Tag Info

Hot answers tagged

13

No, generally not, although of course they say they can. DDoS is about volume UTM is almost always at the local end of Internet access Therefore, DDoS can usually fill the Internet pipe before even reaching a UTM device. The reasoning - By definition a DDoS - being Distributed - is taking advantage of multiple attack points to generate a level of ...


9

Neither of these technologies can prevent a DDoS attack, what they can do is help to prevent a DDoS attack from taking down services. They have completely different functions so you can't say one is better is better than the other. An Intrusion Prevention System looks for anomalous traffic on a network and can alert operations staff that a DoS attack is ...


8

While the other answer focuses on modifying the exploit itself, you can also modify the transport of the exploit, so that the IDS will not detect it (Disclaimer: some of this points to my own research). Some examples on how to do this on the application layer with HTTP (i.e. for drive-by-downloads while browsing the web etc): Use a valid but less common ...


7

Passively listening to network traffic to detecting suspicious behavior is still important. There are only a few obvious attacks which you might detect and block immediately but there is lots of traffic which only looks a bit suspicious or even innocent. But, if you collect traffic information over some time and maybe from multiple places in your network, ...


6

I would say that the main reason that most organizations would opt for an IDS over an IPS (assuming they do) is the fact that a false positive on an IDS is much less detrimental than an IPS' false positive. If an IPS incorrectly takes action against legitimate traffic it thinks is malicious then it's really doing more harm than good.


5

Functionally, they are two different applications, but they are often meshed together because the monitoring process tends to be at the edge off the network. Many times you see UTM (Unified Threat Management) which are firewalls with IPS/IDS services integrated as a subscription. Firewalls serve to control the inbound/outbound connections into an ...


5

You could sniff the network for traffic and change your network configuration to an active machine(i.e. MAC address): # ifconfig wlan0 down # ifconfig wlan0 hw ether DE:AD:66:55:12:34 <== sniffed MAC # ifconfig wlan0 up assuming wlan0 is your wireless network interface. On Windows you can do something like this. Now there should be two work stations ...


5

Being hit hundreds or thousands of times per day is completely normal, and I wouldn't worry about it at all. There are a few major sources of suspicious traffic: Automated scanners. A number of organizations "map" the Internet and produce a ton of traffic. They do so more or less randomly. I've gotten a lot of traffic on ports 80 and 443 despite not ...


4

Utilizing readily available system resources. Alphanumeric shellcode. Encrypt the shellcode. Polymorphic shellcodes. Metamorphic shellcode. http://www.tenouk.com/Bufferoverflowc/Bufferoverflow5.html Follow the link and skip down to "More Advanced Techniques" for additional information.


3

The contents of a shellshock attack are technically valid web server requests. You could aggressively cull them (by looking for strings which could possibly be a shellshock attack and blocking them), but it would have limitations for legitimate applications (such as those which need to work with binary data that may happen to fit a shellshock signature). ...


3

An antivirus solution will usually not detect it, because these programs only scan files. In case of the shellshock exploit, no files are written to the servers filesystem. Depending on whether or not an intrusion detection system detects this attack depends on how uncommon the activity really is for the specific web application it is protecting, so there ...


3

What you're seeing is automated probing for security holes in your website. Currently, attacks that try to retrieve the contents of wp-config.php are the big thing; other popular targets are phpMyAdmin and php-cgi. For probes like these, either you're vulnerable (and have probably already been successfully attacked) or you're not vulnerable (and have ...


3

The layout/format is usually determined by the con and specified in the CFP if not web based. As to the content of your CFP response i found this post to be very helpful when I started: https://www.defcon.org/html/links/dc-speakerscorner.html#nikita-cfp


3

Script kiddies need holidays too. Seriously, how about the answer "coincidence"? If there are usually one or two per day, it´s not that hard to believe that some days have 0. Just random background noise in the internet. Or maybe there was a single person repeatedly trying to get into your net. In this case, things happen to people. Computer broke; ...


2

Do they still sell IDS? I think most vendors these days have an Intrusion Prevention device. This device can be configured to work in 'IDS' or 'IPS' mode. In fact you can even be as specific as saying for a particular set of signatures just detect, do not prevent. You would do this for signatures that are known to throw a lot of false positives. And for some ...


