Upload File

evading(deep(inspection(for fun(and(shell(...• introduceon)to)evasions) • previous)research) •...

  • Home
  • Documents
  • EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda
57

Upload: others

Post on 11-May-2020

2 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

EVADING  DEEP  INSPECTION  FOR  FUN  AND  SHELL  

Page 2: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

Who  we  are  

•  Olli-­‐Pekka  Niemi  –  Chief  Research  Officer,  Stoneso9  

•  An;  Levomäki  –  Senior  Vulnerability  Analyst,  Stoneso9  

Page 3: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  IntroducEon  to  evasions  •  Previous  research  •  Evasions  explained  •  Evasion  tesEng  methodology    •  Results    

Agenda  

Page 4: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Network  intrusion  prevenEon  systems  (IPS)    – middleboxes  used  to  protect  hosts  and  services  – analyze  network  traffic  and  aNempt  to  alert  and  terminate  connecEons  that  are  deemed  harmful.  

•  Next  GeneraEon  Firewalls  (NGFW)  – Firewalls  with  built  in  IPS  funcEonaliEes  

•  We  treat  NGFW  as  IPS  in  this  presentaEon  

IPS,  NGFW,  what?  

Page 5: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Intrusion  PrevenEon  Systems  should    protect  vulnerable  hosts  from  remote  exploits  

•  Exploits  can  apply  mulEple  evasion  methods  to  bypass  the  detecEon  capabiliEes  of  the  IPS  and  break  into  the  remote  protected  host  

Page 6: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

What?  

Page 7: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Successful  traffic  analysis  requires  that  the  IPS  device  interprets  traffic  in  the  same  way  as  the  host  it  is  protecEng  – TCP/IP  protocols  and  applicaEon  protocols  on  top  of  TCP/IP  are  rich  in  features.  

–  there  is  a  large  gap  between  how  protocols  should  be  used  and  how  they  can  be  used  

Should  vs  Must  

Page 8: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  The  reason  that  evasions  work  is  the  old  robustness  principle  stated  by  Jon  Postel  in  RFC793      

   “be  conservaEve  in  what  you  do,          be  liberal  in  what  you  accept  from    

             others”.    

Why  

Page 9: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  We  call  deliberately  sending  traffic  in  a  way  that  is  difficult  to  analyze  by  a  middlebox  an  evasion  technique    

Page 10: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Aren’t  evasions  just  some  protocol  anomalies  or  malicious  packets…  •    …that  can  be  dropped  by  the  IPS?  

Page 11: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  No.  Some  evasions  can  be  classified  as  an  aNack,  but  most  evasions  are  simply  alternaEve  ways  of  encoding  data.  

Page 12: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Evasion  is  evasion  only  when  applied  with  aNack.  Blocking  connecEons  based  on  a  potenEal  evasion  without  normalizing  cause  false  posiEves  

Page 13: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Most  of  IPS  devices  are  throughput  oriented  by  design.  Evasions  work  because  

–  the  IPS  devices  are  lacking  proper  understanding  and  analysis  of  the  protocol.  

– TCP/IP  reassembly  implementaEon  shortcuts  to  favor  packet  throughput  

– design  flaws  or  missing  features  

Page 14: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Have  evasions  been  researched  before?  – Yes.    A  lot.  

Page 15: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Ptacek,  Newsham:  “InserEon,  Evasion,  and  Denial  of  Service:  Eluding  Network  Intrusion  DetecEon”,  1998.  

•  Raffael  Marty,  Thor  –  A  tool  to  test  intrusion  detecEon  systems  by  variaEon  of  aNacks,  2002  

•  A.  Samuel  Gorton  and  Terrence  G.  Champion,  Combining  Evasion  Techniques  to  Avoid  Network  Intrusion  DetecEon  Systems,  2004  

•  Giovanni  Vigna  William  Robertson  Davide  Balzaro;  :  TesEng  Network-­‐based  Intrusion  DetecEon  Signatures  Using  Mutant  Exploits,  2004    

•  Shai  Rubin,  Somesh  Jha,  and  Barton  P.  Miller:  AutomaEc  GeneraEon  and  Analysis  of  NIDS  ANacks,  2004      

•  Varghese,  et  al.,  DetecEng  Evasion  ANacks  at  High  Speeds  without  Reassembly,  Sigcomm,  2006.  

