Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fusker - a NodeJS security system that attacks back

github.com

Post reply on HN
Print view View original

31–36 of 36 posts

Re: Fusker - a NodeJS security system that attacks back

#31

Post by ericmoritz »

jgrahamc wrote: post #13

The idea of a firewall of some sort for web applications seems like a good idea, but this particular one seems rather lame. For example, here's the complete code that implements the 'local file inclusion' attack detection: var url = require('url'); exports.check = function (req, res) { if (req.url.indexOf('../') > -1) { fusker.handleAttack('LFI', req, res); } }; https://github.com/wearefractal/fusker/blob/master/lib/…

My guess is this is just a proof of concept. For this kind of thing, [Snort](http://www.snort.org/) with it's huge corpus of intrusion detection patterns.

Re: Fusker - a NodeJS security system that attacks back

#32

Post by xpaulbettsx »

younewman wrote: post #15
maeon3 wrote: post #12

The solution to this is not to launch a counter attack on the attacker, but to automatically launch automated collaborative investigation where evidence is gathered to try to nudge the attacker into doing something that reveals his location/identity. 1. Software notices inappropriate behavior. 2. Launches a honeypot service with lots of holes in it to give attacker opportunity to get root. 3. Root takes them to a loc…

How exactly is this "recursive trace" going to work? As soon as you get to a computer the attacker controls he can subvert whatever mechanism you're thinking of.

If you were clever with virtualization software, you could let the VM guest get taken over, and use heuristics on the host to detect where they were coming from.

Re: Fusker - a NodeJS security system that attacks back

#33

Post by khafra »

thaumaturgy wrote: post #16
jgrahamc wrote: post #7

Earlier quoted context omitted.

http://en.wikipedia.org/wiki/TCP_sequence_prediction_attack You spoof the IP address you are sending from and then predict the TCP sequence number so you can make it look as though you are receiving the replies (even though they are going to another machine since you spoofed the IP address). Such an attack was proposed by Hacker News' very own rtm: http://tools.ietf.org/html/rfc1948

Unfortunately for my original point, it looks like my info was waaaay out of date, and most OSs started using cryptographically random ISNs years ago. My bad, sorry for the noise. edit: I suppose this means it's time for me to finally discard my copy of Inside TCP/IP, third edition. :-(

Don't just throw it away; it's great for ergonomics. Most people's monitors are way too far below eye level.

Re: Fusker - a NodeJS security system that attacks back

#34

Post by EButlerIV »

mikaelchoni wrote: post #23
jameshart wrote: post #17

Completely misses the point of XSS and XSRF attacks. In those scenarios the 'attacking' browser is actually the attacker's victim. If you use this module, an attacker can link a victim to you and have your 'defences' arbitrarily attack them, making you part of the problem, not the solution.

Hmm... this never occurred to me. The future of the project is going to be socket.io packet analysis with detectives. The current http request analysis is really weak and not intended to be the main focus If you want to prevent this from happening there will be http-xss and socket-xss detectives in the future, just leave out the http-xss to keep it safe. Optionally you could always set your payloads to logging only

If it's not intended to be the main focus, why are you bothering to demo it now? Why not wait and show us something even slightly representative of what your project is supposed to be like?

Re: Fusker - a NodeJS security system that attacks back

#35

Post by EButlerIV »

munin wrote: post #25

be careful with anything that "attacks back", the legality of that is still being phrased. yes, i know that it doesn't "really" "attack back" but when you phrase it that way you're going to raise some hackles.

"Attacking back" with shock images may be genuinely legally problematic, given the untested new Tennessee law on the subject. http://arstechnica.com/tech-policy/news/2011/06/tenn-law-ban... . Using the included nimp payload is even more legally problematic since it actually does redirect the user to a site that contains malicious code.

I think this project, much like all "offensive security" projects, is fundamentally misguided. At best, this project loudly alerts the hacker every time an attack is detected, providing an easy way to black-box test the service's attack detection criteria. At worst, it provides an easy way for jerks to goatse, Last Measure, etc. third parties using the webmaster's site. While I understand the kind of spiteful thrill that would come from redirecting a (maybe not) attacker to a shocking image, quietly stopping and logging the attack is always the best option.

Re: Fusker - a NodeJS security system that attacks back

#36

Post by mikaelchoni »

EButlerIV wrote: post #35
munin wrote: post #25

be careful with anything that "attacks back", the legality of that is still being phrased. yes, i know that it doesn't "really" "attack back" but when you phrase it that way you're going to raise some hackles.

"Attacking back" with shock images may be genuinely legally problematic, given the untested new Tennessee law on the subject. http://arstechnica.com/tech-policy/news/2011/06/tenn-law-ban... . Using the included nimp payload is even more legally problematic since it actually does redirect the user to a site that contains malicious code. I think this project, much like all "offensive security" projects, is fundamentall…

Don't enable any payloads besides blacklisting then. Problem solved
Post reply on HN