RE: ssh and ids

["Matthew F. Caldwell" <mattc () guarded net>]

At 06:18 PM 6/18/2004 +0000, Runion Mark A FGA DOIM WEBMASTER(ctr) wrote:
> Lets suppose the attacker is mildly sophisticated, and after making the
> initial assault roots the box and installs a secure backdoor or two.  Is
> there any IDS capable of isolating data it cannot read, except to monitor
> authorized port usage of a system or group of systems?
 
As mentioned previously no virtually  IDS/IPS incorporates monitoring of SSHv2/v1 sessions of ssh. However some SSH 
(version 1) sessions are subject to man in the middle attacks as well as some SSL connections. Applications that help 
in performing the "forensic" man in the middle attack include ettercap http://ettercap.sourceforge.net or sshmitm (an 
app from the dsniff suite) http://www.monkey.org/~dugsong/dsniff/ 
 
 Happy hacker hunting!
 
 
Matthew F. Caldwell 
Chief Security Officer
GuardedNet, Inc. 
www.guarded.net
 
 
 

---------------------------------------------------------------------------

---------------------------------------------------------------------------