bypassingintrusiondetectionsystems-文庫(kù)吧
2025-08-27 09:04 本頁(yè)面
【正文】 tions messages xfer access_log secure sendmail messages xfer access_log secure sendmail One Security Log Firewalls as an IDS ? Excellent source of work probe, attack and misuse information ? Detect policy deviations based on access control lists ? Some have “NIDS” capabilities Network Honeypots ? Sacrificial system(s) or sophisticated simulations ? Any traffic to the honeypot is considered suspicious ? If a scanner bypassed the NIDS, HIDS and firewalls, they still may not know that a Honeypot has been deployed honeypot HTTP DNS Firewall Technical Bypass Techniques ? NIDS – fragmentation – TCP unsync – Low TTL – ?Max? MTU – HTTP Protocol – Tel Protocol ? HIDS – Kernel Hacks – Bypassing stack protection – Library Hacks – HTTP Logging insertion techniques NIDS FRAGMENT QUEUE SESSION QUEUE IP 1 IP 2 IP 3 Session 1 Session 2 Session 3 NIDS FRAGMENT QUEUE SESSION QUEUE IP 1 IP 2 IP 3 Session 1 Session 2 Session 3 Bypassing NIDS Fragmentation ? NIDS must reconstruct fragments – Maintain state = drain on resources – Must overwrite correctly = more drain on resources ? Target server correctly defrags ? Attack 1 just fragment ? Attack 2 frag with overwrite ? Attack 3 start an attack, follow with many false attacks, finish the first attack Bypassing NIDS TCP unsync ? Inject a packet with a bad TCP checksum –fake ?FIN? packet ? Inject a packet with a weird TCP sequence number – step up – wrapping numbers Bypassing NIDS Low TTL NIDS 1 2 3 WWW Bypassing NIDS Max ?MTU? N
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號(hào)-1