IDS and IPS Sensors
Traditionally, network Intrusion Detection Systems,
or Intrusion Prevention Systems protect against incoming malicious traffic.
However, they are often used to filter outgoing traffic.
The main difference between these devices is that an IPS is an active device
sitting in-line of the traffic and can block traffic,
while a traditional IDS is a passive device,
which does not sit inline and is designed to only alert.
However, both devices will perform deep packet inspection.
Large chunks of data are generally fragmented as they traverse
the IP network, because some links have low Maximum Transmission Unit values,
which limits the size of packets that can be transferred over the network medium.
This process is called IP fragmentation.
Because of this fragmentation, IDS and IPS devices will first need to reassemble
packets to reconstruct the data.
The devices will then examine the content of the traffic beyond IP addresses and
port numbers, and inspect application layer data
in search of identifiable patterns defined by signatures.
These signatures are often created by malware analysts using methods similar
to antivirus signature creation and must be very specifically tuned for accuracy.
This tuning process can work to our advantage, allowing us to evade detection
by making very small changes to an otherwise suspicious traffic pattern.
Since IPS and IDS sensors usually match a very unique pattern,
the simplest way to bypass signature detection
is to simply change our tool’s traffic pattern.
Most major frameworks, like Meterpreter, Empire, and Covenant
allow varying degrees of custom configuration options.
We can manipulate these options in various ways to bypass IDS/IPS signatures.
In the next section, we’ll demonstrate this as we bypass the Norton 360
host-based IPS system.