IDS mailing list archives
Re: Using Snort to find creditcard data?
From: Siim Põder <siim () p6drad-teel net>
Date: Fri, 19 Oct 2007 09:59:21 +0300
Yo! Craig Chamberlain wrote:
Good point; what I'm suggesting is that while it's relatively easy to hide or obfuscate the data itself, it is hard to conceal the fact that data - or packets - are being transmitted, possibly using a recognizable application protocol, to an unexpected destination, which can be a useful last-ditch detection mechanism when the other methods fail - or can be a useful corroboration when correlated with the other detect data.
There is bound to be some sort of legitimate production traffic. For example, if there are https connections coming in to a specific machine and specific port. You can detect if that machine starts sending out data on its own or starts accepting connections on another port. However, if the same port starts serving credit card numbers (obfuscated) or even hides the credit card numbers in tcp sequence numbers (or does something even more subtle as serving them by changing the case of "A" letters in http connections from certain addresses) the movement of data should be extremely hard to detect. Siim ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
Current thread:
- Re: Using Snort to find creditcard data?, (continued)
- Re: Using Snort to find creditcard data? Stefano Zanero (Oct 01)
- Re: Using Snort to find creditcard data? Martin Roesch (Oct 02)
- Re: Using Snort to find creditcard data? Ron Gula (Oct 01)
- Re: Using Snort to find creditcard data? Jason (Oct 01)
- RE: Using Snort to find creditcard data? Srinivasa Addepalli (Oct 01)
- Re: Using Snort to find creditcard data? Thrynn (Oct 01)
- Re: Using Snort to find creditcard data? Jason Ross (Oct 01)
- RE: Using Snort to find creditcard data? Ofer Shezaf (Oct 02)
- RE: Using Snort to find creditcard data? Craig Chamberlain (Oct 16)
- Re: Using Snort to find creditcard data? Siim Põder (Oct 18)
- Message not available
- Re: Using Snort to find creditcard data? Siim Põder (Oct 19)
- RE: Using Snort to find creditcard data? Craig Chamberlain (Oct 19)
- RE: Using Snort to find creditcard data? Craig Chamberlain (Oct 16)
- Re: Using Snort to find creditcard data? Stefano Zanero (Oct 01)