Hot answers tagged ids
7
The general ways that a rogue access points are found:
An enterprise wi-fi access point spends some of its time not just serving clients, but listening on various channels for other wi-fi traffic. (This works best for the 2.4Ghz band where there are fewer channels. Fortunately this is also where most run-of-the-mill, non-targeted attacks are going to be. ...
7
That's a very general question.
Your concern should not just in relation to Snort, it all depends on the platform that you install it on (o/s - yes it does run on Windows, CPU, memory etc) and what elements (pre-processors for fragmentation or stream reassembly) of Snort that you enable (look in the configuration file, typically /etc/snort.conf, for more ...
7
Sensor placement can be very tricky as there are loads of variables to consider. At minimum, you should take into account
Classification level of monitored resource
Network design
System throughput
Personnel time (for management and analysis)
Resource availability
Throwing all of those into a blender and turning on high for a few minutes will give you ...
6
This is exactly the problem that Secure Boot was created to solve. The problem is that if you don't have a chain of trust going all the way back to POST, then you can't guarantee that there hasn't been tampering. (And even then, "guarantee" is an exaggeration).
You can checksum the boot partition at startup; perhaps use the checksum as part of the key for ...
6
As far as I'm aware, Kaspersky were the first company to discover it and they've written some great blogs on it, with excellent detail on the registry keys, files etc that are affected but there isn't much information on the IP addresses of CC servers. Here's their most recent blog detailed the registry keys etc -
...
6
There are two subtly different things you might want to test.
Is Snort working in the sense that it's running, able to sniff trafic, testing it against the rules, and alerting you when one is triggered?
Is Snort working in the sense that it's current rule set detects a specific intrusion of type X?
To test case 1, you make a rule that's easy to fire, ...
6
Speculation: they look to hire people who have experience with:
OSSEC (host-based IDS)
Tripwire and Samhain (file integrity)
Splunk (log aggregation, reporting & alerting)
Nagios
firewall & threat management
grsecurity/pax/suhosin etc
Nmap, BackTrack, and Metasploit (proactive security tools)
When the perimeter was breached, their monitoring and ...
5
0000000: 00 01 72 6f 75 74 65 72 2e 63 6f 6e 66 00 6e 65 74 61 73 63 69 69 00
..router.conf.netascii.
That's probably a router, requesting the router.conf file in netascii encoding.
0000000: 00 01 42 6f 6f 74 5c 78 38 36 5c 77 64 73 6e 62 70 2e 63 6f 6d 00 6e 65 74 61
000001A: 73 63 69 69 00
..Boot\x86\wdsnbp.com.netascii.
That's a Windows PE attempt at ...
4
It depends. An IDS might detect the vulnerability, or it might not, depending upon whether it has the ability to detect exploitation of the vulnerability itself independent of the exploit payload.
In general, IDS systems can try to detect attacks either by trying to recognize the payload of an attack ("exploit code"), or by trying to recognize the ...
4
By definition, that is a NIDS. That may or may not be enough for your project.
What is possibly more important for a real world NIDS is how it is updated, how is is tuned, how it is managed, how it reports on exceptions or alerts etc. Any of the following would be useful in a NIDS.
Updates - using Snort signatures is useful. Is there any ...
4
The problem with ML is with the training. Over-training leads to matching the exact training set, making the learning non-generic.
Since my current employer develops scientific computing libraries for Python, I can point you to map-reduce on Disco for finding common clusters in log files: https://github.com/JensRantil/disco-slct
That's not a NN, but it ...
4
There has been an enormous amount of research into using machine learning techniques for anomaly detection, i.e., to scan network traffic and detect intrusions. However, this research has had very little practical impact. These techniques have seen little deployment and are rarely used in practice.
Why not? There are a number of reasons.
First, these ...
4
Web application firewalls like mod_security have the potential to be more effective than network-based IDSs like Snort, because a web firewall can see the request exactly as it will be handled by the web server, and a network-based IDS cannot.
Network-based systems, like Snort, can only see the network packets. They have to infer/guess how the web server ...
4
IPS like Snort are more of generalists for protecting commonly used Internet Protocols like HTTP, DNS, FTP, SMTP etc.
WAFs are supposed to be specialists for protecting HTTP.
Just to take injection attacks like SQLi, XSS as a starting point:
You can take some or all of mod_security's signatures and attempt to write equivalents for snort. However, IPS ...
4
I'll answer this as best I can, since some of it is subjective or subject to change.
