Evading Network-based Intrusion Detection Systems

Architecture and Background

Robert Graham - Evading network-based intrusion detection systems You've just spent $10,000 on network IDS from a trustworthy company (obviously trustworthy because the vendor spends beaucoup $$$ on marketing). You are satisfied with the purchase because you're catching all these script-kiddies who think they are putting one over on you with their "stealth" scans. But then something bad happens: your servers get hacked through your firewall, and that expensive IDS never utters a peep.

Vulnerability Analysis

How did this happen? The root of the problem is that most commercial IDSs are little more than anti-script-kiddy tools and cannot detect ueberhackers. This talk will show how to evade these IDSs using popular tools like whisker and fragrouter.

Exploitation and Demonstrations

It will also reveal for the first time additional secret techniques used by ueberhackers. Graham learned hacking as a toddler from his grandfather, a WW-II codebreaker. His first IDS was written more than 10 years ago designed to catch Morris-worm copycats.

Remediation and Defensive Strategies

He is the author of several pending patents in the IDS field. He is the author of well-regarded security-related documents ( and is a frequent speaker at conferences. IRL, he is the co-founder, CTO, and chief-architect at Network ICE.