Full Disclosure mailing list archives
Re: Brute force attack - need your advice
From: Tonnerre Lombard <tonnerre.lombard () sygroup ch>
Date: Tue, 12 Feb 2008 15:16:40 +0100
Salut, keith () securitynow us, On Tue, 12 Feb 2008 08:17:13 -0500 (EST), keith () securitynow us wrote:
been using since begining of project, but requires a lot of learning to setup properly" and as I stated nothing is foolproof or totally secure. Other measures need deployed as well such as an application
I would not suggest that I have not set it up correctly, because it recognized all the background noise attack patterns just well (and did not notify), but nevertheless it was totally incapable of detecting anything which could really have been interesting.
It takes quite a bit of heat and even then some data can be recovered, from magnetic residue, in labs. Usually cost prohibitive unless someone really wants your data bad and has a big budget. But please state a config that someone with experience can not get into, is more of a point that security is ever evolving.
Well, you can take Flash storage and put 300-400V or so at the contacts - just enough to melt the core before the contacts. If the voltage is too high, only the contacts melt away and the core stays intact. That is the only really erasable medium I'm aware of. An alternative for the longer term is a PGP smart card with an 8192 bit RSA (not! DSA) key which you simply break apart as you get into trouble. It takes a while to reverse engineer the data. But as I said, this is pure populism, servers are here to serve, not to be made inaccessible. It is possible to maintain reasonable security without achieving unusability.
Yup it is security by obscurity and it will help against a script kiddie that won't take the time to scan all ports, thats why I suggested move to a high non-standard port.
That script kiddie won't find its way into a reasonably maintained server anyway, it takes someone clued to do it.
I'm not talking about downloading blacklists but dynamic firewall rules and scripting to achieve a dynamic list based on ranking of attacks against the box. Google does have a few references and
Me too; there are e.g. scripts which evaluate failed logins from syslog and ban them. Thus the mention of the user name with spaces, some of these scripts fall for that trick. Tonnerre -- SyGroup GmbH Tonnerre Lombard Solutions Systematiques Tel:+41 61 333 80 33 Güterstrasse 86 Fax:+41 61 383 14 67 4053 Basel Web:www.sygroup.ch tonnerre.lombard () sygroup ch
Attachment:
signature.asc
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Brute force attack - need your advice, (continued)
- Re: Brute force attack - need your advice Michael Simpson (Feb 12)
- Re: Brute force attack - need your advice Valdis . Kletnieks (Feb 12)
- Re: Brute force attack - need your advice Tonnerre Lombard (Feb 12)
- Re: Brute force attack - need your advice Valdis . Kletnieks (Feb 12)
- Re: Brute force attack - need your advice Simon Smith (Feb 12)
- Message not available
- Re: Brute force attack - need your advice Simon Smith (Feb 12)
- Re: Brute force attack - need your advice Keith Kilroy (Feb 12)
- Re: Brute force attack - need your advice Tonnerre Lombard (Feb 12)
- Re: Brute force attack - need your advice Keith Kilroy (Feb 12)