Intrusion Detection

Disgruntled Goat sent us a review of Intrusion Detection, a text sure to be of interest to all those working in organizations. The author is a former NSA employee and has written this book as a text to convince upper-level types of the need for security and actually paying attention to it. Click below to read more.

Intrusion Detection
author	Rebecca Gurley Bace
pages	339
publisher	Macmillan Technical Publishing, o01/2000
rating	9/10
reviewer	Disgruntled Goat, [e-mail]
ISBN	1-57870-185-6
summary	Very good InfoSec handbook for suits and junior suits.

The Scenario

Security books, quite frankly, are pretty much a dime a dozen, most of which are written by people in IT field security. What immediately separates this book from the rest is the background of the author. Ms. Bace is an ex-government employee, spending 12 years in everyone's favorite spook organization, the National Security Agency. She led the Computer Misuse and Anonmaly Detection (CMAD) Research Program for six years at the NSA. She also collaborated on Computer Crime : A Crimefighter's Handbook by Dr. David Icove of the FBI. She also won the Distinguished Leadership Award in 1995 from the NSA.

What's Bad?

This book is sort of dry reading. It's akin to reading college CS textbooks for pleasure. Or law books. What I didn't like is the fact that she wasn't real clear on the distinction of "hackers", nor how she describes them. She worries that "hackers" wish to "corrupt the trust process". And the focus for the book is not primarily for techies. It's designed for CIO smacking. Generally, if you're in an organization like mine, your CIO has very little technical background. So, good for CIO bashing.
And, it's $50 also.

What's Good?

This is good if you're in a position where you need to convince management of security threats. It's also good for the kiddies who want to get an idea of what to look for when they're gunning for targets to disrupt.
What made this good for me was the fact that I could have points to show to management for InfoSec issues. I work in a hospital and we tend to attract a large amount of famous people as patients. If something damaging was leaked to the media about a famous person's medical condition that was potentially embarassing, we're looking at a good multi-million dollar lawsuit. This book isn't a by-the-book "How to protect your systems", but more of a book on what to safeguard, and how to detect patterns that may indicate patterns of unauthorized usage.
One of the things that I liked was the chapter on Legal Issues. One of the sections in the chapter was "What Real Cases Have Taught Us". It did a few page review on Mitnick's case, cut and dry. It shows that Shimomura was no rocket scientist, and with cooperation from the courts, you can bust almost anyone. But it did bring up several good points, such as obtaining court orders, how laws work, and how it can be considered evidence.

So What's In It For Me?

If you're a script kiddie, probably nothing. But for those who are achin' to topple some network, this may be for you.

For those with functioning brains who have vested interests in InfoSec and protecting their organization from people who wish to do harm, and getting real security info, rather than from those half-assed "Security Experts" like JohnP, then pick this up.

Pick this book up at ThinkGeek.

Table of Contents

1. The History of Intrusion Detection
2. Concepts and Definitions
3. Information Sources
4. Analysis Schemes
5. Responses
6. Vulnerability Analysis: A Special Case
7. Technical Issues
8. Understanding the Real-World Challenge
9. Legal Issues
10. For Users
11. For Strategists
12. For Designers
13. Future Needs

whois nsa.gov

[dattaway]

TCP connection to 'www.nsa.gov' failed, No Such Agency?

VIIDS

[xianzombie]

the post anonymous button would be nice right now...

anyway, VIIDS = visual imagery and intrusion detection systems: ie. my current job. (yes, also government)

this much i will tell you, the majority of the equipment used (and i don't know about NSA) but for priority A and B resources (being Nucelar Weapons and Armed Fighters/Weapons Storage areas, etc.) DO NOT have all that hi-tech junk you see on tv. up until recently our annunciator system was a hunk of metal developed by the navy back in the 60-70's. the rest is mainly motion detectors, sensors, etc.

These aren't used so much to prevent ppl from getting in, but also to deter admitance. (Don't worry though, should u get in, there are cops in there still who have full athority to shoot you). In fact almost daily i see a sign that states "Use of Deadly Force is Authorized".

As far as if you were to try and hack the computer annunciator systems, well, first you'd have to get access to them, they're not on an outside network, so good luck there.

basically, if someone once this stuff bad enough, they can get it. It will however take them alot of work, and also would result in probably a lot of damage to the equipment to get it out of the area.

to all the would be's who think they want to try, good luck, and i hope you can run fast cuz i'll shoot your ass too.

