Re: Need some information on HIDS!

["SecurIT Informatique Inc." <securit () iquebec com>]

At 10:43 PM 01/03/2005, Frank Knobbe wrote:

> On Mon, 2005-02-28 at 13:48 -0500, SecurIT Informatique Inc. wrote:
> > Hello.  I have already invoked such a scenario in some of my previous IDS
> > work/articles.  What I had in mind is something like encrypting the whole
> > network traffic, to prevent sniffing from intruders (let's say 
> wall-to-wall
> > SSH, for example).  In such an environment, if you still wanted to keep
> > some NIDS capabilities, you'd actually have to install NIDS software 
> (Snort
> > comes to mind) on every host on the network, in non-promiscuous mode 
> (since
> > sniffing the rest of the network traffic is useless, since it is 
> encrypted).
>
> Non-promiscuous mode shouldn't matter. If you sniff on the network
> interface, you are still only sniffing encrypted traffic.
>
> The only way I can see this work, which may be the direction you're
> heading and what you are proposing here, is to sniff traffic on the
> loop-back adapter.

I have not implemented this, so in my mind it is still theoretical, but 
what I had in mind is that sniffing local data should be done in the IP 
stack after it's been dealt with by the encryption layer.  This is what I 
had in mind with "non-promiscuous", since the local IP stack will be unable 
to decrypt the traffic not pertaining to it.  Maybe SSH was not the best 
example, but I think you got the idea.

> (snip)
> But since you are already on the host, why not monitor syscalls and
> applications directly?

That's what I'm currently doing/planning to do with some of my own 
software.  The suggested setup I mentionned here was in relation to the 
original question in this list.

Adam

> Cheers,
> Frank


--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 266.5.7 - Release Date: 01/03/2005



--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------