Hacker News Reader

Comment by hga | Hacker News Reader

I suppose I wouldn't be surprised if the actual use in the industry of effective intrusion detection systems was negligible, but I'd hope otherwise. I'd note that we wouldn't likely hear about many intrusions discovered by the entity itself, they'd ideally stop them before anything major was lost, at worst case keep it quiet.

And, you know, outside of computer stuff where I send my money to NewEgg, I do by default prefer Amazon to all others.

(NewEgg has good prices, superb shipping of bare hard drives, the very best and informative reviews, and now a question and answer system, which sends email to people who've bought a product in case they can answer them. Or so I've found with a fan I recently bought, and helped two people, in one case whipping out my micrometer.)

View on HN

The actual use in industry of intrusion detection is negligible, and the systems themselves are nearly worthless.

For what it's worth: we don't generally recommend IDS deployments.

What about tripwire and the like?

(That is not asked out of idle curiosity, and I've been told the worst intrusions hack the kernel so tripwire would likely be useless, but don't know if those are widespread.)

I operate from the assumption that any serious compromise starting at SQLI injection equates to kernel compromise, so I don't spend a lot of time thinking about host-IDS either.

Tripwire is not a total waste of time, like a network IDS would be, but for most startups a minute spent setting up Tripwire is a minute that could be better spent on appsec.

That is quite a leap to assume root access. A user mode database should have write access only to partitions that are mounted noexec. That would make getting root privileges quite hard even on a vulnerable kernel.

Also with proper hardening you can prevent the kernel from being modified even by root. Things like FreeBSD securelevel that once enabled blocks writing to kernel memory and raw disk devices.

Excuse me if a few years of writing securelevel advisories back in the 1990s leaves me unimpressed with the power of securelevels. :)

Tripwire is just file integrity. It can help to detect the installation of a backdoor. But that doesn't help at all if the backdoor is just memory resident (or installs at kernel level). It also doesn't help if the attacker breaks in, grabs your data and leaves for good.

File integrity is also a pain in the ass. You have to keep a database of good file hashes and it can't be stored on the server (or the attacker modifies the known good hashes). Generally you also should not even have the file integrity software on the live server filesystem.

Similarly Network IDS has the flaw that you must have well defined profiles of "normal behavior" so it can identify abnormal behavior. The other option is signature-based but that would only detect known exploits.

Reply on news.ycombinator.com