That gets me thinking - any chance Daniel and the crew would consider implementing a HIPS/HIDS (inline) extension for OSSEC? That would be awesome... Of course, we have already mentioned ModSecurity. There's another one that looks really promising called "AppSensor" (check the OWASP pages - it's all on a Google code site). Haven't tried implementing AppSensor yet but it integrates more at the application level than it does at the OS level.
On Sat, Feb 5, 2011 at 6:44 AM, Steven Stern <[email protected] > wrote: > On 02/04/2011 09:46 PM, tanishk lakhaani wrote: > > Yes, the active response works on the basis of this only...When u > > launch a scan, a few attacks will acually pass thru, then only the agent > > will forward the corresponding logs to the OSSEC Server, who will then > > decide whether to use Active Response or not. Once the server decides to > > use active response, all the future attacks from the attacker IP will be > > prevented from being executed.....This is how active respone works. > > > > Btw, Steve, can u pls tell me how is the link that u have just > > circulated (the XKCD reference) is helpful to us ? > > > > Regards > > Tanishk > > > > On Sat, Feb 5, 2011 at 2:18 AM, Steven Stern > > <[email protected] <mailto:[email protected]>> > > wrote: > > > > On 02/04/2011 12:39 PM, tanishk lakhaani wrote: > > > Well, I think that deploying active response can be a good way out > to > > > prevent SQL Injection based attacks. However, there may be a few > > issues > > > related to it viz..decoders in ossec are designed to indicate a SQL > > > Injection attack even in case SELEC/UNION or any other SQL Based > > command > > > is used in the Request. This may be a bit of hinderance, as it may > be > > > that the legitimate traffic is being blocked. > > > > > > I have already deployed Active Response in testing Environment, > > and post > > > deplpyment , launched a NESSUS Scan, and to my surprise, Active > > Response > > > turned out to be fantastic to prevent SQL Injection based attacks. > > > > > > Regards > > > Tanishk > > > > > > On Fri, Feb 4, 2011 at 12:12 AM, Steven Stern > > > <[email protected] > > <mailto:[email protected]> > > <mailto:[email protected] > > <mailto:[email protected]>>> > > > wrote: > > > > > > On 02/03/2011 12:00 PM, satish patel wrote: > > > > How efficient OSSEC is to stop SQL injection ? If not then i > > have to > > > > move on mod_security > > > > > > > > Is anybody out there who using ossec for sql injection ? > > > > > > > > > > > > Thanks, > > > > S > > > It's very good at detecting SQL injection, but your code > shouldn't > > > (<smile>) be susceptible to it. mod_security has its own > > issues with > > > false positives. > > > > > > -- > > > -- Steve > > > > > > > > Unfortunately, the first attack line probably gets through. By the > way, > > mandatory XKCD reference: http://xkcd.com/327/ > > > > -- > > -- Steve > > > > > > > > > > -- > > warm regards > > Tanishk Lakhaani > > Exactly. The first injection connection can be bad. I have run systems > that were found to be vulnerable to SQL injection. OSSEC detected the > attack, but we were being hit from multiple IPs over a long time at a > low rate. Active response wouldn't have helped. We were able to use > OSSECs logs (and system logs) to figure out what scripts the attackers > were using. We took our systems off the internet, ran the same scans at > a high rate, and determined which parts of the system had not been > hardened against injection attacks. We then coded in a protection layer. > When we went back on the internet, OSSEC showed that the attacks > continued but without any success. > > -- > -- Steve >
