Re: ForeScout ActiveScout

[Gadi Evron <ge () linuxbox org>]

Brent Stackhouse wrote:
> Gadi,
>
> Thanks very much for your detailed response.  I
> understand their definition of 100% accuracy but it
> still begs the question as to how they make the
> initial determination of what to track or not.  Surely

You have access to the machine.. just take a look. They provide with a 
good events log, as well as the ability to go down to the traffic itself

> they don't send their crafted data on every single
> connection to see if it comes back.  Their web site
> states that ActiveScout is looking for recon activity
> so some threshold or "trigger" must exist for them to
> differentiate recon from legitimate traffic.

Exactly.

> Their site also states that they're not signature
> based.  Again, if they have some sort of logic based
> on thresholds (x amount of TCP packets per minute from
> the same source IP, etc.), it sounds like a signature
> to me.  At least I know that Cisco, ISS, etc. all have
> threshold-based signatures in their IDS products.

Almost everything can be called a signature, to a level, but they 
usually don't use what you or me would call an IDS signature.

> All that aside, I saw the results of a SuperScan port
> scan that included a bunch of junk caused by
> ActiveScout.  I would think that feeding an attacker a
> bunch of info that leads them to believe that you're
> really vulnerable is not a great idea (like open
> SunRPC ports, NetBIOS, etc.).  I want less attention,

Than this is not about ActiveScout, it is about you not wanting to run 
an honey pot/net.

> not more.  I suspect that anything out-of-the-ordinary
> would perhaps cause more attention.  This is sort of a
> honeypot idea gone berserk.  Instead of one host
> appearing vulnerable, all of your hosts appear
> vulnerable.

Not all hosts. You can set it to show how many hosts per how many 
attempts you want to be triggered, as well as what kind of hosts should 
they be. It doesn't have to work this way, it can also only monitor your 
network.. but that kind of beats the point.

The point being catch the bad guy and block him. Don't expect it to 
catch all bad guys.

> Anyway, it doesn't sound like it buys much, if
> anything, over "traditional" IDS/IPS.

I strongly disagree, but it is not for everyone and much like any other 
products, it isn't perfect.

        Gadi.

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------