Re: Important Comments re: INtrusion Detection

[Aleph One <aleph1 () dfw dfw net>]

On Sat, 14 Feb 1998, Steve Bellovin wrote:

> The most serious problem, of course, is that there is no a priori reason
> to think that the IDS's stack is bug-free.  And if you penetrate it, you've
> acquired control of a machine that is by definition a perfect sniffer --
> for the dark side...

But this is the case of non-proxy IDS's (or any other network program
[e.g. firewalls]) right now as well. The new architecture does not change
this.

Aleph One / aleph1 () dfw net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61  8C 39 EA 47 A8 6A B8 01