Academic  Research  

Page 16: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Horizon,  DefeaEng  Sniffers  and  Intrusion  DetecEon  Systems,  Phrack  Magazine    Issue  54,  1998,  arEcle  10  of  12.  

•  Rain  Forest  Puppy:  A  look  at  whisker's  anE-­‐IDS  tacEcs,1999  

•  NIDS  Evasion  Method  named  "SeolMa",  Phrack  57,  Phile  0x03,  2001  

•  Daniel  J.  Roelker  ,  HTTP  IDS  Evasions  Revisited,  2003  •  Brian  Caswell,  H  D  Moore,  ThermopEc  Camouflage:Total  IDS  Evasion,  BlackHat,  2006      

•  Renaud  Bidou:  IPS  Shortcomings,  BlackHat  2006  

Hacker  Research  

Page 17: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Fragroute(r)  by  Dug  Song  ~1999  •  Robert  Graham:  SideStep,  2000  •  Rain  Forest  Puppy:  Whisker,  libwhisker  •  Raffael  Marty:  Thor,  2002  •  Metasploit  Framework  •  Immunity  Canvas  •  Core  Impact  •  Breaking  Point  •  Libnet  •  Scapy  •  Tcpreplay    •  Karalon  

Tools  

Page 18: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  So  Why  do  evasions  sEll  work?  

Page 19: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Evasion  detecEon  and  normalizaEon  is  difficult  •  Reduce  throughput    •  Anomaly  based  evasion  prevenEon  false  posiEves  •  Throughput-­‐wise  effecEve  packet  based  paNern  matching  miss  aNacks  deploying  evasions  

•  Proper  TCP/IP  reassembly  requires  a  lot  of  memory  

Page 20: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  IPS  does  not  know  whether  a  packet  seen    reaches  the  desEnaEon  –  Packet  loss  may  have  occurred  –  Packet  will  be  discarded  by  the  desEnaEon  

The  Problem  of  Stream  Reassembly  

Packet  loss?  

ANacker  

Page 21: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  The  IPS  knows  that  a  packet  reached  the  desEnaEon  when  it  receives  acknowledgement  from  the  desEnaEon    

The  Problem  of  Stream  Reassembly  

ANacker  ACK  

Page 22: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  The  aNacker  may  cra9  a  packet  that  will  be  dropped  by  the  desEnaEon,  while  the  IPS  is  fooled  to  classify  this  as  normal  (packet  loss)  

•  The  aNacker  will  then  send  the  malicious  packet  that  the  IPS  will  pass  along  as  a  retransmission    –  There  are  mulEple  ways  of  doing  this:  

•  TTL/IP  opEons/TCP  opEons/checksums  

The  Problem  of  Stream  Reassembly  

ANacker  

Page 23: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  At  the  point  of  triggering  the  vulnerability,  cra9  a  packet  that  is  not  malicious  looking  and  will  not  exploit  the  target  

•  The    packet  will  be  dropped  by  the  target  •  IPS  does  not  know  that  •  Send  the  packet  that  will  compromise  the  target.    •  IPS  treat  this  packet  as  a  resend  due  to  packet  loss  and  passes  the  packet  

•  Enjoy  shell  (IPS  does  not  log  anything)  

ALack  Strategy  

Page 24: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  IPS  must  keep  every  unacked  packet  in  memory  to  avoid  being  evaded  –  It  seems  that  most  do  not,  or  at  least  the  implementaEon  is  faulty  

Proper  MiNgaNon  

Page 25: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

EVASIONS  EXPLAINED  

Page 26: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Payload  can  be  split  into  segments  of  arbitrary  size    

•  Segments  can  be  sent  in  any  order  •  Too  many  small  TCP  segments  might  lead  into  anomaly  based  connecEon  terminaEon.  Apply  segmentaEon  only  when  actually  triggering  the  vulnerability  and/or  to  the  shellcode  – Most  boxes  are  sEll  vulnerable  to  this  

TCP  SegmentaNon  and  Reordering  

Page 27: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  The  PAWS  (ProtecEon  Against  Wrapped  Sequence  numbers)  algorithm  is  defined  in  RFC1323  –  uses  TCP  Emestamps  to  drop  segments  that  contain  Emestamps  older  than  the  last  successfully  received  segment.    

