Hot answers tagged ids
13
Auditd is an extraordinarily powerful monitoring tool. As anyone who has ever looked at it can attest, usability
is the primary weakness. Setting up something like auditd requires a lot of pretty in-depth thought about exactly
what it is that needs auditing on the specific system in question. In the question you decided on a web server
as our example ...
12
You typically have two kinds of IDS, network-based and host-based, and these can be signature or statistical response types.
Signature IDS's are simple, fast, and can be updated easily. Usually vendors supply signature files - similar to the way anti-virus vendors supply virus signatures. For this reason most IDS's use signature recognition. The downside is ...
11
The most systematic answer is to implement split horizon DNS in your infrastructure, such that only internal addresses resolve; clients then must use a proxy server to connect out to the internet, and the proxy server resolves external DNS for them. This is particularly effective if your core network doesn't have a default route, so that packets destined ...
11
You will need a wireless nic that permits a 'monitor' mode, and that requires some special drivers and special nics.
Kismet's list of cards for Linux
tests on different cards
pineapple device (special device)
airpcap nic (specialized nic for Windows)
Once you get a card, you will need software to deal with the data and Kismet is the leader in this area ...
10
Yes you can, apache log gives you information about people who visited your website including bots and spiders.
patterns you can check:
someone made multiple requests in less than second or accepted time frame.
accessed secure or login page multiple times in a one minute window.
accessed non existent pages using different query parameters or path.
apache ...
10
I think there's something to be said for setting a bar, regardless of how low it is. Can Tripwire be bypassed? Sure. Will it catch things that you wouldn't otherwise? Yes it will.
The main problem I've seen in a Tripwire installation is tuning it to where it isn't false-positive laden to the point of ignoring it. If it blows up every time someone ...
9
This is a common method of editing files in Linux. Your editor opened the file, wrote your new changes someplace (with a new inode), and when that file was completely written it linked the hosts.deny location to the new inode.
The reason this is done is to prevent file locking issues and to avoid partially clobbering a file. In this way, if I remove a file ...
9
Intrusion Detection Systems indeed are a natural fit for statistics.
An interesting example I've come across:
At host based IDSes, track and statistically analyze the system calls of an application. An interesting approach is to group the system calls in pairs, triples etc. and then observe their behavior when the application encounters an attack.
Have a ...
8
You're somewhat approaching the question the wrong way. You need to decide what you want to log, and find out how to log that. Generating a bunch of log files is cool and all, but if you never look at them or don't know what you're looking for, it just wastes time and space.
When deciding what to log, you need to identify what behavior it is that you care ...
8
Several areas use statistical means and probability theory.
Intrusion Detection was mentioned already
You mention SSH fingerprinting, which concerns the very large field of traffic analysis. There was a paper at Oakland Security & Privacy this year where they use this to decrypt encrypted VoIP.
Another aspect is side-channel analysis, where you probe a ...
7
Due to the sensitive nature of APT and that it is closely aligned to espionage, the only real way to get a suitable feed will be through Government or National Law Enforcement agencies.
The difficulty will be in establishing a level of trust to enable the sharing of information.
For organisations within the USA, the advice is to contact your local FBI ...
7
I don't know specifically about Stonesoft, but not only is IDS evasion real, it's also nothing new.
There have been any number of techniques, vectors, and attacks to evade IDS - and really any network filtering mechanism - dating at least back a dozen years or so to RainForestPuppy's classic work on evasion mechanisms. New techniques come out all the time.
...
7
"and the demo website wouldn't let me log on, which doesn't engender extreme confidence" ouch.. I am the developer of Snorby and i'll bet 100 USD you were typing "snorby@snorby.com" (try .org). I have never had one issue with authentication or demo downtime since the launch of Snorby 2.x.x. Please make sure you verify credentials thoroughly before you post ...
7
Can't recall the name, but I know there's been at least one commercial product which used port 53 to phone home (not a full TCP/IP tunnel though).
I would seriously question the (f)utility of trying to prevent this kind of thing by attempting to block specific outbound traffic though. Firewalls were never intended to filter outbound traffic, tunnels, ...
7
Fail2ban does exactly what you ask.
It monitors your log files looking for certain patterns and then executes whatever action you specify. You can block an IP for a length of time.
It does require some skill in regex, but it comes packaged with regex testers.
