Re: Cisco IOS Shellcode - McAfee IPS Protection

[Ron Gula <rgula () tenablesecurity com>]

At 01:12 PM 8/8/2005, Ed Gibbs wrote:
> Having used IntruShield for several years, I called them on this because I 
> thought the same thing.  As it turns out, they protect detect the shell 
> code, and if your policies setup can actually block it.   Their detection 
> of shell-code execution is pretty strong from our research.
>
> Ed

Hi Ed,

I'd appreciate it if you can elaborate. When I hear folks talk about
shell code execution, I become curious about two parameters, the
false positive rate and the false negative rate. In your research,
how many, if any, detected shell code executions were not accurate,
and possibly, how many shell code exploits occurred that were not
detected?

Ron Gula, CTO
Tenable Network Security





------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------