Out of the box intrusion prevention systems. Test Drive

Hello, Khabrovchans!

Today we want to talk about how intrusion detection / prevention systems cope with their task right after you get them out of the box, initialize them and put them on your network. The following hardware platforms will participate in today's test drive:

• Cisco IPS 4240;
• IBM Proventia GX4004;
• StoneGate IPS 1060.

Based on our experience, approximately 80% of IPS organizations are not configured properly. This is due to the fact that there is simply no one to configure them or the system was installed only “for show” to meet one or another of the requirements of regulators. Therefore, we decided to compare the intrusion detection systems on the default settings.

In the article we want to share the results of our test drive with respected Harazhitelami.

All interested are invited to cat.

Technical Description of Compared IPS

Here, in fact, our experimental subjects:


First, we give a few dry numbers characterizing the performance characteristics of hardware platforms, taken from open sources of information:

Test drive program

We will compare the work of three IPS under the same conditions: work in IDS mode (comparison was carried out in a real network), work in IPS mode and “very conditional” load testing (comparison was carried out in the laboratory). As a result, we get a summary table with data on the number of vulnerabilities found and blocked.

I would immediately like to stipulate that the comparison took place on the latest available version of the software and with the latest signatures at the time of testing, the default policies were used to detect and block threats .

Our "racing track"

Work in IDS mode

Testing of the hardware platforms of intrusion detection systems in IDS mode (network activity monitoring) was carried out according to the scheme shown in the figure below, by connecting all the glands to the span ports of the Cisco Catalyst 3750 switch, which mirrored traffic from the organization’s real network.


After three days of working in the network monitoring mode, IPS found the following number of vulnerabilities / attacks (we took into account only High, Medium and Low vulnerabilities, Info vulnerabilities were not taken into account):

• Cisco IPS 4240 - 17 vulnerabilities / attacks;
• IBM Proventia GX4004 - 32 vulnerabilities / attacks;
• StoneGate IPS 1060 - 103 vulnerabilities / attacks.

There are not so many common vulnerabilities / attacks that all pieces of iron could detect:

• ICMP Network Sweep w / Address Mask;
• ICMP Network Sweep w / Timestamp;
• TCP_Port_Scan;
• UDP_Port_Scan;
• ICMP_Subnet_Mask_Request;
• ICMP_Timestamp_Request.

A summary table with a list of all found vulnerabilities / attacks and a breakdown by pieces of iron can be viewed under the spoiler.

It is worth noting that IPS in monitoring mode can not only detect attacks, but also find vulnerable services and applications on the network, for example, use the default settings of the SNMP community, use empty passwords, and non-updated software.

IPS Operation

Testing of the hardware platforms of the intrusion detection systems in IPS mode (monitoring network activity and blocking malicious traffic) was carried out according to the scheme shown in the figure below, by switching on all the hardware platforms in Inline mode (in the gap) between the Attacking Workstation and the Victims (servers). Microsoft Windows 2003 R2 OS and the following application software were installed on the Victims:

• Oracle express 10g;
• MySQL 5.2;
• Apache 2.2.26;
• WEB IIS 6 / FTP ISS 6;
• Filezilla FTP Server 0.9.41 beta;
• TFTPD 32 4.0;
• MSSQL Express 2005.


From the attacker's workstation, Nessus scanned the victims using the Nessus security scanner and determined the list of vulnerable services running on them. After scanning, attempts were made to exploit vulnerabilities (launch exploits) on the Victims using the Metasploit Framework exploit pack.

The following is a summary table of the IPS response to attacks:


It can be seen that IPS with default settings are not able to block all attacks, even those using not the latest vulnerabilities. Therefore, it is strongly recommended to configure the piece of iron specifically for your needs and services.

"Very conditional" load testing

This testing was carried out using the hping3 utility (you can read about the utility here ) from the Backtrack 5 R3 distribution kit. The purpose of the testing was to check the IPS "resistance" to flood attacks, i.e. we did not try to compare the performance of devices, but only examined their response to overload.

Description of the stand:
IPS was installed in the gap between the attacking node (Backtrack 5 R3 OS) and the victim node (Windows Server 2003 R2 OS). The hping3 utility was launched within 5 minutes with the “--flood” parameter, this key allows you to use the maximum possible packet generation speed.

Command example:
hping3 ip_address --flood

Below is a summary table with the results:


As we can see, none of the IPS systems (at the default settings) was able to protect the node from a flood attack. Cisco and IBM in the logs issued alerts and did not try to block the attack, StoneGate began to block connections, but went to reboot, and the attack on the victim successfully continued. This is due to the fact that the default mode of operation of inline interfaces is set to fail-open, i.e. all traffic flows freely between interfaces without inspection in the event of a hardware platform failure.

Conclusion

If you decide to install IPS in order to really protect your users or some important services from external threats and be aware of what is happening on your network, then we recommend fine-tuning the hardware. A properly tuned IPS can close a very large number of security holes, even if it is already old and weak. And on the default settings, none of the manufacturers showed results that could be called "impressive".

Thank you all for your attention!

Glebov Maxim, Selishchev Ivan