RE: IPS comparison

From: Joseph Hamm (jhamm_at_lancope.com)
Date: 08/30/05

  • Next message: Richard Bejtlich: "Re: IPS technology question." 
    Date: Tue, 30 Aug 2005 17:15:52 -0400
To: "Ron Gula" <rgula@tenablesecurity.com>, "Focus-Ids Mailing List" <focus-ids@securityfocus.com>

    >- I agree that "anomaly detection" != "zero day" detection. Just
    because
    > my DNS server starts to connect to all the other hosts on my
    network,
    > doesn't mean it has got a worm on it.

    It might if your DNS server doesn't normally do this. Consider a
    network anomaly detection system that profiled your network and created
    unique usage/behavioral profiles for each host (including Ron's DNS
    server). You've told the box how your internal address space is defined
    so now the box also knows your network's "dark" or unused address space.

    (Defined internal address space) - (active hosts seen) = Unused or
    "Dark" IP space

    Now consider that your DNS server gets infected with a new worm and
    starts scanning nearby hosts. A smart NADS (network anomaly detection
    system) will be able to quickly determine that this host is scanning
    your dark address space (honeynet concept). Any activity being directed
    at this unused space can be assumed to be suspect.

    Also, consider the port being used. If this is not a port that the DNS
    server normally uses, then that would be suspect as well. Not to
    mention all of the tcp resets or icmp port unreachables (in the case of
    UDP) that the DNS server will receive as it scans across your network.

    Check out the whitepapers published by NADS vendors that outline cases
    where new "zero-day" worms were detected before signatures became
    available. I agree that marketing departments squeeze all they can out
    of zero-day, but I can at least vouch that our SteatlhWatch products
    detected Zotob (and its variants) without the need for any signature
    updates. This means customers had early detection before signatures
    were available. I'm sure there are some other vendors out there that
    can report the same. Even signature based solutions can tout this if
    they write sigs for the vulnerability as opposed to the exploit.

    Joe

    Joe Hamm, CISSP
    Senior Security Engineer
    Lancope, Inc.
    jhamm@lancope.com
    404.644.7227 (cell)
    770.225.6509 (fax)

    Lancope - Security through Network Intelligence(tm)
    StealthWatch(tm) by Lancope, a next-generation network security
    solution, delivers behavior-based intrusion detection, policy
    enforcement and insightful network analysis. Visit www.lancope.com.

    -----Original Message-----
    From: Ron Gula [mailto:rgula@tenablesecurity.com]
    Sent: Monday, August 29, 2005 8:56 PM
    To: Focus-Ids Mailing List
    Subject: Re: IPS comparison

    At 06:01 PM 8/29/2005, Stefano Zanero wrote:
    >Daniel Cid wrote:
    > > This "anomaly" detection will only detect 0-day exploits for known
    > > vulnerabilities.
    >
    >A zero-day exploit is a curious marketing thing. You suddenly redefine
    >a difficult problem (catching zero-days) as a rather simpler problem
    >(create signatures that actually describe the vulnerability, which is
    >what any signature worth your licensing cost should do).
    >
    >So, presto!, you can rush up and put out some rather nice marketing
    >material on it.
    >
    >Fact is, anomaly detection is so rare that it's almost unexistant in
    >the commercial products, except for limited forms of "protocol anomaly
    >detection" and for Arbor's peakflow technology.

    Two comments here.

    - lot's of NIDS that tend to code for a vulnerability, don't actually
       code for the vulnerability. They are still writing attack signatures.
       The attack signatures are smarter than what was standard about five
       years ago, but I've yet to really see a NIDS come out of the box
       with full vuln/IDS correlation.

    - I agree that "anomaly detection" != "zero day" detection. Just because
       my DNS server starts to connect to all the other hosts on my network,
       doesn't mean it has got a worm on it.

    Ron Gula, CTO
    Tenable Network Security

    ------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it with real-world attacks from
    CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    ------------------------------------------------------------------------

    ------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it
    with real-world attacks from CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    ------------------------------------------------------------------------

  • Next message: Richard Bejtlich: "Re: IPS technology question."

    Relevant Pages

    • Re: IPS comparison
      ... > my DNS server starts to connect to all the other hosts on my network, ... When a new DNS server comes online, ... Workstation-A has 2 nameservers configured, ...
      (Focus-IDS)
    • RE: IPS comparison
      ... >It might if your DNS server doesn't normally do this. ... and anomaly detection. ... analysis tool for network traffic, netflow, firewall logs, host logs, .etc, ... but anomaly detection is just that -- anomalies. ...
      (Focus-IDS)
    • RE: DC Issues
      ... DCs are imputable to DNS server problems. ... For your replication, you should be aware that you will be needing two ... maintain the DCs connected in this network updated. ... Server is not responding or is not considered suitable. ...
      (microsoft.public.windows.server.active_directory)
    • Re: How is DNS resolution working?
      ... >> and our DNS server on machine B is only on a private network, ... host on the external network ... It just happens that on the external network, there is a Windows domain ...
      (microsoft.public.win2000.networking)
    • Re: Event errors
      ... need of a serious professional overhaul of your network, ... Event Source: NETLOGON ... authoritative DNS server required to process this update request has ...
      (microsoft.public.windowsxp.network_web)