Tag Info

Hot answers tagged

8

Neither of these technologies can prevent a DDoS attack, what they can do is help to prevent a DDoS attack from taking down services. They have completely different functions so you can't say one is better is better than the other. An Intrusion Prevention System looks for anomalous traffic on a network and can alert operations staff that a DoS attack is ...


8

While the other answer focuses on modifying the exploit itself, you can also modify the transport of the exploit, so that the IDS will not detect it (Disclaimer: some of this points to my own research). Some examples on how to do this on the application layer with HTTP (i.e. for drive-by-downloads while browsing the web etc): Use a valid but less common ...


7

Passively listening to network traffic to detecting suspicious behavior is still important. There are only a few obvious attacks which you might detect and block immediately but there is lots of traffic which only looks a bit suspicious or even innocent. But, if you collect traffic information over some time and maybe from multiple places in your network, ...


6

I would say that the main reason that most organizations would opt for an IDS over an IPS (assuming they do) is the fact that a false positive on an IDS is much less detrimental than an IPS' false positive. If an IPS incorrectly takes action against legitimate traffic it thinks is malicious then it's really doing more harm than good.


5

The Bad News Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple locations. You'll still have alerts from signatures imported from both ddos.rules and log.rules logged together. The Good News Fear not, we can make it work. ...


5

Next generation is just marketing lingo and "IDS" itself too, as do IPS, NGFW, UTM and whatever they come up with next week. The underlying technologies got several enhancements in the past, e.g. they can look deeper, may use anomaly detection etc - but in my opinion they are still dumb enough and can still be circumvented with not too much efforts. Don't ...


5

Functionally, they are two different applications, but they are often meshed together because the monitoring process tends to be at the edge off the network. Many times you see UTM (Unified Threat Management) which are firewalls with IPS/IDS services integrated as a subscription. Firewalls serve to control the inbound/outbound connections into an ...


5

Utilizing readily available system resources. Alphanumeric shellcode. Encrypt the shellcode. Polymorphic shellcodes. Metamorphic shellcode. http://www.tenouk.com/Bufferoverflowc/Bufferoverflow5.html Follow the link and skip down to "More Advanced Techniques" for additional information.


3

I think you can safely live normally ;) The user in this forum propably just took a guess on your UserAgent. This is neither considered hacking nor does it do any damage on your pc. There is even a Website telling you what OS you use, only by visiting it. There are also more informations about how this is working.


3

Large enterprises typically use NIDS - network intrusion detenction devices ( http://en.wikipedia.org/wiki/Network_intrusion_detection_system ). These are usually on a span port on the switch so they don't impact latency. Alternatively you might go for NIPS - network intrusion prevention which must be inline on the network and therefore is likely to alter ...


3

mitmssh is the only tool I'm aware of capable of MITM'ing SSHv2 sessions. If you're looking for after-the-fact capture decode, that's not possible, as SSH universally uses ephemeral key exchange mechanisms.


3

Configured properly, you shouldn't be able to detect snort. "Properly" means on an unconfigured/no-address-assigned port in promiscuous mode. As PTW-105 mentioned, if snort is configured to send resets then maybe you can detect it, but more likely, you'd detect that something was blocking you. The same holds true if it's in inline mode. Two things I can ...


3

What you're seeing is automated probing for security holes in your website. Currently, attacks that try to retrieve the contents of wp-config.php are the big thing; other popular targets are phpMyAdmin and php-cgi. For probes like these, either you're vulnerable (and have probably already been successfully attacked) or you're not vulnerable (and have ...


3

An antivirus solution will usually not detect it, because these programs only scan files. In case of the shellshock exploit, no files are written to the servers filesystem. Depending on whether or not an intrusion detection system detects this attack depends on how uncommon the activity really is for the specific web application it is protecting, so there ...


3

The contents of a shellshock attack are technically valid web server requests. You could aggressively cull them (by looking for strings which could possibly be a shellshock attack and blocking them), but it would have limitations for legitimate applications (such as those which need to work with binary data that may happen to fit a shellshock signature). ...


