
Some of our users have installed Mouse Without Borders and I wanted to know if it is possible to intercept the traffic being sent between the two computers and read it in some meaningful manner. I was ...
4
votes
1answer
226 views
SSL protocol issues on OS X and iOS
I have a PfSense box as a UTM, running snort among other things. I started noticing that when MacBooks and iPhones/iPods connect to my network, the snort log gets flooded with this message:
...
2
votes
1answer
192 views
Stateful Signatures in an IPS
I am researching IPS devices and their signatures both stateful and stateless. The test network I am looking to implement the IPS in has asymmetric traffic so stateful inspection would be nearly ...
0
votes
1answer
92 views
Is there a Snort rule that equates to “something suspicious flagged from a client side application?”
The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?
5
votes
2answers
2k views
Detecting the presence of wifi devices
Is it possible, with a normal wifi adapter, to detect present wifi devices in the surrounding? Let's say, is it possible to detect an Iphone with wifi switched on in the range of my wifi adapter?
...
4
votes
2answers
496 views
How effective is an IDS at catching targeted attacks
I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies.
I was ...
0
votes
1answer
184 views
Rules for log analysis in an IDS
I am working on an IDS which has brought into the view of log analysis basically. I have to detect an intruder if there are any user behaviour anomalies present in the logs. I am having problems ...
1
vote
1answer
180 views
types of intrusions on host [closed]
I am implementing an IDS and just want to know that what are the possibilities with which the intrusion can occur.I am just doing a literature survey over the atacks possible so I want to know that ...
10
votes
9answers
6k views
Tracking down a rogue access point
Over the course of about a month we have received multiple reports of a rogue access point attempting to intercept traffic. I suspect an attacker is using a wifi pineapple, or similar hardware ...
2
votes
3answers
241 views
Implementation of an IDS
I am starting my final year project and I have decided to make an Intrusion Detection System, but I am a little confused where to start. I have read some papers and those have been pointing out the ...
2
votes
2answers
348 views
How can an IPS\IDS detect SQLi \ XSS (or other application layer) attacks?
I've been thinking about how an IPS works, and as far as I know it inspects the packets on the TCP\IP layer.
How can it detect attacks on higher levels without harming the user experience? How does ...
12
votes
7answers
998 views
Tripwire - Is it security Theater?
Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes.
Let's say I have tripwire configured to run ...
5
votes
1answer
209 views
Using “canaries” to detect intrusion?
I haven't read much about such a technique, but I'm wondering if there's any sort of best practice around the use of "canaries" to detect certain types of intrusion:
Create a bogus account that ...
3
votes
1answer
406 views
Blacklist IP addresses based on number of 404s in Apache
I'm getting a lot of hackers spamming my domain with requests for files that just don't exist. This is eating up a lot of my allotted bandwidth and I'd like to blacklist these IP addresses.
Is there ...
1
vote
1answer
158 views
Can HIPS software practically be considered a form of MAC
Host Intrusion Prevention Software can restrict applications from taking certain actions regardless if they have the privileged to do so as assigned by the operating system.
Given that with the use ...
4
votes
1answer
301 views
Logging True/False Negatives on Snort
I'm using Snort in a lab environmnet with artificially generated traffic.
I'm looking to build a confusion matrix from known generated attacks.
True Positives and False Positives are easy to parse ...
1
vote
1answer
686 views
Power friendly home router, firewall, IDS/IPS setup?
For those that like to manage their own firewall and run IDS/IPS on their home networks, I'm curious - what are you using and is it power friendly?
I used to have a shelf full systems doing various ...
1
vote
1answer
146 views
Working of WAF/IDS/IPS payload normalization schemes?
I want to know how WAF/IDS/IPS deals with Payload Transformations. Such payload transformations may be
base64Encode
html EntityDecode
url Encode
Remove whitespaces
I want to know how WAF/IDS/IPS ...
7
votes
2answers
157 views
Can you tell if an attack is successful by looking at IPS logs?
In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
1
vote
1answer
170 views
OSSEC New Install: Scan and analyse full log?
When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
0
votes
2answers
689 views
How do we protect our server from anonymous hacker? [duplicate]
Possible Duplicates:
Hardening Linux Server
How to best defend against Targeted Attacks?
I read this news: Anonymous hacker group hits Apple, publishes data
My question: How do we ...
10
votes
6answers
690 views
Applications of probability/statistics in IT security?
What are some areas of computer security that utilizes statistical modeling? I ask b/c I'm a studying statistics at school and have become interested after reading a few papers.. some of the areas ...
16
votes
2answers
8k views
Simple example auditd configuration?
Auditd was recommended in an answer to Linux command logging?
The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, ...
4
votes
1answer
237 views
Attacks against HIDS software running on the same machine
I am interested in the attacks that could be used to compromise or disable HIDS software such as Tripwire or Samhain. I understand that ideally checks should be run periodically and the database ...
5
votes
3answers
370 views
Best practice for creating an initial IPS policy
I see that most IPS available in the market comes with a basic pre-defined policy which administrators can base on when creating their initial IPS policy. However, these policy may be insufficient and ...
13
votes
5answers
4k views
Do you detect/react to DNS tunnelling?
I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
4
votes
3answers
259 views
Information gathering before deploying a Network IPS
I understand that most NIPS these days have either rules or signatures built in to them and perhaps gathering information prior to deployment may help in fine-tuning the rules / signature once the IPS ...
4
votes
2answers
382 views
Has anyone else seen commands embedded in an ICMP echo request?
My IPS recently detected a type 8 ICMP packet (echo request) with an unusual payload.
The echo request command a fragment of a command that looked like part of a route add. Here's a PCAP of the ICMP ...
6
votes
3answers
277 views
How can an IPS be fingerprinted?
I'm not trying to solve a current technical problem but I came across this and have been wondering how it's done. Intrusion Prevention Systems are supposed to let all network traffic pass through and ...
4
votes
2answers
661 views
Can you have 2 promiscuous (sniffing) ports on a single machine?
I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?
