The Attack Detection Plug-In

About Attack Detection

The Attack Detection plug-in informs you of a possible attack on your computer from the Internet or the network your computer is connected to.

The Outpost Attack Detection Plug-in consists of two parts:

  • Outpost Scanning Detection module.

  • Outpost Attack Detection module.

The Outpost Attack Detection module detects and blocks the following attacks-also called exploits or Denial Of Service (DOS) attacks: Teardrop, Nestea, Iceping, Moyari13, Winnuke, Nuke, FRAG_ICMP Class (Jol12, Targa13 and other), FRAG_IGMP Class (IGMPSYN and other), SHORT_FRAGMENTS Class, MY_ADDRESS Class (Snork and others), Rst, 1234, Fawx, Fawx2, Kox, Tidcmp, Rfposion, Rfparalyse and Win95handles.

The Outpost Attack Detection module can also detect and neutralize simple distributed DOS attacks.

The Outpost Scanning Detection module can detect simple TCP and UDP port scanning as well as the following types of stealth scanning: Syn, Fin, Xmas, Null, Udp. If Outpost detects a suspicious packet, it displays the "Connection request" message in its log file. "Port Scanning" is another intrusion indicator that is detected if several suspicious packets are received from one remote host within a specified time interval.

The following topics describe how to set-up the Attack Detection plug-in:

Viewing the Attack Detection log

Setting the Alarm Level

Blocking intruders


Viewing the Attack Detection Log

To view the Attack Detection log:

  1. Right-click on the Outpost Firewall icon in the system tray to get the context menu.

  2. Select Show Outpost Firewall

  3. Highlight Attack Detection in the Plug-Ins tree.

  4. Press the Show Detailed Log button on the plug-in information panel.

  5. Outpost Log Viewer will be run displaying the log for the Attack Detection plug-in log.

For more information about Outpost log system please read The Outpost Log System chapter.

Related Topics

About Attack Detection

Setting the Alarm Level


Setting the Alarm Level

The Alarm Level determines the number of suspicious packets detected before Outpost reports "Port Scan Detected".

To set the alarm level:

  1. Select Options

  2. Select Plug-Ins

  3. Highlight Attack Detection

  4. Click Settings

  5. To set the alert level move the slider to

    • Maximum—a "Port Scanned" alert is displayed even if a single scanning of your port is detected.

    • Normal—a "Port Scanned" alert is displayed if several ports are scanned or if a specific port is scanned that Outpost Firewall recognizes as one that is commonly used in attacks.

    • Minimum—a "Port Scanned" alert is displayed if a multiple attack is definitely detected.

Notes

  • You can quickly access the plug-in's properties by right-clicking its name in the left panel of Outpost Firewall's main window.

  • To receive visual alerts about detected attacks, select the Report detected attacks option.

Related Topics

About Attack Detection

Viewing the Attack Detection log


Customizing Attack Detection List

Customizing the Attack Detection List

You can select attacks that Outpost Firewall will detect and avert. By default, Outpost Firewall handles more than fifteen different types of attacks and exploits, but you can select not to detect certain attack types to lower your system resource usage or to stop too-frequent and faulty alert messages that may appear if, for example, a service in your network acts like an attack source.

To customize the attack detection list:

  • On the Options menu click Plug-Ins setup

  • Select Attack Detection and click Settings

  • Click the Advanced tab and then click Edit List

  • Select the attacks that you want Outpost Firewall to detect and avert

  • Click Advanced if you want to modify the advanced attack detection settings

  • Click OK

Related Topics

About Attack Detection

Viewing the Attack Detection log

Setting the Alarm Level


Blocking Intruders

After Outpost detects an attack and displays the "Port Scan Detected" message in the logs, it can be configured to avoid possible future attacks.

  1. Select Options

  2. Select Plug-Ins

  3. Highlight Attack Detection

  4. Click Settings

  5. Specify the steps Outpost Firewall is to follow if an attack on your computer is detected:

    • Block the intruder IP for, if selected, blocks all network exchanges from the computer attacking yours for the number of minutes you set (60 minutes is the default).

    • Also block intruder subnet, if selected, blocks all network exchanges from the entire subnet to which the intruder belongs.

Note

You can quickly access the plug-in's properties by right-clicking its name in the left panel of Outpost Firewall's main window.

