Hot answers tagged

20

IDSs and several deep inspection firewalls (sometimes called NGFW or UTM) can usually detect whether the traffic is HTTP or not. Also a reverse HTTP proxy in front would simply block anything which is not proper HTTP. But be aware that it is possible to build a reverse shell where the traffic will look like HTTP, so this filtering will only help a bit.


18

A little background first. As you know, when communicating over a network, programs split raw data into "packets", which as well as this raw data also contain some extra information: Where does this particular packet fit inside the entire block of data being transmitted? Who does the packet come from? To whom does it need to be delivered? Routers are the ...


10

The attacker can easily mimic HTTP traffic, so I will doubt any IDS/IPS would prevent a well developed shell from mimicking HTTP requests to exfiltrate data. It's very easy to create a fake HTML page, embed the images with <img src="data:image/png;base64,iVBORw0KG…8bg5CYII="> and put the traffic inside. A lossless compression (like PNG) will allow ...


10

It depends on the kind of DPI you are talking about. If it is purely passive DPI (i.e. only looking at the packets) then you will not be able to detect it. If this is instead DPI which can modify the data then you might be able to detect it depending on the kind of access and knowledge you have. Some typical examples on how active DPI devices change ...


9

Generally, if you are doing DoS from computer to another, you are hitting anything (like routers, ...) between them with the same load.


6

Advanced IPS/IDS can help you. but there are some kinds of firewalls that are completely customized for web (HTTP/HTTPS). They are called WAFs, Web Application Firewalls. A good WAF with a proper configuration can prevent many attacks, like the one which you're speaking about.


5

There are various ways that comes handy with nmap to evade the basic rules of firewall or Intrusion detection system. 1) Packet Fragmentation: This option evade pattern matching detection technique. Since packet reassembly can be quite processor intensive, it's common for admin to disable it. In snort, fragmentation reassembly functionality is disabled ...


4

Depends on the filter implementation and maybe the OS on the client machine. As you said - the IP address will end up in the TCP packets in its binary representation, regardless of how it was originally passed to the socket software layer. Firewalls will filter for this binary address and thus catch anything - there is no way around that. However, if the "...


4

First, you talk about HIDS and HIPS. The 'D' stands for "Detection". It means that the protection system will be able to detect and alert upon a possible security event, but it will not attempt to block anything. The 'P' stands for "Prevention". This means that when the protection system detects a possible security event, it will automatically try to block ...


4

Since you mentioned home network, I'm going to bring up a couple of points that may be unique to them. First, there's the use of dumb switches. Quite often, home customer premises equipment will use dumb unmanaged switches with no support for spanning tree. Internally, this might be a separate switch chip or it might be integrated onto main system-on-a-chip....


3

So in overall,which one should I prefer ? You should prefer the one where you are able to deal with the logs and how much security you need and how much time you can invest to deal with false positives. Static signatures will fail to catch new attacks but have usually less false positives. Heuristics might catch more new malware but this usually comes ...


3

IDS can cover deep packet inspection, or a simple look at connection types, or anything in between. You can have Network IDS or Host IDS, depending on what you want to focus your attention on. DPI is a very specific type of analysis of packet contents in order to understand what the purpose of the communication is. Signature Based Detection does not ...


3

If you start to send lots of packets it would probably create a bottleneck on the network. But you can try to send only a few packets just for testing purposes.


3

It will surely impact the complete network, as sending too many packets would lead to bandwidth starvation in the local network. Also the router through which you are connected could start dropping packets if it isn't capable of handling them all !! I would rather suggest for you to test the DDoS on a virtual environment.


3

This is of course only an example and I'm aware of the possibility to hide the payload in a seemingly correctly designed payload. It's all about making it harder for the bad guys. It's not merely "possible." It's easy. In fact, under HTML5, it is downright trivial. With WebSockets, an HTTP-like connection can tunnel arbitrary content between client-side ...


3

DNS does not use ICMP. It uses UDP (and rarely TCP) port 53. The firewall/router the captive portal contols either does not block that port or it is the DNS server and is responding. All other traffic are of course blocked until you log in. Response to comment: For 2), UDP has no session control, i.e. it just sends a packet without checking if it has ...


