Out-of-box intrusion prevention systems. Test Drive

Hi, Habrovchane!

Today we want to talk about how intrusion detection / prevention systems do their job right after you get them out of the box, initialize them, and put them in your network. The following hardware platforms will participate in today's test drive:

• Cisco IPS 4240;
• IBM Proventia GX4004;
• StoneGate IPS 1060.
')
Based on our experience, approximately 80% of IPS organizations are not configured properly. This is due to the fact that there is simply no one to configure them or the system was installed only “for a tick” in order to comply with certain requirements of regulators. Therefore, we decided to compare the intrusion detection systems at the default settings.

In the article we want to share the results of our test drive with respected Habrazhiteli.

All interested are invited under the cat.

Technical description of comparable IPS

Here, in fact, our experimental:


To begin with, we will give a few dry numbers describing the performance characteristics of hardware platforms, taken from open information sources:

Program test drive

We will compare the work of three IPS under the same conditions: work in IDS mode (comparison was carried out in a real network), work in IPS mode and “very conditional” load testing (comparison was carried out in the laboratory). As a result, we get a summary table with data on the number of found and blocked vulnerabilities.

At once I would like to say that the comparison took place on the latest available software version and with the latest signatures at the time of testing, the default policies were used to detect and block threats.

Our "racing track"

IDS operation

Testing of hardware platforms for intrusion detection systems in IDS mode (monitoring network activity) was carried out according to the scheme shown in the figure below by connecting all the hardware to the Cisco Catalyst 3750 switch ports, on which traffic from the organization’s real network was mirrored.


After three days of work in the monitoring mode of the IPS network, we found the following number of vulnerabilities / attacks (we took into account only vulnerabilities of the High, Medium and Low levels, the Info vulnerabilities were not taken into account):

• Cisco IPS 4240 - 17 vulnerabilities / attacks;
• IBM Proventia GX4004 - 32 vulnerabilities / attacks;
• StoneGate IPS 1060 - 103 vulnerabilities / attacks.

There are not so many common vulnerabilities / attacks that could detect all the glands:

• ICMP Network Sweep w / Address Mask;
• ICMP Network Sweep w / Timestamp;
• TCP_Port_Scan;
• UDP_Port_Scan;
• ICMP_Subnet_Mask_Request;
• ICMP_Timestamp_Request.

A summary table with a list of all found vulnerabilities / attacks and a breakdown by piece of hardware can be viewed under the spoiler.

It is worth noting that IPS in monitoring mode can not only detect attacks, but also find vulnerable services and applications on the network, for example, using the default settings of the SNMP community, using blank passwords, unpatched software.

IPS operation

Testing of hardware platforms for intrusion detection systems in IPS mode (monitoring network activity and blocking malicious traffic) was carried out according to the scheme shown below by alternately turning on all hardware platforms in Inline mode (in the gap) between the Attacker Workstation and the Victims (servers). The Victims had Microsoft Windows 2003 R2 installed and the following application software:

• Oracle express 10g;
• MySQL 5.2;
• Apache 2.2.26;
• WEB IIS 6 / FTP ISS 6;
• Filezilla FTP Server 0.9.41 beta;
• TFTPD 32 4.0;
• MSSQL Express 2005.


With the Attacker Workstation, the Victims were scanned using the Nessus security scanner and a list of vulnerable services running on them was determined. After scanning, attempts were made to exploit vulnerabilities (launch exploits) on the Victims using the Metasploit Framework exploit pack.

Below is a summary table of the IPS attack response:


It can be seen that IPS with default settings can block not all attacks, even those that do not use the latest vulnerabilities. Therefore, it is strongly recommended to customize the piece of hardware specifically for your needs and services.

"Very conditional" load testing

This testing was performed using the hping3 utility (you can read about the utility here ) from the Backtrack 5 R3 distribution kit. The purpose of the testing was to test the “resistance” of IPS to flood attacks, i.e. we did not try to compare the performance of devices, but only investigated their response to overload.

Stand description:
IPS was established in the gap between the attacking node (OS Backtrack 5 R3) and the victim node (Windows Server 2003 R2). The hping3 utility was launched within 5 minutes with the “--flood” parameter; this key allows you to use the maximum possible packet generation rate.

Command example:
hping3 ip_address --flood

Below is a summary table with the results:


As we can see, none of the IPS systems (on the default settings) could protect the node from a flood attack. Cisco and IBM in the logs issued alerts and did not try to block the attack, StoneGate began to block the connections, but went into reboot, and the attack on the victim continued successfully. This is due to the fact that by default the mode of operation of inline-interfaces is chosen fail-open, i.e. all traffic passes freely between interfaces without inspection in case of failure of the hardware platform.

Conclusion

If you decide to put IPS in order to really protect your users or some important services from outside threats and to be aware of what is happening in your network, we recommend that you do fine-tune the hardware. Properly tuned IPS is able to close a very large number of “holes” in security, even if it is already old and weak. And on the default settings, none of the manufacturers showed results that could be called "impressive."

Thank you all for your attention!

Glebov Maxim, Selishchev Ivan