Guide for suggested actions to take when being portscanned/attacked about security-growler HOT 8 CLOSED

To be fair, pulling the ethernet cable is actually the perfect response to an incoming portscan. There's nothing an attacker can do to get around that haha.

from security-growler.

Or have a script ready that'll force your router to reconnect to the internet, which will give you a new IP address (with dynamic IPv4 only, of course). Doesn't work, though, if you're away from home, unless they have the same router. ;)

from security-growler.

I think the most reasonable response would be to temporarily enable firewall stealth-mode on OS X, which will drop all packets that aren't in an app whitelist.

I don't really want Security Growler to be a full-fledged IDS though, I'd rather limit it to simply providing alerts and letting the user take actions if needed. If the user doesn't know how to respond to being portscanned, they aren't really the target audience for this app anyway. I am happy to provide documentation for suggested responses on the website though, and clicking on an alert can take you to the website with instructions.

from security-growler.

Good idea.

/usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode <on|off>

from security-growler.

Hahaha you are probably right, disconnect from ethernet would be the better solution indeed xD

I agree with @pirate, a link to the documentation would be nice.

from security-growler.

I can easily add some basic docs and make the log menu items clickable, my target is to get it out with the next v2.3 release.

After that we can think about adding some more complex actions on click. For example, right now clicking on the VNC connection alerts takes you to Sharing prefs in System Preferences so you can disable VNC.

from security-growler.

Stealth on/off as mentioned above doesn't work on my system; only this one does:
sudo defaults write /Library/Preferences/com.apple.alf stealthenabled -bool <true|false>

from security-growler.

Done, see the new README section How should you respond to alerts?.

from security-growler.