Intrusion Detection is ability of a system to analyze different parameters on a computer system to determine if a system is compromised or not. These can be done through: Log analysis Hash checking of files Network analysis
0
votes
1answer
61 views
How can I find out what user from a specified IP is doing with my server?
Yesterday night around 2:00, I occasionally try out a snippet:
netstat -ntu | tail -n +3|awk '{ print $5}' | cut -d : -f 1 | sort | uniq -c| sort -n -r | head -n 5
Then it turns out one IP is having ...
2
votes
2answers
52 views
Removing new fingerprint detection message from nmap
I run a nmap scan of my hosts daily to check for open ports.
sudo nmap -f -sS -sV --log-errors -append-output -p1-9999 host.com
But along with the output I get a long list of fingerprint ...
0
votes
1answer
94 views
what tool searches for /w00tw00t.at.ISC.SANS.DFind:)?
In my web server logs I get a lot of these:
[error] [client x.x.x.x] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)
I know it's just a failed ...
2
votes
1answer
71 views
Using a UTM with a Link Aggregrator
I consider changing my office's internet access infrastructure to multilpe ADSL lines aggregated with a link aggregator (Peplink B710).
I plan to place my existing UTM (FortiGate-100A) after the ...
3
votes
4answers
322 views
Asterisk Intrusion Prevention
Let me start of by saying that I'm a noob, and what I've figured out so far has only been by stumbling my way through it. I have Googled around and the solution may be out there already, but it was ...
1
vote
4answers
111 views
What response should be made to a continued web-app crack attempt?
I've issues with a continuous, concerted cracking attempt on a website (coded in php). The main problem is sql-injection attempts, running on a Debian server.
A secondary effect of the problem is ...
0
votes
2answers
91 views
Strange entry in Apache log
in my previous post I got something weird in Apache log. Again, I found something strange, but what freaks me out is the response code. It's not 501 anymore, but 200. What do you say? Should I enable ...
0
votes
2answers
93 views
last night, my server was doing something intensive with the hard drive
I have an ubuntu server running in my bedroom. It's connected to the internet. Last night, at 5am, it was doing some intensive i/o with the hard drive (I heard it) for like 20 minutes. I don't have ...
0
votes
1answer
202 views
Have I Just Been Hacked? (Intrusion Alert, Known Hacker's Email is Marked as Recipient for an Email in Thunderbird) [closed]
I'm a product creator, and in attempt to track and stem my losses from piracy, I occasionally visit a bulletin board dedicated to piracy and piracy-for-profit; my products are regularly pirated and ...
2
votes
1answer
187 views
Are random packets normal?
About a month ago on one of my servers I started receiving random packets from IPs all over the world. So I did the smart thing and stopped putting off installing an IDS. This IDS is a ClearOS Gateway ...
0
votes
1answer
274 views
How Does Cisco IPS Work?
How does it work? Does it typically have predefined patterns of trusted or malicious activity? Is it actually a category of firewall techniques? I am more curious about Cisco than I am about other ...
1
vote
2answers
124 views
IIS - Script for repeated hacks on a website
I currently have a site that is armored by ELMAH as its reporting mechanism. Each time someone hits a URL that is incorrect it notifies me or logs to the system. This is annoying for someone ...
1
vote
2answers
320 views
How to find security-leak after a skynet intrusion?
Some days ago, the server of a friend had an intrusion. The attack installed a new SSH daemon that let any valid account in, without providing a valid password. After login, each account automatically ...
1
vote
1answer
145 views
Intrusion detection
I've got a security project regarding the intrusion detection and prevention. I've been googling about it but didn't land up on something substantial. I'm supposed to submit an abstract as of now, I'd ...
4
votes
6answers
394 views
Why is my port 25 so active?
Using netstat -na I notice that I have a lot of connections like
tcp 0 0 XXX.XXX.XXX.XXX:25 YYY.YYY.YYY.YYY:13933 ESTABLISHED
tcp 0 0 XXX.XXX.XXX.XXX:25 ...
0
votes
1answer
258 views
Windows: Audit/View logins from remote networks?
i want to audit remote connection attempts to a Windows 2003 Server. i've changed the group policy to show logon successes and failures:
>gpedit.msc
Local Computer Policy
Computer ...
0
votes
2answers
411 views
AWS EC2: How to determine whether my EC2/scalr AMI was hacked? What to do to secure it?
(See update below)
I received notification from Amazon that my instance tried to hack another server. there was no additional information besides log dump:
Original report:
Destination IPs:
...
4
votes
5answers
4k views
Recommend alternative to tripwire?
Looking for a host-based IDS comparable to tripwire. Preferably one that allows centralized management. Right now I use tripwire and though it works management and reporting through a central server ...
4
votes
3answers
1k views
Comparison of Firewall, Intrusion Prevention, Detection and Antivirus Technologies in Organizational Network Architecture
in these days i'm reading about intrusion prevention/detection systems.When reading i really confused in some points.
First, the firewall and antivirus technologies are known terms for years, however ...
1
vote
1answer
783 views
Can snort output an alert for a portscan (sfPortscan) to syslog?
I've been working on this for too long now. I'm sure the answer should be obvious, but...
Snort manual:
http://www.snort.org/assets/125/snort_manual-2_8_5_1.pdf
lists two logging outputs on pg 39 (pg ...
1
vote
3answers
3k views
How to configure sensor rules in OSSIM
we've recently moved our NIDS installation from StrataGuard to the new OSSIM 2.1 release to take advantage of the additional features (Nagios, ntop, Nessus/OpenVas, etc.) it provides in addition to ...
1
vote
3answers
577 views
What are some of the commonly used rule actions in snort other than the defaults?
I'm writing a strict snort rule parser and I would like to accommodate snort rules from popular plugins. The documentation specifies that any action/type is possible because they can be defined by ...
2
votes
5answers
678 views
Utility to notify when website files are changed
Does any one know of a (preferably free) windows utility that recursively hashes all the files in a directory tree every x minutes and sends a notification if any files have changed.
I want to have a ...
3
votes
1answer
422 views
OSSIM In Production Environment
I am trying to get some real-world feedback on OSSIM.
Are you using OSSIM in production?
If so, what has your overall experiance been?
How many nodes are in your enviroment?
Finally, what kind ...
22
votes
15answers
2k views
Recommend an intrusion detection system (IDS/IPS), and are they worth it?
I have tried out various network-based IDS and IPS systems throughout the years and have never been happy with the results. Either the systems were too difficult to manage, only triggered on ...
5
votes
8answers
363 views
What is the best strategy for detecting database intrusions?
Filesystem intrusions can be detecting using tools such as Snort but it is more difficult to detect intrusions into a database, such as deletion of rows, modification of tables, etc. What is the best ...