2

As you mentioned if someone manages to get root access to your server its game over. The best practices to keep your server safe are: Strong password policy Keep it patched all the time Enforce additional safety mechanisms on the server such as SELinux, AppArmor etc... (assuming this is a linux server?) there is a good list of these on ubuntu's site Don't ...


2

I would first try to contact the vendor and explain to them what occurred so that they would re-do your license to allow you to move your scanner to where it should be. Most, if not all would do this. Secondly, I don’t want to misinterpret things here, but when you state “due to limitations on Gov cloud” I am interpreting this to mean you do not have ...


2

I don't have much experience with AWS, but if your main goal is to protect against web-related exploits like XSS, SQL injection, etc., then a web application firewall may be more effective. Snort certainly has rules available for these things, but in my experience a web application firewall will do a better job. This thread has a good explanation on why this ...


2

A tool like HP ArcSight can be customized very deeply, and just writing the right use cases and rules to correlate relevant events and alert on meaningful incidents, is super hard. Many organizations fail miserably implementing ArcSight. Just getting raw logs through connectors to logger and then to ESM, and then writing use cases is a project that ...


2

An NIDS would not be able to detect a buffer overflow for a couple of reasons. It's impossible to know what the target platform for the payload is; strictly based off of network traffic. Exploits at the network level most likely target some application or daemon on the other side. The buffer overflow is likely targeting a specific vulnerability, and this ...


2

So first lets look at these two. A Web Application Firewalls, as the name implies, work with web applications almost exclusively. Most WAF are often not best-of-breed traditional firewalls, and should not be implemented in place of a traditional network firewall. Typical WAF deployments feature SSL decryption of web application traffic and blocking of ...


2

No, Snort is not designed to log all application and events occurring in a system. A HIDS is not just a NIDS limited to just one host; it's a separate and additional layer of protections that can only be performed locally (like looking at files, processes, logs, and user contexts). Snort doesn't even try to do any of that.


2

Whats the difference between IDS and NIDS? The concept of IDS can be divided to Two classes, this are Host IDS and Network IDS or HIDS and NIDS. IDS / \ HIDS NIDS Host IDS Network IDS Inspecting Host Inspecting Network For ...


1

Trying to detect malicious URLs is a difficult and in many ways impossible game to win, just like trying to detect malware in executables. IF you are trying to protect your network from malicious URLs, there are threat feeds available, which are useful, be as others have stated, domains are cheap and easy to throw away. The strongest way to prevent ...


1

Domain names are cheap. Attackers are quite happy to register a domain to use in a single campaign. At some point thereafter the domain will be red-flagged by reputation services, but by that time the attacker has moved onto the next one.


1

Classical IDS work at the network layer and thus cannot handle encrypted connections like HTTPS which happen at the application or presentation layer (see OSI model). But, since you are interested only in detecting attacks by checking HTTP header fields (i.e. attacks at the application layer) you could built a (transparent) HTTP proxy instead and then do ...


1

Edit: just so I preempt comments along the lines you know nothing about how IPS works, I will stipulate that, and instead direct my answer towards the general method of inspecting HTTPS traffic. The short is answer is you can't. The long answer is you would have to perform MITM attacks against the connections. This can be done in cases when you only have ...


1

The shellshock vulnerability is a bug found in bash. Antivirus will not find it because it is not a virus (it is a bug in a program). Intrusion Detection Systems (IDS's) will not usually detect a vulnerability such as this unless it is being actively exploited (e.g. an intrusion is happening). As indicated in other answers, an intrusion detection system ...


1

One idea (though it may or may not be correct) is that malware on your system could be trying to reach out to its creator (e.g. to send out information or to allow for your system to be used in a botnet). The * is typically used as a "wild card". For example, the domain www.abc.3d-game.com should be found by the *.3d-game.com query. The domains shown here ...


1

This question is likely going to get flagged since it is vendor specific however I will take some time to answer your questions using a security approach. It's free and and open source - there is a cost associated with learning any tool and implementing it properly. There is also a cost associated with support. At crunch time, using an open source model, ...



Only top voted, non community-wiki answers of a minimum length are eligible