This is Flameeyes's TypePad Profile.
Join TypePad and start following Flameeyes's activity
Flameeyes
Recent Activity
Another method I implemented in my ruleset is to check for "sdch" in Chrome requests' Accept-Encoding: only Chrome supports that encoding, and no other browser, which makes it perfect for this use.
I think my ruleset alone kills half those default user-agents :)
Commented Jan 28, 2012 on HOIC DDoS Analysis and Detection at SpiderLabs Anterior
HOIC DDoS Analysis and Detection
In a previous blog post, we provided details of a DDoS attack tool called LOIC (Low Orbit Ion Canon) used by Anonymous in supports of denial of service attacks over the past year. Attackers are constantly changing their tactics and tools in response to defender's actions. Recently, the SANS In...
Glad to see I'm not the only one considering browser fingerprinting a valid technique... my experiment with using it as an antispam method have worked quite nicely, for what concerns my blog.
Some fake browser rejection is already implemented in my own set of rules at http://www.flameeyes.eu/projects/modsec — there is one further that here is not considered: MSIE always sends an Accept-Encoding header as well.
Also about the use of Host and HTTP/1.0 (which is another thing that suggested to me going for browser fingerprinting), no modern browser still uses HTTP/1.0, unless it's going through a proxy and is the proxy doing the downgrade. But if there is a proxy involved, it should include a Via header as well. I have used that for a while but there was some reason why I had to take it out.
I need to check Windows-based browsers, by the way, but I think a browser sending an Accept: */* might be a red flag as well.
Commented Jan 28, 2012 on HOIC DDoS Analysis and Detection at SpiderLabs Anterior
HOIC DDoS Analysis and Detection
In a previous blog post, we provided details of a DDoS attack tool called LOIC (Low Orbit Ion Canon) used by Anonymous in supports of denial of service attacks over the past year. Attackers are constantly changing their tactics and tools in response to defender's actions. Recently, the SANS In...
Uhm, the IP check only works with IPv4.. admittedly I haven't seen any interesting attack on IPv6 yet, but that would be a first way to defeat the rules....
Commented Sep 30, 2011 on ModSecurity Advanced Topic of the Week: Remote File Inclusion Attack Detection at SpiderLabs Anterior
ModSecurity Advanced Topic of the Week: Remote File Inclusion Attack Detection
Remote file inclusion (RFI) is a popular technique used to attack web applications (especially php applications) from a remote server. RFI attacks are extremely dangerous as they allow a client to to force an vulnerable application to run their own malicious code by including a reference pointer...
You have a typo in the example config, it's not RequestReadyTimeout it's RequestReadTimeout, but beside that, thanks for letting us know about this!
Commented Nov 30, 2010 on (Updated) ModSecurity Advanced Topic of the Week: Mitigating Slow HTTP DoS Attacks at SpiderLabs Anterior
(Updated) ModSecurity Advanced Topic of the Week: Mitigating Slow HTTP DoS Attacks
Update - the latest version of the ModSecurity 2.6 has a new directive called SecWriteStateLimit that helps to defend against Slow POST attacks. With the recent OWASP AppSec DC presentation on Slow HTTP POST DoS attacks, the issue of web server platform DoS concerns have reached a new high. Not...
Flameeyes is now following The Typepad Team
Nov 30, 2010
Subscribe to Flameeyes’s Recent Activity