•  Its  use  as  an  evasion  was  described  already  by  Ptacek  and  Newsham  in  1998    –  SEll  works  against  most  of  today´s  IPS  devices      

PAWS    

Page 28: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  PAWS  causes  problems  for  TCP  reassembly  when  the  IPS  does  not  know  which  segments  the  end  hosts  accept  or  discard.  

•  TCP  segments  designated  for  PAWS  eliminaEon  can  be  created  by  duplicaEng  a  valid  TCP  header  and  moving  its  Emestamp  value  backwards.  The  actual  payload  can  be  arbitrary,  e.g.,  a  non-­‐malicious  version  of  a  protocol  message.  

PAWS    

Page 29: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Retransmit  SYN  with  first  segment  containing  payload  

•  Most  IPS  devices  have  problems  with  the  unexpected  combinaEon  of  a  retransmiNed  SYN  flag  and  new  payload  in  an  established  connecEon  –  IPS  devices  are  fooled  by  the  duplicated  SYN  and  pass  connecEon  uninspected  

SYN  Retransmit  

Page 30: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda
Page 31: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  IPv4  packet  headers  can  contain  opEons.  If  any  of  the  opEons  are  invalid,  the  whole  IPv4  packet  should  be  discarded  by  the  receiving  host.  This  can  cause  problems  if  the  inspecEng  device  and  the  end  host  discard  different  packets.  

IPv4  OpNons  

Page 32: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Urgent  pointer  marks  TCP  payload  as  urgent  •  TCP  socket    handle  urgent  data  as  either  inline  or  out-­‐of-­‐

band.  –   Out-­‐of-­‐band  data  is  not  returned  via  normal  recv()  calls  and  gets  discarded  by  applicaEons  that  do  not  use  urgent  data.  Most  operaEng  systems  default  to  out-­‐of-­‐band  urgent  data    

•  The  use  of  TCP  urgent  data  as  an  evasion  was  documented  in  Phrack  Magazine  2001.    

•  ProblemaEc  for  IPS  devices  because  the  choice  between  handling  data  as  inline  or  out-­‐of-­‐bound  is  applicaEon  specific.  

•  Urgent  pointer  evasion  is  sEll  efficient  against  many  IPS  

Urgent  

Page 33: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  TCP  receive  window  is  the  amount  of  new  data  that  the  sending  side  is  willing  to  receive.  An  aNacker  can  adverEse  a  small  window  size  to  force  the  other  end  of  the  TCP  connecEon  into  sending  small  segments.    

•  This  complements  sending  small  TCP  segments  by  allowing  the  aNacker  to  control  TCP  segment  sizes  in  both  direcEons.      

TCP  Receive  Window  

Page 34: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda
Page 35: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  A  tool  to  test  (NG)?(I[DP]S|FW)  protocol  analysis  and  reassembly  capabiliEes  by  applying  evasions  to  aNacks  

•  Does  not  simulate,  does  real  aNacks  against  real  targets  

•  Simple  Test  Scenario:  #shell  does  not  lie  – Send  aNack,  if  we  got  the  shell  back,  evasion  was  successful  and  DUT  failed  

What  is  Evader  

Page 36: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Built  on  a  proprietary  TCP/IP  stack.  •  Has  applicaEon  clients  &  servers  for  higher  layer  protocols  

Ø Complete  control  over  every  packet  sent.  

