4 ms·
From the perspective of an information security researcher with plenty of time spent working on both sides of the issue, I can tell you that any attacker worth
by ax0n 16y ago
From the perspective of an information security researcher with plenty of time spent working on both sides of the issue, I can tell you that any attacker worth their salt will be persistent and use multiple attack vectors to get what they want. This holds true for bored teens, corporate spies and real penetration testers (not just dorks that get paid to run scanning tools on your network) alike.
I've spent the last decade doing mostly IT Security defense work. I don't worry when I see someone port-scan my servers. Those kiddos are almost always benign. I worry when I see that our IDS starts to correlate many subtle attacks over a long period of time from similar places (such as the same school, ISP, etc)
- kranner 16y agoThat's interesting. I've never admin'ed a server before so I hadn't thought about this at all. It'll probably be useful to me to keep more verbose access logs and hash IP addresses to track what individual users (at least those not behind a group firewall) are up to. Thanks for the tip!
- bl4k 16y agoYou should be most paranoid when you see/hear nothing
- jon_dahl 16y agoAt the moment, I don't hear/see ninjas sneaking up on me, hackers taking down my web app, a terrorist plot, or the shadow government spying on me. Oh crap.
- ax0n 16y agoPlease. No attack is perfectly stealth. Keep in mind I've played both sides of this game. People who know how attacks work in the wild can usually spot things that might not raise the ire of average sysadmins.
- bl4k 16y agoSo you are saying that in 2 minutes that you aren't watching logs somebody can't gain access, clear out the IDS and other logs and reset tripwire?
- ax0n 16y agoNo, I'm saying an attacker would also have to find and destroy the immutable central logging store that all the stuff goes to. They'd also have to reach through the sands of time to get the stuff that's already been blowing up my phone. Get over yourself. It's worth mentioning that no one is perfectly secure, either. A sufficiently bored, persistent and motivated attacker WILL find some kind of way in. I'll give you that. I've seen it play out enough times. But with centralized logging, transaction shipping for hot-site replication, and sufficient effort placed on separation of duties, an organization can minimize the impact a successful attacker can have, and can ensure that all audit trails remain intact in some way or another.
- bl4k 16y agoI am over myself. Note that everything I replied with was a question, and that I haven't had to proceed anything I have said with something like 'Keep in mind I've played both sides of this game'. Anyway, to go on (keep in mind that I am genuinely interested in what you have to say). Isn't it true though that your IDS is only as good as your signature db? So if there was sshd or ftpd 0day that wasn't generic (generic shellcode etc.) that in theory you could spawn a shell without it ever being logged?
- ax0n 16y agoIt's true. You could. But that shell and the activities therein would get logged in places that would make it hard for most attackers to cover their tracks. Mandatory Access Control and privilege separated daemons should also severely limit what that shell can do. I'm not trying to have a pissing contest, but the reason we have defense in depth isn't to get 100% secure. You and I both know it's impossible. It's also there to preserve evidence if the unthinkable occurs. I do genuinely appreciate the forward thinking, so I'm sorry if I was a tad harsh in my reply above. Your responses (and your HN bio) came off a tad skiddie-ish at first blush. Being in infosec, where "Hacker" has a different meaning and stigma than "Hacker" in HN was originally meant to convey, I'm actually glad there are threads where Infosec "hacking" discussions can occur without getting completely buried by haters.
- bostonvaulter2 16y agoWhat IDS do you use? Snort? What would you recommend for a home and business environment?
- ax0n 16y agoI don't generally talk in public forum about the specific products I use, but if you want to play with an IDS at home: snort or suricata would be good toys to play with. In the enterprise, there are so many IDS/IDP and SIEM products out there, and they're all different. Some are great for mixed environments of Windows, UNIX and infrastructure. Others are better for specific platforms. Your best bet is to get demo licenses and start playing with them instead of relying on word-of-mouth or shiny pamphlets from marketing-types.
- bostonvaulter2 16y agoThanks for the pointers. I hadn't heard of suricata before.
- peterwwillis 16y agohttps://wiki.softwink.com/bin/view/Main/SaganFAQ#Why_Sagan https://wiki.softwink.com/bin/view/Main/SaganFAQ#Why_Sagan http://www.darknet.org.uk/2010/07/sagan-real-time-system-event-log-syslog-monitoring-system/ http://www.darknet.org.uk/2010/07/sagan-real-time-system-eve... Pretty good system to correlate different events to get a better picture of a potential intrusion. If you're familiar with Snort I recommend checking it out.
- ax0n 16y agoI already have a commercial system (with some homebrew, of course) that correlates, but I absolutely love playing with new things. I'll get this going in a lab soon. Thanks for sharing!