RE: Bittorrent - utorrent

[<jay.tomas () infosecguru com>]

Setup an inline sniffer, or examine router logs. Correspond IP Address > MAC Address > Username  > Real Name and then 
fire them.

I know this is a technical list and would defer the question to anyone who wants to raise some wicked f00 to state a 
solution.

This is more a management/personnel issue. If you have folks that are blantanly downloading torrents at work, I'm sure 
they have chat clients running tunelling and out your SOCKS server. You can spend money and effort to control them or 
root them out and remove them. You have enough folks in the world that would like to abuse your network. Your employees 
shouldnt be one of them.

Jay

----- Original Message -----
From: Ove Dalg?rd Hansen [mailto:odh () itq dk]
To: focus-ids () securityfocus com
Sent: Wed, 07 Mar 2007 20:38:29 +0100
Subject: Bittorrent - utorrent

Hello Everyone,

I am in a bit of trouble,

On a network where i am configuring IDS - using ASA5510 + SSM module, we try to deny access to Bittorrent downloads - 
it consumes quite a bit of bandwith and is not allowed by the company's policy.
We try to filter bittorrent which succedes - but the utorrent changes protocol and goes by the SSL port 443 and thereby 
circumvent the IDS, since its not possible to see the encrypted traffic.

Does anyone out there have a good idea of how i am to solve the issue?


Best Regards

Ove Hansen
IT-Quality A/S
Banemarksvej 50F
Denmark - 2605




------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------