Tag Info

New answers tagged

3

If you use a public hosting service, that service could of course also keep track of what it's hosting and who uploaded and downloaded it. If the filehost is not a honeypot, if you use an unsecured or semisecured connection with a known protocol to transfer your files, the ISP could track whenever you initiate a file transfer. If the protocol works with an ...


1

As you don't have access to the uplink you could try a passive approach by installing a honeypot. A honeypot does not actively scan the network and is generally considered legal. It simply runs in the background waiting to be attacked. You are inside the network so if you are attacked you will get detailed information on the attack vector and source.


0

You leave out a bit of key information to consider. For example, when you say "attack" you don't mention what the target asset is running. In the case of an HTTPS website, most IDS/IPS's don't offer the ability to upload your SSL certificates in order to decrypt the traffic in order to inspect it. In this case, your IDS/IPS's are providing little to no ...


2

I'll turn your question around: "What attacks can only be detected by a combination of host and network data?" And the answer to that question is: not many. The true power of correlation of host and network data is the ability to see 'beyond' the attack to see how widespread it is and where it originated from. In other words, you correlate those ...


0

Correlation is used to reduce false positives. Intrusion Detection Systems are notorious for generating a large number of false positives due to the anomaly based detection. In case of signature based IDS the rate of false positives is reduced but the detection capability is limited to only known attacks for which the IDS has the detection signature. If ...


0

Well it depend firstly there are two types of IDS signature based and anomaly based. Signature based IDS work pretty similar to AV you have signatures with well know attack, so the IDS monitor packets on the network and compare them against a database of signatures if the packets are meet to some signature, the IDS will alert you. The other type is anomaly ...


1

I suspect they are oversimplifying. Your correct in that generally two way communication with a spoofed IP address is not possible. There were tcp sequencing attacks but they have not been practically possible for years. However there are so many other ways to hide your IP address; tor, pivoting off compromised hosts, using a VPN that won't keep logs, free ...



Top 50 recent answers are included