Re:Intrusion Detection - An Analysts' Approach

[n3rd]

I know this isn't exactly what you're looking for, but I purchased a copy of O'Reilly's book Practical UNIX and Internet Security 2nd Edition [oreilly.com] and have found it to be very useful. This book covers almost everything (accounts, passwords, auditing, logging, backups, physical security, file system, etc etc etc) and is well written (I expect no less from ORA). I also purchased a copy of the book you are referring to, and even though it was not very well written, the "real world" examples of TCP/IP and UDP/IP attacks were a good way to put all I knew about TCP/IP in theory into real world situations. Oh yeah, and from the book, I also know how to disconnect people from IRC now (love them RSTs!).

Deception ToolKit

[MinaInerz]

One the more interesting Intrusion Detection concepts I've seen in recent times is the Deception ToolKit [all.net]. What this program does is "fakes" a bunch of commonly exploited security holes on your system - even though those holes aren't actually there. This is could prove to be very good at catchin script kiddies who run sendmail break-in scripts, etc. A very interesting concept, indeed - I don't know how well it works, though. Anybody out there with any opinions on this piece of software?


Dear IRS,
I am writing to you to cancel my subscription.

Check out this ID book

[kaos_]

Network Intrusion Detection: An Analyst's Handbook
by Stephen Northcutt
ISBN: 0735708681

Excellent book on intrusion detection.

Computer Security by Gov't

[witchking]

Having read Clifford Stoll's book (The Cuckoo's Egg) I believe that government employees suffer a credibility problem when discussing computer security issues. In his book, Stoll describes the arrogance of government staff who would not take him seriously when he detailed the security breaches he had found. Although I haven't read the book being reviewed here, I would also highly recommend Stoll's book to those who are interested in this issue (IMHO).

Re:Intrusion Detection - An Analysts' Approach

[Esjion]

And, you can get the book [bookpool.com] from bookpool.com [bookpool.com] for $26.50 (I agree that it's a useful book, and this is a decent price, so I thought I would share).

Re:VIIDS

[DoomHaven]

I am assuming that you think IDS (intrusion detection systems) are "physical" intrusion detection systems (meaning that they detect someone physically trespassing on the premise) instead of "network" intrusion detection systems (that they detect crackers "trepassing" on the premise's network). So, just to clarify, we are talking about "electronic" intrusions here, okay?

Just to toss out a couple half decent links on intrusion detection systems, for those who are interested:

This is a good link that compares a few commerical network IDSs [data.com]
This is a shitty test suite for network IDSs [infoworld.com]

Damn, I thought I had more. Oh well, enjoy!

Re:Deception ToolKit

[Anonymous Coward]

Pros: Allows you to see what tactics are being used by crackers. One port (forgot the #) is set aside to say "Hey, we're using the Deception Tool Kit; we're watching you, and it isn't worth your time to try and figure out how to break in."

Cons: Actual services can still be cracked. Also, by using the DTK, you might be opening up another security hole; crash DTK and get root, yadda, yadda, yadda,...

The author is well connected

[griffjon]

I met her briefly at RSA2000 (...and got a signed copy, heh.) (should I ebay it?).

Anyway, when I met her, Peter Neumann (yes, /that/ Peter Neumann [sri.com], borrowed my copy to flip through and see the references to him and to check the TOC for topics covered. He seemed pleased... I haven't had time to read the book yet, though I've flipped through and seen various references to SATAN and similar...

Re:Deception ToolKit

[SEWilco]

Crash DTK and get root? Oh, yeah, due to the reserved port numbers. Not if you're remapping the incoming reserved ports to non-reserved ports.

Re:Deception ToolKit

[Jonathan White]

The concept is not new, it's called a honeypot. It allows you to trick the attacker into thinking he found a weakness.

There are many ways to respond after the attacker tries to exploit it. One of the more common is to log whatever info you can get and try to pursue him.

It's main usefulness with script kiddies lies in that the attacker will be off trying to figure out wtf is wrong with his shellcode while you have the FBI kick in his door.

However against more organized attacks from more powerful entities (governments, corporations) it can only serve as an obfuscator and an early warning system.