Related Topics

About Attack Detection

Viewing the Attack Detection log

Setting the Alarm Level


Specifying Vulnerable Ports

From the security point of view TCP and UDP ports in your system are divided into several groups according to probability of an attacker to use a port to break into your system. Typically, ports assigned to vulnerable services like DCOM or RPC should be monitored with greater care because they are more likely to be an attack target.

However, you may have custom services assigned to custom ports that are also a lure for an attacker. Outpost Firewall lets you create a list of such ports to which it will pay more attention while monitoring network traffic.

To manage the list:

  • On the Options menu click Plug-Ins setup

  • Select Attack Detection and click Settings

  • Click the Advanced tab and then click Specify

    Vulnerable ports     are divided in two groups: System and Trojan. Add ports that are used by vulnerable system services to the system ports list. Add ports that are exploited by well-known Trojan horses to the Trojan ports list. Click the tab according to the list you want to change.

  • Click Add to add a port. You will have to specify the following parameters:
    Protocol    , Port number and Weight. Weight is a decimal value that indicates that port’s importance. A greater number indicates a more vulnerable port. You may also add optional comments to describe the port’s purpose or anything else you’d like noted.

  • Click OK

Related Topics

About Attack Detection

Viewing the Attack Detection log

Setting the Alarm Level


Trusted Hosts and Ports

There may be computers that you are absolutely sure are not a source of danger for your system as well as ports on your system you are sure cannot serve as an intruder’s backdoor. In other words, you consider any monitoring of these hosts and ports useless and prefer to conserve system resources and performance by not monitoring them.

Outpost Firewall Attack Detection plug-in features exclusion lists to which you can add hosts and ports you don't want to be monitored.

To manage these lists:

  • On the Options menu click Plug-Ins setup

  • Select Attack Detection and click Settings

  • Under Exclusions click either Hosts or Ports depending on what list you do want to manage

  • Click OK after you are done with editing the selected list
Related Topics

About Attack Detection

Viewing the Attack Detection log

Setting the Alarm Level


.topic 0x97741784
Number of suspicious packets that are considered to be an attack.

.topic 0x80c11773
Edit the Trusted Hosts list.

.topic 0x80c11771
Edit the list of vulnerable ports. Outpost Firewall will pay more attention monitoring these ports.

.topic 0x9772177b
List of attack against which Outpost Firewall protects you.

.topic 0x97711776
Click to add a port to the list.

.topic 0x97711777
Specify decimal value that identifies port importance.

.topic 0x80c11770
Click to manage the list of detected attacks.

.topic 0x97751788
Click to remove a port from the list.

.topic 0x80bd1775
Select to have plugin to display an alert message every time an attack is detected.

.topic 0x97711775
Specify protocol.

.topic 0x97731787
Click to reset settings to the default values.

.topic 0x9773177d
Parameters that determine how Outpost Firewall detects attacks.

.topic 0x80c11772
Edit the Trusted Ports list.

.topic 0x97741782
Number of suspicious packets that are considered to be an attack.

.topic 0x80be1774
Select to display visual alerts every time an attack is detected.

.topic 0x80bd03fe
A checkmark enables the blocking of an intruder's subnet mask.

.topic 0x80bd03fa
A checkmark enables the blocking of an intruder's IP address for a period if port scanning is detected.

.topic 0x9775178a
Click to add a port to the list.

.topic 0x80bd03fc
An input field to enter the period an intruder's IP address is to be blocked.

.topic 0x80bd03f9
Sets the alert level to low, normal or high.

.topic 1
Applies and saves any changes you have made, and then closes this dialog box.

.topic 0x80be1770
Select to play an audio file every time an attack is detected.

.topic 0x97741780
Number of suspicious packets that are considered to be an attack.

.topic 0x97751789
List of vulnerable ports.

.topic 0x9771177a
Type any information that helps better understand why this port is considered trusted or vulnerable.

.topic 2
The Cancel button closes this dialog box without saving any changes you have made. The Close button closes this dialog box and retains the changes you made.

.topic 0x9772177a
Click to modify advanced attack detection features. Note that they will apply to all attacks on the list.

.topic 0x97741786
Click to reset the alarm levels settings to default.

.topic 0x80bd0401
A checkmark enables the blocking of a local port if a DoS attack is detected.