Tag Info

Hot answers tagged

13

No, generally not, although of course they say they can. DDoS is about volume UTM is almost always at the local end of Internet access Therefore, DDoS can usually fill the Internet pipe before even reaching a UTM device. The reasoning - By definition a DDoS - being Distributed - is taking advantage of multiple attack points to generate a level of ...


8

Neither of these technologies can prevent a DDoS attack, what they can do is help to prevent a DDoS attack from taking down services. They have completely different functions so you can't say one is better is better than the other. An Intrusion Prevention System looks for anomalous traffic on a network and can alert operations staff that a DoS attack is ...


8

While the other answer focuses on modifying the exploit itself, you can also modify the transport of the exploit, so that the IDS will not detect it (Disclaimer: some of this points to my own research). Some examples on how to do this on the application layer with HTTP (i.e. for drive-by-downloads while browsing the web etc): Use a valid but less common ...


7

Passively listening to network traffic to detecting suspicious behavior is still important. There are only a few obvious attacks which you might detect and block immediately but there is lots of traffic which only looks a bit suspicious or even innocent. But, if you collect traffic information over some time and maybe from multiple places in your network, ...


6

I would say that the main reason that most organizations would opt for an IDS over an IPS (assuming they do) is the fact that a false positive on an IDS is much less detrimental than an IPS' false positive. If an IPS incorrectly takes action against legitimate traffic it thinks is malicious then it's really doing more harm than good.


5

Functionally, they are two different applications, but they are often meshed together because the monitoring process tends to be at the edge off the network. Many times you see UTM (Unified Threat Management) which are firewalls with IPS/IDS services integrated as a subscription. Firewalls serve to control the inbound/outbound connections into an ...


4

Utilizing readily available system resources. Alphanumeric shellcode. Encrypt the shellcode. Polymorphic shellcodes. Metamorphic shellcode. http://www.tenouk.com/Bufferoverflowc/Bufferoverflow5.html Follow the link and skip down to "More Advanced Techniques" for additional information.


3

What you're seeing is automated probing for security holes in your website. Currently, attacks that try to retrieve the contents of wp-config.php are the big thing; other popular targets are phpMyAdmin and php-cgi. For probes like these, either you're vulnerable (and have probably already been successfully attacked) or you're not vulnerable (and have ...


3

An antivirus solution will usually not detect it, because these programs only scan files. In case of the shellshock exploit, no files are written to the servers filesystem. Depending on whether or not an intrusion detection system detects this attack depends on how uncommon the activity really is for the specific web application it is protecting, so there ...


3

Large enterprises typically use NIDS - network intrusion detenction devices ( http://en.wikipedia.org/wiki/Network_intrusion_detection_system ). These are usually on a span port on the switch so they don't impact latency. Alternatively you might go for NIPS - network intrusion prevention which must be inline on the network and therefore is likely to alter ...


3

I think you can safely live normally ;) The user in this forum propably just took a guess on your UserAgent. This is neither considered hacking nor does it do any damage on your pc. There is even a Website telling you what OS you use, only by visiting it. There are also more informations about how this is working.


3

Two answers to this question: You can't Port Knocking Services exist to be connected to. If you have a service, then you need to allow clients to connect to it, and once you do that, it is open to be 'enumerated'. You can't block someone from trying a service to see if it responds because you need that ability for clients to connect to you. ... Unless ...


3

The contents of a shellshock attack are technically valid web server requests. You could aggressively cull them (by looking for strings which could possibly be a shellshock attack and blocking them), but it would have limitations for legitimate applications (such as those which need to work with binary data that may happen to fit a shellshock signature). ...


3

The layout/format is usually determined by the con and specified in the CFP if not web based. As to the content of your CFP response i found this post to be very helpful when I started: https://www.defcon.org/html/links/dc-speakerscorner.html#nikita-cfp


3

Script kiddies need holidays too. Seriously, how about the answer "coincidence"? If there are usually one or two per day, it´s not that hard to believe that some days have 0. Just random background noise in the internet. Or maybe there was a single person repeatedly trying to get into your net. In this case, things happen to people. Computer broke; ...