Re:Computer Security by Gov't

[dingbat_hp]

Stoll ? Isn't that a decade old by now ?

Things change. Net things change insanely fast. Even governments can't be relied upon to stay stupid forever (*). If you read a net book that was in print a month ago, chances are that it's only fot for fish & chip wrappers by now.

* Well, maybe not repeatably stupid in a consistent manner 8-)

Re:Intrusion Detection - An Analysts' Approach

[shilly]

Can't do exactly what you want, but have you looked at Ross Anderson's homepage at
http://www.cl.cam.ac.uk/users/rja14/
He has lots and lots of interesting stuff on security on his site. The lottery paper was great.

Intrusion Detection

[sss12]

If you really want to learn how to secure your network, learn how to break in to one. If you aren't interested enough to learn this highly versatile skill, you are in the wrong industry and your company is allowing the wrong people to make their security decisions for them.

Re:Computer Security by Gov't

[fridgepimp]

Not necessarily,

Read @ Large (forget the authors at the moment) but it details a story (from the mid 90's) very similar to the one presented in Cuckoo's Egg. Same attitude, same lack of security.

Also, take a look at all of the defaced web pages on 2600.com or Hacker News Network...more than 50% are gov't sites, and more than half of those are military installations. While web sites may not qualify as "sensitive", I find that good security professionals tend to secure all machines in their purview, whether or not they really need it.

-FP

Re:whois nsa.gov

[armb]

It is in the google cache [google.com].

Re:whois nsa.gov

[kd7ahv]

Try www.nsa.gov:8080 it worked last time I checked it (two or three weeks ago.)

A good Linux security book.

[Chyeburashka]

My most often referenced book these days:

Title: Maximum Linux Security
Publisher: SAMS Publishing
Author: Anonymous
ISBN: 0-672-31670-6
LOCCCN: 99-61434
First Printing: September 1999
Pages: 743

Micro-Review: Definitely worth buying, reading, and implementing.

PHB's and security...

[jburroug]

Ack. Recently during a department meeting our security guy was explaining to our PHB the steps he has taken to protect our general purpose internet server (web, ftp, email primairly) He told her about how we use ipchains firewall rules to protect the system and started talking about the IDS we recently installed (portsentry by Psionic Software [psionic.com] which is some pretty impressive softare, and it's GPL'd) and how it responds to a portscan, which is to drop the route to the attacker completely by appending the ipchains ruleset. She initially told him to remove portsentry and the firewall rules because she "didn't like the idea of denying anyone access to our resources"
I think a book like this could be very useful in such situations when the person in charge simply doesn't grasp the basic principles of network security (or really networks in general.) And if reading it doesn't help it sounds big and heavey enough to be used as an effective LART. ;->

InfoSec

[348]

I thought the review was right on. I've read the book also and the biggest problem I have is convincing senior management that information security is paramount and should be treated as such. This book helped me a lot in this effort, it brought me from port level scanning conversations and helped me make the communication much more generic in terms that my management understood.

The main InfoSec problem out there today is that the people who control where the IT money is spent, don't always understand the risks associated with ignoring or cutting back on proactive security measures. This book gave me a different way to present. I'd strongly recommend it to both InfoSec folks as well at senior IT management.

Never knock on Death's door:

Re:Check out this ID book

[lw54]

I agree. This is an incredible book that is easy to read and covers the technical side of things as well.

Aye, right on.

[Rodney L Caston]

I've read this book, and the review is dead on in my opinion. It's a nice general overview of the subject matter, and like a college textbook or stereo instruction manual, it reads very dry. I'd suggest it to people with no real knowledge of the world of security as a realistic look on the problems that need to be tackled. However this book is in no ways a way to be taught how to solve said problems.

Re:PHB's and security...

[Kaa]

and how it [portsentry] responds to a portscan, which is to drop the route to the attacker completely by appending the ipchains ruleset.

Not to defend your PHB, but a lot of people consider this to be a misfeature. The problem is with DOS by spoofed attacks. If you don't want host B to talk to host A and A is running portsentry, just spoof attack from B to A.

Nmap, for example, has an option to spoof attack source and warns about the potential side effects on portsentry.

Kaa

Re:Check out this ID book

[Genady]

Not only is it an Interesting read, the autor is also one of the authors of SHADOW, ID Software from the Naval SUrface Warfare Center. Very good coverage of man different ID softwares.

