On 02/04/2011 11:51 PM, Jeremy Lee wrote:
I think his point is that one attack 'passing' through is enough. Think about it - if they can get an attack through that successfully commits a DROP TABLE statement, you're already in the black. Whether you've dropped them at that point or not doesn't really matter because they've accomplished what they wanted to do. On top of that, most hackers will be coming from multiple IPs if they really want to hack you - so drop one IP and move to the next. But every new IP the hacker uses, if he knows exactly what statement to issue, can do a lot of damage. So the real solution is to fix the vulnerable code. Otherwise, if the developers are unwilling, modsecurity would be the next choice (of course, the mitigation of 'code' is now in your hands...). If developers are unwilling to fix vulnerable code, it's not merely a problem of bad coding. It's more likely an issue of politics.
You bring up some very good points and of course you are exactly correct. OSSEC is NOT a HIPS and it would be a mistake to think Active Response is an effective way to ensure things like SQL injection flaws cannot be exploited. What I can say--based on my "real world" experience--is that Active Response does a pretty good job of preventing breaches. All but the most sophisticated attackers will do some sort of enumeration and there are rules in place to detect that, which can also initiate an Active Response. Of course, these work best when layered with things like mod_security. Another good reason to layer security protection measures is that it's not unheard of to put something in "look-but-don't-touch" mode and forget about it when troubleshooting a problem. With just one layer, like OSSEC, you have nothing if it gets turned off. But with multiple layers, there is at least something in place to protect you.