2

It sounds like what you're trying to do is block all traffic from Tor exit nodes. This is exactly opposite of what shady sites like Silk Road do, in that they allow traffic only from Tor exit nodes. Either configuration is easily done because all Tor exit nodes are published. See these two StackExchange articles about how to do this: Quick and easy ...


2

The main information I get from your question is that you don't know what kind of threats to expect in your network, but nevertheless you hope to address them using some kind of IDS. This will probably fail. So the first thing would be to make a risk analysis, develop a threat model and then do a cost/benefit analysis to decide which threats should ...


2

I'm not sure with pfsense, but this is possible with psad: psad makes use of Netfilter log messages to detect, alert, and (optionally) block port scans and other suspect traffic. For tcp scans psad analyzes tcp flags to determine the scan type (syn, fin, xmas, etc.) and corresponding command line options that could be supplied to nmap to generate such a ...


2

Two answers to this question: You can't Port Knocking Services exist to be connected to. If you have a service, then you need to allow clients to connect to it, and once you do that, it is open to be 'enumerated'. You can't block someone from trying a service to see if it responds because you need that ability for clients to connect to you. ... Unless ...


2

Sorry but this view that Linux is by default more secure than Windows is wrong. Does GnuTLS mean anything to anyone? How about all of the issues in OpenSSL recently? Vulnerabilities affect Linux just as much as Windows. More so in some cases. In general, as long as you are keeping your OS and applications patched, you are doing the first few things right. ...


2

Network IDS's tend to run passively, so they don't respond to network traffic: they just listen. No way to get it to respond in such a way as to determine that it is running, what kind, or what version. You'd need to go a different route to glean that info.


2

A lot of anti-malware 'heuristic'-engines do this kind of stuff. They check entropy of chunks of code, or even the entire PE. Lots of malware is obfuscated to exist longer in the wild. The problem with this kind of detection is that is works poorly with smart-er attackers. eg when I write exploits, I randomize everything keep things small and you will ...


2

The page lists the affected systems and your windows 7 32bit is not included: Affected Avaya DefinityOne Media Servers Avaya IP600 Media Servers Avaya S3400 Message Application Server Avaya S8100 Media Servers Microsoft Windows 2000 Advanced Server SP1, SP2, SP3, SP4 Microsoft Windows 2000 Datacenter Server SP1, SP2, SP3, SP4 Microsoft Windows 2000 ...


2

If you're worried about security you could use the naxsi module with nginx and catch such attempts a bit more explicitely with rules. I'm pretty happy with it - it's fast and lightweight. https://github.com/nbs-system/naxsi


2

As you mentioned if someone manages to get root access to your server its game over. The best practices to keep your server safe are: Strong password policy Keep it patched all the time Enforce additional safety mechanisms on the server such as SELinux, AppArmor etc... (assuming this is a linux server?) there is a good list of these on ubuntu's site Don't ...


2

Do they still sell IDS? I think most vendors these days have an Intrusion Prevention device. This device can be configured to work in 'IDS' or 'IPS' mode. In fact you can even be as specific as saying for a particular set of signatures just detect, do not prevent. You would do this for signatures that are known to throw a lot of false positives. And for some ...


2

I would first try to contact the vendor and explain to them what occurred so that they would re-do your license to allow you to move your scanner to where it should be. Most, if not all would do this. Secondly, I don’t want to misinterpret things here, but when you state “due to limitations on Gov cloud” I am interpreting this to mean you do not have ...


2

I don't have much experience with AWS, but if your main goal is to protect against web-related exploits like XSS, SQL injection, etc., then a web application firewall may be more effective. Snort certainly has rules available for these things, but in my experience a web application firewall will do a better job. This thread has a good explanation on why this ...


2

An NIDS would not be able to detect a buffer overflow for a couple of reasons. It's impossible to know what the target platform for the payload is; strictly based off of network traffic. Exploits at the network level most likely target some application or daemon on the other side. The buffer overflow is likely targeting a specific vulnerability, and this ...


2

A tool like HP ArcSight can be customized very deeply, and just writing the right use cases and rules to correlate relevant events and alert on meaningful incidents, is super hard. Many organizations fail miserably implementing ArcSight. Just getting raw logs through connectors to logger and then to ESM, and then writing use cases is a project that ...



Only top voted, non community-wiki answers of a minimum length are eligible