At the very least it should be using the asyncness of node to hold malicious connections open forever, bogging down any synchronous attack tools. Although, I doubt there are any such attack tools out there these days.
Fusker - a NodeJS security system that attacks back
11–20 of 36 posts
Re: Fusker - a NodeJS security system that attacks back
#12The solution to this is not to launch a counter attack on the attacker, but to automatically launch automated collaborative investigation where evidence is gathered to try to nudge the attacker into doing something that reveals his location/identity.
1. Software notices inappropriate behavior.
2. Launches a honeypot service with lots of holes in it to give attacker opportunity to get root.
3. Root takes them to a locked down part of the computer.
4. Have the system project a computer where the admins are complete fools, making the attackers feel a false sense of security.
5. Send investigation information about the attacker to other servers running this software, ask other servers to "Help me find the bozo using this spoofed IP address". If you see someone transmitting on this IP, help me find its true origin.
The software could recursively trace right back to the ISP that is hosting the computer of the attacker. Don't have it launch a counter attack, the goal here is not to send the attacker to goatse (he probably enjoys it). The counterattack should be in the form of a policeman tapping the attacker on the shoulder and saying: "you have the right to remain silent".
The answer is not fighting back immediately, it's sun tzu's legendary advice, let the enemy think they have gamed your box, so they launch a bolder move, then you catch them with their hand in the cookie jar.
Re: Fusker - a NodeJS security system that attacks back
#13The idea of a firewall of some sort for web applications seems like a good idea, but this particular one seems rather lame. For example, here's the complete code that implements the 'local file inclusion' attack detection:
var url = require('url');
exports.check = function (req, res) {
if (req.url.indexOf('../') > -1) {
fusker.handleAttack('LFI', req, res);
}
};
That's very simplistic and I wouldn't be surprised if you could get round it with trickery like ..%2F or similar encodings since if you dig in it's being passed the req from the http Node.js module and using the .url parameter. That returns the full URL from the request itself.
And check out how SQL injection is detected: https://github.com/wearefractal/fusker/blob/master/lib/detec... It appears to be completely unimplemented.
Also, the whole 'fight back' idea is a bad one. We've seen from the spam world that fighting back tends to create collateral damage. If someone is attacking your web site then it's best just to silently discard attacks, after all if an attack back is detected that gives the attacker information.
Also, blacklisting IP addresses on the Internet is quite a dangerous thing to do. The IP address being presented to the end web site may well come from a company or from an ISP where there are many, many legitimate users on the same IP. A blacklist needs to be managed carefully to avoid an attacker knocking out a large group of legitimate users.
Re: Fusker - a NodeJS security system that attacks back
#14It "attacks back" in this case by redirecting users to various other sites. The fun thing about applications like this one is that they make for a great self-inflicting DoS; all I have to do, as an attacker, is run a script that launches lame attacks with spoofed IPs against a fusker site. With not too much trouble, I could cause your website to redirect a lot of your U.S. customers to goatse, or whatever module you…
Except then you could use your "lame" spoofing attacks to redirect whoever you wanted to whatever site you wanted anyway.
Re: Fusker - a NodeJS security system that attacks back
#15The solution to this is not to launch a counter attack on the attacker, but to automatically launch automated collaborative investigation where evidence is gathered to try to nudge the attacker into doing something that reveals his location/identity. 1. Software notices inappropriate behavior. 2. Launches a honeypot service with lots of holes in it to give attacker opportunity to get root. 3. Root takes them to a loc…
How exactly is this "recursive trace" going to work? As soon as you get to a computer the attacker controls he can subvert whatever mechanism you're thinking of.
Re: Fusker - a NodeJS security system that attacks back
#16Earlier quoted context omitted.
> is run a script that launches lame attacks with spoofed IPs against a fusker site How do you spoof your IP in TCP? If you spoof your source address you shouldn't be able to get past the handshake.
http://en.wikipedia.org/wiki/TCP_sequence_prediction_attack You spoof the IP address you are sending from and then predict the TCP sequence number so you can make it look as though you are receiving the replies (even though they are going to another machine since you spoofed the IP address). Such an attack was proposed by Hacker News' very own rtm: http://tools.ietf.org/html/rfc1948
Unfortunately for my original point, it looks like my info was waaaay out of date, and most OSs started using cryptographically random ISNs years ago.
My bad, sorry for the noise.
edit: I suppose this means it's time for me to finally discard my copy of Inside TCP/IP, third edition. :-(
Re: Fusker - a NodeJS security system that attacks back
#17Completely misses the point of XSS and XSRF attacks. In those scenarios the 'attacking' browser is actually the attacker's victim. If you use this module, an attacker can link a victim to you and have your 'defences' arbitrarily attack them, making you part of the problem, not the solution.
Re: Fusker - a NodeJS security system that attacks back
#18[deleted]
Re: Fusker - a NodeJS security system that attacks back
#19The idea of a firewall of some sort for web applications seems like a good idea, but this particular one seems rather lame. For example, here's the complete code that implements the 'local file inclusion' attack detection: var url = require('url'); exports.check = function (req, res) { if (req.url.indexOf('../') > -1) { fusker.handleAttack('LFI', req, res); } }; https://github.com/wearefractal/fusker/blob/master/lib/…
Blacklisting is done for small temporary amounts of time
And yes, some things are not finished yet. The project was started a matter of hours ago and not even close to it's full potential
EDIT: Keep in mind you are the one who decides what modules and payloads to use. Blacklisting is optional
Re: Fusker - a NodeJS security system that attacks back
#20It's all fun and games to imagine attackers and script kiddies having trouble with this. But its scary to think what might happen if one the innocent visitors/customers are marked as attackers by mistake.