RE: ssh and ids

From: Matthew F. Caldwell (mattc_at_guarded.net)
Date: 06/22/04

  • Next message: Joshua Berry: "RE: Anomaly Based Network IDS" 
    Date: Mon, 21 Jun 2004 18:42:39 -0400
To: "Ron Gula" <rgula@tenablesecurity.com>, <focus-ids@securityfocus.com>

     
    At 06:18 PM 6/18/2004 +0000, Runion Mark A FGA DOIM WEBMASTER(ctr) wrote:
    >Lets suppose the attacker is mildly sophisticated, and after making the
    >initial assault roots the box and installs a secure backdoor or two. Is
    >there any IDS capable of isolating data it cannot read, except to monitor
    >authorized port usage of a system or group of systems?
     
    As mentioned previously no virtually IDS/IPS incorporates monitoring of SSHv2/v1 sessions of ssh. However some SSH (version 1) sessions are subject to man in the middle attacks as well as some SSL connections. Applications that help in performing the "forensic" man in the middle attack include ettercap http://ettercap.sourceforge.net or sshmitm (an app from the dsniff suite) http://www.monkey.org/~dugsong/dsniff/
     
     Happy hacker hunting!
     
     
    Matthew F. Caldwell
    Chief Security Officer
    GuardedNet, Inc.
    www.guarded.net
     
     
     

    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------

  • Next message: Joshua Berry: "RE: Anomaly Based Network IDS"