Intrusion Detection Systems
18
votes
7answers
4k views
Can I detect web app attacks by viewing my Apache log file?
I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
16
votes
2answers
8k views
Simple example auditd configuration?
Auditd was recommended in an answer to Linux command logging?
The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, ...
15
votes
3answers
840 views
What techniques and tools do you use to relate security events?
You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck.
Do you have any cool ...
13
votes
5answers
4k views
Do you detect/react to DNS tunnelling?
I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
12
votes
7answers
1k views
Tripwire - Is it security Theater?
Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes.
Let's say I have tripwire configured to run ...
12
votes
5answers
392 views
Neural networks & anomaly detection
Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
10
votes
6answers
692 views
Applications of probability/statistics in IT security?
What are some areas of computer security that utilizes statistical modeling? I ask b/c I'm a studying statistics at school and have become interested after reading a few papers.. some of the areas ...
10
votes
9answers
6k views
Tracking down a rogue access point
Over the course of about a month we have received multiple reports of a rogue access point attempting to intercept traffic. I suspect an attacker is using a wifi pineapple, or similar hardware ...
10
votes
2answers
3k views
How do Intrusion Detection Systems (IDS) work?
How do Intrusion Detection Systems (IDS) work? As I understand it, they monitor network traffic but what exactly do they look for? How can they tell apart regular activity from intrusions?
10
votes
3answers
376 views
Do any of you who are *really* dealing with APT have any recommended intelligence feeds for SIEM/IDS/etc?
This question about Advanced Persistent Threats (APT) was posted by Rich Mogull on twitter. I copied it here because I'm curious too.
Rich posted these follow-up tweets:
And by APT I mean real ...
10
votes
2answers
374 views
Detecting website attack attempts
I am currently trying to implement some recommendations from OWASP AppSensor Project and I'd like to respond to attacker, when he tries to break into my website. Is there any resource ...
9
votes
2answers
3k views
Snort's great, but BASE isn't. What are some alternative front-ends?
BASE is an improvement over ACID, but it's easy to tell that it's maintained by someone who doesn't use it. There's no at-a-glance overview of network activity like you get with McAfee's NUBA IDS and ...
8
votes
3answers
426 views
What FOSS software do you like to use to build intrusion detection stacks?
Start-ups and organizations with limited budgets that are security conscious are often encouraged to deploy intrusion detection stacks. Given that prevention will always fail, intrusion detection ...
7
votes
3answers
264 views
What are the pros/cons of using a threat detection system?
What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)?
What does a properly implemented threat detection system do and how does it behave when it detects ...
7
votes
2answers
158 views
Can you tell if an attack is successful by looking at IPS logs?
In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
7
votes
3answers
339 views
Popularity of Anomaly based IDSes
I've been reading quite some time about anomaly/behavior based IDSes for Web servers.
I understand the downsides: possible high false positives, learning phase, constant training.
My question is how ...
6
votes
4answers
454 views
Is Stonesoft's “advanced evasion technique” a major problem?
A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques.
With these techniques, they claim to be capable of launching attacks on a network ...
6
votes
3answers
1k views
HIDS detection system and registry changes
I use OSSEC HIDS to monitor XP and Windows 7 Operating Systems.
When OSSEC flags changes in the Windows registry, I have no idea where to go for to look for information and identify if the changes ...
6
votes
3answers
278 views
How can an IPS be fingerprinted?
I'm not trying to solve a current technical problem but I came across this and have been wondering how it's done. Intrusion Prevention Systems are supposed to let all network traffic pass through and ...
6
votes
1answer
472 views
Intrusion Prevention Logs
I received an email from a client with IDS logs. I was wondering if the following log has any real indications of the server being compromised. If there are certain things I can do to diagnose the ...
6
votes
1answer
502 views
How can an admin choose which Snort rules to enable?
The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection
attacks, port ...
5
votes
3answers
8k views
Testing a Snort IDS installation
What is the easiest way to test Snort IDS after installing? Would using and writing a rule that captures all of the traffic work?
alert ip any any -> any any ( msg: "ICMP packet detected!"; sid: ...
5
votes
2answers
578 views
Snort Sensor Placement
I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
5
votes
2answers
2k views
Detecting the presence of wifi devices
Is it possible, with a normal wifi adapter, to detect present wifi devices in the surrounding? Let's say, is it possible to detect an Iphone with wifi switched on in the range of my wifi adapter?
...
5
votes
2answers
205 views
How did Evernote detect the security breach?
http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/
Evernote's official message says little about technical details of the attack and how it was detected.
...
5
votes
1answer
209 views
Using “canaries” to detect intrusion?
I haven't read much about such a technique, but I'm wondering if there's any sort of best practice around the use of "canaries" to detect certain types of intrusion:
Create a bogus account that ...
5
votes
3answers
370 views
Best practice for creating an initial IPS policy
I see that most IPS available in the market comes with a basic pre-defined policy which administrators can base on when creating their initial IPS policy. However, these policy may be insufficient and ...
