0

Security Intern here given the assignment to find the IP address of an attacker using IBM's IDS.

The event or attack in question is entitled X509_Weak_Signature_Algorithm, and from what I understand, this attack involves exploiting MD5 to generate rogue certificates to compromise our servers.

When I go to review an individual event log, I noticed that the attacker's IP address is a Class A local IP.

Shouldn't this be a public IP address because we are being attacked by an external host?

  • Depends on your architecture? We'll need more info to work on. Where is your IDS situated in relation to the Internet? – schroeder Oct 9 '14 at 21:33
  • It really depends on the environment setup. In your case I guess the "attacker" is inside your network. – Patel95 Oct 9 '14 at 21:33
  • this really isn't an answer – schroeder Oct 9 '14 at 21:39
  • 1
    @user57339 I thot you said it was a private IP range? – schroeder Oct 9 '14 at 21:56
  • 1
    There are a lot of reasons this could happen. Are you able to identify anything at all about the IP it was sourced from? It could be a load balancer pool or something similar, which would mean you'd have to look at the logs from that device (if they exist) to figure out more details. Unless there is a bug of some kind, the IDS can only report the IP it sees the attack from. NAT, Load Balancing, and other network tools may change the source IP while performing their functions. – theterribletrivium Oct 9 '14 at 22:48
2

This is not an attack

The IDS is merely telling you that you have an SSL certificate with a weak algorithm. more info

The IP address is the address of your own internal server, that has the weak certificate.

  • I'd assume this too, but we're not getting enough detail and and the details we do get conflict. – schroeder Oct 10 '14 at 14:18
  • link This is an audit, not an attack. To remedy it you should contact the owner of the server and get them to regenerate the certificate using SHA-256 or better. Users to the site are likely getting certificate warnings about the weak algorithm. You would get the same event if a malicious host was masquerading as the legitimate server (which means you don't know if this server is legitimate without additional information). – Jeff K Feb 24 '17 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.