Hot answers tagged

19

A little background first. As you know, when communicating over a network, programs split raw data into "packets", which as well as this raw data also contain some extra information: Where does this particular packet fit inside the entire block of data being transmitted? Who does the packet come from? To whom does it need to be delivered? Routers are the ...


13

No, generally not, although of course they say they can. DDoS is about volume UTM is almost always at the local end of Internet access Therefore, DDoS can usually fill the Internet pipe before even reaching a UTM device. The reasoning - By definition a DDoS - being Distributed - is taking advantage of multiple attack points to generate a level of ...


9

Generally, if you are doing DoS from computer to another, you are hitting anything (like routers, ...) between them with the same load.


9

It depends on the kind of DPI you are talking about. If it is purely passive DPI (i.e. only looking at the packets) then you will not be able to detect it. If this is instead DPI which can modify the data then you might be able to detect it depending on the kind of access and knowledge you have. Some typical examples on how active DPI devices change ...


8

While the other answer focuses on modifying the exploit itself, you can also modify the transport of the exploit, so that the IDS will not detect it (Disclaimer: some of this points to my own research). Some examples on how to do this on the application layer with HTTP (i.e. for drive-by-downloads while browsing the web etc): Use a valid but less common ...


5

Being hit hundreds or thousands of times per day is completely normal, and I wouldn't worry about it at all. There are a few major sources of suspicious traffic: Automated scanners. A number of organizations "map" the Internet and produce a ton of traffic. They do so more or less randomly. I've gotten a lot of traffic on ports 80 and 443 despite not ...


5

You could sniff the network for traffic and change your network configuration to an active machine(i.e. MAC address): # ifconfig wlan0 down # ifconfig wlan0 hw ether DE:AD:66:55:12:34 <== sniffed MAC # ifconfig wlan0 up assuming wlan0 is your wireless network interface. On Windows you can do something like this. Now there should be two work stations ...


5

Since you mentioned home network, I'm going to bring up a couple of points that may be unique to them. First, there's the use of dumb switches. Quite often, home customer premises equipment will use dumb unmanaged switches with no support for spanning tree. Internally, this might be a separate switch chip or it might be integrated onto main ...


4

Utilizing readily available system resources. Alphanumeric shellcode. Encrypt the shellcode. Polymorphic shellcodes. Metamorphic shellcode. http://www.tenouk.com/Bufferoverflowc/Bufferoverflow5.html Follow the link and skip down to "More Advanced Techniques" for additional information.


4

If you start to send lots of packets it would probably create a bottleneck on the network. But you can try to send only a few packets just for testing purposes.


4

It will surely impact the complete network, as sending too many packets would lead to bandwidth starvation in the local network. Also the router through which you are connected could start dropping packets if it isn't capable of handling them all !! I would rather suggest for you to test the DDoS on a virtual environment.


4

Depends on the filter implementation and maybe the OS on the client machine. As you said - the IP address will end up in the TCP packets in its binary representation, regardless of how it was originally passed to the socket software layer. Firewalls will filter for this binary address and thus catch anything - there is no way around that. However, if the ...


4

First, you talk about HIDS and HIPS. The 'D' stands for "Detection". It means that the protection system will be able to detect and alert upon a possible security event, but it will not attempt to block anything. The 'P' stands for "Prevention". This means that when the protection system detects a possible security event, it will automatically try to block ...


3

Script kiddies need holidays too. Seriously, how about the answer "coincidence"? If there are usually one or two per day, it´s not that hard to believe that some days have 0. Just random background noise in the internet. Or maybe there was a single person repeatedly trying to get into your net. In this case, things happen to people. Computer broke; ...


3

The layout/format is usually determined by the con and specified in the CFP if not web based. As to the content of your CFP response i found this post to be very helpful when I started: https://www.defcon.org/html/links/dc-speakerscorner.html#nikita-cfp


3

No, Snort is not designed to log all application and events occurring in a system. A HIDS is not just a NIDS limited to just one host; it's a separate and additional layer of protections that can only be performed locally (like looking at files, processes, logs, and user contexts). Snort doesn't even try to do any of that.


