Re: best ids placement?

From: Simon Adlem (sadlem_at_fotango.com)
Date: 08/19/03

  • Next message: Evans, Arian: "RE: Network IDS, or IPS, or Proxy?" 
    To: "Rob Shein" <shoten@starpower.net>, <focus-ids@securityfocus.com>
Date: Tue, 19 Aug 2003 10:56:56 +0100

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    On Monday 18 Aug 2003 7:50 pm, Rob Shein may quite possibly have written:
    > Actually, this isn't accurate. Just because an IDS doesn't have a two-way
    > connection on the wire doesn't mean that it cannot be compromised by
    > traffic it monitors. For example, let's say you had box running an older
    > version of snort or tcpdump, with one of the vulnerabilities that were
    > found, hooked up to a wire via a tap. You could theoretically root that
    > box, even if it had no other network connectivity besides that tap. But
    > realistically speaking, an IDS is going to typically have connectivity via
    > another route; otherwise how can you do IP block lookups, googling, etc. to
    > determine more about attacks? Furthermore, besides rooting, what if the
    > attacker merely wanted to knock the IDS offline for a bit...then it becomes
    > a lot more feasible and realistic as an attack. So remember; taps are NOT
    > guarantee against attacks aimed at an IDS. They make the IDS invisible,
    > but it doesn't cost much to squirt a few generic snort/tcpdump/whatever
    > else attacks onto the wire just in case.

    HI Rob,

    Thanks for your comments.

    Interesting points there.

    Agreed that it's not a complete solution and the IDS can still be affected
    however, other than the DOS scenario that you mention, we find that the taps
    do make it harder, to detect and attack the IDS than if it was connected
    straight to the wire.

    I don't tend to use the IDS box for googling, lookups etc. anyway. The IDS is
    a Linux box that just sits and does it thing and I do further analysis on my
    workstation.

    Take care

    Simon
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE/QfRoAEPeBJNaHh0RAra3AJ9vuKCbT6G5nXH+7RFcGpExGi2g5QCdEhKT
    9wyMHr3t+3n/zhS9NuV5G4M=
    =2VSF
    -----END PGP SIGNATURE-----

    ---------------------------------------------------------------------------
    Attend Black Hat Briefings & Training Federal, September 29-30 (Training), October 1-2 (Briefings) in Tysons Corner, VA; the world’s premier
    technical IT security event. Modeled after the famous Black Hat event in
    Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.
    Symanetc is the Diamond sponsor. Early-bird registration ends September 6 Visit: www.blackhat.com
    ---------------------------------------------------------------------------

  • Next message: Evans, Arian: "RE: Network IDS, or IPS, or Proxy?"

    Relevant Pages

    • RE: Intrusion Prevention
      ... Coverage what can it detect; this covers basic attacks, ... IDS purchase. ... While doing these implementations and while working in an IDS vendor I ... sometimes we're told that we cannot see the testing methodology upfront. ...
      (Focus-IDS)
    • RE: Changes in IDS Companies?
      ... This means you need a standard IDS sitting behind it/next to it watching the ... Things like port scans and DoS attacks ... >>> If people are running insecure web servers, ... > Pretty sad state of affairs, when people don't update their patches at ...
      (Focus-IDS)
    • RE: Best Method(s) for signature verification.
      ... on this list - and other IDS lists - for the means to test their IDS ... When I say we use IDS Informer for our signature recognition testing, ... should point out that we do NOT use all the default attacks! ... (IIS attacks run against Apache web servers on Unix - "real ...
      (Focus-IDS)
    • Re: How to choose an IDS/FW MSS provider
      ... First, "recording everything" is not what IDS's were EVER meant for, ... others can create "audit" trails of every web request, every mail, every ... >detect attacks by inspecting layer 3 headers for prohibited IP ... >facility with an IDS or IPS deployed. ...
      (Focus-IDS)
    • Re: Alarming (was protocol analysis)
      ... Obviously, there are different ways to "detect" attacks, but John uses the ... no one should ever "rely" on any IDS for our ... As for Johns Metaphor of the motion sensor vs the pressure sensor, ... toward Intrusion Prevention as opposed to just Intrusion Detection. ...
      (Focus-IDS)