IDS detection

How do you detect of some one is running an IDS?

Nmap their network and see if the cops show up at your door or your ISP cut's you off. :) Seriously, I don’t think that there is a reliably way to tell. It is a good question though.

Really... Unless you are inside his network in the first place he should have made it impossible for you to detect it. But then that might also depend upon the sysadmins choice of IDS and his rules. In Snort for example I can use the "react" keyword.... It sends an RST to one or both ends of the conversation when it alerts.... But that would tell you I'm watching you..... So I don't use "reacts".... I just log you, block you or otherwise defeat you or wait for you to make a mistake..... which, if your intentions for asking the question are dishonorable you will surely make if you need to ask the question in the first place...... nuff said?

It depends on how the IDS is setup. Quite often today we see IDS, like Snort, run on "Stealth" ports. One way might be to look for a default administrative port that specific IDSes use. Alternatively, listening for packets that might be sent back and forth (assuming you have access to the network to do so).

Certainly it's not unusual to see an attacker attempt to "flood" what might be an IDS network/IP. IDS are vulnerable to having too much data.

I did take a look around because I have to admit I haven't looked into this issue specifically (although I suspected that many of the existing problems with firewalls would also fall over to IDSes). Take a look at this article. While not detailed on specifics it should give you some ideas.

I do suspect that with the advent of combos (firewall + IDS) it may be easier for attackers to detect them (finding fingerprints of these applications) and thus make it easier for attackers to break these down. I'm personally a big fan of layers of security (have a seperate box for an IDS, one for firewall, another for another firewall, etc.)

I would think that if the admins are looking at the IDS logs they will detect your probing for what IDS they have before you get a chance to use said information. Makes it somewhat pointless, either they are looking at their logs and see your probes for what IDS they use, or there aren’t paying attention to what their IDS reports so it does not matter anyway. Still, interesting to know about Snort and "reacts".

Then there's Stick and Snot that they'll use to try to flood your IDS by using it's own rules against it..... It might confuse the admin... It might drop the important packets.... But, oh, I forgot.... Snort has been hardened against such attacks since 1.8 or 9 I believe it was... Oh well.... another little avenue of pleasure cut off..... :cool:

Ok thank you for the information i was just wornding about idses and one more thing what kind of places usualy run idses.

Any places that have smart IT staff. ;)

How you secure you assets, (specifically digital assets), is determined entirely by a risk assessment. The risk assessment places a "value" on your assets. From that value you determine the cost and the suitable tools you should use to defend those assets.

Thus, if your risk assessment indicates that it would be of value to protect the assets an IDS is a very useful tool when you consider that, for the largest part, nothing is secure.

Quote:

---

for the largest part, nothing is secure

---

Especially when your security admins are away on vacation/holidays... ;)

Quote:

---

Originally posted here by phishphreek80
Especially when your security admins are away on vacation/holidays... ;)

---

Vaction/holidays ......what the hell are those. :p


Cheers:

Quote:

---

Especially when your security admins are away on vacation/holidays...

---

They don't have to be on holidays. Poor configurations lead to a lot of holes and vulnerabilities. It's a lack of attention to detail and lack of desire to pay attention to that detail. Many have been trained to administrate their networks but few are trained to think security from the get go. As long as that exists, there will always be those that can by-pass firewalls, IDSes, pick out the honeypots and go to the bank with your data. As long as people assume they are secure, they will never be secure.

Better to be paranoid and think of all the possibilities than to get lax. The attackers aren't.

Of course rather then trying to detect the IDS, which as has been said is not very practical from the outside, an attacker can try to avoid it, various methods exist for doing this. Which is why defense in depth is such a good idea. Make sure boxes are patched are locked down, logs are being monitored, AV is running etc...

ok so places like schools, web servers, and small bussiness would not usualy have one but places like banks, large bussiness, and sights with valuable information stored on them for bussiness men away from the office would have IDSes.

Quote:

---

ok so places like schools, web servers, and small bussiness would not usualy have one but places like banks, large bussiness, and sights with valuable information stored on them for bussiness men away from the office would have IDSes.

---

Not always true. Schools, webservers and small businesses also have valuable information to protect (e.g., client information, personal privacy of students, grades, exams, etc.) It's often a question of budget, admin's knowledge and how important it is to them.

o ok. thank you all for the help.

There are several methods. I've described some in this thread:

http://marc.theaimsgroup.com/?l=vuln...8483927663&w=2

Saw that there was another thread here with almost the same question, but it was geared a bit more towards detecting snort:
http://www.antionline.com/showthread...hreadid=270550

I found this little blurb about detecting if someone is running a NIDS (Network IDS) on another site:

"A NIDS is essentially a sniffer, so therefore standard sniffer detection techniques can be used. Such techniques are explained in http://www.robertgraham.com/pubs/sni...q.html#detect.
An example would be to do a traceroute against the victim. This will often generate a low-level event in the IDS. Traceroutes are harmless and frequent on the net, so they don't indicate an attack. However, since many attacks are preceded by traceroutes, IDSs will log them anyway. As part of the logging system, it will usually do a reverse-DNS lookup. Therefore, if you run your own DNS server, then you can detect when somebody is doing a reverse-DNS lookup on your IP address in response to your traceroute. "
-Snippet taken from www.ticm.com/kb/faq/idsfaq.html

Interesting site, lots of useful faq's pertaining to IDS's