Re: Local Mirror Prevention with IDS

From: Michal Melewski (mike_at_pn66.poznan.sdi.tpnet.pl)
Date: 12/20/04

  • Next message: Murtland, Jerry: "RE: Intrushield vs. ISS once more..."
    Date: Mon, 20 Dec 2004 20:39:52 +0100
    To: focus-ids@securityfocus.com
    
    

    On Fri, Dec 17, 2004 at 02:38:16PM +0200, Dimitrios Patsos wrote:
    >
    > Hi!
    >
    > Can anybody provide some help on how can we prevent a user from making a
    > local mirror of a web site by using both host & network IDS?
    If it isn't diffrent from normal HTTP traffic it's impossible to do it by
    NIDS. (Quoting someone from this list - "There is not enough information on a
    wire.").
    By HBIDS? Like using hammer to splash a fly.

    Try restrict using programms like wget (or write some wrapper to catch '-r'
    and '-l" options).

    You can always use quota if it's the lack of free space problem or some
    bandwidth management if having problems with bandwith consumption.

    >
    > Thank you in advance.
    >
    > Regards,
    >
    > Dimitrios G. Patsos
    > IT Security Consultant

    Best regars

    -- 
    Michael "carstein" Melewski	 |  "Humanistą był Kepler, był Leibnitz.
    carstein@poznan.linux.org.pl 	 |   Człowiek definiujący humanizm jako
    mobile:	502 545 913		 |   brak umiejętności całkowania
    gpg: carstein.c.pl/carstein.txt	 |   humanistą nie jest."
    --------------------------------------------------------------------------
    Test Your IDS
    Is your IDS deployed correctly?
    Find out quickly and easily by testing it with real-world attacks from 
    CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
    to learn more.
    --------------------------------------------------------------------------
    

  • Next message: Murtland, Jerry: "RE: Intrushield vs. ISS once more..."

    Relevant Pages

    • Re: Local Mirror Prevention with IDS
      ... > local mirror of a web site by using both host & network IDS? ... this isn't really an IDS issue. ... single subnet range) can make in a minute/hour/day/week. ... web server to temporarily refuse to accept further requests from the ...
      (Focus-IDS)
    • Re: know its ipad
      ... new web site with the user that requires assistive technologies as the ... Each part has a list of IDs. ... Fundamentally, that's a database-type solution, but not needing formal ... the program could well be in WSH JavaScript. ...
      (comp.lang.javascript)
    • Local Mirror Prevention with IDS
      ... local mirror of a web site by using both host & network IDS? ... Test Your IDS ...
      (Focus-IDS)
    • Re: Local Mirror Prevention with IDS
      ... > local mirror of a web site by using both host & network IDS? ... Michael Boman ... Test Your IDS ...
      (Focus-IDS)