Introduction

Intrusion Detection Systems (IDS) play a crucial role in securing modern networks. They are designed to detect and alert on malicious activities, and provide network administrators with the necessary information to respond to potential threats. However, despite their importance, IDS systems can be bypassed by attackers who use specific techniques to evade them. In this article, we will delve deeper into some of the most common techniques used to evade basic IDS systems.

Fragmentation and Small Packets

One of the simplest techniques that attackers use to evade IDS is to split the attack payload into multiple small packets. By doing this, the IDS has a difficult time reassembling the packet stream and detecting the attack. The attacker can use fragmentation to split the packets or simply craft packets with small payloads. This technique is known as “session splicing.”

While small packets alone may not evade the IDS, they can be modified in a way that complicates reassembly and detection. Attackers can pause between sending parts of the attack, hoping that the IDS will time out before the target computer does. They can also send the packets out of order, making it even more difficult for the IDS to reassemble the packet stream correctly.

Overlapping Fragments and TCP Segments

Another technique used by attackers to evade IDS is to craft a series of packets with overlapping TCP sequence numbers. For instance, the first packet may contain 80 bytes of payload, while the second packet’s sequence number starts 76 bytes after the start of the first packet. When the target computer reassembles the TCP stream, it must determine how to handle the overlapping bytes. Some operating systems will choose the older data, while others will choose the newer data.

If the IDS doesn’t reassemble the TCP stream in the same way as the target, it can be manipulated into either missing a portion of the attack payload or seeing benign data inserted into the malicious payload, breaking the attack signature. This technique can also be applied to IP fragmentation in a similar manner.

Encryption and Obfuscation

Another technique used to evade IDS is encryption and obfuscation. By encrypting the attack payload, the IDS is unable to inspect the contents of the packets and detect the attack. Attackers can also use obfuscation to hide the attack payload within benign traffic, making it difficult for the IDS to distinguish between the two.

Protocol Anomalies

Attackers can also evade IDS by exploiting protocol anomalies. This involves sending packets that violate protocol specifications in a way that the end host can still interpret the packets correctly, but the IDS either interprets the packets incorrectly or determines that the traffic is benign too quickly. For example, attackers can use malformed packets to exploit buffer overflow vulnerabilities in the target host or to bypass firewalls.

Conclusion

In conclusion, the security of a network is a constant arms race between attackers and defenders. Despite their importance, IDS systems can be bypassed by attackers using techniques such as fragmentation, small packets, overlapping fragments, encryption and obfuscation, and protocol anomalies. Network administrators must stay informed of the latest threats, regularly monitor their systems, and keep their security tools and processes up-to-date to ensure the security of their network. Regular software and firmware updates, along with regular penetration testing and vulnerability assessments, can help identify and address any potential vulnerabilities in the IDS system.