Vincent Arnold

We saw in part three of this article series that Snort logged pretty much all of the activity that happened over the course of the webserver being exploited by the hacker. That said, it did miss the usage of a key program that was transferred there by the hacker. Much as I mentioned in part three is that an IDS is not a device which guarantees network security. An IDS is at its heart a pattern matching program. Those patterns are the signatures that have been written for it, and continue to get updated over time. While IDS vendors make a pretty decent attempt at generating a fairly broad set of signatures, there is still room for improvement.

Source: Windows Security

This entry was posted on Saturday, April 5th, 2008 at 4:55 pm and is filed under Attack Vector.