I think his point is that one attack 'passing' through is enough. Think about it - if they can get an attack through that successfully commits a DROP TABLE statement, you're already in the black. Whether you've dropped them at that point or not doesn't really matter because they've accomplished what they wanted to do. On top of that, most hackers will be coming from multiple IPs if they really want to hack you - so drop one IP and move to the next. But every new IP the hacker uses, if he knows exactly what statement to issue, can do a lot of damage. So the real solution is to fix the vulnerable code. Otherwise, if the developers are unwilling, modsecurity would be the next choice (of course, the mitigation of 'code' is now in your hands...). If developers are unwilling to fix vulnerable code, it's not merely a problem of bad coding. It's more likely an issue of politics.
On Fri, Feb 4, 2011 at 7:46 PM, tanishk lakhaani <[email protected]>wrote: > Yes, the active response works on the basis of this only...When u launch a > scan, a few attacks will acually pass thru, then only the agent will forward > the corresponding logs to the OSSEC Server, who will then decide whether to > use Active Response or not. Once the server decides to use active response, > all the future attacks from the attacker IP will be prevented from being > executed.....This is how active respone works. > > Btw, Steve, can u pls tell me how is the link that u have just circulated > (the XKCD reference) is helpful to us ? > > Regards > Tanishk > > On Sat, Feb 5, 2011 at 2:18 AM, Steven Stern < > [email protected]> wrote: > >> On 02/04/2011 12:39 PM, tanishk lakhaani wrote: >> > Well, I think that deploying active response can be a good way out to >> > prevent SQL Injection based attacks. However, there may be a few issues >> > related to it viz..decoders in ossec are designed to indicate a SQL >> > Injection attack even in case SELEC/UNION or any other SQL Based command >> > is used in the Request. This may be a bit of hinderance, as it may be >> > that the legitimate traffic is being blocked. >> > >> > I have already deployed Active Response in testing Environment, and post >> > deplpyment , launched a NESSUS Scan, and to my surprise, Active Response >> > turned out to be fantastic to prevent SQL Injection based attacks. >> > >> > Regards >> > Tanishk >> > >> > On Fri, Feb 4, 2011 at 12:12 AM, Steven Stern >> > <[email protected] <mailto:[email protected] >> >> >> > wrote: >> > >> > On 02/03/2011 12:00 PM, satish patel wrote: >> > > How efficient OSSEC is to stop SQL injection ? If not then i have >> to >> > > move on mod_security >> > > >> > > Is anybody out there who using ossec for sql injection ? >> > > >> > > >> > > Thanks, >> > > S >> > It's very good at detecting SQL injection, but your code shouldn't >> > (<smile>) be susceptible to it. mod_security has its own issues >> with >> > false positives. >> > >> > -- >> > -- Steve >> > >> > >> Unfortunately, the first attack line probably gets through. By the way, >> mandatory XKCD reference: http://xkcd.com/327/ >> >> -- >> -- Steve >> > > > > -- > warm regards > Tanishk Lakhaani >
