Re: Vulnerability vs. Exploit signatures and IPS??

[Matt.Carpenter () alticor com]

The vulnerabilities often can take many shapes, with arbitrary selections 
which "work" but are not mandated.
Exploits like those found in worms and hacker tools will have a particular 
signature.  Since other code can exploit the same vulnerability but look 
different on the wire, each exploit requires its own signature.

Signatures based on exploits must first have known exploits to identify, 
making them a strictly reactive defense.

Signatures based on the vulnerabilities only require intimate knowledge of 
the vulnerabilities.  They can be developed prior to any known exploits, 
allowing them to be proactive.  This method, done well, is likely to pick 
up exploits before they are publicly available.  Unfortunately, due to the 
increased vagueness of the signature, this method can also lead to more 
false-positives unless the sig-developer has intimate knowledge of the 
protocol as well.  More knowledge is required, often more value is 
delivered.



 
Matthew Carpenter
IT Security Specialist
Alticor Corporation
Phone: 616-787-0287
Email: matt.carpenter () alticor com
Page Me (230 characters Max)
Email ITSS On-Call Account


-----BEGIN PGP PUBLIC KEY FINGERPRINT-----
PGP Fingerprint: 52C3 328D C29C 178B 2DFD 9EA8 C710 0042 8CB4 3CDB
-----END PGP PUBLIC KEY FINGERPRINT-----




Jacob Winston <jctx09 () yahoo com> 
16/05/2005 22:57

To
focus-ids () securityfocus com
cc

Subject
Vulnerability vs. Exploit signatures and IPS??









Can someone explain to me the difference in writing signatures based on 
Vulnerabilities versus writing signatures based on Exploits? TippingPoint 
makes a claim that their IPS is better because they write signatures based 
on Vulnerabilities and not exploits. I don't quite understand this.

Thank you,

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------




--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------