Network Intrusion Detection
& Intrusion Prevention
“The information world is truly electronic-there’s no turning
back.” - Winn Schwartau
Conner Finlay
Josh Smith
Differences
Network Intrusion Detection System - attempts to detect
unauthorized and anomalous activity by monitoring packets
traversing a given network
Network Intrusion Preventation System - block or reject packets
that match a particular signature or behavior and sits in-line
instead of using a network tap or port span
History of IDS/IPS
• Between 1984 and 1986, Dorothy Denning and Peter
Neumann researched and developed the first model of a
real-time IDS. This prototype was named the Intrusion
Detection Expert System (IDES). This IDES was initially a
rule-based expert system trained to detect known malicious
activity.
• First commerical implementation in the early 1990's by
Haystack Labs
• Started to grow in popularity with Cisco buying out vendors
in the mid/late 90s
Types of IDS/IPS Systems
Anomaly detection model: The IDS has knowledge of
normal behavior so it searches for anomalous behavior or
deviations from the established baseline. While anomaly
detection’s most apparent drawback is its high false
positive, it does offer detections of unknown intrusions and
new exploits.
Misuse detection model: The IDS has knowledge of
suspicious behavior and searches activity that violates
stated policies. It also means looking for known malicious or
unwanted behavior. In fact, its main features are its
efficiency and comparably low false alarm rate.
Types of IDS
• Rule Based
• Protocol Analysis
• Policy Based
• Heuristic Based
Bro IDS/IPS
• Unix IDS
• Not an "Out-of-the-box" solution
• Types of Alerts
o Log Alerts
o Real Time Alerts
o System Command Execution
• Does not require software to be installed on each host
Single network host
• Custom Scripting Language for Rulesets
Bro IDS/IPS
• Snort2Bro - Custom tool to convert Snort Signatures to Bro
Format
• Also enables Bro features in converted signatures to reduce
false positives
• How is Bro different from Snort?
• "Snort is signature based, while Bro can store information
about previous network activity and store it for analysis of
current activity."
Bro IDS/IPS
• Ability to automagically encrypt email alerts
• Custom policies to adjust to different network designs
const web_servers = { www.lbl.gov, www.bro-ids.org, };
const mail_servers = { smtp.lbl.gov, smtp2.lbl.gov, };
const allow_my_services: set[addr, port] = {
[mail_servers, smtp],
[web_servers, http],
};
Bro IDS/IPS
• Geo-Location to detect and map attacks
global ftp_location_log: file = open_log_file("ftp-location");
event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool)
{
local client = c$id$orig_h;
local loc = lookup_location(client);
if (loc$region == "OH" && loc$country_code == "US")
{
print ftp_location_log, fmt("FTP Connection from: %s (%s, %s, %s)",\ client, loc$city, loc$region,
loc$country_code);
}
}
Hogwash IDS
• Started by a student in 1996 at Idaho State University
• Versatile network IDS with three different modes
o Regular IDS
Watches traffic on a span port (switch/router) and
generates alerts based on what it sees
o Inline Scrubber
Actively filters the traffic (acts as a firewall). Sits
between the cloud and the internal network
o HoneyPot Control
"arbitrates IP address and MAC address conflicts to
help run the honeypots. It is possible to have an array
of honeypots behind a single Hogwash box, all with the
same IP and MAC address"
Still experimental
Hogwash in HoneyPot Control Mode
Types of IPS
• Packet Filtering
• Session Analysis
• Packet Manipulation
• IP Blocking
IPS Packet Filtering
• Ability to block individual protocols
• Allow FTP and HTTP but block AIM or VNC
IPS Session Analysis
• Inspect each packet that applies to a protocol and ruleset
and match traffic against signature based rules or policies
IPS Packet Manipulation
• Manipulate data inside a packet and pass packet along to
its destination
• Can be used to remove shellcode or exploit attacks
