Tag Info

Hot answers tagged

9

These are scans for proxy servers. The first one tests for a SOCKS4 proxy, the second one for a SOCKS5 proxy, and the third one tests if your server allows forwarding via a CONNECT request to "valuable" ports (SMTP in this case). You don't have to be worried about that, it's what you expect to see on public servers. Your server answers with return code of ...


8

You are correct to think that these three technologies are complementary and will often detect the same issues. However, that in itself is no reason not to use them in layers. One may catch things the other may not. Look at virus scanners - here's an example where only 14% of the 37 scanners attempted found the virus! And that's with the same exact type ...


8

Neither of these technologies can prevent a DDoS attack, what they can do is help to prevent a DDoS attack from taking down services. They have completely different functions so you can't say one is better is better than the other. An Intrusion Prevention System looks for anomalous traffic on a network and can alert operations staff that a DoS attack is ...


7

Passively listening to network traffic to detecting suspicious behavior is still important. There are only a few obvious attacks which you might detect and block immediately but there is lots of traffic which only looks a bit suspicious or even innocent. But, if you collect traffic information over some time and maybe from multiple places in your network, ...


6

I would say that the main reason that most organizations would opt for an IDS over an IPS (assuming they do) is the fact that a false positive on an IDS is much less detrimental than an IPS' false positive. If an IPS incorrectly takes action against legitimate traffic it thinks is malicious then it's really doing more harm than good.


5

It's generally not possible to tie a person to specific IP addresses without corroborating information, or help from an ISP/the police. The IP addresses you have listed all fall into a netblock owned by an Ottowa based company, which would tie in with what you've found so far. Realistically if that's all the information you have you'd need to see if the ...


5

The Bad News Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple locations. You'll still have alerts from signatures imported from both ddos.rules and log.rules logged together. The Good News Fear not, we can make it work. ...


5

Next generation is just marketing lingo and "IDS" itself too, as do IPS, NGFW, UTM and whatever they come up with next week. The underlying technologies got several enhancements in the past, e.g. they can look deeper, may use anomaly detection etc - but in my opinion they are still dumb enough and can still be circumvented with not too much efforts. Don't ...


5

Functionally, they are two different applications, but they are often meshed together because the monitoring process tends to be at the edge off the network. Many times you see UTM (Unified Threat Management) which are firewalls with IPS/IDS services integrated as a subscription. Firewalls serve to control the inbound/outbound connections into an ...


4

The world is your oyster with this one. If you simply need to create one alert use a packet crafting tool like scapy. Testing a rule like this in snort is easy, however, this can work for all types of rules. alert tcp any any -> any 80 (content:"GET";) From here, just fire up scapy and at the console type: ...


3

I'm not aware of any official product similar to EICAR but I'd suggest that something noisy and easily noticeable as invalid, such as a Christmas tree scan should achieve what you're looking for. An IDS if configured to notice/block port scans should definitely notice something like that which uses a packet type which should never (AFAIK) be valid ...


3

With OSSEC ver. 2.7.1, ossec.conf (by default located in /var/ossec/etc) contains the following active response configuration: <!-- Active Response Config --> <active-response> <!-- This response is going to execute the host-deny - command for every event that fires a rule with - level (severity) >= 6. - The IP is going to ...


3

Sure this is possible. There's a couple of ways to approach it. The easiest way is to run kismet then as you're running it look for your Rogue access point appearing on the list of access points seen. When it does, lock the channel that kismet is looking on to the channel being used by your rogue access point (this gives a clearer signal than if kismet is ...


3

The email headers should suffice (see "email header ip address for an example of how to read them."). Perhaps post them here as well. I want to emphasize that while only the most recent header line is absolutely reliable, header information is really the only information about email origin that you can obtain. You could email a copy of the headers to the ...


3

Configured properly, you shouldn't be able to detect snort. "Properly" means on an unconfigured/no-address-assigned port in promiscuous mode. As PTW-105 mentioned, if snort is configured to send resets then maybe you can detect it, but more likely, you'd detect that something was blocking you. The same holds true if it's in inline mode. Two things I can ...


