Tag Info

Hot answers tagged

21

Auditd is an extraordinarily powerful monitoring tool. As anyone who has ever looked at it can attest, usability is the primary weakness. Setting up something like auditd requires a lot of pretty in-depth thought about exactly what it is that needs auditing on the specific system in question. In the question you decided on a web server as our example ...


15

You typically have two kinds of IDS, network-based and host-based, and these can be signature or statistical response types. Signature IDS's are simple, fast, and can be updated easily. Usually vendors supply signature files - similar to the way anti-virus vendors supply virus signatures. For this reason most IDS's use signature recognition. The downside is ...


13

I think there's something to be said for setting a bar, regardless of how low it is. Can Tripwire be bypassed? Sure. Will it catch things that you wouldn't otherwise? Yes it will. The main problem I've seen in a Tripwire installation is tuning it to where it isn't false-positive laden to the point of ignoring it. If it blows up every time someone ...


13

The most systematic answer is to implement split horizon DNS in your infrastructure, such that only internal addresses resolve; clients then must use a proxy server to connect out to the internet, and the proxy server resolves external DNS for them. This is particularly effective if your core network doesn't have a default route, so that packets destined ...


12

Yes you can, apache log gives you information about people who visited your website including bots and spiders. patterns you can check: someone made multiple requests in less than second or accepted time frame. accessed secure or login page multiple times in a one minute window. accessed non existent pages using different query parameters or path. apache ...


12

The line is definitely blurring somewhat as technological capacity increases, platforms are integrated, and the threat landscape shifts. At their core we have Firewall - A device or application that analyzes packet headers and enforces policy based on protocol type, source address, destination address, source port, and/or destination port. Packets that do ...


11

You will need a wireless nic that permits a 'monitor' mode, and that requires some special drivers and special nics. Kismet's list of cards for Linux tests on different cards pineapple device (special device) airpcap nic (specialized nic for Windows) Once you get a card, you will need software to deal with the data and Kismet is the leader in this area ...


10

You're somewhat approaching the question the wrong way. You need to decide what you want to log, and find out how to log that. Generating a bunch of log files is cool and all, but if you never look at them or don't know what you're looking for, it just wastes time and space. When deciding what to log, you need to identify what behavior it is that you care ...


10

This is a common method of editing files in Linux. Your editor opened the file, wrote your new changes someplace (with a new inode), and when that file was completely written it linked the hosts.deny location to the new inode. The reason this is done is to prevent file locking issues and to avoid partially clobbering a file. In this way, if I remove a file ...


9

Fail2ban does exactly what you ask. It monitors your log files looking for certain patterns and then executes whatever action you specify. You can block an IP for a length of time. It does require some skill in regex, but it comes packaged with regex testers.


9

The general ways that a rogue access points are found: An enterprise wi-fi access point spends some of its time not just serving clients, but listening on various channels for other wi-fi traffic. (This works best for the 2.4Ghz band where there are fewer channels. Fortunately this is also where most run-of-the-mill, non-targeted attacks are going to be. ...


9

These are scans for proxy servers. The first one tests for a SOCKS4 proxy, the second one for a SOCKS5 proxy, and the third one tests if your server allows forwarding via a CONNECT request to "valuable" ports (SMTP in this case). You don't have to be worried about that, it's what you expect to see on public servers. Your server answers with return code of ...


8

"and the demo website wouldn't let me log on, which doesn't engender extreme confidence" ouch.. I am the developer of Snorby and i'll bet 100 USD you were typing "snorby@snorby.com" (try .org). I have never had one issue with authentication or demo downtime since the launch of Snorby 2.x.x. Please make sure you verify credentials thoroughly before you post ...


8

Intrusion Detection Systems indeed are a natural fit for statistics. An interesting example I've come across: At host based IDSes, track and statistically analyze the system calls of an application. An interesting approach is to group the system calls in pairs, triples etc. and then observe their behavior when the application encounters an attack. Have a ...


8

Several areas use statistical means and probability theory. Intrusion Detection was mentioned already You mention SSH fingerprinting, which concerns the very large field of traffic analysis. There was a paper at Oakland Security & Privacy this year where they use this to decrypt encrypted VoIP. Another aspect is side-channel analysis, where you probe a ...


