DISQUS

DISQUS Hello! dmiessler.com | grep understanding is using DISQUS, a powerful comment system, to manage its comments. Learn more.

Community Page

dmiessler.com | grep understanding

dmiessler.com/about/
Jump to original thread »
Author

TTL Caging: How to Fight Malware Using Reduced TTL Values

Started by Daniel Miessler · 7 months ago

My buddy and co-worker Steve Crapo (pronounced CRAY-poe) recently told me about an idea he had a while back about how to keep malware on your network from talking to the Internet. The idea is so simple and beautiful I just had to share it.

As we all know, malware does bad things; ... Continue reading »

3 comments

  • kuza55

    1 year ago

    And the benefit of using this instead of a firewall is what? That anyone who wants to can circumvent it? That doesn't seem like a very useful idea to me...Especially since you're still relying on being able to identify bad traffic going through the proxy.


    P.S. IDS' suck.

    reply
  • Kenneth R Swain II

    1 year ago

    Would not a good egress rule be far more beneficial? I love the way he was thinking, but this would be very hard to maintain. Plus I do not even believe possible in environments that include WAN links such as MPLS or others. One argument that you could use would be that your work place will not let you use good egress rules. If that is they case it seems far fetched that they would let you do this as it would make trouble shooting more difficult.

    reply
  • Daniel Miessler

    1 year ago

    Guys,


    I agree that this would just be another layer if one was already doing the blocking at the firewall. That's a valid point. I just think it's an interesting and elegant way of approaching the problem.

    reply

Add New Comment

Returning? Login