Host-based Intrusion Detection Systems (HIDS) Pieter de Boer - PowerPoint PPT Presentation

Host-based Intrusion Detection Systems (HIDS) Pieter de Boer Martin Pels 09/02/2005

Contents ● HIDS-types ● Example break-in ● Protection using HIDS ● Evasion possibilities ● Evasion prevention ● Conclusion 09/02/2005 Host-based Intrusion Detection Systems 2/8

HIDS-types Contents ● Types ● Break-in ● Protection ● Filesystem monitoring ● Evasion ● Prevention ➔ AIDE, Mtree ● Conclusion ● Logfile analysis ➔ Swatch, Sec ● Connection analysis ➔ Scanlogd, PortSentry ● Kernel-based IDS (process monitoring etc.) ➔ IDSpbr, LIDS 09/02/2005 Host-based Intrusion Detection Systems 3/8

Example break-in Contents ● Types ● Break-in ● Protection 1) Bug in forum: uploading & executing PHP-code ● Evasion ● Prevention 2) Downloading netcat through PHP-file ● Conclusion 3) Binding netcat to a port --> Shell 4) Executing root-exploit in the shell 5) Install rootkit, etc. 09/02/2005 Host-based Intrusion Detection Systems 4/8

Protection using HIDS Contents ● Types ● Break-in ● Protection ● Logfile analysis ● Evasion ● Prevention ➔ Detection of PHP-file upload and netcat execution ● Conclusion ● File monitoring ➔ Detection files (PHP-file & netcat binary) and installed rootkit ● Connection Analysis ➔ Detection of unauthorized daemons ● Kernel-based IDS ➔ Detection of root-exploit execution 09/02/2005 Host-based Intrusion Detection Systems 5/8

Evasion possibilities Contents ● Types ● Break-in ● Protection ● Logfile analysis ● Evasion ● Prevention ➔ Encoding of requests ● Conclusion ● File monitoring ➔ Deletion of files after use, modify file monitor ● Connection Analysis ➔ Set up netcat connection to the outside ● Kernel-based IDS ➔ Use of undetectable exploits 09/02/2005 Host-based Intrusion Detection Systems 6/8

Evasion prevention Contents ● Types ● Break-in ● Protection ● Logfile analysis ● Evasion ● Prevention ➔ Anomaly detection ● Conclusion ● File monitoring ➔ Realtime monitoring, Placing monitor on read-only media ● Connection Analysis ➔ Detection of connections to the outside ● Kernel-based IDS ➔ Anomaly detection 09/02/2005 Host-based Intrusion Detection Systems 7/8

Conclusion Contents ● Types ● Break-in ● Protection ● HIDSs are not perfect ● Evasion ● Prevention ● Despite this they can certainly be useful ● Conclusion 09/02/2005 Host-based Intrusion Detection Systems 8/8