Security Intern here given the assignment to find the IP address of an attacker using IBM's IDS.

The event or attack in question is entitled X509_Weak_Signature_Algorithm, and from what I understand, this attack involves exploiting MD5 to generate rogue certificates to compromise our servers.

When I go to review an individual event log, I noticed that the attacker's IP address is a Class A local IP.

Shouldn't this be a public IP address because we are being attacked by an external host?

  • Depends on your architecture? We'll need more info to work on. Where is your IDS situated in relation to the Internet?
    – schroeder
    Oct 9, 2014 at 21:33
  • It really depends on the environment setup. In your case I guess the "attacker" is inside your network.
    – Patel95
    Oct 9, 2014 at 21:33
  • this really isn't an answer
    – schroeder
    Oct 9, 2014 at 21:39
  • 1
    @user57339 I thot you said it was a private IP range?
    – schroeder
    Oct 9, 2014 at 21:56
  • 1
    There are a lot of reasons this could happen. Are you able to identify anything at all about the IP it was sourced from? It could be a load balancer pool or something similar, which would mean you'd have to look at the logs from that device (if they exist) to figure out more details. Unless there is a bug of some kind, the IDS can only report the IP it sees the attack from. NAT, Load Balancing, and other network tools may change the source IP while performing their functions. Oct 9, 2014 at 22:48

1 Answer 1


This is not an attack

The IDS is merely telling you that you have an SSL certificate with a weak algorithm. more info

The IP address is the address of your own internal server, that has the weak certificate.

  • I'd assume this too, but we're not getting enough detail and and the details we do get conflict.
    – schroeder
    Oct 10, 2014 at 14:18
  • link This is an audit, not an attack. To remedy it you should contact the owner of the server and get them to regenerate the certificate using SHA-256 or better. Users to the site are likely getting certificate warnings about the weak algorithm. You would get the same event if a malicious host was masquerading as the legitimate server (which means you don't know if this server is legitimate without additional information).
    – Jeff K
    Feb 24, 2017 at 20:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .