Slashdot Mirror
Attack Registry And Intelligence Service
thelaw writes: "SecurityFocus just announced the start of their new service, ARIS (Attack Registry and Intelligence Service) Analyzer. The service allows you to submit logs from several different intrusion detection systems automatically and quasi-anonymously. Looking at the front page, they seem to have over 700,000 incidents already reported since starting."
And I'll bet they can clear 1,000,000 attacks before the day is out.
Slashdot: Proof that a million monkeys at a million typewriters can create a masterpiece
This centralized service for reporting will lead to some falsified logs being submitted to get somebody in trouble. I hope people use this service, but I also hope they take it with a grain of salt.
Of course, all too soon, they will have a whole category for "slashdotted"...
--Blair
... and it'll be much harder for someone to break into a box and rifle the logs before someone else can look at them. It's not a guarantee that the system will be safe and secure, but it could be a nice deterrent to someone hacking and thinking that they can just clean the logs of their activities later...
"Titanic was 3hr and 17min long. They could have lost 3hr and 17min from that."
IBM had PL/1, with syntax worse than JOSS,
And everywhere the language went, it was a total loss...
Are sites linked from /. thinking they're in the middle of a DoS attack?
DanH
Cav Pilot's Reference Page
Cav Pilot's Reference Page
UNIX - Not just for Vestal Virgins anymore
And my bit of paranoia for the day:
Why do they keep saying how 'secure and private' the log files you send them are? Can't they just trace the IP that sent the log right back to the company and/or individual who owns the IP (unless of course it's a dynamic IP being assigned)? Not that they would want to do so, but let's just stop advertising privacy. There is no privacy on the net. It's like streaking thru a crowded marketplace; not many people notice, but those that do get to see the whole deal.
Although some interesting information could pop out of the service, I don't see any real benefit for ME to submit MY logs. In fact, I only see potential harm... after all, what if their security is breached?
If I'm shown to be wrong, then I must reconsider. But for now, I'll stay on the sidelines.
Really? It doesn't look like the US is disproportionately represented in this list. All of the 'generic' domains plus .us equals ~60%, and a significant number of .coms (over half of that 60%, BTW) are not US sites.
+5:offtopic,but anti-American
cat /var/logs/security | awk '{print $2 " " $3 " " $4} | sort | uniq -c | sort
doing the same thing except that it's not in pretty html format?
Hey i'm still waiting for the cheesy Jon Katz article about the oscars for special effects and how those poor picked on geeks have changed the movie inuistry forever and set a new paradigm for the antiquated movie industry...
blech...
I must have missed something.
I'm not trying to troll or anything but other than the "Cool" factor what does this service do? How is knowing the most common attack types going to help me? The common ones are already patched by clued-in admins. I mean did you see the common attack list? If you're open to SNMP GET you have problems.
Are they going to try and find new attacks with the data or something?
G.H.
Just wait till some crappy band steals your nic.
This service has two sides:
The bright side is that it will bring stats of intrussion attempts. This is particularly interesting, because you can learn wha't going around and take measures before it's too late.
The dark side is that I see a forthcomming IASD (Intrussion Attempt source database) available online, so many ppl will start banning IP's "Just in case".
I do not like ORBS, I feel it's not usefull because of the tendence of give false positives.
As an example, we use a very strict mail relay policy, and every week I get the ORBS tester machines sending mails that end up in postmaster because of their lack of valid rcpt addressess.
Every time is because some ignorant saw SPAM w/bogus reply addresses in some of our domains and thinks that the spam was actually sent from one of our SMTP servers (false, all tend to came from yah00 or h0tmail or some server in korea, who cares).
Imagine a script kiddie who, instead of deleting it's path in the victim's logfile, now replaces it's IP w/someone else's IP address.
Who audits the victim's security policy? Who gives for grant that the supposed victim is honest?
This is very, very difficult to prove.
That last sentence seems unclear - I don't mean to imply that over half of the .coms are not US sites, but that over half of the 60% (i.e. 38% of the total) are .coms, not all of which are US sites.
+5:offtopic,but anti-American
awk '{print $2 " " $3 " " $4}' /var/logs/security | sort | uniq -c | sort
Also, your sort will look like this...
1
10
11
12
2
3
4
5
6
7
8
9
-- perl -e'print pack"H*","6e656d6f406d38792e6f7267"'
"ARIS analyzer is a service designed, administered and maintained by SecurityFocus.com to allow participating network administrators to submit suspicious network traffic and intrusion attempts anonymously, for detailed analysis and tracking. Our aim is to help our participants track incidents and find patterns in attacks that will serve as a threat gauging system for the Internet community."
...DAMN! Doesn't apply to me! Still, this looks to be very useful, and I'd probably subscribe to this service if, you know, I weren't just a college kid on a personal computer.
In fact, they're creating the biggest repository of cracker data in the Web!! If they get compromised, everybody using their services will be painted in red as potential targets.
:
...your account information is stored separately from the IDS logs you submit for analysis...
...You always have the choice of how much information you wish to send. You may decide to strip address information when cleaning logs in ARIS extractor...
As it says in their FAQ
1)
2)
Also, they only know who you are if you choose to tell them, and, even so, that information is stored separately from the attacks on your system.
but you can't be too careful... Amen to that.
Try to hack my 31337 firewall!
Nice service...
But, could've been far more interesting if you could see graphs of OVERALL statistics, not only graphs and data of the logs you sent.
For example, I really wanted to know what are top 10 countries that most of the attacks origin from.
I have no idea if those numbers are typical: the DSL ranges are well known, and so is my ISP's netblock. . . But I'd wager it's virtually ALL automated tools. . .
What can there possibly be left for old-skool h4x0rz like myself? Those 455hol3z have taken all the phun out of it.
A g4ll3ry of my h4x0r1ng k0nqu3sts
This will be like having a free online survey of everyone who got hacked... Pretty soon we'll have the perfect profile for the vulnerable admin/setup and targetting spam,hacks,etc at. A little bit of stats work and you may as well have been handed the emails/ip's of the vulnerable systems. Better still, when their database does get hacked, how much do you wanna bet that info is gonna be worth?
Erm. Scratch sort problem.
Sort is a bgit smarter then I thought.
1
10
is different then
1
10
-- perl -e'print pack"H*","6e656d6f406d38792e6f7267"'
Paranoid freaks of the world unite!
do they also offer hacker toolkits for download or do I have to go elsewhere for that?
"The Most Fun Possible on 4 wheels" is at SunBuggy in Las Vegas
After looking over the ARIS site, I'm left with a bunch of questions.
First, what the heck is the definition of an "incident"? Their FAQ doesn't indicate what this means. If some goofball script kiddie runs a script that sends out 100,000 pings of death, is that one incident, or 100,000? If he tries a Syn flood attack on my site, setting up 1,000 sessions, is that one incident, or 1,000? It sounds like AOL's goofy customer count: "Here, set up seven screen names so that we can claim you're seven different customers."
Secondly, does handing all your log files over to these guys remind anyone of the movie The Net? How do we know SecurityFocus can be trusted? How do we know we're not handing our log files over to someone who's already hacked SecurityFocus? What does this service do for us?
Incidents.org is run by the Global Incidents Analysis Center which is associated with the SANS institute. It's be operating for a while and the "current detects" section is very valueable for those of us who have to address day-to-day security issues.
GIAC assigns a "handler" to be on-duty at any given time. All the reported incidents are filtered through the handler.
Absolutely. Users who create an account and submit their logs have access to the following:
- A service designed to assist users in reporting incidents. We look up the appropriate contacts for the offending organization and their upstream provider, allow you to select which incidents you wish to report, and draft a report fo you with all the pertinant information.
- Access to descriptions about what the attack was that your IDS spotted. This includes links into the Bugtraq database where approrpiate, articles, exploit code (so you can see if the compromise was successful or not), etc...
- The ability to see how many other ARIS users your attacker has attacked, in case that factors into your decision on whether to report or not.
- We track which incidents have been reported (thorugh our system) for you.
- We cross-correlate reports from different IDS brands, for those users who have more than one type.
GMac, your plan is (adopts Sean Connory accent) "Sherioushly Flawed".
;-)
If you automatically shut down a system which looked like it was being hacked, you risk turning off the front door on your 24/7 international business!
It's very difficult to detect a real alert from a false alarm. Case in point:
Last client I was working in had a pair (!) of Sun E10Ks in a failover cluster forming the engine of their website. The Cisco Netranger IDS in the network segment occassionally thought one E10K was launching "ping smurf" attacks on the other E10K, and no amount of IDS tuning would get round it. It turned out it was part of normal Sun cluster network chatter, and it's extremely difficult to harden a clusterised E10K: that's why you deploy an extremely tight firewall in front of it.
Hilarious I grant you, but not at 3am when your mobile goes off and someone is screaming "Help!!" down it
I found it humorous that a exploit cataloging system is being hosted on an NT machine.
The value of this data could theoretically extend far beyond prevention of current attacks. A large body of data on the types and frequency of attacks could potentially lead to statistical analyses allowing predictions of the most common origins of attacks. One could then use this data to inform the development of internet routers and filters to minimize international attacks.
Further, one could do post-hoc correlations of attacks to salient events, yearly cycles, etc. Such data could lead to more accurate predictions of the impacts of same on a company.
In other words, this will be useful for helping to figure out the big picture of how the internet creates and deals with attacks.
Someone hacks on me site, I shut it down using whatever mechanism required, including pulling the plug.
Don't hack on me!Am I the only one who likes to watch script kiddies try and infultrate my machine. I mean I love to watch them try tired old attacks and fail. If this service would let me watch the activities on other servers as well I can double my fun. Actually I'd like the ability to see if the same h4x0r is trying to attack my neighbors as well.
had to, it just sounded great
GIAC has a similar system already at incidents.org. They assign a "handler" to be on duty at any given time, and all incident reports are filtered through the handler. Someone might submit falsified logs, but unless a lot of sources report the same incidents they problably won't get much mention.
The incidents.org website is new, but the GIAC has been around for a while. It used to be just the "current.html" page but they are now expanding to include a whole website. Obviously the web site is nothing much yet. I have a lot of faith in both GIAC and SecurityFocus but I tend to think that GIAC will do a better job by virtue of the experience of their handlers and especially because of the quality of the people already submitting incidents to GIAC.
Deja Vous baby...
--
*Condense fact from the vapor of nuance*
25: ten.knilrevlis@wkcuhc
*Condense fact from the vapor of nuance*
I think this will be an interesting tool. Perhaps by determining which attacks are more frequent in certain regions, people can determine which networks might be missing certain patches? Or parts of the world?
Microsoft aggravates my tourettes syndrome.
another site that is related...but not as full featured is this