Re: Crying wolf: False alarms hide attacks : Eight IDSs fail to impress during the monthlong test on a production network.

From: tHe fuJi (fujix2@hotmail.com)
Date: 06/28/02 

From: "tHe fuJi" <fujix2@hotmail.com>
To: "Tom D'Aquino" <tom_daquino@yahoo.com>, "Andrew Plato" <aplato@anitian.com>, <focus-ids@securityfocus.com>
Date: Fri, 28 Jun 2002 01:12:28 -0500

? I
> don't know of a single NIDS product capable of confirming whether or not
> the host was compromised.

    If the IDS has a protocol analysis engine then a trained analyst could
determine weather the host was compromised or not. I agree false alarms
suck and make most IDS's too cumbersome to be helpful unless a skilled
analyst is on site. This doesn't seem to happen on a full time basis too
often at non-G-man sites. Good article though snort or snort based
solutions (demarc pure secure) have never failed on me with comparable
traffic.

-fuJi facTor
----- Original Message -----
From: "Tom D'Aquino" <tom_daquino@yahoo.com>
To: "Andrew Plato" <aplato@anitian.com>; <focus-ids@securityfocus.com>
Sent: Thursday, June 27, 2002 8:01 PM
Subject: Re: Crying wolf: False alarms hide attacks : Eight IDSs fail to
impress during the monthlong test on a production network.

> Hi all,
>
> Regarding this article, I found the following sections rather interesting:
>
> "We considered an attack to be any compromise of any computing resource on
> the "protected" network. That resource could be bandwidth, disk space, a
> printer, a password file - basically, anything for which access is not
> explicitly authorized. This is not the same as an attempted attack; if
> there was no compromise, then the IDS is essentially reporting on a
> vulnerability that doesn't exist. During the test, most of the ISPs
> generated so many false positives that it was difficult to spot reports of
> real attacks."
>
> Is this how the rest of the IDS community defines a false positive? I
> don't know of a single NIDS product capable of confirming whether or not
> the host was compromised. I think if an actual attack was thrown at a
> host, the IDS should report on it.
>
> "But Opus One's servers run OpenVMS, not Windows. Even though it is
> trivially easy to figure out what operating system a Web server uses, not
> one of the IDSs did so."
>
> Is nCircle the only company that has a device capable of this?
>
> "Second, most IDSs don't offer a means of grouping hosts or networks
> together under some easily remembered nickname. The exception is NFR,
> which let user-defined groups be set up using its N-code programming
> language."
>
> Isn't this what the "var" command is for in Snort's config file?
>
> Thanks for the input.
> Tom D'Aquino
>
> --- Andrew Plato <aplato@anitian.com> wrote:
> > In-Reply-To: <000201c21bdd$5843dcc0$4c01a8c0@MINE>
> >
> >
> > >Network World Fusion News has a comparison of 8 IDS's. This is an
> > >interesting read.
> > >
> > >http://www.nwfusion.com/techinsider/2002/0624security1.html
> >
> > Great report.
> >
> > Next time they should do RealSecure on one of my Win2k appliances. I
> > have
> > RealSecure Sentry and Guard Appliances out at customer sites on Win2k
> > that
> > have been running error free for months. (sorry for the shameless plug)
> >
> > This also illustrates a dark side of IDSs that virtually no vendor will
> > bother to tell you. IDSs require a lot of tuning and tweaking before
> > they
> > can become an integral part of your network. And there is always a
> > certain
> > percentage of events that are false positives. The only way to get a
> > feel
> > for this is to deploy and baseline those systems. Something they rarely
> > bother to mention in the documentation you get.
> >
> > ------------------------------------
> > Andrew Plato, CISSP
> > President / Principal Consultant
> > Anitian Corporation
> > http://www.anitian.com
> > ------------------------------------
>
>
> __________________________________________________
> Do You Yahoo!?
> Yahoo! - Official partner of 2002 FIFA World Cup
> http://fifaworldcup.yahoo.com

Relevant Pages

  • Re: Crying wolf: False alarms hide attacks : Eight IDSs fail to impress during the monthlong test
    ... "We considered an attack to be any compromise of any computing resource on ... most IDSs don't offer a means of grouping hosts or networks ... >>Network World Fusion News has a comparison of 8 IDS's. ...
    (Focus-IDS)
  • RE: Session Hijacking
    ... compromise is a relative term in this case. ... DNS cache poisoning that redirects the attack to another hosts allowing for MITM. ... Subject: Session Hijacking ... attacker A has to compromise some host in host B's network in Ohio or at host C's network in Florida inorder to conduct MITM attack. ...
    (Security-Basics)
  • [NEWS] IGMP Denial of Service Vulnerability
    ... We consider different scenarios in which such an attack can be launched. ... Host H1 and H2 are connected to a router R using a hub. ... soliciting for membership reports from the hosts in the network it is ... now R doesn't receive any membership reports for the group ...
    (Securiteam)
  • Re: Target based IDS review and discussion in Information Security
    ... > 1) A URL attack is seen by the sensor affecting Windows IIS. ... > each and every step we took to investigate the attack (from IDS ... > impacted host to manually verify if the attack was successful or not. ... Automated forensics are useful and a nice step forward but if the ...
    (Focus-IDS)
  • The Art of Unspoofing
    ... stack allows anyone to send spoofed packets to a target host, ... the ability of its administrator to determine the origin of the attack. ... then can it inject the malicious packets. ... host of the attack or their nameserver. ...
    (Focus-IDS)