Intrusion Detection Issues Presented by Deepa Srinivasan CSE581, Winter 2002, OGI.
-
Upload
amie-cooper -
Category
Documents
-
view
215 -
download
0
Transcript of Intrusion Detection Issues Presented by Deepa Srinivasan CSE581, Winter 2002, OGI.
Intrusion Detection Issues
Presented by
Deepa Srinivasan
CSE581, Winter 2002, OGI
Papers on this topic
• Insertion, Evasion and Denial of Service: Eluding
Network Intrusion Detection (Jan ‘98)
• Network Intrusion Detection: Evasion, Traffic Normalization and End - End semantics (‘01)
• IP Fragmentation and fragrouter (Dec ‘00)
• An Achilles’ Heel in Signature-based IDS: Squealing False Positives in SNORT (‘01)
Agenda• Introduction to IDS
– Some popular IDSs
• Problems with IDSs
• Normalizer
• IP Fragmentation & fragrouter
• “Squealing” in SNORT
Introduction to IDS• Intrusion attempt or a threat: potential possibility of a
deliberate unauthorized attempt to access/manipulate information, or render a system unreliable or unusable.
• Types of IDS
– Host-based
– Network IDS
• Example IDSs
– ISS RealSecure, WheelGroup NetRanger, Network Flight Recorder, Snort
Principles of IDSs
Common Intrusion Detection Framework
– Event generators
– Analysis Engines
– Storage Mechanisms
– Countermeasures
Principles of IDSs
Common Intrusion Detection Framework
Principles of IDSs
• Passive monitoring
• Signature Analysis
• Need for reliable ID
– accuracy: false positives and false negatives
– “fail-open”: if an attacker disables the IDS, entire network is still accessible
– forensic value of information
Fundamental problems of IDSs
• Deployed on a different box
• Could be on a different network segment
• Protocol implementation ambiguities
– different protocol stacks have different behavior
• NIDS could see a different stream of packets than host
Fundamental problems of IDSs
• False positives
– incorrectly identify an intrusion when none has occurred
• False negatives
– incorrectly fail to identify an intrusion that has actually occurred
Attacks on IDSs• Insertion
– IDS thinks packets are valid; end system rejects these
• Evasion
– end system accepts packets that IDS rejects
• Denial of Service– resource exhaustion
• Examples
Popular problems/attacks
• TCP/IP Options fields
• TCB Creation/Teardown
• TCP Stream Reassembly
• IP Fragmentation
– overlapping fragments
Specific attacks
• Invalid MAC addresses?
• Invalid headers
– Permissive in receiving, frugal in sending?
– Bad IP checksum will be dropped?
– IP options
• IP TTL ambiguity– Packer received or not?
Specific attacks
• Packet size– Packet too large for downstream link?
• Source-routed packets– Will destination reject such packets?
• Fragment or TCP handshake time-out– Will other parts of fragment/TCB still be at destination?
• Overlapping segments– Rewrite old data or not?
Specific attacks
• Weird TCP options– Destination might be configured to drop
• Old TCP timestamps (PAWS)– Destination might be configured to drop
• TCP RSTs with weird sequence numbers– Is connection reset?
• Addition of interpreted characters (“^H”)– How does OS interpret?
IP Fragmentation
• Allows IP traffic over different network media with different max packet sizes
• IP stacks do not handle reassembly well– can lead to DOS (teardrop, jolt2)
• Fragrouter– NIDS testing tool
– accepts IP packets routed from another system
– fragments these packets according to various schemes
Popular problems/attacks
• Resource Exhaustion
– CPU, Memory, Network Bandwidth
– CPU: Data-structure attack via fragments
– Memory: Space attack via fragments
– Network: Targeted DoS to disrupt TCP reassembly
• Abusing reactive IDS
– attack to generate false positives
– IDS shuts down valid connections, blocks valid traffic etc.
– Results in IDS triggering a DOS
IP Fragmentation
• Allows IP traffic over different network media with different max packet sizes
• IP stacks do not handle reassembly well
– can lead to DOS (teardrop, jolt2)
• Fragrouter
– NIDS testing tool
– accepts IP packets routed from another system
– fragments these packets according to various schemes
Popular problems/attacks
• Resource Exhaustion
– CPU, Memory, Network Bandwidth
• Abusing reactive IDS
– attack to generate false positives
– IDS shuts down valid connections, blocks valid traffic etc.
