Re: Local Mirror Prevention with IDS

On Fri, 17 Dec 2004 14:38:16 +0200, Dimitrios Patsos <dpat@space.gr> wrote:
> Can anybody provide some help on how can we prevent a user from making a
> local mirror of a web site by using both host & network IDS?

IMHO, this isn't really an IDS issue.

Most of the mechanisms I have seen for trying to stop HTTP users from
recursively fetching the entire contents of a site use three
approaches --

1) Make a mirror.zip available, to save bandwidth.

2) Use network, load-balancer, and/or web server rate-limiting modules
to control the number requests and bandwidth that a single IP (or a
single subnet range) can make in a minute/hour/day/week.

3) Include "canary" dead-end links which, when accessed, cause your
web server to temporarily refuse to accept further requests from the
source IP which accessed the canary.  This can cause problems for
proxies (this may be a feature).

Kevin Kadow

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------