Re: Intrushield vs ISS

From: Dave Aitel (dave_at_immunitysec.com)
Date: 01/04/05

  • Next message: Frank Knobbe: "Re: Local Mirror Prevention with IDS" 
    Date: Tue, 04 Jan 2005 10:02:51 -0500
To: Matthew LeGrow <mlegrow@nfr.com>

    Matthew LeGrow wrote:

    > Dave Aitel wrote:
    >
    >> Interesting, because this means Intrushield must parse MSRPC and SMB
    >> correctly. This is actually quite rare in an NIDS or NIPS. It'd be
    >> good to see what NFR and some of the other heavy hitters do.
    >>
    >
    > For NFR Sentivist, we reassemble MSRPC fragments before analyzing the
    > traffic, including MSRPC over SMB and web (via CIS). Any anomalies in
    > MSRPC fragment reassembly will also kick off alerts.
    >
    > A pseudo-whitepaper written to help teach N-Code function callbacks
    > appeared in our last quarterly newsletter here and describes the MSRPC
    > over SMB interaction in some detail:
    >
    > http://www.nfr.com/newsletter/fall-04/AdvancedN-CodeFUCallbacksPackageIntegration.htm
    >
    >

    I actually assumed you would handle this correctly, knowing your team.
    On the other hand, I didn't think Snort would fail as badly as it did.

    This is the part that actually confuses me, since the CRI will split the
    DCOM header itself into multiple SMB packets. I'm not familiar with
    NCODE though, so there may be something I'm missing.

    # MSRPC analyzes DCE/RPC data from the passed-in SMB payload

       1. Receives an entire SMB, and the offset to the start of RPC header
          after having registered callbacks with the SMB/Named Pipes
          backend. *ENABLE_MSRPC_OVER_SMB * must be set to 1 and the named
          pipes to monitor must be filled in the list for the
          *MSRPC_NAMED_PIPES * variable.
       2. Operates on the MSRPC traffic as if it were arriving over port
          135/TCP - gathers fragments, optionally parses
       3. Calls callbacks based on UUID

    When one SMB packet comes in, this will buffer the data until it has an
    entire DCE PDU, at which point it will send it to the DCE parser, which
    will then buffer data until it has a whole request?

    I checked your site for a free download, but I don't think there is one.
    Any recent CANVAS or the CRI might be worth doing a quick looksee,
    because then you can claim definitively that you do pass it. :> I didn't
    design the CRI to defeat any particular IDS (i.e. the test is not
    "tuned"), so I don't know the results beforehand.

    Dave Aitel
    Immunity, Inc.

    --------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it with real-world attacks from
    CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    --------------------------------------------------------------------------

  • Next message: Frank Knobbe: "Re: Local Mirror Prevention with IDS"