Tag Info

Hot answers tagged

9

The line is definitely blurring somewhat as technological capacity increases, platforms are integrated, and the threat landscape shifts. At their core we have Firewall - A device or application that analyzes packet headers and enforces policy based on protocol type, source address, destination address, source port, and/or destination port. Packets that do ...


8

You are correct to think that these three technologies are complementary and will often detect the same issues. However, that in itself is no reason not to use them in layers. One may catch things the other may not. Look at virus scanners - here's an example where only 14% of the 37 scanners attempted found the virus! And that's with the same exact type ...


7

The way to look at which is better for you is to work out what your risk appetite is. If you must have service at all costs then you don't want to fail closed, as any problem with that IPS will cause a Denial of Service. That is a very rare scenario though - the majority of implementations are configured to protect the server and the data on it. This is ...


7

These are scans for proxy servers. The first one tests for a SOCKS4 proxy, the second one for a SOCKS5 proxy, and the third one tests if your server allows forwarding via a CONNECT request to "valuable" ports (SMTP in this case). You don't have to be worried about that, it's what you expect to see on public servers. Your server answers with return code of ...


6

While there are some IDS/IPS devices which are marketed as 'minimal' setup, in reality IDS is one of the most setup-intensive devices in a typical network. In your situation, I would strongly suggest that you avoid this type of device as there is a high likelihood that false positives would further convince your client that he is being targeted. I would ...


6

I can think of some ways: Malware connect to C&C server. if you monitor your traffic (as sensitive system should be monitored) - than you find unusual traffic that can be sign (and should be investigated) If the malware uses USB flash drives to spread itself, and you have different computer platforms in your environment (e,g: windows, mac, linux and ...


5

It's generally not possible to tie a person to specific IP addresses without corroborating information, or help from an ISP/the police. The IP addresses you have listed all fall into a netblock owned by an Ottowa based company, which would tie in with what you've found so far. Realistically if that's all the information you have you'd need to see if the ...


4

The Bad News Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple locations. You'll still have alerts from signatures imported from both ddos.rules and log.rules logged together. The Good News Fear not, we can make it work. ...


4

The world is your oyster with this one. If you simply need to create one alert use a packet crafting tool like scapy. Testing a rule like this in snort is easy, however, this can work for all types of rules. alert tcp any any -> any 80 (content:"GET";) From here, just fire up scapy and at the console type: ...


3

Your question can be seen in broader context: How to defend against an APT (advanced persistent threat) style attack (aka targeted attack). Qucik recap about main characteristics of APT attacks: Attack vector As seen so far, most such attacks use one of three attack vectors (with some examples): spear phising: GhostNet Safe: A Targeted Threat ...


3

You can do this by making a customized active response. This will require you to write a script which can add IPs to your remote firewall. I suggest reading up on the linked documents as they explain this quite well.


3

To properly test your appliance and website I would get some pentesters involved and hand them over the rule set you are currently using. This will assist them in trying to create custom malicious payloads which would traverse the WAF for which you can then create additional rules. I would also make them test the application which you are protecting ...


3

Xen allows for transparent copying of a live machine (with Remus). The guest system ("domU" in Xen terminology) needs not be aware of this process. Consequently, if the VPS provider employees are intent on having a look at your machine without being detected, well, they technically can: they "just" have to make a live copy. This is inherent to the concept of ...


3

Let's get to the root of the problem(s): Someone is accessing his network remotely, and its likely all his passwords are compromised. If someone does have a hook into his network, no matter what he types, there is a high likelihood that his password is being either written (stored) or watched (keystroke logger). 1) Someone is accessing his network remotely. ...


3

There is a lot of discussions about this, for example honeywords: https://www.schneier.com/blog/archives/2013/05/honeywords.html Though I think that this approach brings a lot of additional administrative effort with it. User management, etc. You might want to check out active defense techniques, like Nova http://www.projectnova.org/ Mykonos ...


3

Snort doesn't support wildcards or regular expressions on IP addresses/ranges. It does support CIDR notation for IP ranges, a few pre-configured variables in snort.conf like $HOME_NET and similar, and a ! for IP or IP range negation (edit: Oh, and of course any, but not !any). What you could do however is to define a new ipvar variable, fill it with the ...