Page 37: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Exploits  are  divided  into  stages  –  Each  stage  corresponds  to  a  step  in  the  applicaEon  protocol  

•  Evasions  can  be  targeted  to  all  or  just  a  range  of  stages  

Ø TargeEng  to  specific  stages  criEcal  to  IPS  detecEon  makes  anomaly  based  blocking  more  difficult    

Page 38: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

MSRPC  exploit  stages  

Page 39: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  All  exploits  containing  shellcode  can  be  run  ’obfuscated’  – Generates  a  different  shellcode  encoder  and  possible  NOP  sled  for  each  execuEon.  

– Makes  exploit  based  detecEon  harder.  

•  Normal  versions  aNempt  to  look  like  commonly  found  public  exploits.  

Page 40: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Evader  contains  known  exploits  that  every  IPS  should  detect  •  CVE-­‐2008-­‐4250,  MSRPC  Server  Service  Vulnerability  [13].  

–  A  buffer  overflow  vulnerability  in  Microso9  Windows  allowing  arbitrary  code  execuEon.  Widely  exploited  by  the  Conficker  worm.    

–  Evader  targets  a  Windows  XP  SP2  host.  –  Protocols  used:  IP,  TCP,  NetBIOS,  SMB,  MSRPC.  

•  CVE-­‐2004-­‐1315,  HTTP  phpBB  highlight  –  Input  sanitaEon  vulnerability  in  phpBB  allowing  arbitrary  PHP  execuEon.  

Exploited  by  the  Santy.A  worm  in  2004.  –  Protocols  used:  IP,  TCP,  HTTP  

•  CVE-­‐2012-­‐0002,  Windows  RDP  Denial  of  Service  [14].  –  Vulnerability  in  the  Remote  Desktop  Protocol  implementaEon  in  Microso9  

Windows.    –  Exploit  in  Evader  crashes  unpatched  Windows  7  hosts.  –  Protocols  used:  IP,  TCP,  RDP    

Page 41: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  In  theory,  for  the  selected  exploit,  the  Evader  could  produce  every  possible  data  stream  transmi;ng  the  payload,  but  in  pracEce  this  cannot  be  tested  since  there  are  virtually  endless  amount  of  combinaEons  and  stage  permutaEons.    

Page 42: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  When  evasions  are  not  used,  IPS/NGFW  devices  detect  and  terminate  the  aNack  

•  With  proper  evasions    applied,  IPS/NGFW  start  to  Fail  – Does  not  detect  anything  – Detect  something  that  cannot  be  terminated  due  to  risk  for  false  posiEve  

– Detect  aNack,  claims  to  terminate  but  fails  terminaEon  

Page 43: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Evader  can  be  automated  with  another  tool  called  Mongbat  

•  Mongbat  runs  evader  with  different  evasion  combinaEons  and  collects  results  – Successful  exploits  are  reported  along  with  a  command  line  for  easy  repeatability.  

– Takes  packet  captures  – Basically  Mongbat+Evader=Evader  Fuzzer  

Page 44: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

Mongbat  Single  Run  

Page 45: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Mongbat  randomly  selects  a  number  of  evasions  and  their  parameters  for  each  Evader  execuEon.  – No  special  care  is  taken  to  produce  only  legiEmate  traffic  •  The  vicEm  computer  is  used  to  validate  working  combinaEons  

 

Page 46: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  Here  we  present  the  results  of  running  Mongbat  against  9  vendors’  commercial  IPS  devices.  The  vendors  include  most  Gartner  2012  IPS  and  2013  NGFW  Magic  Quadrant  leaders  and  challengers.    

•  The  devices  have  up-­‐to-­‐date  so9ware  and  updates  installed.  We  have  aNempted  to  configure  the  devices  for  maximum  detecEon  and  blocking  while  sEll  allowing  the  Evader  clean  check  to  succeed.  

Page 47: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  We  have  defined  12  evasion  test  cases.  The  tests  are  run  with  Mongbat  so  that  only  the  listed  evasions  are  used.  

•   If  working  evasion  is  not  found  in  one  minute  the  test  case  is  marked  as  failed,  otherwise  as  success.      