3

So in overall,which one should I prefer ? You should prefer the one where you are able to deal with the logs and how much security you need and how much time you can invest to deal with false positives. Static signatures will fail to catch new attacks but have usually less false positives. Heuristics might catch more new malware but this usually comes ...


3

IDS can cover deep packet inspection, or a simple look at connection types, or anything in between. You can have Network IDS or Host IDS, depending on what you want to focus your attention on. DPI is a very specific type of analysis of packet contents in order to understand what the purpose of the communication is. Signature Based Detection does not ...


2

My suggestion is to go with the Scapy option. It is less painful in the long run and gives very very granular control over packets. If you want to test fragmentation for the purpose of bypassing IDS, you are going to need a LOT of trial and error, changing many and multiple fields (checksums, header length, packet length) and at least for scalability, you ...


2

A tool like HP ArcSight can be customized very deeply, and just writing the right use cases and rules to correlate relevant events and alert on meaningful incidents, is super hard. Many organizations fail miserably implementing ArcSight. Just getting raw logs through connectors to logger and then to ESM, and then writing use cases is a project that ...


2

Whats the difference between IDS and NIDS? The concept of IDS can be divided to Two classes, this are Host IDS and Network IDS or HIDS and NIDS. IDS / \ HIDS NIDS Host IDS Network IDS Inspecting Host Inspecting Network For ...


2

I think that it is not a good idea as this deployment would defeat the basic idea of SSL/TLS: End-to-end encryption. In practice, such a deployment can cause the following problems: Sites, web services etc. that use Certificate Pinning (e.g., via HPKP) would stop working because the browser / client is suddenly seeing a valid but different SSL ...


2

If you are able to define how sensitive data look at the network layer then you might do it. But there is no "sensitive data" flag or similar attached to the packets so usually one can not detect at the network layer what is sensitive or not. The problem I have is if someone compromises that Snort VM somehow, or even employee who is responsible for ...


2

I know most bots use either IRC or HTTP to communicate with the C&C As far a I know IRC is not much used any longer in current C&C communication because it is to easy to detect. Current C&C communication tries harder to blend in and uses mostly HTTP, but DNS is also used. So if a botnet is using HTTP, how can this be prevented? Just ...


2

Stream. Here is a good document regarding how snort uses libpcap to apply heuristic and signature based anomoly detection to network traffic; http://www.pearsonhighered.com/samplechapter/157870281X.pdf and when in doubt consult the manual https://www.snort.org/faq/readme-stream5


1

How to diagnose if you are under a brute scan or a targeted attack? If you have the possibility to do so, keep free a specific public @IP within your network. Register it correctly on the DNS as a typical name for a web server. But don't attribute this @IP to any real machine within your network. I mean don't go as far as to create a honey pot, just create ...


1

AFAIK several implementations exist, but openess is often limited by competitive advantage (AV companies for example). Microsoft has published much of their honeymonkey project. See http://research.microsoft.com/en-us/um/redmond/projects/strider/honeymonkey/ for more details.


1

A honeypot is not a plugin which will defend you while surfing. For this you already have several plugins available, each one dedicated to face different kind of attacks (whether it is phishing, tracking, SSL / JavaScript / Flash related, etc.). A honeypot on the contrary is made to attract and allow attacks to better study them. The way I could imagine ...


1

I would guess that this is an automated attack which does not have too much intelligence built-in. A sign of an automated script would be other (possibly unrelated) attempts from the same IP.


1

If you want something that provides advice targeted to your specific needs and environment, then a free Snort or Suricata install without a support contract from an established vendor or good consultant is probably not the best solution for your desires, though it may fit your budget. In general, start off with the default SNORT rulesets you use - the ...



Only top voted, non community-wiki answers of a minimum length are eligible