After two years of development, the first release of the Messor project is now available. It enhances free, independent, and decentralized software for network security and transparent data collection on attacks and scans. The project's developers have launched the Messor.Network and published a plugin for the OpenCart3 e-commerce platform. The plugin's code is written in PHP and is distributed under the Apache 2.0 license. A module for nginx/apache2 (C++) is in development, along with a plugin for Magento (php) and a plugin for WordPress (php).
The project provides a combination of IPS, Honeypot, and a hybrid P2P client that implements protection against scans, irrespective of their purpose, whether it involves exploiting vulnerabilities, bots, search engines, or other applications. The main distinction of Messor from other IPS systems is its unique network structure. Connected sites form a single P2P network known as Messor-Network, where each participant collects data on intruders, sends information to other network participants, and receives daily updates on the database. Each participant in the Messor network is tasked with distributing the current database to other network members and sending collected data about attacks to the central network. server collected data on attacks.
The database contains:
- List IP addresses, which the network has deemed dangerous, indicating that attacks have been repeatedly recorded from them recently;
- Lists of IP addresses of various bots;
- Regular expressions for detecting attacks based on UserAgent/GET/POST/COOKIE data;
- Regular expressions for identifying bots;
- A list of traps (honeypots) for detecting scans.
Source: opennet.ru
