Chapter 4 - Sniffing and Evasion (Evading IDS, Firewalls and Honeypots)

Question 1

Two types of IDS

signature
anomaly (aka behavior)

false positives
false negatives

Answer 1

signature
IDS compares packets against list of known traffic patterns

anomaly
makes decisions based on learned behavior and ‘normal’ patterns. known for false positives

false positives - alarm over normal traffic
false negatives - no alarm over malicious traffic

Question 2

Exam Tip

libwhisker

Answer 2

perl library used for HTTP related functions

vulnerability scanning
exploitation
IDS evasion

Question 3

HIDS

Answer 3

Host-based IDS

runs on host itself. Typically signature based but not always. Only concerned with that host

Question 4

NIDS

Answer 4

Network-based IDS

sits on the network perimeter. Signature or anomaly based

Can place one outside the firewall, one in the DMZ, one inside the network

Question 5

Snort

Answer 5

Open source IDS

sniffer, traffic logger, protocol analyzer

Can detect buffer overflows, port scans, OS fingerprinting and most any type of attack or probe that can be imagined

signature files updated constantly

Question 6

Network Tap

Answer 6

any connection that lets you see all traffic passing by

Can be as simple as a hub, or complex as an appliance
Must be able to keep up with the data flow

Question 7

Firewalls

types of rules

Answer 7

explicitly stating what is allowed from one side to other

implicitly denying. If there isn’t a rule for the traffic, it gets blocked.

List of rules read in order from top to bottom

Question 8

NAT

PAT (aka NAT overload)

Answer 8

one to one mapping of internal to external addresses. Too expensive for most people

PAT uses port numbers to allow many internal addresses to use a single external IP address

Question 9

ECC Firewall terms

Screened Subnet (aka Public Zone
Bastion Hosts
Private Zone
Multi-home

Answer 9

Screened Subnet (aka Public Zone)
connected to internet, hosts all public facing servers and services 

Bastion Hosts
sit outside the firewall, designed to protect internal resources from attacks

Private Zone
holds all internal devices that internet hosts have no business interacting with

Multi-home
Means the firewall has > 2 interfaces

Question 10

packet filtering firewalls

stateful packet inspection firewalls
aka stateful multilayer inspection firewalls

Answer 10

packet filters look at headers of packets and base decisions on that. Unfortunately doesn’t know what’s in the payload of the packet and doesn’t know the state of the packet

SPI - tracks entire status of a connection. If a packet arrives with ACK flag set, but firewall has no record of the original SYN packet, it’s seen as a malicious attempt
Work in the layers up to Application layer but focus on layers 3 and 4 (Network, Transport)

Question 11

circuit-level gateway firewall

application-level firewall

Answer 11

circuit-level - works at Session layer (5) and allows/prevents data streams, not necessarily concerned with individual packets

Application-Level - filters traffic like a proxy, allowing specific applications in and out of the network based on a rule set

Question 12

2 common implant technologies for getting data out of a network

Answer 12

HTTP beacons

HTTP tunneling

Question 13

circuit-level gateway firewall *

application-level firewall

Answer 13

circuit-level - works at Session layer (5) and allows/prevents data streams, not necessarily concerned with individual packets

Application-Level - filters traffic like a proxy, allowing specific applications in and out of the network based on a rule set

Question 14

Why use unicode during evasion?

Answer 14

many web and IDS filters don’t check for it

use Unicode characters instead of text to confuse signature based IDS.

Sometimes it works, but unicode signature files are available to look for this

Question 15

Tools for IDS evasion

Answer 15

Nessus
ADMmutate
NIDSbench
Inundator
IDSInformer
Packet Generator and PacketETH

Question 16

Firewall Evasion

ICMP Codes

ICMP Type 3 Code 13
ICMP Type 3 Code 3

Answer 16

Type 3 Code 13 - shows traffic is stopped (filtered) by firewall or router

Type 3 Code 3 - indicates the client itself has the port closed

Question 17

Firewalking

Answer 17

Technique to find out what ports and protocols a firewall lets through

Used to get through or around a firewall

Tools like nmap, and Packetstorms firewalls help

Goal is to find a port that’s allowed through and start your attack there

Best way is to have compromised machine on the inside since firewalls typically don’t inspect egress traffic

Question 18

Two important points about honeypots

Answer 18

don’t trust anything on them, because they’re designed to attract malicious software

where you place them is critical. Typically put them in the DMZ and ensure it’s walled off to prevent it from being used for launching other attacks

Question 19

Two types of honeypots

high interaction
low interaction

Answer 19

high interaction simulates all services and applications and is designed to be completely compromised

low interaction simulates limited number of services, can’t be compromised completely, by design.

most hackers realize when they’re in a honeypot