3

Snort isn't very good at keeping state over a longer period of time than a tcp session. Snort is very much signature based. What you want is more of a flow/heuristic based IDS. I run Snort AND the somewhat unknown and very under-rated Bro IDS: http://bro.org This provides MUCH better coverage and visibility into your network than Snort alone. ...


3

The email headers should suffice (see "email header ip address for an example of how to read them."). Perhaps post them here as well. I want to emphasize that while only the most recent header line is absolutely reliable, header information is really the only information about email origin that you can obtain. You could email a copy of the headers to the ...


3

I'm not aware of any official product similar to EICAR but I'd suggest that something noisy and easily noticeable as invalid, such as a Christmas tree scan should achieve what you're looking for. An IDS if configured to notice/block port scans should definitely notice something like that which uses a packet type which should never (AFAIK) be valid ...


2

It depends on what you want to do If you want to see what threats are being aimed at your from the internet. You can put the IDS outside the firewall (assuming you've hardened it appropriately) and behind the router. If you want to see what potentially malicious internal traffic you have inside your perimeter then monitoring from a point between the ...


2

For a dataset to assist the evaluation of IDS / IPS systems, I recommend you the following: http://iscx.ca/dataset ISCX 2012 dataset, collected in 2010 as a replacement for KDDCup99. The dataset has network packet filtering (NPF) attributes; it does not include KDDCup99's more expansive SIEM logging system data. Fortunately, it is labelled. ...


2

Short answer: no. Longer answer: If you've got coding chops, you basically need to add a new detection keyword that acts almost exactly like the threshold keyword, except it alerts for any packets after s seconds, rather than c packets within s seconds. This might be appealing if you're already building your sensors from source in your infrastructure. Not ...


2

Security onion sounds like your best bet. It will set up and IDS pretty fast. Have it watch traffic in and out of your network and install OSSEC on your clients at your house and point them to security onion. This website has all the information you need on the howto. http://securityonion.blogspot.com/


2

If you have an OSSEC agent running on the remote firewall, you can use native ossec commands. The < location > option defines where the active response should be executed. Normally it is configured to execute the active response on the host that generated the event ("local"), but can also be configured to execute the active response on any host that has ...


2

You have a few options: First one that comes to mind is creating an SSH tunnel from your Windows Server to your Syslog Server and sending your syslogs to localhost:1514 which would tunnel to logserver:514. This would encrypt your Syslog data in an SSH tunnel. You can do this several ways, like a batch script on startup to invoke PuTTy, like this ...


2

At face value, this is easy, but as anyone can tell by reading your question (or for those of us who have implemented something along these lines) this quickly becomes a can of worms. Lets look at a few potential metrics... Failed attempts per username -- the standard metric by which an account gets locked out, keep it low and most attacks will be ...


2

Difficult for a straight up answer since I have no indication of how many users you have, or intend on having, logging into your server. If this hits the thousands, you will be shooting yourself in the foot with so many false positives, that you will eventually ignore all alerts. So I will add my two cents to this devils advocate style: Brute forcing ...


2

False positives are a tricky issue. They deepening on your setup, the rules you use, and the IDS configuration. Generic industry numbers will not apply to your network. If you just want stats try NSS Labs, http://www.nsslabs.com. They do competitive testing for all types of security products and false positive rate is one of the metrics they use heavily.


2

The appliance is obviously using arbitrary names to name/describe those threats. Vendors often use such home-made naming/description conventions. For example: Symantec Virus Naming Convention Avira Malware Naming Convention And you can also find naming/description standards from the academic world or standard organizations, for example: MITRE MAEC ...


2

Sure this is possible. There's a couple of ways to approach it. The easiest way is to run kismet then as you're running it look for your Rogue access point appearing on the list of access points seen. When it does, lock the channel that kismet is looking on to the channel being used by your rogue access point (this gives a clearer signal than if kismet is ...



Only top voted, non community-wiki answers of a minimum length are eligible