用snort检测nmap和Metasploit入侵技术

AdvancesinCommunications,Computing,NetworksandSecurity10104SnortIDSAbilitytoDetectNmapandMetasploitFrameworkEvasionTechniquesZ.JammesandM.PapadakiCentreforSecurity,CommunicationsandNetworkResearchPlymouthUniversity,UnitedKingdome-mail:[e-mail]oitandportscandisguisedbyevasiontechniqueisachallengeforIDS.ThisresearchexaminestheevasiontechniqueprovidedbyNmap,aportscannerandMetasploitFramework,anexploitlauncheragainstafamousIDSnamedSnort.TheresulttendstoprovethatSnorthastheabilitytodetectportscanandexploitonconditiontohaveagoodconfigurationofSnortandsignaturefortheexploit.KeywordsIDS,Snort,Nmap,MetasploitFramework,evasiontechniques,resilience1IntroductionNowadays,informationsystemsareincreasinglyopenInternet.Thisopeningisbeneficialbutisposesneverthelessamajorproblem:itbringsanumberofnewattacksandrequirement.Thefirsteffectistheimplementationofasecuritypolicyaroundthesesystems.Inadditiontotheimplementationoffirewallsandauthenticationsystemsarealsonecessary.Tocompletethissecuritypolicy,itisalsoimportanttohavemonitoringtoolstodetectpossibleintrusionsinthesystem.Thesolutionisintrusiondetectionsystembutlikeeachsoftware,theIDShavealsosomeweaknessnamed:evasiontechniques.Hopefully,overthetime,theIDSareimprovedbringingnewfunctionalitiesbuttherefore,theyarebecomepowerfulbutalsodifficulttoconfigure.Today,theslightesterrorinconfigurationcanthenletgoofthousandsofintrusionwithoutbeingalerted.2EvasiontechniquesTheevasiontechniqueswerefirstlyintroducedbyPtacekandNewham(1998).Theyexplainedthattheydescribedthreeevasionswhicharethefoundations:theinsertion,theevasionandthedenialofservice.TheinsertionattackisanattackwhereIDSdoesnotdetectanythingalthoughonthetargetsystem,theattackdoesoccurandthetargetsystemignoredthepackets.TheevasionattackisanattackwherethetargetsystemacceptsthepacketsalthoughtheIDSrefusedthepackets.TheaimoftheseevasiontechniquesarethepacketcontentinthetrafficwasdifferentlyinterpretedbetweentheIDSandtheendsystem;thisSection2–ComputerandInformationSecurity105beingduetothedifferentsystemimplementation.Finally,thedenialofserviceattackisanattackisanattackwiththeaimofmakesunavailabletheIDS.ThisknownevasionstechniquestargetspecificlayersoftheTCP/IPprotocolstackandusetheirweakness(forinstancefragmentation).Nowadays,thesetechniqueshavealsospreadtootherdifferentprotocolasSMB,DCERPCandHTTP.In2010,Stonesoft(Boltz,Jalava,&Walsh,2010)sharedfindingsonanewevasionthreat.Indeed,theydiscoverthisyearnewtechniquestoevadeIDSnamedAdvancedEvasionsTechniques(AET).TheAETstargetmultiplelayersoftheprotocolTCP/IPstackandcombinemultipleevasionmethods.Furthermore,theycanbechangedormodifiedduringtheexploit.TheproblemisthattheydonotconformtotherulesusedbyIDStoday.Nowadays,manytoolsusedtotestthesecurityimplementsdifferenttechnicalevasion.Forinstance,Nmap(2012)isdesignedtodetectopenports,identifyhostedservicesandinformationabouttheoperatingsystemofaremotecomputerbutprovidedsomeevasiontechniques.MetasploitFramework(Maynor,2007)isatoolthatallowslaunchingdifferentexploitagainstaremotehostwhilealsoprovidingdifferentevasiontechniques.Anexploitisacomputerprogramto“exploit”asecurityflaworvulnerabilities.Snort(2012)isasignature-basedIDSe.g.itusessignaturesofknownattacktodetecttheattackinthenetworktraffic.Itisverydependentsignaturesandthereforerequiredtobeupdatedregularly.Snortisalsoconsideredlikeanomaly-basedIDS.Itisabletodetectsomeanomaliesinthedifferentprotocol.Snortisthereforebasedonthepreprocessorstonormalizetrafficanddetectinganomaliesandontherulestodetectinthisstudyexploits.preprocessorsandruleswillbeputtothetest.3SnortconfigurationagainstNmap’sevasiontechniquesTheexperiencesmadewithNmapcanbeeasilyredobecauseitdoesnotnecessaryhavespecificequipment.Theonlyrequirementistohave2computerorvirtualmachine.Themostimportantistohaveonehostwhichlaunchesthescanandanotherwhichisscanned.ItcouldbeusefultoprefertotargetaLinuxdistributionratherthanawindowssystem.NmapoffersdifferentscantechniquesbasedontheTCPandUDPprotocol.ThesfPortscanisthepreprocessorthatisabletodetectdifferentportscaninfunctionofitsconfiguration.MostoftheevasionsarebasedonchangestotheUDP,TCPandIPprotocol.Forthispart,theexperienceusesdifferentscansprovidebyNmap.ThemostefficientevasiontechniqueprovidedbyNmaptoevadethismoduleisthefragmentation.Usually,fragmentationoccurswhendatagramsarelargerthantheallowablesize,thislimitationiscalledMTU(MaximumTransmissionUnit).EachfragmentedpackethasanIPheaderforlinkingfragmentstogetherduringthereconstruction.AdvancesinCommunications,Computing,NetworksandSecurity10106TypeofscanWithFrag3WithoutFrag3Synscan/regularscanOKNOFinscanNONONullscanNONOMaimonscanNONOXmasscanNONOConnectscanOKNOAckscanNONOIPprotocolscanNONOIntensivescanOKNOIntensivescanplusUDPOKNOIntensivescanalltcpOKNOSlowcomprehensivescanOKNOTable1-PortscandetectionwithfragmentationInthiscase,despitethatthesfPortscanisenabled,Snortisunabletodetectanyportscan.Snortneedsthefrag3preprocessorwhichperformsthedefragmentationofIPpacketsinordertopreventattackpacketsintentionallyfragmentedcane