Re: [Full-Disclosure] Re: Bypassing "smart" IDSes with misdirected frames? (long and boring)

From: Michal Zalewski (lcamtuf_at_ghettot.org)
Date: 05/28/04

  • Next message: Ron DuFresne: "Re: [Full-Disclosure] Breaking Laws Cisco's stolen code"
    To: Jim Bauer <jfbauer@nfr.com>
    Date: Fri, 28 May 2004 18:21:39 +0200 (CEST)
    
    

    On Fri, 28 May 2004, Jim Bauer wrote:

    > The IDS will see not see a valid response to the "DATA" command (that is
    > never received) so it will know it is still in SMTP command mode. Even
    > if your not-so-smart IDS let this slip by, there is still the issue of
    > "DEBUG" not being in a valid format for a header.

    Which is precisely what I stated in the next paragraph. This is a naive
    example, but illustrates w far broader and non-SMTP-specific problem quite
    well. There are various protocols or attack vectors that do not involve
    challenge-response communications (even the problem of distinguishing
    between message body and message headers can be an example).

    Cheers,

    -- 
    ------------------------- bash$ :(){ :|:&};: --
     Michal Zalewski * [http://lcamtuf.coredump.cx]
        Did you know that clones never use mirrors?
    --------------------------- 2004-05-28 18:19 --
       http://lcamtuf.coredump.cx/photo/current/
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html
    

  • Next message: Ron DuFresne: "Re: [Full-Disclosure] Breaking Laws Cisco's stolen code"

    Relevant Pages