For the past 15 years, the subject of Intrusion Prevention Systems (IPS) has been present in the heads of those who work in applied computer security. However, just like Intrusion Detection Systems (IDS) they’ve been a bit neglected as of late. The subject seemed too complex and too difficult to handle.

The subjects rose back to popularity with their simplification and professionalization. There are numerous approaches to the subjects by just as many vendors. Traditionally, an IDS/IPS is used as a sensor in a network.

HP TippingPoint is one of those HIDS/HIPS-Systems (it’s even being advertised as a NGIPS – a Next Generation Intrusion Prevention System). The commercially available product comes with 7000 Protection Filters that use a traditional pattern recognition to detect attack attempts. Users can bundle those filters together into profiles, tie them to certain interfaces (for example, they can be used to monitor inbound traffic only) and apply actions to these profiles (such as permit, block, notify, trace).

This article will focus on the Protection Filters that TippingPoint provides. HP’s approach and the program’s structure is being looked at dissected.

Naming

The title of a filter is following the simple structure of ID: Name. The typical filters to detect classic anomalies in ICMP are named:

• 0079: ICMP: Echo Reply
• 0081: ICMP: Unassigned Type (Type 1)
• 0082: ICMP: Unassigned Type (Type 2)
• 0083: ICMP: Fragmented packet

The ID is four characters long and is being incremented with every newly introduced filter. Numbers lower than 1000 will be prefixed with zeroes. There are over 7000 filters, but there are holes in the IDs. This is most likely due to there being filters that were never released or retracted. There are filters with IDs higher than 10000. This has had no impact on the zero-prefixing-convention.

If a vulnerability is published via ZDI (Zero Day Initiative), the corresponding ID will be added in parentheses. Other sources, such as OSVDB or CVE are unfortunately not included. Similarly, there is no database publicly accessible database of the filters that could facilitate linking filters to other sources. Therefore the association of filters with specific vulnerabilities is very difficult at this point. A similar problem can be observed with Qualys. That is just one of the reasons why open databases should be prioritized.

Categories

The filters are assigned to categories. The following table will explain those categories:

The categorization is sometimes not easy to understand. For example: 0079: ICMP: Echo Reply is filed under Security Policy even though it would fit better into Reconnaissance. Some DDoS-Tools and worms would probably be a better fit in Virus than in Exploits.

Like other products, there’s a market-driven mixing between Intrusion Prevention and Malware Detection. This is obvious when looking at the category Virus. Even though it can be an advantage to have an IPS recognize malware early on, this solution does not – at least not as of writing this – replace a real anti-virus solution. The list of viruses the IPS detects is too limited and too short. In addition to that, the IPS is focussed on the spread of the virus and not on the subsequent actions.

Default Profile

HP propagates a so-called Default Profile. This is their recommended profile, that should be used to prove basic protection in most environments without having any negative impact on operations. This means that 32.6% of all filters are being activated. The remaining 67.4% remain inactive because they could be too aggressive.

Also, among other things, filters that are considered simple that produce very few false positives are deactivated. Among them are (short list of highlights):

• 0682: FTP: LIST command Overflow
• 1027: SMTP: expand root
• 1048: SMTP: helo Buffer Overflow Vulnerability
• 1224: SNMP: Community Name Brute Force Attempt
• 1225: SNMP: PROTOS Scan (Version Too Long)
• 1229: SMB: Out-of-Band TCP Data (Winnuke Exploit)
• 10767: HTTP: Acunetix Security Scanner
• 12961: DNS: Large UDP Packet DDoS

A lot of vulnerabilities that are specific to an application or a product are also ignored. Among those are (again, just a short list of highlights):

• 1605-1619: HTTP: IIS WebDAV Buffer Overflows
• 2065-2079: IMAP: Command Overflows
• 12198-12202, 12224-12227: SMB: Samba Heap Overflows

Those are not listed in the table above due to their high number and diversity. It is to be assumed that the filters have produced an above-average number of false positives in this context and have thus been disabled. Or they used too much of the resources. It is thus the job of the user to enable them.

This shows that users shouldn’t trust HP’s recommendations blindly. In a secure environment, there’s also the specifics of the company that need to be considered. New filters have to be reviewed, tested and then deployed securely.

Summary

HP TippingPoint is an interesting system that leaves a good impression when it comes to certain levels. From a performance and security standpoint, it certainly is worth checking out. The filters that are included with the software can help to set up a security baseline in a company quickly and efficiently.

Still, our tests have shown that some standard settings have been negligently ignored and thus, they even enable attackers by introducing new ways for them to attack. Classic attack vectors are becoming interesting again. And if an attacker knows which configuration of a system awaits him, he will be able to launch a lot of successful attacks completely undetected.

The closed nature of the system makes it nigh impossible to determine further details about the behaviour of the filters and to optimize them where needed. That’s the big disadvantage that can only be tackled by open – in the ideal case even the source code is open – systems. This is a way of thinking that shouldn’t just be applied to IDS/IPS.

About the Author

Marc Ruef has been working in information security since the late 1990s. He is well-known for his many publications and books. The last one called The Art of Penetration Testing is discussing security testing in detail. He is a lecturer at several faculties, like ETH, HWZ, HSLU and IKF. (ORCID 0000-0002-1328-6357)

Links

• http://www8.hp.com/us/en/software-solutions/software.html?compURI=1343617#.UqghAPTuIYk