Page 48: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

#   Atomic  Evasions  

0   Baseline  aNack  without  evasions  

1   Paws  EliminaEon  Evasion  

2   SYN  Retransmit  Evasion  

3   IPv4  OpEons  

4   TCP  Urgent  Data  

5   TCP  Receive  Window  

6   TCP  SegmentaEon  and  Reordering  (TSR)  

Evasion  test  cases  

Page 49: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

#   Evasion  CombinaNons  

7   TCP  Paws  +  TSR  

8   SYN  Retransmit  +  TSR  

9   IPv4  OpEons  +  TSR  

10   Urgent  Data  +  TSR  

11   TCP  Receive  Window  +  TSR  

12   All  Listed  Evasions  

Evasion  test  cases  

Page 50: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

Vendor 0 1 2 3 4 5 6 7 8 9 10 11 12

Vendor1                          

Vendor2     x   x   x x   x x x x

Vendor3     x               x   x

Vendor4   x   x     x x   x x x x

Vendor5   x x x       x   x     x

Vendor6           x x x   x   x x

Vendor7   x x x x x x x   x x x x

Vendor8   x x   x x x x   x x x x

Vendor9               x     x   x

Results  for  MSRPC  without  stages  

Page 51: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

Vendor   0   1   2   3   4   5   6   7   8   9   10   11   12  

Vendor1                                                      

Vendor2           x       x       x   x   x   x   x   x   x  

Vendor3           x                   x   x       x       x  

Vendor4       x       x           x   x   x   x   x   x   x  

Vendor5       x   x   x               x   x   x           x  

Vendor6                       x   x   x   x   x   x   x   x  

Vendor7       x   x   x   x   x   x   x   x   x   x       x  

Vendor8       x   x       x   x   x   x   x   x   x   x   x  

Vendor9                               x   x       x       x  

Results  for  MSRPC  with  stages  

Page 52: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  All  vendors  are  able  to  stop  the  MSRPC  exploit  with  no  evasion  applied.  TCP  segmentaEon  and  reordering  by  itself  seem  to  go  through  most  vendors  IPS  devices.  When  this  is  combined  with  segments  desEned  for  PAWS  eliminaEon  and  applied  to  stages  almost  all  vendors’  inspecEon  can  be  bypassed.  

Page 53: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  The  MSRPC  exploit  requires  mulEple  SMB  requests  and  responses  before  the  vulnerability  can  be  exploited.  This  allows  IPS  devices  to  perform  protocol  validaEon  and  possibly  terminate  evasion  aNempts  during  the  session  setup  phase.  Evasions  using  just  a  small  TCP  receive  window  probably  cause  some  devices  to  lose  protocol  state  due  to  a  failure  in  parsing  server  responses.  

Page 54: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

Vendor   0   1   2   3   4   5   6   7   8   9   10   11   12  

Vendor1                                                      

Vendor2       x   x   x   x   x   x   x       x   x   x   x  

Vendor3   x   x       x   x   x   x   x       x   x   x   x  

Vendor4       x   x   x   x   x   x   x       x   x   x   x  

Vendor5   x   x   x   x   x   x   x   x       x   x   x   x  

Vendor6   x   x   x   x   x   x   x   x       x   x   x   x  

Vendor7           x       x                       x       x  

Vendor8   x   x   x   x   x   x   x   x       x   x   x   x  

Vendor9       x   x               x   x           x   x   x  

Results  for  HTTP  

Page 55: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

•  All  vendors  were  not  able  to  block  the  obfuscated  HTTP  exploit  without  evasions.  The  complete  set  of  test  cases  was  sEll  run  to  see  if  the  devices  block  some  evasions  as  anomalies.  TCP  segmentaEon  and  reordering  was  again  successful  also  over  HTTP,  especially  when  combined  with  TCP  segments  containing  urgent  data.  

•  In  cases  when  no  exploit  succeeded  Mongbat  executed  around  500-­‐2000  aNempts  in  the  60  second  test  period.  Most  successful  evasion  combinaEons  were  found  in  1-­‐10  aNempts.  

Page 56: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

 

     DEMO  

Page 57: EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL(...• IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

Thank  You!    

