RE: Obfuscated web pages

["Mike Barkett" <mbarkett () us checkpoint com>]

Well, my friend, I guess we will have to agree to disagree and leave it at
that for now.  As you said, the topic is tiresome now that our respective
opinions are already on the table, and surely time will tell.

The only part I feel compelled to respond to is the sentence below in which
you wryly call out my method of argumentation.  To reiterate, I answered two
separate questions differently: the original thread query (re: DOM
inspection) in the hypothetical future tense, using past experiences as
support for an opinion; and an ancillary question (re: sandboxed signatures)
in the literal present, using current facts as support.  No mixing of
abstraction necessary.


Hopefully the thoughts expressed in this thread will inspire one of the many
college students on this list to take up the challenge, and try to
demonstrate whether or not inline JS inspection can be made to be somewhat
useful.  If anyone does decide to try to implement it with N-code or any
other language, then let me know and I'd be happy to lend some ideas to the
cause.


Thanks.
-MAB

--
Michael A Barkett, CISSP
IPS Security Engineering Director
Check Point Software Technologies
+1.240.632.9000 Fax: +1.240.747.3512


> -----Original Message-----
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
> On Behalf Of Ivan Arce
> Sent: Thursday, February 28, 2008 8:14 PM
> To: Mike Barkett; focus-ids () securityfocus com
> Subject: Re: Obfuscated web pages
...
> > generally not the tone of this list, and I doubt either of us has the
> time.
> > In my opinion, it would be a mistake to flout the continued maturation
> of
> > analysis technology, much as was done by the many people who a decade
> ago
> > thought that IPS was infeasible.  Ptacek and Newsham's paper was
> seminal,
> > and defense against those principles is a must-have in the IPS world
> today,
> > but let's not forget that 10 years ago many were citing that paper as a
> > harbinger of doom for IDS, not to mention IPS.  Yet, within a couple
> years,
> > the better IDS products had accounted for all the methods.
>
> You seem to mix different layers of abstraction in the manner that best
> serves to support your opinion, which is completely fair game but not
> necessarily accurate.


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------