Hi Joff,
This is long pending problem for IDS/IPS vendors. Not that the
Solution is not availbale , it all depends on how much performance
compromise u wanna agree upon v/s required security.
To resolve issues with Encrypted Data, there are IPS who does MIM
while key is being exchange and before sending the packet back to the
trusted machine on the Internal network it decrypts the packet and if
packets seems benign, the packet is encrypted and sent back to Client.
Also for IPSEC VPN , Network architecture might do a trick by keeping
VPN box out side IPS or putting Host based IDS/IPS on the machine u
are protecting.
Also Note that for Header senitization, IPS vendors are having
protocol decode modules, again here the question is what u want to
choose, Performance or security, Also some of the Applications and way
RFC's are written(May, May nots in RFC), it becomes difficcult for
IPS vendor to std-ized protocol decode module resulting sometimes in
false positive and lot of tuning .
Hope this helps,
Regards,
Vijay Upadhyaya
On 5/25/07, Joff Thyer <jsthyer@gmail.com> wrote:
It is reasonably trivial to encode data within packet headers, and
even encrypt said data as most are probably aware. There are past
examples where control information has been sent within ICMP and other
packets using header fields.
My question surrounds detection; given that IDS tends to be payload
focused, if a covert channel exists that has encrypted data in a
packet header, how do we go about detecting it?
My initial thought leans toward the fact that encrypted data blocks
are statistically flat over time. Given say 'snort', how can we use
this idea? I am not a snort expert by any means, so please no
flames!
I would be happy to summarize opinions.
-Joff Thyer
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
--
Vijay Upadhyaya
BS-7799 Lead Auditor
CISSP
CSGA
Nortel ASF Training Certification
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
