Matthew LeGrow wrote:
Dave Aitel wrote:
Interesting, because this means Intrushield must parse MSRPC and SMB
correctly. This is actually quite rare in an NIDS or NIPS. It'd be
good to see what NFR and some of the other heavy hitters do.
For NFR Sentivist, we reassemble MSRPC fragments before analyzing the
traffic, including MSRPC over SMB and web (via CIS). Any anomalies in
MSRPC fragment reassembly will also kick off alerts.
A pseudo-whitepaper written to help teach N-Code function callbacks
appeared in our last quarterly newsletter here and describes the MSRPC
over SMB interaction in some detail:
http://www.nfr.com/newsletter/fall-04/AdvancedN-CodeFUCallbacksPackageIntegration.htm
I actually assumed you would handle this correctly, knowing your team.
On the other hand, I didn't think Snort would fail as badly as it did.
This is the part that actually confuses me, since the CRI will split the
DCOM header itself into multiple SMB packets. I'm not familiar with
NCODE though, so there may be something I'm missing.
# MSRPC analyzes DCE/RPC data from the passed-in SMB payload
1. Receives an entire SMB, and the offset to the start of RPC header
after having registered callbacks with the SMB/Named Pipes
backend. *ENABLE_MSRPC_OVER_SMB * must be set to 1 and the named
pipes to monitor must be filled in the list for the
*MSRPC_NAMED_PIPES * variable.
2. Operates on the MSRPC traffic as if it were arriving over port
135/TCP - gathers fragments, optionally parses
3. Calls callbacks based on UUID
When one SMB packet comes in, this will buffer the data until it has an
entire DCE PDU, at which point it will send it to the DCE parser, which
will then buffer data until it has a whole request?
I checked your site for a free download, but I don't think there is one.
Any recent CANVAS or the CRI might be worth doing a quick looksee,
because then you can claim definitively that you do pass it. :> I didn't
design the CRI to defeat any particular IDS (i.e. the test is not
"tuned"), so I don't know the results beforehand.
Dave Aitel
Immunity, Inc.
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
