Here is some food for thought--- what if the "Management Network" were
running a different protocol? Defense by Diversity?

-----Original Message-----
From: Michael Lea [mailto:mleaATOMICBLUEBEAR.ORG]
Sent: Tuesday, January 09, 2001 3:43 PM
To: FOCUS-IDSSECURITYFOCUS.COM
Subject: Two-headed NIDS - security risk?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

One common suggestion I've seen for implementing NIDS is to have two
interfaces in the box. One interface is unaddressed, and is used to
monitor the target network. The other interface has an address and is
connected to a network that is isolated from the target. This second
interface is used for management, alerting, and whatever else you might
want the box to do.

For the especially paranoid, people have recommended snipping the TX wires
on the unaddressed interface or using some sort of tap to enforce a
listen-only behaviour.

The theory behind this, as I understand it, is that since the NIDS does
not have an addressable interface on the monitored (and "untrusted")
network, it is not subject to attacks. However, as NIDS is becoming more
complex with protocol decoding and the like, isn't it possible (even
likely) that an attacker could craft an attack that would cause the NIDS
to execute arbitrary code and be used as a launching point for an attack
into the "trusted" world.

You can take the recent (i.e. November) protocol decode bugs in Ethereal
and tcpdump as an example of this in action.

Have those of you with two-headed NIDS considered this? Is it a serious
concern, or am I being overly paranoid? Is there a solution?

- - Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (FreeBSD)
Comment: Made with pgp4pine 1.75-6

iEYEARECAAYFAjpbd/sACgkQc9EFi4qQZEyZRgCfSHaV2iCstKkJ/5wdvwAlu/Cp
7BYAoNswHnZj4WIVBzGmK7t4cLGaD1YG
=6Dfj
-----END PGP SIGNATURE-----

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]