Re: How to choose an IDS/FW MSS provider

[Andre Ludwig <andre.ludwig () gmail com>]

I would also like to add this simple question (and answer) to the mix.

What is the best way to evade an IDS? 






Knowing what it looks for...


Open sigs for an IDS/IPS does more harm then good (for the majority) IMO.  

IE a SKILLED attacker wants to attack my network, and i use an ids
that has an open sig set.   Via posts on various mailing lists the
attacker has worked up a probability matrix of what products are being
used for IDS/IPS.  So happens that those products have an open
signature set.  Now all the attacker has to do is look at what those
systems deficiencies are (be it from a technical stand point, be it
from a sig stand point) and modify his attack to circumvent the
product that is put in place.

Those opens sigs sure did help in evading the protection put in place. 

The best option IMO is having a skilled R&D team who is on the edge of
what is out there, a closed signature set, and the ABILITY to add your
own SIGNATURES from other sources (be it snort based rules only or
snort based rules + vendor based rule framework).   All of a sudden
you then have the best of both worlds.

Oh and simple pattern matching is crap, there needs to be an
abstraction layer above the pattern matching that says "apply this
pattern if the following criteria have been meet  {syn syn ack syn ack
*pattern* rst}" or something along those lines that are exploit
specific, be it flow information or protocol level flags or features.

Andre

On Tue, 15 Mar 2005 08:06:02 -0800, Andrew Plato
<andrew.plato () anitian com> wrote:
> 1. I know ISS's language to some extent because I helped develop the
> engine inside their product (I worked at Network ICE before ISS bought
> them.) Some are simple pattern matches, many are not.
>
> 2. I am familiar with Snort's rules (although I do not profess to be an
> expert). I also know that Snort's rules, while very powerful and
> flexible, are WELL beyond the capability of 90% of the IT and network
> admins in the world. Most organizations don't take the time (nor do they
> have the time) to analyze signatures. They are more consumed with things
> like productivity and performance. I know this from my experience (10+
> years) as an IT consultant.
>
> Thus my point - while seeing the details of a signature is fascinating
> to security geeks, it is not terribly important to the vast majority of
> IT admins. As such, I don't think the ability to see signature specs is
> an important measure of the value of an IPS/IDS product. It may be
> important to security nerds, but the general IT/network admin population
> doesn't care that much. And frankly, products that do show their
> signature details are rarely changed anyways.
>
> ___________________________________
> Andrew Plato, CISSP
> President/Principal Consultant
> ANITIAN  ENTERPRISE  SECURITY
>
> 3800 SW Cedar Hills Blvd, Suite 280
> Beaverton, OR 97005
> 503-644-5656 Office
> 503-214-8069 Fax
> 503-201-0821 Mobile
> www.anitian.com
> ___________________________________
>
> GPG fingerprint: 16E6 C5B0 B6CB F287 776E E9A9 AF47 9914 3582 633D
> GPG public key available at: http://www.anitian.com/corp/keys.htm
>
> -----Original Message-----
> From: Joshua Berry [mailto:jberry () PENSON COM]
> Sent: Tuesday, March 15, 2005 6:50 AM
> To: Andrew Plato; Stephane; rick.brady () libertymutual com
> Cc: focus-ids () securityfocus com
> Subject: RE: How to choose an IDS/FW MSS provider
>
> Since you can't see the signature, how do you know they aren't doing
> simple string matching?  Second, obviously you aren't very familiar with
> Snort's rule language, it isn't just simple string matching, there is a
> *ton* of other logic available to reduce false positives/negatives.
> Snort also has conveniently had support for PCRE matching for a long
> time now.
>
> --------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from
> CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> --------------------------------------------------------------------------

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------