Re:Intrusion Detection - An Analysts' Approach

[D3]

Network Intrusion Detection: An Analyst's Handbook by Stephenn Northcutt is an excellent resource. Go back a couple of months in the book reviews here on /. and you'll find my review of it. It was published in Sept. 1999 so it is about as current as you can get. Also, it describes what functionality an IDS should have so you can decide what system works best for your network. Northcutt is one of the original SHADOW people and now works for SANS.

Intrusion detection software:

[Last Warrior]

If you are considering investing in intrusion detection software, there are a number of drawbacks that you should be aware of before you rely too heavily on these security methods.

1. IDS systems are notorious for dropping packets. Attacks to your network can be missed when the bandwith utilization on your network exceeds a certain percentage. Many IDS systems are only reliable in this fashion up to 10Mb connections.

2. Intrusion detection programs generally will not reorder packets. Any attacks with fragmented packets, out of order packets, and so on will often slip by without being detection. This is also a good way to penetrate a firewall packet filtering rule that does not reorder/reassemble packets.

3. IDS systems tend uto use a string matching algorithm to detect network attacks ( such as a phf or php ) and variances in the attack string can also potentially bypass the IDS without generating an event.

An intrusion detection system is a good tool to top off your networks security policy.. It should not replace human intervention or other security measures including a firewall and proactive network scanning.

LW

Re:PHB's and security... (minor correction)

[Signal 11]

It's not GPL'd... it's free for non-commercial use.

Re:whois nsa.gov

[Barbarian]

I used the whois available here: http://freshmeat.net/appind ex/1999/10/30/941297803.html [freshmeat.net] plus a perl script to take care of the recent rs.internic.net changes (not necessary for this query).

$ whois nsa.gov
National Security Agency (NSA-DOM)
9800 Savage Rd.
Ft. Meade, MD 20755-6000


Domain Name: NSA.GOV
Status: Active

Administrative Contact:
Quinn, Patricia E. (PEQ)
[phone] (FAX)[phone]
[e-mail]


Domain servers in listed order:

TOPSCALE.NSA.GOV 144.51.68.4
ROMULUS.NCSC.MIL 144.51.5.2
NS1.QWEST.NET 216.111.65.217
NS2.QWEST.NET 205.171.16.250

Record last updated on 26-Oct-99.

Please be advised that this whois server only contains information
pertaining to the .GOV domain. For information for other domains please
use the whois server at RS.INTERNIC.NET.

NSA /.'ed?

[Barbarian]

Is it just my connection, or did we /. the NSA web site?

MODERATE ABOVE UP White's "Re:Deception ToolKit"

[griffjon]

very informative post there.

Also, there's a fundamental problem with all of these honeypot systems. Say you're running a web server, no ssl or any weird stuff, and have locked it down to JUST port 80. You get portscanned, maybe a kiddie devotes a few seconds trying the best port-80 hacks.

OTOH, you have a honeypot or port listener running, and you pop up like a glowing beacon in the night as, well, a honeypot worthy of much, much attention.

Of course if your server's already a mound of tantalizing open ports, the loss in making it (look) more attractive are less in comparison with being able to capture kiddies, or at least scare them with lawyers.

Re:NSA /.'ed?

[griffjon]

Didn't you see the top lvl-2+ post? No Such Agency ...exists on the net. Yeah, I think the NSA has been slashdotted.

Hey CmdrTaco, here's a new slashbox or side-menu item, list of famous websites we've slashdotted back to the stoneage.

Re:A good Linux security book.

[Emphyrio]

I won't comment on the quality of the 'maximum linux security' book - but there's one thing to keep in mind: it's off-topic.
Securing a system is making it safe, whereas intrusion detection is something totally different: registring security-breach attempts.

Re:Computer Security by Gov't

[aetius2]

It isn't just computer security that suffers -- read Rogue Warrior by Richard Marcinko. His Red Cell team play-acted as terrorists to evaluate Navy security, and the same attitude was present -- most of the commanders were too worried about looking bad to actually implement real security.

Aetius

Why offend someone with style when you can offend them with substance?

Counterpoint/complement to Northcutt Book

[Anonymous Coward]

Try the following paper:

http://bejtlich.home.texas.net/intv2-1.txt

The author takes a different view on some of Stephen Northcutt's analysis, especially regarding reset scans. (He says they don't really exist.)