3

I think you can safely live normally ;) The user in this forum propably just took a guess on your UserAgent. This is neither considered hacking nor does it do any damage on your pc. There is even a Website telling you what OS you use, only by visiting it. There are also more informations about how this is working.


3

Large enterprises typically use NIDS - network intrusion detenction devices ( http://en.wikipedia.org/wiki/Network_intrusion_detection_system ). These are usually on a span port on the switch so they don't impact latency. Alternatively you might go for NIPS - network intrusion prevention which must be inline on the network and therefore is likely to alter ...


3

What you're seeing is automated probing for security holes in your website. Currently, attacks that try to retrieve the contents of wp-config.php are the big thing; other popular targets are phpMyAdmin and php-cgi. For probes like these, either you're vulnerable (and have probably already been successfully attacked) or you're not vulnerable (and have ...


2

You route relevant traffic through your IDS yes. Latency will depend on your device's performance. VLANS are secure if implemented correctly. Make sure to also use 802.1x (PNAC) to authenticate devices at layer 2. Make sure you do not start routing between your VLANS (unless appropriate) Depends what type of VPN you employ, layer 3 or layer 2 VPN. Make sure ...


2

For a dataset to assist the evaluation of IDS / IPS systems, I recommend you the following: http://iscx.ca/dataset ISCX 2012 dataset, collected in 2010 as a replacement for KDDCup99. The dataset has network packet filtering (NPF) attributes; it does not include KDDCup99's more expansive SIEM logging system data. Fortunately, it is labelled. ...


2

False positives are a tricky issue. They deepening on your setup, the rules you use, and the IDS configuration. Generic industry numbers will not apply to your network. If you just want stats try NSS Labs, http://www.nsslabs.com. They do competitive testing for all types of security products and false positive rate is one of the metrics they use heavily.


2

EDIT: This one might be even better, though there might be some RH specific commands in there (probably not): http://oss.tresys.com/repos/clip-rhel5/trunk/puppet/modules/AU-2/templates/audit.rules Check out the bug report here: https://github.com/gds-operations/puppet-auditd/pull/1 They give a very long example file which contains many important ...


2

Difficult for a straight up answer since I have no indication of how many users you have, or intend on having, logging into your server. If this hits the thousands, you will be shooting yourself in the foot with so many false positives, that you will eventually ignore all alerts. So I will add my two cents to this devils advocate style: Brute forcing ...


2

At face value, this is easy, but as anyone can tell by reading your question (or for those of us who have implemented something along these lines) this quickly becomes a can of worms. Lets look at a few potential metrics... Failed attempts per username -- the standard metric by which an account gets locked out, keep it low and most attacks will be ...


2

Test My IDS has the output of the Unix `id' command, when run as root. It should alarm an IDS.


2

The appliance is obviously using arbitrary names to name/describe those threats. Vendors often use such home-made naming/description conventions. For example: Symantec Virus Naming Convention Avira Malware Naming Convention And you can also find naming/description standards from the academic world or standard organizations, for example: MITRE MAEC ...


2

The main information I get from your question is that you don't know what kind of threats to expect in your network, but nevertheless you hope to address them using some kind of IDS. This will probably fail. So the first thing would be to make a risk analysis, develop a threat model and then do a cost/benefit analysis to decide which threats should ...


2

mitmssh is the only tool I'm aware of capable of MITM'ing SSHv2 sessions. If you're looking for after-the-fact capture decode, that's not possible, as SSH universally uses ephemeral key exchange mechanisms.


2

Network IDS's tend to run passively, so they don't respond to network traffic: they just listen. No way to get it to respond in such a way as to determine that it is running, what kind, or what version. You'd need to go a different route to glean that info.


2

Sorry but this view that Linux is by default more secure than Windows is wrong. Does GnuTLS mean anything to anyone? How about all of the issues in OpenSSL recently? Vulnerabilities affect Linux just as much as Windows. More so in some cases. In general, as long as you are keeping your OS and applications patched, you are doing the first few things right. ...



Only top voted, non community-wiki answers of a minimum length are eligible