8

Tripwires are very useful for defending against userland rootkits. Kernelland rookits do not need to replace binaries to subvert the behavior of the system, usually these rootkits are just a Linux Kernel Module (LKM). In fact when you control the kernel like this any executable's behavior can be influenced without needing to modify the binary its self. ...


8

I don't know specifically about Stonesoft, but not only is IDS evasion real, it's also nothing new. There have been any number of techniques, vectors, and attacks to evade IDS - and really any network filtering mechanism - dating at least back a dozen years or so to RainForestPuppy's classic work on evasion mechanisms. New techniques come out all the time. ...


8

You are correct to think that these three technologies are complementary and will often detect the same issues. However, that in itself is no reason not to use them in layers. One may catch things the other may not. Look at virus scanners - here's an example where only 14% of the 37 scanners attempted found the virus! And that's with the same exact type ...


8

Neither of these technologies can prevent a DDoS attack, what they can do is help to prevent a DDoS attack from taking down services. They have completely different functions so you can't say one is better is better than the other. An Intrusion Prevention System looks for anomalous traffic on a network and can alert operations staff that a DoS attack is ...


7

Sensor placement can be very tricky as there are loads of variables to consider. At minimum, you should take into account Classification level of monitored resource Network design System throughput Personnel time (for management and analysis) Resource availability Throwing all of those into a blender and turning on high for a few minutes will give you ...


7

Due to the sensitive nature of APT and that it is closely aligned to espionage, the only real way to get a suitable feed will be through Government or National Law Enforcement agencies. The difficulty will be in establishing a level of trust to enable the sharing of information. For organisations within the USA, the advice is to contact your local FBI ...


7

Can't recall the name, but I know there's been at least one commercial product which used port 53 to phone home (not a full TCP/IP tunnel though). I would seriously question the (f)utility of trying to prevent this kind of thing by attempting to block specific outbound traffic though. Firewalls were never intended to filter outbound traffic, tunnels, ...


7

That's a very general question. Your concern should not just in relation to Snort, it all depends on the platform that you install it on (o/s - yes it does run on Windows, CPU, memory etc) and what elements (pre-processors for fragmentation or stream reassembly) of Snort that you enable (look in the configuration file, typically /etc/snort.conf, for more ...


7

This is the same as a High Interaction Honeypot idea, but you seem to be asking about embedding honeypot elements in production systems. Even so, I believe that the best practices for honeypots would apply here. As for your second bullet point, a Data Loss Protection system would seem to be a better way to go. You can monitor, track, and most importantly, ...


7

The way to look at which is better for you is to work out what your risk appetite is. If you must have service at all costs then you don't want to fail closed, as any problem with that IPS will cause a Denial of Service. That is a very rare scenario though - the majority of implementations are configured to protect the server and the data on it. This is ...


7

Passively listening to network traffic to detecting suspicious behavior is still important. There are only a few obvious attacks which you might detect and block immediately but there is lots of traffic which only looks a bit suspicious or even innocent. But, if you collect traffic information over some time and maybe from multiple places in your network, ...


6

Web application firewalls like mod_security have the potential to be more effective than network-based IDSs like Snort, because a web firewall can see the request exactly as it will be handled by the web server, and a network-based IDS cannot. Network-based systems, like Snort, can only see the network packets. They have to infer/guess how the web server ...


6

There are two subtly different things you might want to test. Is Snort working in the sense that it's running, able to sniff trafic, testing it against the rules, and alerting you when one is triggered? Is Snort working in the sense that it's current rule set detects a specific intrusion of type X? To test case 1, you make a rule that's easy to fire, ...


6

As far as I'm aware, Kaspersky were the first company to discover it and they've written some great blogs on it, with excellent detail on the registry keys, files etc that are affected but there isn't much information on the IP addresses of CC servers. Here's their most recent blog detailed the registry keys etc - ...


6

This is exactly the problem that Secure Boot was created to solve. The problem is that if you don't have a chain of trust going all the way back to POST, then you can't guarantee that there hasn't been tampering. (And even then, "guarantee" is an exaggeration). You can checksum the boot partition at startup; perhaps use the checksum as part of the key for ...



Only top voted, non community-wiki answers of a minimum length are eligible