RE: Bittorrent - utorrent

Breach Security has a product called BreachView SSL that passively decrypts SSL traffic for an IDS without terminating the SSL session. The product comes as either a software plug-in or an appliance.

http://www.breach.com/products_breachviewssl.asp

ko

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx] On Behalf Of Panayiotis Psihoyios
Sent: Thursday, March 08, 2007 10:01 AM
To: 'Ove Dalgård Hansen'; focus-ids@xxxxxxxxxxxxxxxxx
Subject: RE: Bittorrent - utorrent

Since it is going through SSL (and no IDS can look into SSL), you have two
options:

Plan A: Deny SSL traffic, but that usually this is not possible,

Plan B: Let your users out through a proxy server, which will identify
non-browser traffic using http/s header inspection. Configure your firewall
to permit HTTP/S out only from your proxy and not your clients.

Regards,
Panayiotis

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx] On
Behalf Of Ove Dalgard Hansen
Sent: Wednesday, March 07, 2007 9:38 PM
To: focus-ids@xxxxxxxxxxxxxxxxx
Subject: Bittorrent - utorrent

Hello Everyone,

I am in a bit of trouble,

On a network where i am configuring IDS - using ASA5510 + SSM module, we try
to deny access to Bittorrent downloads - it consumes quite a bit of bandwith
and is not allowed by the company's policy.
We try to filter bittorrent which succedes - but the utorrent changes
protocol and goes by the SSL port 443 and thereby circumvent the IDS, since
its not possible to see the encrypted traffic.

Does anyone out there have a good idea of how i am to solve the issue?


Best Regards

Ove Hansen
IT-Quality A/S
Banemarksvej 50F
Denmark - 2605




------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=in
tro_sfw
to learn more.
------------------------------------------------------------------------



------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------

Relevant Pages

  • RE: Firewall or IDS
    ... Yes they can detect certain SSL exploits and weaknesses but they nor anyone ... Subject: Firewall or IDS ... Most if not all IDS's cannot really look at SSL streams for attacks ...
    (Focus-Microsoft)
  • Re: Bittorrent - utorrent
    ... SSL connection at the border and proxy your data within another SSL ... the ones that you load your web server keys into, you can then use an IDS ... with real-world attacks from CORE IMPACT. ...
    (Focus-IDS)
  • RE: Bittorrent - utorrent
    ... the statement that no IDS can "look" into SSL is not completely ... Here is a number of indicative solutions: ... On a network where i am configuring IDS - using ASA5510 + SSM module, ... with real-world attacks from CORE IMPACT. ...
    (Focus-IDS)
  • RE: Bittorrent - utorrent
    ... Since it is going through SSL, ... Plan B: Let your users out through a proxy server, ... Subject: Bittorrent - utorrent ... On a network where i am configuring IDS - using ASA5510 + SSM module, ...
    (Focus-IDS)
  • RE: Bittorrent - utorrent
    ... We try to filter bittorrent which succedes - but the utorrent changes protocol and goes by the SSL port 443 and thereby circumvent the IDS, since its not possible to see the encrypted traffic. ... different externals hosts. ... looks a bit like BitTorrent when you're just seeing the session records. ...
    (Focus-IDS)