RE: IDS Players?

From: Brian Laing (Brian.Laing@Blade-Software.com)
Date: 06/19/02 

From: "Brian Laing" <Brian.Laing@Blade-Software.com>
To: "'Greg Shipley'" <gshipley@neohapsis.com>, <focus-ids@securityfocus.com>
Date: Wed, 19 Jun 2002 11:15:21 -0700

I will add to what greg has said, by saying that not only is
configuration wrong but the attacks themselves could be wrong. I have
been through numerous bake offs with IDS where attacks were launched
that one IDS detected and another did not. When you look further at the
attack you find that the attack was not truly an attack but that the IDS
that did trigger was just a poorly written signature.

-------------------------------------------------------------------
Brian Laing
CTO
Blade Software
Cellphone: +1 650.280.2389
Telephone: +1 650 367.9376
eFax: +1 208.575.1374
Blade Software - Because Real Attacks Hurt
http://www.Blade-Software.com
-------------------------------------------------------------------

-----Original Message-----
From: Greg Shipley [mailto:gshipley@neohapsis.com]
Sent: Wednesday, June 19, 2002 10:09 AM
To: focus-ids@securityfocus.com
Cc: 'Nicholas Bachmann'; Gary Halleen; Bill Mote
Subject: RE: IDS Players?

On Wed, 19 Jun 2002, Ralph Los wrote:

> I have to chime in with a real-world example.
>
> We were pen-testing a client of ours and the Cisco IDS's they
> had caught 39% of the total attacks we threw at it....is that
> THE most pathetic score I've ever seen? We took the same
> attack-set and pushed it against a NetworkICE Guard box...and it
> got us on 86% of the attacks, although some were mis-labeled due
> to heavy fragmentation, packet-engineered/reordering, etc. I
> can't go into detail about the attacks we used, but it was a
> full spectrum of script-kiddie to advanced hacking type attacks.

Didn't we go over this same issue back in Feb?

Yeah, I'm pretty sure we did:
http://archives.neohapsis.com/archives/sf/ids/2002-q1/0183.html
http://archives.neohapsis.com/archives/sf/ids/2002-q1/0185.html

Without knowing what version that sensor was running, how it was
configured, how many sigs were turned on/off, how updated the sigs were,
etc., suggesting that their product is pathetic is kind of, er,
short-sighted, no?

I don't want to sound like a "defender of Cisco" but I'm sure we can
find
crap installations of Snort, Dragon, and any other NIDS on the market.
Pilot error is not the fault of the vendor, IMHO....

-Greg

Relevant Pages

  • RE: Intrusion Prevention
    ... Coverage what can it detect; this covers basic attacks, ... IDS purchase. ... While doing these implementations and while working in an IDS vendor I ... sometimes we're told that we cannot see the testing methodology upfront. ...
    (Focus-IDS)
  • RE: Changes in IDS Companies?
    ... This means you need a standard IDS sitting behind it/next to it watching the ... Things like port scans and DoS attacks ... >>> If people are running insecure web servers, ... > Pretty sad state of affairs, when people don't update their patches at ...
    (Focus-IDS)
  • RE: Best Method(s) for signature verification.
    ... on this list - and other IDS lists - for the means to test their IDS ... When I say we use IDS Informer for our signature recognition testing, ... should point out that we do NOT use all the default attacks! ... (IIS attacks run against Apache web servers on Unix - "real ...
    (Focus-IDS)
  • Re: How to choose an IDS/FW MSS provider
    ... First, "recording everything" is not what IDS's were EVER meant for, ... others can create "audit" trails of every web request, every mail, every ... >detect attacks by inspecting layer 3 headers for prohibited IP ... >facility with an IDS or IPS deployed. ...
    (Focus-IDS)
  • Re: Alarming (was protocol analysis)
    ... Obviously, there are different ways to "detect" attacks, but John uses the ... no one should ever "rely" on any IDS for our ... As for Johns Metaphor of the motion sensor vs the pressure sensor, ... toward Intrusion Prevention as opposed to just Intrusion Detection. ...
    (Focus-IDS)