9

A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques.

With these techniques, they claim to be capable of launching attacks on a network without being detected and blocked by the IDS.

Is this thread real, or it is only an ad campaign ?

All the details can be found in the website developed by StoneSoft (http://www.antievasion.com/)

5 Answers 5

7

Sales pitch from Stonesoft. I saw the entire video, and just like AviD said, IDS evasion is real and new ways to evade comes out all the time.

These guys probably found a new evasion technique which they are now marketing hard.

To answer your question, I believe they found an evasion technique which is yet undiscovered by most common IPS/IDS vendors. However, it won't be long until this technique is known to the public and all the major vendors patch against it.

3
  • 2
    Maybe so, but then begins anew the hamster wheel of detection/evasion...
    – AviD
    Nov 30, 2010 at 9:56
  • AET are about taking existing threats and mixing them, not creating new atomic evasion, but using existing one and combining them (Evader). Fact is that combining an evasion A with an evasion B might be enough to pass undetected through an IPS that actual claims to detect A and B... Since there are numerous way to evade and IPS, combination is really huge, if IPS don't use normalization for each and every threat but just detect them barely with signature matching on awaited flow, then it creates space for combination evasion. (disclaimer : i work at Stonesoft, but this is my own analysis.). Nov 24, 2013 at 21:38
  • @philippelhardy this comment should be on the original question (or an answer in its own right) Aug 1, 2017 at 8:00
9

I don't know specifically about Stonesoft, but not only is IDS evasion real, it's also nothing new.
There have been any number of techniques, vectors, and attacks to evade IDS - and really any network filtering mechanism - dating at least back a dozen years or so to RainForestPuppy's classic work on evasion mechanisms. New techniques come out all the time.

0
4

Short answer: If you rely on IDS/IPS to protect your systems, concern might be appropriate. NOTE: You should never rely on IDS/IPS to protect your systems.

These techniques are related to IDS/IPS evasion and hold no bearing on other protection mechanisms. Your exposed services should be up to date on software patches and have as restrictive configurations as possible. Services that don't need to be exposed should be restricted to listening on localhost or protected by firewall or router ACLs. Ability to evade your IDS/IPS is irrelevant if your services aren't reachable, or if you have no exposed vulnerabilities.

2

Their PR agent at http://www.antievasion.com/community?mingleforumaction=viewtopic&t=2.0 says "What’s also interesting is that most vendors haven’t taken evasions seriously, and IPS normalization engines are not up to the task of handling the permutations." That's as much of a red flag to me as a paper on Arxiv.org saying they found something Einstein overlooked.

Snort, as a prominent example, has several facilities for dealing with evasion techniques: The frag3 preprocessor reassembles fragmented ip packets, taking into account the policies on the target host, to prevent evasions using fragroute. The flow preprocessor reassembles tcp streams in an analogous way. The Stonesoft evasion techniques, if they are actually novel, will be integrated in their turn.

0

AET are about taking existing threats and mixing them, not creating new atomic evasion, but using existing one and combining them (Evader). Fact is that combining an evasion A with an evasion B might be enough to pass undetected through an IPS that actual claims to detect A and B... Since there are numerous way to evade and IPS, combination is really huge, if IPS don't use normalization for each and every threat but just detect them barely with signature matching on awaited flow, then it creates space for combination evasion. (disclaimer : i worked at Stonesoft, but this is my own analysis.).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .