Date: Sat, 7 Apr 2001 16:25:52 -0500 From: "Jacques A. Vidrine" <n@nectar.com> To: Crist Clark <crist.clark@globalstar.com> Cc: lee@kechara.net, freebsd-security@FreeBSD.ORG Subject: Re: Theory Question Message-ID: <20010407162552.D87286@hamlet.nectar.com> In-Reply-To: <3ACF83FA.55761A7B@globalstar.com>; from crist.clark@globalstar.com on Sat, Apr 07, 2001 at 02:17:46PM -0700 References: <200104071610.RAA18117@mailgate.kechara.net> <3ACF83FA.55761A7B@globalstar.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Apr 07, 2001 at 02:17:46PM -0700, Crist Clark wrote: > A possible scenario: Your IDS is listening to the unprotected link to > the Internet and chugging away, crunching the data passing by looking > for attack signatures. Hiding somewhere in the bowels of this large > and complex IDS program[0] is a buffer overflow vulnerability. EvulHax0r > sends a crafted series of packets past the box which trip the buffer > overflow and execute arbitrary code of his choosing on the box. Game > over. His code could attach an IP stack to the external interface > (just run ifconfig), it could open a tunnel through the backside of > the IDS and back out of the front[1] of your network, or if EvulHax0r > is really 33l33t, he could set up a covert channel on the external > interface that does not use the kernel stack. This is why you physically cut the TX wires to the network. That buffer overflow can still be successful, and the machine can still be comprimised, but it cannot be used to make further attacks. The types of comprimises are also limited, since the attacker must work blindly. Of course, the problem is then how do you get useful information out of your IDS? Cheers, -- Jacques Vidrine / n@nectar.com / jvidrine@verio.net / nectar@FreeBSD.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010407162552.D87286>