Search Results

The obvious problem is that a conflict might arise with existing ids in the database for other items. … Apart from that there are attacks against assumptions about the ids made in your application. It looks like your application assumes random ids. …

alert tcp any any -> 192.168.6.4 any (msg:"FIN"; flags: F;) flags: F matches packets where the flag is exactly FIN. But if you want to match the end of the connection you usually encounter packets …

It is unknown what version you are using, but I will assume that you are not using a beta version. bitmask was only recently implemented in 6.0.0-beta1 and is at the time of this writing not available …

The technology is called OpenAppID. It is present in Snort since 2.9.7 - see this presentation from 2015 or this announcement from 2014.

Snort is more a traditional IDS/IPS which does some deep packet inspection and then applies signatures on the traffic in order to detect (and maybe block) attacks. … Classical signature based IDS like Snort or Suricata are instead more used as actual IDS, i.e the focus is on matching specific attack signatures. …

For testing, a simple google search was done in the web browser (firefox). Search engines today are usually accessed by HTTPS (and this is definitely true with Google). in HTTPS all the HTTP is …

If the hash is only used by itself to distinguish between malicious and non-malicious applications then it is probably not very effective since as you've said already hashes from various applications …

Snort and Suricata work on the packet level. While they can reassemble a TCP stream for analysis spanning multiple packets they have not the ability for making changes to the data stream which involve …

If you want to monitor data and also actively block traffic the IDS has to be in the path of the traffic. … But, as Josef noted in a comment: it should be setup in a way that users simply cannot bypass the IDS just by changing the gateway. …

I suspect that the report is kind of misleading in claiming the expired certificate as the problem. A certificate can not be used to decrypt traffic at all but rather the private key matching the cert …

It is generally recommended that the administration of a security device (IDS, firewall) should be done using a network you can trust as much as possible. … One can assume that the network where the IDS is looking for intrusions can not really be considered trusted, otherwise one would probably not use an IDS to detect potential attacks. …

Theoretically, could a Intrusion Prevention System (IPS) appliance ... placed in between an ISP/gateway and a vulnerable router/firewall have blocked the attack, assuming a matching signature was a …

The terms "Firewall" and "IPS" do not describe specific technical implementations and capabilities. While traditionally the term "Firewall" is mostly used to describe a stateless and then later a stat …

My guess is that the specific IDS rule only does only a very shallow inspection at the TCP level and has no deep enough understanding of the FTP/FTPS protocol. …

Another way sometimes employed in firewalls/IDS protecting a specific server (like in web application firewalls) is to not make this server the TLS endpoint. …