On 02/04/2011 09:46 PM, tanishk lakhaani wrote: > Yes, the active response works on the basis of this only...When u > launch a scan, a few attacks will acually pass thru, then only the agent > will forward the corresponding logs to the OSSEC Server, who will then > decide whether to use Active Response or not. Once the server decides to > use active response, all the future attacks from the attacker IP will be > prevented from being executed.....This is how active respone works. > > Btw, Steve, can u pls tell me how is the link that u have just > circulated (the XKCD reference) is helpful to us ? > > Regards > Tanishk > > On Sat, Feb 5, 2011 at 2:18 AM, Steven Stern > <[email protected] <mailto:[email protected]>> > wrote: > > On 02/04/2011 12:39 PM, tanishk lakhaani wrote: > > Well, I think that deploying active response can be a good way out to > > prevent SQL Injection based attacks. However, there may be a few > issues > > related to it viz..decoders in ossec are designed to indicate a SQL > > Injection attack even in case SELEC/UNION or any other SQL Based > command > > is used in the Request. This may be a bit of hinderance, as it may be > > that the legitimate traffic is being blocked. > > > > I have already deployed Active Response in testing Environment, > and post > > deplpyment , launched a NESSUS Scan, and to my surprise, Active > Response > > turned out to be fantastic to prevent SQL Injection based attacks. > > > > Regards > > Tanishk > > > > On Fri, Feb 4, 2011 at 12:12 AM, Steven Stern > > <[email protected] > <mailto:[email protected]> > <mailto:[email protected] > <mailto:[email protected]>>> > > wrote: > > > > On 02/03/2011 12:00 PM, satish patel wrote: > > > How efficient OSSEC is to stop SQL injection ? If not then i > have to > > > move on mod_security > > > > > > Is anybody out there who using ossec for sql injection ? > > > > > > > > > Thanks, > > > S > > It's very good at detecting SQL injection, but your code shouldn't > > (<smile>) be susceptible to it. mod_security has its own > issues with > > false positives. > > > > -- > > -- Steve > > > > > Unfortunately, the first attack line probably gets through. By the way, > mandatory XKCD reference: http://xkcd.com/327/ > > -- > -- Steve > > > > > -- > warm regards > Tanishk Lakhaani
Exactly. The first injection connection can be bad. I have run systems that were found to be vulnerable to SQL injection. OSSEC detected the attack, but we were being hit from multiple IPs over a long time at a low rate. Active response wouldn't have helped. We were able to use OSSECs logs (and system logs) to figure out what scripts the attackers were using. We took our systems off the internet, ran the same scans at a high rate, and determined which parts of the system had not been hardened against injection attacks. We then coded in a protection layer. When we went back on the internet, OSSEC showed that the attacks continued but without any success. -- -- Steve
