Re: interesting paper on testing sig-based IDS

[Giovanni Vigna <vigna () cs ucsb edu>]

Well,
        We sort of suck in terms of publicizing our research.

Our tool, which is called 'Sploit', is more similar to CANVAS than to  
any other.
I haven't seen/tried CANVAS so I am not sure, but the basic ideas seem
similar.

You can get the details from the paper, but the idea is
to compose exploit templates and mutant operators.
The mutation engine applies one or more mutant operators to
an exploit template to obtain a mutant exploit. Then the exploit is run
against a vulnerable application and an oracle determines if
the attack was successful (this is necessary because even though
the mutant operator are supposed to preserve the semantics of the
exploit, things can actually go wrong in unexpected ways).
The outcome of the oracle is automatically cross-correlated
with the outputs of one or more intrusion detection systems.
By "exploring" the mutation space it is possible to find the right
composition of mutant operators to evade an IDS.
In out paper we show that using our tool we were able to
evade 9 out of 10 attacks, in the case of ISS RealSecure.

We are not distributing our code at the moment.

Best regards,

        Giovanni


On Feb 25, 2005, at 9:01 PM, Kohlenberg, Toby wrote:

> http://www.cs.ucsb.edu/~vigna/pub/ 
> 2004_vigna_robertson_balzarotti_CCS04.
> pdf
>
> It seems very similar (at least at first glance) what what's been
> implemented by
> RFP in Whisker (the anti-IDS techniques) or in Metasploit (IDS  
> confusion
> techniques).
>
> Have any/many of you seen this before? It seems like it's something we
> would have
> seen cross this list but I don't remember it doing so.
>
> t
>
> Toby Kohlenberg, CISSP, GCIH, GCIA
> Senior Information Security Analyst
> Applied Security Technology Team
> Intel Corporate Information Security
> 503-712-8588  Office & Voicemail
> 877-497-1696  Pager
> "Just because you're paranoid, doesn't mean they're not after you."
>
> PGP Fingerprint:
> 92E2 E2FC BB8B 98CD 88FA  01A1 6E09 B5BA 9E84 9E70
>
>
>
> ----------------------------------------------------------------------- 
> ---
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from
> CORE IMPACT.
> Go to  
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ----------------------------------------------------------------------- 
> ---


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------