IDS mailing list archives
Re: Local Mirror Prevention with IDS
From: Kevin <kkadow () gmail com>
Date: Mon, 20 Dec 2004 21:25:50 -0600
On Fri, 17 Dec 2004 14:38:16 +0200, Dimitrios Patsos <dpat () space gr> wrote:
Can anybody provide some help on how can we prevent a user from making a local mirror of a web site by using both host & network IDS?
IMHO, this isn't really an IDS issue. Most of the mechanisms I have seen for trying to stop HTTP users from recursively fetching the entire contents of a site use three approaches -- 1) Make a mirror.zip available, to save bandwidth. 2) Use network, load-balancer, and/or web server rate-limiting modules to control the number requests and bandwidth that a single IP (or a single subnet range) can make in a minute/hour/day/week. 3) Include "canary" dead-end links which, when accessed, cause your web server to temporarily refuse to accept further requests from the source IP which accessed the canary. This can cause problems for proxies (this may be a feature). Kevin Kadow -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
Current thread:
- Local Mirror Prevention with IDS Dimitrios Patsos (Dec 20)
- Re: Local Mirror Prevention with IDS Michal Melewski (Dec 23)
- Re: Local Mirror Prevention with IDS Kevin Johnson (Dec 23)
- Re: Local Mirror Prevention with IDS Kevin (Dec 23)
- Re: Local Mirror Prevention with IDS Michael Boman (Dec 23)
- Re: Local Mirror Prevention with IDS Jason (Dec 27)
- Re: Local Mirror Prevention with IDS Kyle Maxwell (Dec 23)