• Remove sensitive information
IPS IP Blocking
• Can automagically block IP addresses based on signatures
or policies
• Keep a database of blocked IPs
• Block on a time limit or block permanently
Cisco IPS
• A hardware based Network IPS
• Operates at Layers 2 - 7
• Uses the Cisco IPS signatures (Anomaly/Behavioral)
• Anti-IPS Evasion Techniques
o TCP stream reassembly
o De-obfuscation
o Traffic normalization
• Works in conjunction with the Cisco Security Agent (HIDS)
for a complete solution
Snort_Inline IPS
• Uses libipq - IPTables - Rather than libpcap
• Uses Snort ruleset to tell IPTables to drop the connection or
let it through
• Built on top of existing Snort installation
• Improves Security of Intrusion Detection System
Snort_Inline IPS
Built-in ClamAV Integration
IPTables Rule
Alert, Block, Pass, Drop, Reject
Alert - Alert user (IDS Functionality)
Block - Blocks connection through IPTables
Pass - Ignore Alert and allow traffic
Drop - Drop connection through IPTables and log
Reject - Send Reset packets
SDrop - Drop connection without logging
Snort_Inline IPS
drop udp $HOME_NET any ->
$EXTERNAL_NET 4660:4799
(msg: "BLEEDING-EDGE P2P
eDonkey Search"; content:
"|e3 0e|";
offset: 0; depth: 2;
rawbytes;classtype:
policy-violation;
reference:url,
www.edonkey.com;
sid: 2001305; rev:3;
)
Introduction To Snort
http://www.snort.org/docs/snort_htmanuals/htmanual_2832/
The Art of Writing Snort Rules
Basic Rule
alert protocol $HOME_NET port -> $EXTERNAL_NET any ( \
msg:"Message to alert"; \
flow:established,to_server; \
content:"|0d 0a|User-Agent\: Mozilla/4.0 \
(compatible)|0d 0a|"; \
classtype:trojan-activity; \
sid:2008012801; \
rev:1; )
Using Snort Against a Pcap
snort –k none –c ./rules –A console –q –l ~/log/ –r packed.pcap
Runs snort straight from terminal
Sets checksum mode to none
Sets rulset to use - Can use snort.conf (uses includes)
Sets output of alerts to console
Logs to ~/log/
Reads in packed.pcap and tests against ruleset
Snort Modes
• Sniffer mode -
./snort -vde
• Packet logger mode -
./snort -dev -l ./log -h 192.168.1.0/24 ASCII Logging
./snort -l ./log -b PCAP file
• NIDS Mode -
./snort -dev -l ./log -h 192.168.1.0/24 -c snort.conf
Evasion Techniques
• String Matching Weaknesses
• Polymorphic Code
• Fragmentation Attacks
• Denial of Service
• http://secunia.com/advisories/20413/
Evasion Techniques (Cont.)
• TCP Splicing Attacks
o Passes payload over multiple packets
o Defeats pattern matching
Emerging Threats
• Open source collection of Snort rules that can be used by
any individual/company
• Rules are updated a few times a day, seven days a week
• Received grant money from both the NSF and the Army
Research Office
• A crazy amount of rules, that include: Games, Adult
Material, Malware, P2P, the RBN,etc
OISF
• Open Information Security Foundation
• Non-Profit organization based out of Indiana
• Founded in October 2008
• Goal is to develop a new Open Source IDS/IPS engine
• Any person/company/organization can submit ideas, some
include:
o Passive fingerprinting built-in
o Native IPv6 support
o Hardware acceleration
• First production release at the end of 2009
Detecting Binary Packers
• Binary Packers compress binary files
• Examples of compression:
o Winzip, Winrar, Tar, Gzip, etc.
• Byte Pattern of application used to compress binary file
• Many binary packers are used for malicious purposes
o UPX, Armadillo, VMProtect, SecureRom *cough*
http://malforge.com/snort/output_all.zip
http://malforge.com/snort/userdb_all.zip
Questions, Comments, Conerns,
Criticisms?
Sources
• http://www.sans.org/resources/idfaq/id_vs_ip.php
• http://www.snort.org/about_snort/
• http://www.sans.org/reading_room/whitepapers/detection/
the_history_and_evolution_of_intrusion_detection_344?
show=344.php&cat=detection
• http://www.ece.drexel.edu/telecomm/Talks/thiel.pdf
• http://hogwash.sourceforge.net/docs/overview.html
• http://www.openinfosecfoundation.org/index.php/faq
• http://en.hakin9.org/attachments/hakin9_6-2006_str22-
33_snort_EN.pdf
• http://www.securityfocus.com/infocus/1514
