Re: Intrushield vs ISS

[Dave Aitel <dave () immunitysec com>]

Matthew LeGrow wrote:

> Dave Aitel wrote:
>
> > Interesting, because this means Intrushield must parse MSRPC and SMB 
> > correctly. This is actually quite rare in an NIDS or NIPS. It'd be 
> > good to see what NFR and some of the other heavy hitters do.
>
> For NFR Sentivist, we reassemble MSRPC fragments before analyzing the 
> traffic, including MSRPC over SMB and web (via CIS).  Any anomalies in 
> MSRPC fragment reassembly will also kick off alerts.
>
> A pseudo-whitepaper written to help teach N-Code function callbacks 
> appeared in our last quarterly newsletter here and describes the MSRPC 
> over SMB interaction in some detail:
>
> http://www.nfr.com/newsletter/fall-04/AdvancedN-CodeFUCallbacksPackageIntegration.htm 

I actually assumed you would handle this correctly, knowing your team. 
On the other hand, I didn't think Snort would fail as badly as it did.

This is the part that actually confuses me, since the CRI will split the 
DCOM header itself into multiple SMB packets. I'm not familiar with 
NCODE though, so there may be something I'm missing.

# MSRPC analyzes DCE/RPC data from the passed-in SMB payload

  1. Receives an entire SMB, and the offset to the start of RPC header
     after having registered callbacks with the SMB/Named Pipes
     backend. *ENABLE_MSRPC_OVER_SMB * must be set to 1 and the named
     pipes to monitor must be filled in the list for the
     *MSRPC_NAMED_PIPES * variable.
  2. Operates on the MSRPC traffic as if it were arriving over port
     135/TCP - gathers fragments, optionally parses
  3. Calls callbacks based on UUID



When one SMB packet comes in, this will buffer the data until it has an 
entire DCE PDU, at which point it will send it to the DCE parser, which 
will then buffer data until it has a whole request?

I checked your site for a free download, but I don't think there is one. 
Any recent CANVAS or the CRI might be worth doing a quick looksee, 
because then you can claim definitively that you do pass it. :> I didn't 
design the CRI to defeat any particular IDS (i.e. the test is not 
"tuned"), so I don't know the results beforehand.

Dave Aitel
Immunity, Inc.


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------