As I mentioned in a comment, the barrier to entry in terms of development is higher for layer 2 than it is layer 3, and cables are easier to interface with than radio waves. Most wireless technology involves firmware on a hardware device in order to translate the RF signals ...
3
If you have Cisco networking equipment you can use Catalyst Switched Port Analyzer (SPAN) to mirror traffic from a port to another one which you have your snort sensor on.
Their is a Cisco SPAN Configuration example at http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml.
Other networking equipment has similar ...
3
Typically a honeynet is used as a defensive tool and is used to (sort of) trap attackers. It is designed to fool them into thinking they are on a real system (though most good attackers can quickly detect it's a honeypot). By fooling the attacker, the "honeypot owner" is hoping to learn more about the attacker's motives and techniques. The honeypot is ...
3
I doubt you can find any commercial product since this domain is highly commercialized and their is almost no open source implementation available and most of the work is done in is closed ecosystem. There has been a discussion on this topic you can find at link
The only open source tool i found was OSSEC it is a Host-Based Intrusion Detection and there is ...
3
How to do it depends on the size of your company and it's physical presence as well as how often you want to do it. There are actual rogue wifi detectors that you can install that do nothing else but scan for rogue wifis but that's probably overkill. Chances are the best way to do it is simply install a free detector on your phone and walk around looking for ...
3
I beleive there are currently two methods. The first is that you can use a physical detector, such as AirCheck, and follow the signal until you find it. Then you can identify wether its one you have put there, or if someone else has.
The other method would be to find them on the network side. This article details how it's possible using Nessus, and it ...
3
The only article I've seen so far that gives any IP or domain information is malwaresurival.net. It gives the following IP as one of the C&C servers: 91.203.214.72.
Here is the actual article: http://malwaresurvival.net/2012/05/29/is-the-flame-malware-a-trojan-or-worm/
Edit: This website now has a lot more of the C&C domains on it. ...
3
Sashank, That is a good question.
Writing rules is a fun research work. Often it takes lot of research and analysis, and sometimes for some threats its very easy to write a signature.
This is quick very high level overview of writing signatures. The things you should know before hand to perform analysis and to start writing rules -
Very good ...
3
Replacing 'signature' with 'rule'.
Sometimes it's a simple task, other times not so.
Rules are generally created (afaik) by examining packet captures of attacks/exploits and then creating rules that match that traffic pattern. The skill is creating a rule that is as precise as possible in order to limit false-positives but generic enough to ensure you ...
3
Many P2P software will create hashes of each piece to prevent a malicious entity from modifying the pieces in-flight. When your P2P client gets a piece, it verifies it's hash. This will prevent one malicious entity modifying a piece of a valid file, but it won't help you if the file itself (qwerty.mp3) is malicious.
If the file itself is malicious, a simple ...
3
To test that your default rules are working, assuming you've pulled them down with pulledpork, oinkmaster or something-else, you can simply browse to http://testmyids.com/ from a client whose traffic will be seen by the IDS, through your IDS device being inline or as a port span.
The http response contains the following text -
uid=0(root) gid=0(root) ...
3
There is some repositories of pcap traces. Some have traces of malware, port scanning, etc.. You can then replay these traces with tcpreplay.
http://www.pcapr.net/browse?q=malware
https://www.evilfingers.com/repository/pcaps.php
http://www.caida.org/data/passive/ddos-20070804_dataset.xml < DDOS.
3
If someone is accessing your computer then there will be network traffic related to this. While if you suspect that your PC has been compromised, then you can't rely on data you get from the computer but you could monitor the traffic using a seperate box and (e.g.) wireshark
3
netstat (network Statistics) is a simple command line tool that displays all active connections both incoming and out coming, and provides a number of useful network interface statistics. You can explore it further at how to use this command to detect suspicious IPs. For Blocking you can use IPtables which is a very useful network layer firewall to block all ...
3
This flaw should be graded by capability and exploitability.
Capability falls into the following categories:
The ability to alter information on the system that you should not be able to.
The ability to view information on the system that you should not be able to, such that a person's personal information is revealed, or credentials (or other items of ...
3
Using mod_security as a reverse proxy is common, especially in the IIS world where only recently has a free WAF has become available. Apache running as a reverse proxy will handle your SSL handshakes, so this won't be a problem.
However it sounds like you have a MUCH BIGGER PROBLEM on your hands. If you can't update Apache you are completely and ...
Only top voted, non community-wiki answers of a minimum length are eligible
