FW: Anti-DDoS Appliance with a focus on Web Code Exploits (Comment Spam, and the like)

["Brokken, Allen P." <BrokkenA () missouri edu>]

The biggest problem you are going to run into in this scenario is SSL
encrypted sites.  Even if you put in IDS/IPS or other network appliances
you won't be able to inspect the traffic.

Since you know your code is rotten, and don't expect to be able to fix
it any time soon I would suggest an SSL proxy based Web Application
Firewall.  In this case all of the requests hit the proxy incoming as
SSL, but are decrypted, inspected, and then dropped or passed on to your
Web App.  Most of the modern ones have the behavior recognition you are
expecting, as well as the ability to track basic field limits going out
and then verify if something coming back is within spec.

I did a paper eval a year ago so my info is old.  I would suggest
searching for a Web Application Firewall that uses the Proxy
configuration.  It will be quick and a powerful deterrent, but could
cost some dollars.  I've heard of people growing their own LINUX based
proxy's with SQUID and SNORT to do something similar, but since you
mention IIS and not having time to redo you code, I doubt you have time
to home brew Web App firewall.

Also I would recommend looking into both BlackBox security testing tools
and static analysis eventually to prevent developing new rotten code.

Allen Brokken, Principal Systems Security Analyst
Information Security and Account Management
Division of Information Technology, University of Missouri
brokkena () missouri edu (573)884-8708

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of Ian
Sent: Wednesday, September 05, 2007 10:53 AM
To: webappsec () securityfocus com
Subject: Re: Anti-DDoS Appliance with a focus on Web Code Exploits
(Comment Spam, and the like)

On 31 Aug 2007 at 4:42, Eric Marden wrote:

> I've just started with a company running Coldfusion Apps on Windows.
> Too much code for me to audit quickly, but need some recommendations
> on something we can put at the network perimeter that will sniff
> incoming traffic only for weird patterns.... like if a guest book
> gets hit 100 times in 10 secs from the same IP it will just start to
> block....
>
> It shouldn't worry about outgoing, just incoming.
>
> Didn't think Snort was for this, or other IDS type systems.
> Commercial or Open Source (OS Preferred) will be considered. An
> Appliance if its Commercial. We need something quick and easy.
>
> The previous engineers had no clue, so I'm untangling knots on the
> server/infrastructure side (CF goes down like crazy). The current
> Devs, are just not trained in secure coding practices.
>
> I need a blanket solution that will work for the next couple of
> months, until I can circle back and help them fix their CF Code.
>
> P.S. - We are starting to look at bl.com and project honeypot's
> tools, and like what we see so far, but would like more input.
>
> Thanks in advance!

Hi,

I don't know how suitable this is but what about an 
Apache proxy running mod_security?

Not something I've deployed myself but I've heard 
good things.

Regards

Ian
-- 


------------------------------------------------------------------------
-
Sponsored by: Watchfire

The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online 
despite security executives' efforts to prevent malicious attacks. This 
whitepaper identifies the most common methods of attacks that we have
seen, 
and outlines a guideline for developing secure web applications. 
Download today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
------------------------------------------------------------------------
--


-------------------------------------------------------------------------
Sponsored by: Watchfire

The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online
despite security executives' efforts to prevent malicious attacks. This
whitepaper identifies the most common methods of attacks that we have seen,
and outlines a guideline for developing secure web applications.
Download today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
--------------------------------------------------------------------------