5
votes
1answer
523 views
Tools to identify and report hacking attempts originating inside reputable organizations?
Re: Should I report hacking attempts? - Server Fault
Lots of people look at their own logs for attacks from the outside. But who regularly reports such attacks back to the source? I'm mainly ...
5
votes
2answers
126 views
Managing a team of IDS experts; how would you orgainze your team?
Suppose you are managing a team of Intrusion Detection Experts:
...what are the functional areas of the IDS knowledge space would you group your team into?
...how would you structure your team?
...
4
votes
3answers
259 views
Information gathering before deploying a Network IPS
I understand that most NIPS these days have either rules or signatures built in to them and perhaps gathering information prior to deployment may help in fine-tuning the rules / signature once the IPS ...
4
votes
2answers
500 views
How effective is an IDS at catching targeted attacks
I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies.
I was ...
4
votes
3answers
455 views
How do I identify an unknown port/protocol that my IDS picks up?
Googling a port and protocol leads to a terse description at best, and a linkfarm in the average case. Most protocols on assorted, unknown high ports contain little or no plaintext, and often if the ...
4
votes
1answer
738 views
Bench marking Snort and other IDS/IPS
I am looking for facts and figures of research or surveys done which have bench-marked Snort with other IDS/IPS on various parameters like overall performance, accuracy, speed, documentation, ...
4
votes
2answers
247 views
Detect changes in /boot when using full disk encryption
When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
4
votes
2answers
667 views
Can you have 2 promiscuous (sniffing) ports on a single machine?
I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?
4
votes
1answer
256 views
Outbound TFTP request to 255.255.255.255
Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255
Anyone have a clue as to what this may ...
4
votes
1answer
49 views
Security / logging on a Xen-based VPS instance?
Our company has a Xen-based instance on a VPS provider and we have some sensitive data stored on it. Is there a way for me to tell if/when employees of the hosting company have accessed my VPS (by ...
4
votes
1answer
301 views
Logging True/False Negatives on Snort
I'm using Snort in a lab environmnet with artificially generated traffic.
I'm looking to build a confusion matrix from known generated attacks.
True Positives and False Positives are easy to parse ...
4
votes
2answers
382 views
Has anyone else seen commands embedded in an ICMP echo request?
My IPS recently detected a type 8 ICMP packet (echo request) with an unusual payload.
The echo request command a fragment of a command that looked like part of a route add. Here's a PCAP of the ICMP ...
4
votes
1answer
93 views
Symbiote Counter-Attack Detection
I saw this video on YouTube about hacking Cisco phones (and other embedded systems) and I was overjoyed when the presenter not only hacked, but presented a security solution. Intrigued, I started ...
4
votes
1answer
79 views
Integrity check against package repository?
I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates.
From time to time I want to boot from a clean boot ...
4
votes
1answer
226 views
SSL protocol issues on OS X and iOS
I have a PfSense box as a UTM, running snort among other things. I started noticing that when MacBooks and iPhones/iPods connect to my network, the snort log gets flooded with this message:
...
4
votes
1answer
238 views
Attacks against HIDS software running on the same machine
I am interested in the attacks that could be used to compromise or disable HIDS software such as Tripwire or Samhain. I understand that ideally checks should be run periodically and the database ...
3
votes
2answers
445 views
C&C domains used by Flame/Skywiper trojan
I'm trying to figure out if any of our clients have been infected by the recent trojan/worm Flame.
I have access to our proxy logs, so I want to search for any requests made to the "known" C&C ...
3
votes
3answers
233 views
Is there an IDS based on process patterns?
After reading what Metasploit is able to do my grey hairs got even more.
From my understanding current attack methods are being done without tampering with any file in a filesystem - thus rendering ...
3
votes
1answer
409 views
Blacklist IP addresses based on number of 404s in Apache
I'm getting a lot of hackers spamming my domain with requests for files that just don't exist. This is eating up a lot of my allotted bandwidth and I'd like to blacklist these IP addresses.
Is there ...
3
votes
2answers
219 views
Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?
I understand that there are many applications such as Snort that do the job for network layer 3 IDS.
From what I have researched, layer 2 wireless IDS seems like a field that is very slow in ...
3
votes
1answer
235 views
Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?
I'm trying to develop an IDS/IPS system project to include these elements:
A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1)
A Linux server (Running Kismet server + client)
...
3
votes
1answer
167 views
Checkpoint NGX IPS & NAT
how does CheckPoint R65/R70 handle IPS violations of outbound traffic from hosts that are NAT'ed? Is it necessary to include the NAT'ed IP in the exceptions list or is it sufficient to include the ...
3
votes
1answer
243 views
Anomaly Intrusion Detection relevant features
I am researching on Anomaly Intrusion Detection to implement one. At this phase, I am searching for relevant features to network traffic.
I found 41 features from KDD CUP'99 project (the paper: WENKE ...