•  QuesEons  &  Comments  –  Olli-­‐[email protected]  –  An;[email protected]  

•  Evader  tool  free  download  –  hNp://evader.stoneso9.com  


Evading Classifiers by Morphing in the Dark

null Pune meet - Evading Firewalls: Tunneling

Evading Face Recognition via Partial Tampering of Facesopenaccess.thecvf.com/content_CVPRW_2019/papers/CV... · Evading Face Recognition via Partial Tampering of Faces Puspita Majumdar,

Evading Voltage-Based Intrusion Detection on Automotive CAN

Your State is Not Mine: A Closer Look at Evading Stateful Internet ... · Client SEQ num Payload Data ... • Discovered new behaviors of the GFW • Our new evasion strategies achieve

“Evading scrutiny: Orders for papers and access to … papers/Evading scrutiny Order… · 1 “Evading scrutiny: Orders for papers and access to cabinet information by the NSW

Tax evasion and con dence in institutions: Expectations modelsTax evasion occurs when the utility of evading is greater than the utility of not evading. In the model of Sour (2004),

Evading Defenses to Transferable Adversarial …openaccess.thecvf.com/content_CVPR_2019/papers/Dong...Evading Defenses to Transferable Adversarial Examples by Translation-Invariant

Strategies to prevent evading from Rubber planting

OLLI-PEKKA NIEMI & ANTTI LEVOMÄKI Bypassing Intrusion ...€¦ · Mostly application layer evasions ! Uses host OS TCP/IP stack thus lacking evasions that require customized tcp/ip

"Evading Frames: D'Antin van Rooten's Homophonic Mother Goose"

J. Habetzreder: Evading Greek Models

Evading the Replication Fork Collapse Point

Evading censorship using browser-based proxies

Evading the Issue

esthéticienne - Instant Evasions

DAMART - Evasions d'été - Mai 2013

EVADING(DEEP(INSPECTION(FOR FUN(AND(SHELL( · • IntroducEon)to)evasions) • Previous)research) • Evasions)explained) • Evasion)tesEng)methodology)) • Results)) Agenda

Unstyle: A Tool for Evading Authorship Attribution

TOM HAMMICK : Evading Distopia - Campden Gallery · TOM HAMMICK : Evading Distopia. TOM HAMMICK Evading Distopia ... 2012 Daiwa Foundation Art Prize ... catalogue A Case for Art,

Evasions, Approvals and Facilitations OH MY

SILC - Séjours "Evasions" - Eté 2009

Evading the Transparency Tragedy: The Legal Enforcement of

Automatically Evading Classifiers - NDSS Symposium · Based on Genetic Programming Automated Evasion Approach /Catalog /Pages 0 /JavaScript eval(‘…’); Modified /Root Parser

Network ID Systems Evading/Attacking NIDS Architecture, …jeffay/courses/nidsS05/slides/18-Evading-NIDS.pdf · Network Intrusion Detection Systems ... – Evasion using Polymorphic

SILC - Séjours "Evasions" - Eté 2010

Experimental study on the evading behaviour of single

Exili i evasions al Principat d'Andorra durant la …diposit.ub.edu/dspace/bitstream/2445/66337/1/TFG Esteves...1 Exili i evasions al Principat d'Andorra durant la Guerra Civil Espanyola

Evasions in Interactions: Examples from the Transcultural ... · Evasions in Interactions: Examples from the Transcultural Nursing Research Field Abstract Transcultural qualitative

Ockham’s Razor without Circles, Evasions, or Magic

From Eloquence to Evading Responsibility

RHMD: Evasion-Resilient Hardware Malware Detectorsnael/pubs/micro17-rhmd.pdf(2) Having a model of the detector, can malware developers mod-ify malware to avoid detection? Evading the

CEHv7 Module 16 Evading IDS, Firewalls, And Honeypots

Two-mode back-action-evading measurements in cavity ...clerk/PDFfiles/PRA2013a.pdf · In this paper, we now extend the above idea of two-mode back-action evasion to quantum optomechanics,

NTXISSACSC4 - The Art of Evading Anti-Virus