7
The general ways that a rogue access points are found:
An enterprise wi-fi access point spends some of its time not just serving clients, but listening on various channels for other wi-fi traffic. (This works best for the 2.4Ghz band where there are fewer channels. Fortunately this is also where most run-of-the-mill, non-targeted attacks are going to be. ...
7
That's a very general question.
Your concern should not just in relation to Snort, it all depends on the platform that you install it on (o/s - yes it does run on Windows, CPU, memory etc) and what elements (pre-processors for fragmentation or stream reassembly) of Snort that you enable (look in the configuration file, typically /etc/snort.conf, for more ...
7
Sensor placement can be very tricky as there are loads of variables to consider. At minimum, you should take into account
Classification level of monitored resource
Network design
System throughput
Personnel time (for management and analysis)
Resource availability
Throwing all of those into a blender and turning on high for a few minutes will give you ...
6
Sales pitch from Stonesoft. I saw the entire video, and just like AviD said, IDS evasion is real and new ways to evade comes out all the time.
These guys probably found a new evasion technique which they are now marketing hard.
To answer your question, I believe they found an evasion technique which is yet undiscovered by most common IPS/IDS vendors. ...
6
This is the same as a High Interaction Honeypot idea, but you seem to be asking about embedding honeypot elements in production systems. Even so, I believe that the best practices for honeypots would apply here.
As for your second bullet point, a Data Loss Protection system would seem to be a better way to go. You can monitor, track, and most importantly, ...
6
Tripwires are very useful for defending against userland rootkits. Kernelland rookits do not need to replace binaries to subvert the behavior of the system, usually these rootkits are just a Linux Kernel Module (LKM). In fact when you control the kernel like this any executable's behavior can be influenced without needing to modify the binary its self. ...
6
I'd recommend having a look at the SANS Forensics blog (http://computer-forensics.sans.org), they've a few articles on Windows Registry analysis such as http://computer-forensics.sans.org/blog/2010/10/20/digital-forensics-autorun-registry-keys/.
Here's the link to all their blog posts on Registry Analysis - ...
6
There are two subtly different things you might want to test.
Is Snort working in the sense that it's running, able to sniff trafic, testing it against the rules, and alerting you when one is triggered?
Is Snort working in the sense that it's current rule set detects a specific intrusion of type X?
To test case 1, you make a rule that's easy to fire, ...
6
As far as I'm aware, Kaspersky were the first company to discover it and they've written some great blogs on it, with excellent detail on the registry keys, files etc that are affected but there isn't much information on the IP addresses of CC servers. Here's their most recent blog detailed the registry keys etc -
...
6
This is exactly the problem that Secure Boot was created to solve. The problem is that if you don't have a chain of trust going all the way back to POST, then you can't guarantee that there hasn't been tampering. (And even then, "guarantee" is an exaggeration).
You can checksum the boot partition at startup; perhaps use the checksum as part of the key for ...
6
Speculation: they look to hire people who have experience with:
OSSEC (host-based IDS)
Tripwire and Samhain (file integrity)
Splunk (log aggregation, reporting & alerting)
Nagios
firewall & threat management
grsecurity/pax/suhosin etc
Nmap, BackTrack, and Metasploit (proactive security tools)
When the perimeter was breached, their monitoring and ...
5
As Ams noted, log analysis won't cover all attacks and you won't see parameters of POST requests. However, analyzing logs for POST requests sometimes is very rewarding.
Specifically, POSTs are popular for sending malicious code to backdoor scripts. Such backdoors can be created somewhere deep in subdirectories or a backdoor code can be injected into a ...
5
Snort is an excellent IDS with a long track record. I have deployed slightly over a dozen sensors at my organization, and am continually adding more to the mix. Snort's biggest downfall is the fact that current versions are single-threaded, though that will be changing with the upcoming version 3 release. Combined with the Emerging Threats rules, I have ...
5
http://www.owasp.org/index.php/The_ESAPI_Web_Application_Firewall_%28ESAPI_WAF%29
http://www.owasp.org/index.php/OWASP_AppSensor_Project
http://qosient.com/argus/
http://ourmon.sourceforge.net
5
Absolutely. Specifically "promiscuous" mode is just a flag on the network stack that passes all packets seen on that interface up to the application layer. Using snort as an example, this is often how one will properly monitor multi-homed systems. One NIC monitoring each uplink.
Using snort as your IDS, please be careful with how it handles interface ...
Only top voted, non community-wiki answers of a minimum length are eligible
