Re: RES: Protocol Anomaly Detection IDS - Honeypots

From: Mike Shaw <mike(at)shawnuff.net>
Date: Fri Feb 21 2003 - 11:54:23 EST

>For example, you create a word document that has the title of payroll

This is something I've been doing on my production networks for a couple years now, but at more than the wire level.

Think:
Excel spreadsheets of bogus usernames and passwords. Fake info being passed over AIM and other cleartext protocols on a hub. Bogus customer records in a banking app. Bogus hosts in host lists.
File names that should never be in a directory scan. False DNS entries such as "accounting.domain.com"

The possibilities are endless.

-Mike

---

Does your IDS have Intelligent Attack Profiling? If not, see what you're missing.
Download a free 15-day trial of StillSecure Border Guard. http://www.securityfocus.com/stillsecure Received on Fri Feb 21 12:06:01 2003