From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me X-Spam-Level: * X-Spam-Status: No, score=1.0 required=5.0 tests=BAYES_40,FORGED_GMAIL_RCVD, FREEMAIL_FROM autolearn=no autolearn_force=no version=3.4.4 X-Google-Thread: 103376,9c3574e02078ab9d,start X-Google-Attributes: gid103376,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: g2news1.google.com!postnews.google.com!s8g2000prg.googlegroups.com!not-for-mail From: medusha.hanura@gmail.com Newsgroups: comp.lang.ada Subject: Detecting Intruders on Your System Is Fun and Easy Date: Tue, 11 Dec 2007 15:47:51 -0800 (PST) Organization: http://groups.google.com Message-ID: <4306e7ea-b5f7-4827-bc48-30a445741bd0@s8g2000prg.googlegroups.com> NNTP-Posting-Host: 202.93.36.76 Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Trace: posting.google.com 1197416871 8586 127.0.0.1 (11 Dec 2007 23:47:51 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: Tue, 11 Dec 2007 23:47:51 +0000 (UTC) Complaints-To: groups-abuse@google.com Injection-Info: s8g2000prg.googlegroups.com; posting-host=202.93.36.76; posting-account=3fEdHwkAAACTpw4aSHQ-YY9O2XQmi3fU User-Agent: G2/1.0 X-HTTP-UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6,gzip(gfe),gzip(gfe) Xref: g2news1.google.com comp.lang.ada:18904 Date: 2007-12-11T15:47:51-08:00 List-Id: Detecting Intruders on Your System Is Fun and Easy Well, perhaps the title of this chapter is a slightly misleading. Supposedly, becoming an intruder is fun and easy, too. If you want to detect intruders, you should know what type of system resources can be depended on for providing evidence. Should you want to become an intruder, you ought to know how commercial IDSs look for traces of your activity. Scanners are designed to take a look at your system and to let you know whether you have configuration problems or holes that can be used for attacks. If your system was previously set up in a secure fashion, and an intruder has altered this configuration, a scanner will detect this change (when you run the scan) and notify you of the problem. System-level intrusion detection tools differ from scanners in a couple of ways. If the IDS runs in real time, it can let you know the instant a compromise has occurred. Also, if the monitor gathers its data by reading an activity stream on the system, it can detect a range of features that a single scanner cannot. For example, scanners will not tell you that someone just entered three bad passwords and exceeded the failed login threshold. By the time you finish this chapter, you will understand the following: * How to classify attacks according to how they originate and the threat they pose * The pros and cons of different data sources that a system monitor can use for decisions * What system monitors can and cannot detect * The tradeoffs you may need to make for monitoring your systems in real time * What it takes to really track someone through a network As you will soon see, you need to consider a number of issues when trying to build a system-level IDS. You can see the complate articles at http://www.network.79br.com