CanSecWest01 -- Stealth Scanning & IDS Evasion Techniques

| Last modified: Wednesday, 28-March-2001 03:17:41 PDT

Stealth Scanning & IDS Evasion Techniques (Latest version: http://www.insecure.org/presentations/CanSecWest01/index.html)

1. Introduction
   - Hello; Motivation; Purpose; URL

2. Nmap & Scanning Intro
   - Usage example [1].

3. Preventing standard host logging
   - Logging demo

4. IDS Evasion
   - Demo our guinnea pig IDS
   - Demo Simple scan [2]
   - One potential solution: Decoys ("nmap -D"). Explanation. Demo [3]
   - Slow scan ("-T sneaky" or "-T paranoid")
   - Fragmentation attacks ("-f") and other low-level mischief. Great papers/resources:
     - Excellent classic paper by Thomas Ptacek and Timothy Newsham on evading IDS systems -- http://www.insecure.org/stf/secnet_ids.
     - Fragrouter by Dug Song which implements most of the attacks from the paper above as well as others. -- http://www.anzen.com/research/nidsbench/
   - Specific signature evasion.
     - Example: All of the snort rules which refer to Nmap:

           zardoz~/src/snortrules>grep -i nmap *
           icmp.rules:alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Nmap2.36BETA or HPING2 Echo ";itype:8;dsize:0; reference:arachnids,162;)
           icmp.rules:alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING NMAP"; dsize: 0; itype: 8; reference:arachnids,162;)
           scan.rules:alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN nmap fingerprint attempt";flags:SFPU; reference:arachnids,05;)
           scan.rules:alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN nmap TCP";flags:A;ack:0; reference:arachnids,28;)
           zardoz~/src/snortrules>

     - Don't expect protection just because your IDS is proprietary or expensive.
   - Overload via false alarms. Demo [4]
   - Crash or exploit the IDS
   - Exploit the IDS attacker identification mechanism
     - Vulnerability of various identification mechanisms (IP addy, DNS, NetBIOS)
     - Windentd -- Fun with NMB authentication. Demo [5].
   - Use an exploit that is not in the signature database.

5. More fun
   - Icepick. Demo.

# The Code:

Before I provide links to the code demonstrated, please allow me to state a few caveats and "rules":

- The primary purpose of writing this code was to demonstrate the concepts shown in the presentation. Don't expect them to be full-featured, bug-free examples of clean, elegant programming. They are not really "supported" although you can always write me fyodor@insecure.org with suggestions/fixes/questions. If you want an (IMHO) better example of our code, pick up Nmap.
- I am distributing these as tarballs of some .c/.h files and a Makefile. If you don't know how to compile them, you probably shouldn't. If a binary is included, it is probably for Linux/glibc.
- These are not documented and their purpose probably won't be clear unless you saw the presentation. The outline above is also probably useless if you missed the presentation. I would prefer that you avoid redistributing the code on web sites such as packetstorm, freshmeat, etc. Pointing people to this page would be better.
- These compile and run on my Redhat 7 Linux box. Few other systems have bene tested.
- OK, without further ado, here is Icepick and windentd. Enjoy ;).