Re: Cisco IOS Shellcode - McAfee IPS Protection

From: Ron Gula (rgula_at_tenablesecurity.com)
Date: 08/09/05

  • Next message: Kevin Johnson: "BASE 1.1.4 released" 
    Date: Mon, 08 Aug 2005 20:28:26 -0400
To: <focus-ids@securityfocus.com>

    At 01:12 PM 8/8/2005, Ed Gibbs wrote:
    >Having used IntruShield for several years, I called them on this because I
    >thought the same thing. As it turns out, they protect detect the shell
    >code, and if your policies setup can actually block it. Their detection
    >of shell-code execution is pretty strong from our research.
    >
    >Ed

    Hi Ed,

    I'd appreciate it if you can elaborate. When I hear folks talk about
    shell code execution, I become curious about two parameters, the
    false positive rate and the false negative rate. In your research,
    how many, if any, detected shell code executions were not accurate,
    and possibly, how many shell code exploits occurred that were not
    detected?

    Ron Gula, CTO
    Tenable Network Security

    ------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it
    with real-world attacks from CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    ------------------------------------------------------------------------

  • Next message: Kevin Johnson: "BASE 1.1.4 released"