[mkamka]

There's a new wave of Antivirus solutions coming our way; at least in the corporate world, which promise to deliver ways to stop hacking in it's tracks.

I'm curious what exactly DLP appliances that attach to network core switches and respective Antivirus agents with DLP plugins (on workstations) can and can't do.

For example, McAfee Prevent DLP product and other sister products:
http://www.ndm.net/dlp/McAfee/mcafee-dlp-prevent

Wording like that can even make an innocent ✌ grey-hat hacker nervous; who is probably just SSL tunneling into their home web server.

I would be curious to know how much marketing is behind these products; and, if they can "hack the hacker" by tracking a user's behavior each day; looking for:

- If a user is using SSL to get through to their home web server for extended periods.

- If a user is running a socks proxy on their workstation or forwarding ports on localhost

- Or, maybe even a legitimate MITM attack to see what's in that SSL connection.

Not sure what methods can at least protect the user's privacy a little; by at least feeling they can save files or have local TCP ports open on a workstation without detecting the type of server listening on localhost (socks, http, etc); even if on uncommon ports (stuff like what nmap does).

[Xyk™]

That new wave of Antivirus solutions is announced every few years and nothing ground breaking happens.
They make lots of money treating the symptoms so why would they tackle the cause?

Corporate IDS are nothing new and, if correctly configured, do provide some pretty solid protection.

Detecting and blocking SSH tunnels or VPN connections is easy using DPI. Pattern detection is getting better and better.

In a secure corporate environment, you would block all outbound connections except port 80 (over a transparent proxy) and 443. A SSH tunnel over port 443 would be dropped after a short time because it is highly unusual for HTTPS connections to be long-lasting and having a varying throughput. There's no such thing as a secure system, but you can really make it considerably more difficult and time-consuming for an attacker. DNS/ICMP/HTTP tunnels are easy to detect as well. Especially ICMP and DNS. HTTP is more difficult, but a tool like "httptunnel" generates highly unusual traffic as well and would be caught.

In a big network, 99% of your users are predictable. They always use the same services, websites and software and irregularities, for example a backdoor trying to establish a reverse connection, are easy to spot. Misbehaving users are rare.

McAfee, though, … yeah… I won't comment on the lifestyle of the company founder but I can comment on the quality of their software. It's rather mediocre, and they did shit like pushing signatures for critical system files… not once… but THREE TIMES IN A MONTH. Resulting in massive problems.

which promise to deliver ways to stop hacking in it's tracks

Never trust anyone who promises that. Making it more difficult… maybe. Stopping it – certainly not.