Protecting against and learning attack vectors on web artifacts
A server includes a service processor hosted by a baseboard management controller (BMC) and independent of a CPU of the server. The service processor performs a set of monitoring tasks including performing a deep packet analysis on at least a subset of incoming packets. The deep packet analysis includes maintaining state information about the packets, examining the state information to identify an order in which the packets arrived, reassembling the packets into a new arrival sequence that is different from the order in which the packets arrived, matching the new arrival sequence to attack patterns stored in an attack pattern database, and upon the new arrival sequence matching an attack pattern, adding source Internet Protocol (IP) addresses associated with the packets to a blacklist.
1. A method for protecting a server against attacks comprising:
performing a plurality of monitoring tasks by a service processor, the service processor being hosted by a baseboard management controller (BMC) and independent of a central processing unit (CPU) of the server, the plurality of monitoring tasks comprising:
receiving a plurality of incoming packets at the server; and
performing a deep packet analysis on at least a subset of the packets, the deep packet analysis comprising:
maintaining state information about the packets, the state information comprising timestamps indicating when the packets arrived;
examining the state information to identify an order in which the packets arrived;
reassembling the packets into a new arrival sequence that is different from the order in which the packets arrived;
matching the new arrival sequence to attack patterns stored in an attack pattern database; and
upon the new arrival sequence matching an attack pattern, adding source Internet Protocol (IP) addresses associated with the packets to a blacklist, wherein the service processor resides in a trust boundary having a lower level of trust than a trust boundary in which the CPU of the server resides.
2. The method of claim 1 further comprising:
decoding header information associated with the plurality of incoming packets;
checking the header information against a whitelist and the blacklist;
when the header information matches with the whitelist, passing the packet;
when the header information matches with the blacklist, dropping the packet; and
when the header information does not match with the whitelist and the blacklist, performing the deep packet analysis.
3. The method of claim 1 wherein the plurality of monitoring tasks comprise:
maintaining an original copy of web files hosted by the server in a shared storage space accessible by the service processor; and
periodically checking the web files hosted by the server against the original copy of the web files maintained in the shared storage space for changes indicating compromise.
4. The method of claim 1 wherein the plurality of monitoring tasks comprise:
periodically copying access logs to web files hosted by the server to a shared storage space accessible by the service processor;
scanning the access logs copied to the shared storage space for access requests indicating an attack; and
adding a source IP address associated with the access requests indicating an attack to the blacklist.
5. The method of claim 1 wherein the service processor is associated with a network out-of-band from a network associated with the CPU of the server.
6. A system comprising: a service processor; and memory configured to store one or more sequences of instructions which, when executed by the service processor, cause the service processor to carry out the steps of protecting a server against attacks by:
performing a plurality of monitoring tasks by the service processor, the service processor being hosted by a baseboard management controller (BMC) and independent of a central processing unit (CPU) of the server, the plurality of monitoring tasks comprising:
receiving a plurality of incoming packets at the server; and
performing a deep packet analysis on at least a subset of the packets, the deep packet analysis comprising:
maintaining state information about the packets, the state information comprising timestamps indicating when the packets arrived;
examining the state information to identify an order in which the packets arrived;
reassembling the packets into a new arrival sequence that is different from the order in which the packets arrived;
matching the new arrival sequence to attack patterns stored in an attack pattern database; and
upon the new arrival sequence matching an attack pattern, adding source Internet Protocol (IP) addresses associated with the packets to a blacklist, wherein the service processor resides in a trust boundary having a lower level of trust than a trust boundary in which the CPU of the server resides.
7. The system of claim 6 wherein the service processor further carries out the steps of:
decoding header information associated with the plurality of incoming packets;
checking the header information against a whitelist and the blacklist;
when the header information matches with the whitelist, passing the packet;
when the header information matches with the blacklist, dropping the packet; and
when the header information does not match with the whitelist and the blacklist, performing the deep packet analysis.
8. The system of claim 6 wherein the plurality of monitoring tasks comprise:
maintaining an original copy of web files hosted by the server in a shared storage space accessible by the service processor; and
periodically checking the web files hosted by the server against the original copy of the web files maintained in the shared storage space for changes indicating compromise.
9. The system of claim 6 wherein the plurality of monitoring tasks comprise:
periodically copying access logs to web files hosted by the server to a shared storage space accessible by the service processor;
scanning the access logs copied to the shared storage space for access requests indicating an attack; and
adding a source IP address associated with the access requests indicating an attack to the blacklist.
10. The system of claim 6 wherein the service processor is associated with a network out-of-band from a network associated with the CPU of the server.
11. A computer program product, comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein, the computer-readable program code adapted to be executed by one or more processors to implement a method comprising:
performing a plurality of monitoring tasks by a service processor, the service processor being hosted by a baseboard management controller (BMC) and independent of a central processing unit (CPU) of a server, the plurality of monitoring tasks comprising:
receiving a plurality of incoming packets at the server; and
performing a deep packet analysis on at least a subset of the packets, the deep packet analysis comprising:
maintaining state information about the packets, the state information comprising timestamps indicating when the packets arrived;
examining the state information to identify an order in which the packets arrived;
reassembling the packets into a new arrival sequence that is different from the order in which the packets arrived;
matching the new arrival sequence to attack patterns stored in an attack pattern database; and
upon the new arrival sequence matching an attack pattern, adding source Internet Protocol (IP) addresses associated with the packets to a blacklist, wherein the service processor resides in a trust boundary having a lower level of trust than a trust boundary in which the CPU of the server resides.
12. The computer program product of claim 11 wherein the method further comprises:
decoding header information associated with the plurality of incoming packets;
checking the header information against a whitelist and the blacklist;
when the header information matches with the whitelist, passing the packet;
when the header information matches with the blacklist, dropping the packet; and
when the header information does not match with the whitelist and the blacklist, performing the deep packet analysis.
13. The computer program product of claim 11 wherein the plurality of monitoring tasks comprise:
maintaining an original copy of web files hosted by the server in a shared storage space accessible by the service processor; and
periodically checking the web files hosted by the server against the original copy of the web files maintained in the shared storage space for changes indicating compromise.
14. The computer program product of claim 11 wherein the plurality of monitoring tasks comprise:
periodically copying access logs to web files hosted by the server to a shared storage space accessible by the service processor;
scanning the access logs copied to the shared storage space for access requests indicating an attack; and
adding a source IP address associated with the access requests indicating an attack to the blacklist.
15. The computer program product of claim 11 wherein the service processor is associated with a network out-of-band from a network associated with the CPU of the server.