I'm reviewing a document that makes recomendations regarding Pandora (an attack tool for Novell). It notes "The introduction of an intrusion detection system (IDS) would also help to mitigate this vulnerability. An IDS would not only provide alerts when this type of attack is attempted, but would also aid in identifying the attacker." Does the CSIDS standard signature load include detection of Pandora NCP spoofing attempts?
My network engineer who has used Pandora (legally of course) stated that the utility uses TCP port 524 and UDP port 524. If you setup a custom sig, you should be able to monitor any activity.
The current signature set does not include coverage for Novell NCP spoofing.
Getting Started
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:
