etsy / midas

Mac Intrusion Detection Analysis System

MIDAS

Mac Intrusion Detection Analysis System

MIDAS has been archived

MIDAS is no longer supported and has been archived. The original source is available via https://github.com/etsy/MIDAS/tree/pre_archive. Take a look at Open Source Spring Cleaning for more details.

midas's Issues

The method get_most_recently_updated_file in the filesystem module never returns a value

I am extremely new to python. However, if I understand the code correctly, the variable files is reassigned to an empty hash. Since the new value is an empty hash, there is nothing to iterate over. The subsequent conditional if files: test fails, so nothing is returned from this method.
Perhaps filetimes = {} or something of the sort was originally intended. Please forgive me, I don't have a pull request with a fix at the moment.

Intrusion

I want to intrude into a betting website to change the data.

But I'm not at all.

I am still a child. Is there anyone who can teach me?

My mailbox: [email protected]

报错

Can you share what alternative you have come up with?

I came across this in a search for a good solution for Mac IDS. I assume you found something better, and was curious to know what it was.

Thanks,
J

Permissions problem in logs for plist analysis module.

I am getting an error with the analyze_plist module:

2013-12-28T18:44:39+0100 [snip-host] ty[example_analyzeplist]: ty_error_running_file=/Users/[snip]/src/MIDAS/midas/modules/example_analyzeplist.py ty_error_section=lad ty_error_message=IOError(13, 'Permission denied')

However, I am running launcher.py as root. Moreover, I am able to read and parse other plists into MIDAS, e.g.:

2013-12-28T18:46:49+0100 [snip-host] ty[example_analyzeplist]: ty_name="plist" hash="909592f1ff9df1ff9477c615b2c4e2f92510e2f2"date="Sat, 28 Dec 2013 18:46:49"name="/Applications/LibreOffice.app/Contents/Info.plist"

Does this imply a permissions error on a specific plist file? If so, is it possible to specify in logs which plist is problematic?

Let me know if you need more info to reproduce problem. I am on commit 0763ffe.

$ uname -a 
13.0.0 Darwin Kernel Version 13.0.0: Thu Sep 19 22:22:27 PDT 2013; root:xnu-2422.1.72~6/RELEASE_X86_64 x86_64

$ ls -la `which python`
lrwxr-xr-x  1 [snip]  admin  33 Dec 28 18:26 /usr/local/bin/python -> ../Cellar/python/2.7.6/bin/python