4 ms·
To look at more than metadata, so these systems require a MITM attack? Most data these days is encrypted.
by new_realist 6y ago
To look at more than metadata, so these systems require a MITM attack? Most data these days is encrypted.
- tptacek 6y agoYes, in theory. In reality, the premise is that they're looking for attacks in protocols that aren't encrypted, which is part of the reason the approach doesn't make much sense anymore --- the signatures are all tuned for attacks that only really matter in internal networks, and internal networks are already insecure. (You could also park this in between a TLS-terminating reverse proxy and the app servers, I guess). The source code is here: https://github.com/cmu-snap/pigasus https://github.com/cmu-snap/pigasus --- a lot of it is from Snort.