2

I know most bots use either IRC or HTTP to communicate with the C&C As far a I know IRC is not much used any longer in current C&C communication because it is to easy to detect. Current C&C communication tries harder to blend in and uses mostly HTTP, but DNS is also used. So if a botnet is using HTTP, how can this be prevented? Just ...


2

If you are able to define how sensitive data look at the network layer then you might do it. But there is no "sensitive data" flag or similar attached to the packets so usually one can not detect at the network layer what is sensitive or not. The problem I have is if someone compromises that Snort VM somehow, or even employee who is responsible for ...


2

Instead of the http_header keyword, use the http_host keyword. It will specifically match against the "Host" header. For wildcard matching you should have a look at PCRE: Suricata User Guide » Suricata Rules » Payload keywords » pcre (Perl Compatible Regular Expressions)


2

I think that it is not a good idea as this deployment would defeat the basic idea of SSL/TLS: End-to-end encryption. In practice, such a deployment can cause the following problems: Sites, web services etc. that use Certificate Pinning (e.g., via HPKP) would stop working because the browser / client is suddenly seeing a valid but different SSL certificate....


2

Stream. Here is a good document regarding how snort uses libpcap to apply heuristic and signature based anomoly detection to network traffic; http://www.pearsonhighered.com/samplechapter/157870281X.pdf and when in doubt consult the manual https://www.snort.org/faq/readme-stream5


2

It depends on how your network is setup; but usually the IP is not stripped and the packet headers contain the original source and destination. Generally, a core switch comes after a router, the router is likely on an enterprise network to be doing a lot of NAT translations. In which case, you may see the NAT IP of a given packet be referenced (e.g ...


2

At OSI lvl. 3 it is captured AND handled lvl 4-7 in a sandboxes, that are making the analysis and emulation in secured environment. UPDATE: In case of FTP, it listens for a packets coming to FTP port, captures them, after that libemu takes its part and the process begins : it creates layer7-to-layer4 "thing" that acts like a FTP server. The "thing" is ...


2

My answer would require writing some code. I'm only posting this answer because you mentioned a programming related solution in your question. Ever since Window Vista, the windows kernel raises an event for basically every single thing that happens on your computer. Microsoft provides a library called TraceEvent for .NET that makes it absolutely trivial to ...


2

Many file-encrypting ransomware viruses add some "unique" file extension to the name of the affected file and leave a "manual" of how to decrypt the files in the affected directories. This is one of the easiest ways to detect them. On windows file servers you can set up the file server ressource manager to look for those files and block the creation or ...


1

HIDS is very much overkill for a home PC unless you are doing something super-sensitive. More importantly though, HIDS is reactive and to react, you have to monitor it. So the HIDS app is only a part of the solution. You need event reporting and collation and you need both eyes on the output and a way to do something if you get an event. I've seen far too ...


1

Based on the description of fwsnort it is a packet level IDS using the iptables string matching feature. This means that it can not apply any rules which span multiple packets. This includes any serious application level analysis like looking into SMTP (mail) and HTTP (web) traffic. Thus if you care mostly about attacks at the lower layers it might be ...


1

DNS request logging on your local DNS forwarder (Domain Controllers) is the easiest. Blocking TCP/UDP port 53 outbound except for your Domain Controllers lets you be assured that only they can do recursive DNS lookups. Netflow is another option, but has large data storage requirements since you are storing lifecycle and endpoint information about all UDP ...


1

In IDS in the classical sense is passive (D for detection) and can not drop a packet. In IPS instead (P for prevention) can drop the packet and better should do it. But the usage of the words IDS, IPS, firewall etc is too vague today that it is not clear which kind of technique you are talking about.


1

As schroeder said, your job seems to pinpoint whether the IDS/IPS correctly enforce the company policy, ie. raise an alert when something goes against the policy and remain quiet when the traffic complies with the policy. So there is just no way you can correctly check if the IDS/IPS is "correctly configured" without having a clear knowledge of the current ...



Only top voted, non community-wiki answers of a minimum length are eligible