Intrusion detection system evasion techniques: Difference between revisions

Revision as of 14:15, 13 April 2016

Revision as of 14:16, 13 April 2016

Line 40:

Some IDS evasion techniques involve deliberately manipulating [[Transmission Control Protocol|TCP]] or [[Internet Protocol|IP]] protocols in a way the target computer will handle differently from the IDS. For example, the [[Transmission Control Protocol|TCP Urgent Pointer]] is handled differently on different operating systems. If the IDS doesn't handle these protocol violations in a manner consistent with its end hosts, it is vulnerable to insertion and evasion techniques similar to those mentioned earlier.<ref name=":07">{{Cite journal|last=Ptacek|first=Thomas H.|last2=Newsham|first2=Timothy N.|date=1998-01-01|title=Insertion, evasion, and denial of service: Eluding network intrusion detection|url=http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.119.399&rank=1}}</ref>

=== InsertingLow-bandwidth traffic at the IDSattacks ===

Attacks which are spread out across a long period of time or a large number of source IPs, such as [[Nmap|nmap's]] slow scan, can be difficult to pick out of the background of benign traffic. An online [[Password cracking|password cracker]] which tests one password for each user every day will look nearly identical to a normal user who mistyped their password.

An adversary can send packets that the IDS will see but the target computer will not. For example, the attacker could send packets whose [[Time to live]] fields have been crafted to reach the IDS but not the target computers it protects. This technique will result in an IDS with different state than the target.

== Denial of service ==