 SteveI know your IP addressConsultant
join:2001-03-10
Yorba Linda, CA
kudos:5 | reply to atangel
Re: The ZoneAlarm/BBR research thread I captured one! I don't know whether it's looking at outgoing or incoming data, but I have the data to fool with. I'll see if I can simulate it.
Steve
--
Stephen J. Friedl * Security Consultant * Tustin, California USA * my web site |
|
SteveI know your IP addressConsultant
join:2001-03-10
Yorba Linda, CA
kudos:5 | Well when I reply my POST data, ZoneAlarm doesn't seem to get confused, so it may not be strictly related to short patterns but data as appearing over a longer period.
This may take some doing.
Steve
--
Stephen J. Friedl * Security Consultant * Tustin, California USA * my web site |
|
SteveI know your IP addressConsultant
join:2001-03-10
Yorba Linda, CA
kudos:5 | said by Steve:
This may take some doing.
... and I can now reliably reproduce the ZoneAlarm proxy confusion with a fixed stream of data to the BBR webservers (essentially replaying the captured data from tcpdump with a small perl program), so now it's just a matter of trimming stuff out until it stops misdetecting; then we'll know what the patterns are.
Woo hoo!
Steve
--
Stephen J. Friedl * Security Consultant * Tustin, California USA * my web site |
|
|
|