Re:Computer Security by Gov't

[Our Man In Redmond]

Well, besides being an interesting read in and of itself, when you read it you'll notice things that sound familiar to you. Dictionary cracking programs, for instance. The only real difference between then and now is that there are new ways to break into a system alongside the old, familiar ones.

I'm willing to bet the government's attitude toward technology hasn't changed much, either. My favorite moment in the book, right up there with using the "Man Who Never Was" technique to expose someone breaking into their system, was the FBI guy who, after being presented with a paper trail of evidence starting with a miniscule accounting error and leading to connections to East Germany, asked incredulously if Stoll expected him to mobilize the FBI because Stoll found a quarter missing.
--

"Maximum Security"

[Simon]

Is that based on an earlier book called "Maximum Security" also published by SAMS and written by anon?

If so, then what are the differences? I've got a copy of "Maximum Security" and it's great.


--
Simon

Actually, some can

[foo12849]

The following URL is a recent test of IDS that can both handle 100-mbps as well as reassemble packets: http://www.nwc.com/1023/1023f19.html [nwc.com].

The cool thing is that the only product that could do both (BlackICE Sentry) is also available as a $40 personal version (BlackICE Defender [networkice.com]) that you can install on your own (Windoze) machine. It includes a personal firewall to boot and is really easy to use. It also has extensive anti-evasion technique to solve problem number 3 that you mention. Go to networkice.com and download a copy of it if you don't believe me.

On-line IDS info

[foo12849]

You should check out the IDS FAQ [robertgraham.com]. It has tones of easy to understand, but technical information. The site [robertgraham.com] has a bunch of other infosec information [robertgraham.com].

Try BlackICE Defender

[foo12849]

I mentioned this in a response to another post, but I thought I'd mention it here. If you want to learn more about intrusion detection and you are running Windoze, you can buy your own industrial strength IDS for you own PC. BlackICE Defender is a full network-based IDS that has been scaled down to fit on your PC, and it comes with a built-in firewall to boot. It has some really cool features, such as:

• Easy to understand help on all the intrusions [networkice.com] it detects. example1 [networkice.com] example2 [networkice.com]
• Extremely high performance. The test here [nwc.com] compares the "Sentry" version against other network-based IDSs. The "Defender" version is higher performance than other personal firewalls, but it does both IDS and firewalling.
• You can buy/download [networkice.com] online and install it immediately without even having to reboot your machine.
• It does some simple scans against the intruders (DNS, NetBIOS) and sometimes finds out who they are.

Small problem with BlackIce...

[Anonymous Coward]

...It has a good rep for detecting and blocking external attempts at access. Unfortunatly, it doesn't block transmission *from* your system to the exterior side.

So while it has it's uses, it's not much good if you have downloaded a trojaned program from Jo Bloggs quick and dirty software archive.

I'm not saying that this makes it useless - just that if you install it, you shouldn't allow yourself to develop a false sense of security.

Re:Counterpoint/complement to Northcutt Book

[Anonymous Coward]

Here's the right HTML link...

http://bejtlich.home.texas.net/intv2-1.t xt [texas.net]

Re:Computer Security by Gov't

[dingbat_hp]

That's the problem with Stoll's approach. He starts with a minute error and insists that it's a consequence of something untoward.

These days we all work on Web Time. If it's not done and dusted by Monday, it will be obsolete by Tuesday. No-one has the time to chase pennies. Even individual fraudsters aren't hunted down - I've met ecomm retailers who simply couldn't chase single frauds and would only go after something that looked like a volume syndicate. For the one-offs, the only thing they had the time and money to cope with was letting the item be shipped and then swallow the back-charge from the cc company. RealShopping outlets have taken a similar line for years - they just accept a certain level of stock wastage.

There's also the volume issue. In Stoll's day a hack attempt was done by a hacker who created the tools himself. Now we're drowned under a barrage of dull script kiddies and bad NT holes. It's a panic out there ! I'd regard a serious probe from a skilled old-school hacker as a welcome and interesting diversion.

Hacker/cracker - we lost that argument. Get over it.

Re:Intrusion Detection - An Analysts' Approach

[n3rd]

Well, if you would, please tell us which OS you're running and we'll see what we can dig up for you. :)