Cisco Cisco IPS 4255 Sensor Libro bianco

White Paper

Page 2 of 6

Figure 1. The Evolution of Intent: From Hobbyists to Professionals

Exploit-Focused Detection: The First Generation

Vulnerability: A weakness or flaw in a computer application, operating system, or protocol that

can be exploited to cause the application to operate in a manner unintended by its designers. A

single vulnerability can be targeted by hundreds or thousands of different exploits.

Exploit: An attack program used by malicious hackers to exploit a vulnerability, usually for the

purpose of running arbitrary code on a target system. Exploits comprise a large range of potential

attacks, from HTTP commands designed to extract data from or imbed malware on Web servers,

to buffer overflow attacks that can cause target systems to run arbitrary software.

IDS solutions were initially designed to look for suspicious behavior such as scanning activity,

multiple login attempts, and anomalous traffic behavior. This approach still works well when there

is a highly skilled operator with the time, knowledge, and tools to analyze the data and discover

patterns of potential abuse.

However, hacking tactics have shifted toward more active exploitation of application vulnerabilities

for the purpose of compromising hosts. To meet this challenge, IDS solutions added a new

defense: exploit-focused signatures. Exploit-focused signatures are static (unchanging) pattern

matching signatures that identify well-known exploit code as they cross the wire.

IPS operators use these capabilities to stop well-known attacks and old, fast-moving worms such

as Slammer, a simple, 404-byte UDP packet or Nachi, a simple ICMP Echo Request worm

consisting of a few dozen bytes of repeated data in an ICMP packet. In fact, one of the reasons

that there have been so few outbreaks in the last few years

is that the exploit-focused approach

has been effective in stopping unsophisticated worm attacks. However, as the nature of attacks

has shifted from fame to profit, the attacks become more sophisticated and the limitations with an

exploit-focused approach became increasingly apparent.

IronPort: 2008 Internet Security Trends