Oops. Meant to reply to Michael's post - also I had a 'typo' and added "HIDS" (OSSEC is a HIDS...DUH) - I just meant "HIPS (inline)"
On Sat, Feb 5, 2011 at 9:01 AM, Jeremy Lee <[email protected]> wrote: > That gets me thinking - any chance Daniel and the crew would consider > implementing a HIPS/HIDS (inline) extension for OSSEC? That would be > awesome... Of course, we have already mentioned ModSecurity. There's another > one that looks really promising called "AppSensor" (check the OWASP pages - > it's all on a Google code site). Haven't tried implementing AppSensor yet > but it integrates more at the application level than it does at the OS > level. > > > > > On Sat, Feb 5, 2011 at 6:44 AM, Steven Stern < > [email protected]> wrote: > >> On 02/04/2011 09:46 PM, tanishk lakhaani wrote: >> > Yes, the active response works on the basis of this only...When u >> > launch a scan, a few attacks will acually pass thru, then only the agent >> > will forward the corresponding logs to the OSSEC Server, who will then >> > decide whether to use Active Response or not. Once the server decides to >> > use active response, all the future attacks from the attacker IP will be >> > prevented from being executed.....This is how active respone works. >> > >> > Btw, Steve, can u pls tell me how is the link that u have just >> > circulated (the XKCD reference) is helpful to us ? >> > >> > Regards >> > Tanishk >> > >> > On Sat, Feb 5, 2011 at 2:18 AM, Steven Stern >> > <[email protected] <mailto:[email protected] >> >> >> > wrote: >> > >> > On 02/04/2011 12:39 PM, tanishk lakhaani wrote: >> > > Well, I think that deploying active response can be a good way out >> to >> > > prevent SQL Injection based attacks. However, there may be a few >> > issues >> > > related to it viz..decoders in ossec are designed to indicate a >> SQL >> > > Injection attack even in case SELEC/UNION or any other SQL Based >> > command >> > > is used in the Request. This may be a bit of hinderance, as it may >> be >> > > that the legitimate traffic is being blocked. >> > > >> > > I have already deployed Active Response in testing Environment, >> > and post >> > > deplpyment , launched a NESSUS Scan, and to my surprise, Active >> > Response >> > > turned out to be fantastic to prevent SQL Injection based attacks. >> > > >> > > Regards >> > > Tanishk >> > > >> > > On Fri, Feb 4, 2011 at 12:12 AM, Steven Stern >> > > <[email protected] >> > <mailto:[email protected]> >> > <mailto:[email protected] >> > <mailto:[email protected]>>> >> > > wrote: >> > > >> > > On 02/03/2011 12:00 PM, satish patel wrote: >> > > > How efficient OSSEC is to stop SQL injection ? If not then i >> > have to >> > > > move on mod_security >> > > > >> > > > Is anybody out there who using ossec for sql injection ? >> > > > >> > > > >> > > > Thanks, >> > > > S >> > > It's very good at detecting SQL injection, but your code >> shouldn't >> > > (<smile>) be susceptible to it. mod_security has its own >> > issues with >> > > false positives. >> > > >> > > -- >> > > -- Steve >> > > >> > > >> > Unfortunately, the first attack line probably gets through. By the >> way, >> > mandatory XKCD reference: http://xkcd.com/327/ >> > >> > -- >> > -- Steve >> > >> > >> > >> > >> > -- >> > warm regards >> > Tanishk Lakhaani >> >> Exactly. The first injection connection can be bad. I have run systems >> that were found to be vulnerable to SQL injection. OSSEC detected the >> attack, but we were being hit from multiple IPs over a long time at a >> low rate. Active response wouldn't have helped. We were able to use >> OSSECs logs (and system logs) to figure out what scripts the attackers >> were using. We took our systems off the internet, ran the same scans at >> a high rate, and determined which parts of the system had not been >> hardened against injection attacks. We then coded in a protection layer. >> When we went back on the internet, OSSEC showed that the attacks >> continued but without any success. >> >> -- >> -- Steve >> > >