2

I'm not sure with pfsense, but this is possible with psad: psad makes use of Netfilter log messages to detect, alert, and (optionally) block port scans and other suspect traffic. For tcp scans psad analyzes tcp flags to determine the scan type (syn, fin, xmas, etc.) and corresponding command line options that could be supplied to nmap to generate such a ...


2

A lot of anti-malware 'heuristic'-engines do this kind of stuff. They check entropy of chunks of code, or even the entire PE. Lots of malware is obfuscated to exist longer in the wild. The problem with this kind of detection is that is works poorly with smart-er attackers. eg when I write exploits, I randomize everything keep things small and you will ...


2

The page lists the affected systems and your windows 7 32bit is not included: Affected Avaya DefinityOne Media Servers Avaya IP600 Media Servers Avaya S3400 Message Application Server Avaya S8100 Media Servers Microsoft Windows 2000 Advanced Server SP1, SP2, SP3, SP4 Microsoft Windows 2000 Datacenter Server SP1, SP2, SP3, SP4 Microsoft Windows 2000 ...


2

As you mentioned if someone manages to get root access to your server its game over. The best practices to keep your server safe are: Strong password policy Keep it patched all the time Enforce additional safety mechanisms on the server such as SELinux, AppArmor etc... (assuming this is a linux server?) there is a good list of these on ubuntu's site Don't ...


2

Do they still sell IDS? I think most vendors these days have an Intrusion Prevention device. This device can be configured to work in 'IDS' or 'IPS' mode. In fact you can even be as specific as saying for a particular set of signatures just detect, do not prevent. You would do this for signatures that are known to throw a lot of false positives. And for some ...


2

I would first try to contact the vendor and explain to them what occurred so that they would re-do your license to allow you to move your scanner to where it should be. Most, if not all would do this. Secondly, I don’t want to misinterpret things here, but when you state “due to limitations on Gov cloud” I am interpreting this to mean you do not have ...


2

I don't have much experience with AWS, but if your main goal is to protect against web-related exploits like XSS, SQL injection, etc., then a web application firewall may be more effective. Snort certainly has rules available for these things, but in my experience a web application firewall will do a better job. This thread has a good explanation on why this ...


2

An NIDS would not be able to detect a buffer overflow for a couple of reasons. It's impossible to know what the target platform for the payload is; strictly based off of network traffic. Exploits at the network level most likely target some application or daemon on the other side. The buffer overflow is likely targeting a specific vulnerability, and this ...


2

A tool like HP ArcSight can be customized very deeply, and just writing the right use cases and rules to correlate relevant events and alert on meaningful incidents, is super hard. Many organizations fail miserably implementing ArcSight. Just getting raw logs through connectors to logger and then to ESM, and then writing use cases is a project that ...


2

No, Snort is not designed to log all application and events occurring in a system. A HIDS is not just a NIDS limited to just one host; it's a separate and additional layer of protections that can only be performed locally (like looking at files, processes, logs, and user contexts). Snort doesn't even try to do any of that.


2

Whats the difference between IDS and NIDS? The concept of IDS can be divided to Two classes, this are Host IDS and Network IDS or HIDS and NIDS. IDS / \ HIDS NIDS Host IDS Network IDS Inspecting Host Inspecting Network For ...


1

The shellshock vulnerability is a bug found in bash. Antivirus will not find it because it is not a virus (it is a bug in a program). Intrusion Detection Systems (IDS's) will not usually detect a vulnerability such as this unless it is being actively exploited (e.g. an intrusion is happening). As indicated in other answers, an intrusion detection system ...


1

One idea (though it may or may not be correct) is that malware on your system could be trying to reach out to its creator (e.g. to send out information or to allow for your system to be used in a botnet). The * is typically used as a "wild card". For example, the domain www.abc.3d-game.com should be found by the *.3d-game.com query. The domains shown here ...


1

This question is likely going to get flagged since it is vendor specific however I will take some time to answer your questions using a security approach. It's free and and open source - there is a cost associated with learning any tool and implementing it properly. There is also a cost associated with support. At crunch time, using an open source model, ...


1

That's funny, I was just reading about SPADE yesterday because I had a similar question. I'd be curious to hear more about what you come up with. Meanwhile, I can point you to some other resources. There has been some talk about anomaly detection on the dailydave mailing list over the past two months, but no particular tool or technique stood out and there ...



Only top voted, non community-wiki answers of a minimum length are eligible