IDS signatures [was Re: Interestingly enough...]

On Tue, Nov 07, 2006 at 09:44:07AM +0100, Jan Reister wrote: On 31/10/2006 03:53, Fergie wrote: I found it interesting that Cisco added this their most recent IDS signatures: Bleedingsnort has the following signatures: You can see the rules at

Re: Interestingly enough...

On 31/10/2006 03:53, Fergie wrote: I found it interesting that Cisco added this their most recent IDS signatures: Bleedingsnort has the following signatures: 2001728 || BLEEDING-EDGE POLICY TOR 1.0 Client Circuit Traffic || url,tor.eff.org 2002950 || BLEEDING-EDGE POLICY TOR 1.0 Server Key

Re: Interestingly enough...

well, on one hand, using tor is a sign of distrust towards server privacy policies and the local police subpoena and warrant policies. which is probably not unwarranted. the internet server fraternity is new to having users who can cloak their identity, so naturally like most human responses to

Re: Interestingly enough...

it's a good thing really, shows that public awareness of tor is rising.On 10/31/06, Fergie [EMAIL PROTECTED] wrote:I found it interesting that Cisco added this their most recent IDS signatures:[snip]PLATFORM SIGID SIGNAME ENGINE SEVERITY ENABLED5.x5816.0TOR Client Activity SERVICE-HTTP

Interestingly enough...

I found it interesting that Cisco added this their most recent IDS signatures: [snip] PLATFORM SIGID SIGNAME ENGINE SEVERITY ENABLED 5.x 5816.0 TOR Client Activity SERVICE-HTTP Low True [snip] Go figure. - ferg -- Fergie, a.k.a. Paul Ferguson Engineering