IDS mailing list archives
Re: Local Mirror Prevention with IDS
From: Kevin Johnson <kjohnson () secureideas net>
Date: Mon, 20 Dec 2004 21:03:27 -0500
On Fri, 2004-12-17 at 07:38, Dimitrios Patsos wrote:
Hi! Can anybody provide some help on how can we prevent a user from making a local mirror of a web site by using both host & network IDS? Thank you in advance.
Hi- I am not sure that this would be possible in any usable way. Off the top of my head, the only way I could see doing this would be to alert on any one requesting a certain number of pages within a specific time. BUT I think this would have two problems. The first is that people or web crawlers using the site could trigger it. Second, all that someone would need to do is pause long enough between requests and you would not be able to differentiate between them and another normal user. The problem is, that to view a web page, it HAS to be transfered to the client. If you can give some more detail about what you would like to accomplish, maybe we can come up with a solution that will work for your issue. Kevin ------------------- BASE Project Lead http://sourceforge.net/projects/secureideas http://base.secureideas.net The next step in IDS analysis!
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Local Mirror Prevention with IDS Dimitrios Patsos (Dec 20)
- Re: Local Mirror Prevention with IDS Michal Melewski (Dec 23)
- Re: Local Mirror Prevention with IDS Kevin Johnson (Dec 23)
- Re: Local Mirror Prevention with IDS Kevin (Dec 23)
- Re: Local Mirror Prevention with IDS Michael Boman (Dec 23)
- Re: Local Mirror Prevention with IDS Jason (Dec 27)
- Re: Local Mirror Prevention with IDS Kyle Maxwell (Dec 23)