Detecting Intruders on Your System Is Fun and Easy

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View
Detecting Intruders on Your System Is Fun and Easy

Well, perhaps the title of this chapter is a slightly misleading.
Supposedly, becoming an

intruder is fun and easy, too. If you want to detect intruders, you
should know what type of

system resources can be depended on for providing evidence. Should you
want to become an

intruder, you ought to know how commercial IDSs look for traces of
your activity.

Scanners are designed to take a look at your system and to let you
know whether you have

configuration problems or holes that can be used for attacks. If your
system was previously

set up in a secure fashion, and an intruder has altered this
configuration, a scanner will

detect this change (when you run the scan) and notify you of the

System-level intrusion detection tools differ from scanners in a
couple of ways. If the IDS

runs in real time, it can let you know the instant a compromise has
occurred. Also, if the

monitor gathers its data by reading an activity stream on the system,
it can detect a range

of features that a single scanner cannot. For example, scanners will
not tell you that

someone just entered three bad passwords and exceeded the failed login

By the time you finish this chapter, you will understand the

* How to classify attacks according to how they originate and the
threat they pose
* The pros and cons of different data sources that a system monitor
can use for decisions
* What system monitors can and cannot detect
* The tradeoffs you may need to make for monitoring your systems in
real time
* What it takes to really track someone through a network
As you will soon see, you need to consider a number of issues when
trying to build a

system-level IDS.

You can see the complate articles at

Re: Detecting Intruders on Your System Is Fun and Easy

Is this guy for real?  ??

Cheers -- Martha Adams     [ 2007 Dec 11]

Quoted text here. Click to load it

Re: Detecting Intruders on Your System Is Fun and Easy

On Wed, 12 Dec 2007, in the Usenet newsgroup, in article

Quoted text here. Click to load it

Of course not.    Maybe if you started using a real news reader instead
of some all-singing, all-dancing, automatic mal-ware installing browser,
you'd be able to use a kill file to ignore garbage like that.

        Old guy

Site Timeline