Re: Local Mirror Prevention with IDS

[mike () pn66 poznan sdi tpnet pl (Michal Melewski)]

On Fri, Dec 17, 2004 at 02:38:16PM +0200, Dimitrios Patsos wrote:
> Hi!
>
> Can anybody provide some help on how can we prevent a user from making a
> local mirror of a web site by using both host & network IDS?
If it isn't diffrent from normal HTTP traffic it's impossible to do it by
NIDS. (Quoting someone from this list - "There is not enough information on a
wire.").
By HBIDS? Like using hammer to splash a fly.

Try restrict using programms like wget (or write some wrapper to catch '-r'
and '-l" options).

You can always use quota if it's the lack of free space problem or some
bandwidth management if having problems with bandwith consumption.

> Thank you in advance.
>
> Regards,
>
> Dimitrios G. Patsos
> IT Security Consultant

Best regars

-- 
Michael "carstein" Melewski      |  "Humanistą był Kepler, był Leibnitz.
carstein () poznan linux org pl          |   Człowiek definiujący humanizm jako
mobile: 502 545 913              |   brak umiejętności całkowania
gpg: carstein.c.pl/carstein.txt  |   humanistą nie jest."

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------