Dave Aitel wrote:
Although, keep in mind, Snort completely fails the CRI test, and does
horrible TCP reassembly, let alone SMB or MSRPC reassembly. It just
isn't up to the job of detecting an attacker who's gone to some work to
bypass this sort of thing.
This statement is misleading and implies that there are systems that do
better and can stand up to the same assault. A better statement might
be, there is no IDS/IPS up to the job of detecting the attacker who's
gone to some work to bypass it.
The reality is that every IDS has evasion potentials and if you are able
to control the environment enough that you can influence the view of the
network then you can win, as simple as that.
Lets put it out there for consideration.
- All major IDS players fail in the MSRPC space when challenged with a
capable attacker.
- No IDS can handle proper TCP state tracking when confronted with a
capable attacker. If you are not constrained by 5 hops between you and
the endpoint with at least one of those endpoints being a system charged
with noise elimination ( Checkpoint, PIX, iptables, screen router... )
you can own any state machine.
- All major players will fail to detect XYZ when confronted with the
challenge presented by ABC in a controlled environment.
Even the supposed inline _normalizing_ systems can be evaded in these
ways and unless you have an astute network staff with a very capable
security staff backing it up you are not going to win against the
attacker that is paid to sit down and attack you until they get what
they are looking for.
Moving beyond the detection space. Active technologies suffer from the
same shortcomings in that they must make compromises to achieve a larger
goal. IIRC Canvas will report success on an Win32 Apache Chunked
encoding attack against a FreeBSD Apache server, for example.
The moral of the story is that you have decisions to make and with open
source you at least have an opportunity to make a difference. With all
of the systems that compete with Snort you have no opportunity to make a
difference unless you have a few million dollars and staff capable of
isolating a problem. I can tell you from experience that everyone that I
compete with cannot stand up to controlled environments and advanced
evasion tactics.
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