– Results in IDS triggering a DOS
Methodology
• Black-box testing
• PHF attack
– exploits a CGI script - phf to gain access to web servers
• Software Used
– CASL
– FreeBSD 2.2
– netcat
– tcpdump
Results IDS
Problem
RealSecure NetRanger(requiresspecialhardware)
SessionWall3
NFR (networkmonitoring engine)
IPFragmentationReassembly
Not handled Nothandled
Not handled Handles IP Frag –fails at TCP stream
TCPreassembly
Problems withduplicate packets
N/A
TCP SYN/RST Easily desynchronized N/A Acceptedpacketsrejected byend system
Desynchronizes onspurious SYNpackets
Insertionattacks
Vulnerable to all Vulnerableto TCPchecksum;handles IPchcksum
Not easy tobreak
Vulnerable to all
Discussion
Questions?
Network Intrusion Detection:
Traffic Normalization & End-End Protocol Semantics
"Transport and Application Protocol Scrubbing"
• Recap of previous paper
– IDSs are vulnerable to attacks
– fundamental problems:
• IDS sees different streams than target host
• protocol implementation ambiguities
Introduction
• Paper introduces concept of “normalizer”
• Approach & implementation
• Performance
Normalizer
Normalizer• Sits directly in path of traffic into a site
• Patch up or normalize the packet stream
• Result: same traffic and unambiguous behavior for NIDS and host
• Differs from a firewall
• Other approaches
– host-based IDS, details of intranet, bifurcating analysis
Normalization Tradeoffs• Protection
– not meant to but can act as a firewall
• Need to preserve End-End Semantics
• Impacts end-end performance
• Stateholding attack
– create excess state than Normalizer can handle
• Inbound vs Outbound traffic
Other Considerations• Cold Start
– is a “real world” requirement
– what happens to existing connections?
– Initiate state for connections from trusted network
• Attacking the normalizer itself
Systematic Approach
• Walk through packet headers of each protocol
• Identify what is the “correct” normalization
Example Attack • IP Identifier and stealth port scans
Normalization for this
• Solution for patsy
– Scramble ids of incoming and outgoing packets
– Breaks diagnostic protocols
• Solution for victim
– Reliable RSTs
– Normalizer sends “keep-alive” packet to host to determine if connection was actually closed
Implementation
• Code in C - uses libpcap
• user-level application
• attention to completeness, correctness & performance
• Evaluated using trace-driven approach
– NetDuDE
Performance
• Platform: 1.1GHz AMD Athlon, FreeBSD 4.2, 133 MHz SDRAM
• a normalizer implemented in kernel mode (as a click module) could forward traffic at line-speed on bi-directional 100 Mbps link
Discussion
Questions?
An Achilles’ Heel to Signature-Based IDS:Squealing False Positives in Snort (‘01)
• Paper documents attacking Snort using false positives
• Snort : open-source, free, lightweight NIDS
• Squealing
– noise made by pigs during periods of distemperment
• Boy cried wolf too many times
– additionally, boy may not recognize the wolf when it actually appears!
Introduction
Attacking Snort
• Limitation is not in correctly identifying attacks, but in the ability to suppress false positives
• PCP
– Tool for generating false positives
– packet writing and argument parsing
Squeal Attack types• Noise-masked attacks
– diverts attention from a covert attack
• Attack misdirection
– source of attack is spoofed
• Evidence Reputability
• Target Conditioning
• Statistical Poisoning
– when training an IDS
How easy is it?
• Using SOCK_RAW
• LIBNET, Nemesis
• Script-driven tools available (snot, stick, trichinosis)
Proposed Solutions
• Adaption
– changing the signature-matching algorithms rapidly
• State awareness
– make IDS have a “context” which checking packets
Conclusions
• IDSs have been around for more than a decade
• Several fundamental problems identified in IDS
• IDSs themselves are vulnerable to attacks
– and fail-open
• Upcoming paper groups
References
• online.securityfocus.com/ids
• www.snort.org
• www.raid-symposium.org