From: Eriberto <eriberto@eriberto.pro.br> To: sarlug@lug.ru Subject: [Sarlug] IPS HLBR 1.0 released (off-topic) Date: Mon, 06 Mar 2006 15:29:40 -0300 Message-ID: <duhv4h$4li$12@sea.gmane.org> (raw) IPS HLBR - Version 1.0 can detect malicious traffic using regular expressions Version 1.0 of Hogwash Light BR, released march 5th 2006, brings two interesting new features. The first one is the ability of using regular expressions to detect intrusion attempts and e-mails with virus or phishing. The second is the use of lists with banned words. HLBR is an IPS (Intrusion Prevention System) that reads network traffic in the layer 2 of the OSI model. Since it works like a bridge, it stays in-line in the network topology and doesn't need an IP address. So, HLBR is invisible to attackers. Traffic filtering (including the packets contents) can be done with simple rules. Version 1.0 can use regular expressions to filter the packets. Below is an example of rule with regular expressions: (please see http://hlbr.sourceforge.net/hlbr-rule-1.gif) In short, all TCP traffic destined to port 25 of the e-mail server will be filtered. If the text: filename="anything_different_of_line_breaks.s__c__r" (please ignore underlines in s__c__r) is found inside the packet, that means there are an attachment .scr in the e-mail (virus). So this packet will suffer the action named 'virus'. This action logs the event, dumps the malicious traffic in tcpdump format and drops the packet. Below is an example of rule against a type of buffer overflow attempt against DNS servers: (please see http://hlbr.sourceforge.net/hlbr-rule-2.gif) In this case, due to the use of pipe characters (|), HLBR will check the traffic for the hexadecimal sequence given as an attack signature. HLBR lets you use rules for blocking attacks against network servers. In order to fully understand it please read our documentation at http://hlbr.sourceforge.net/ips-en.html - explanations about the IPS concept including charts. HLBR site is at http://hlbr.sourceforge.net. (Translated from Portuguese by André Bertelli - andre (a) bertelli.name)
reply other threads:[~2006-03-06 18:29 UTC|newest] Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to='duhv4h$4li$12@sea.gmane.org' \ --to=eriberto@eriberto.pro.br \ --cc=sarlug@lug.ru \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Saratov Linux User Group This inbox may be cloned and mirrored by anyone: git clone --mirror http://lore.altlinux.org/sarlug/0 sarlug/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 sarlug sarlug/ http://lore.altlinux.org/sarlug \ sarlug@lists.lug.ru sarlug@lug.ru public-inbox-index sarlug Example config snippet for mirrors. Newsgroup available over NNTP: nntp://lore.altlinux.org/org.altlinux.lists.sarlug AGPL code for this site: git clone https://public-inbox.org/public-inbox.git