Controlling Intrusion Detection Systems by Generating False Positives: Squealing Proof-of-Concept

We introduce a new class of attack against a network signature-based Intrusion Detection System (IDS) which we have tested using SNORT and we call “Squealing”. This vulnerability has significant implications since it can be generalized to any IDS. While signature-based IDSs have implementation problems with high false positive rates that require tuning, we show a more serious general vulnerability in that packets can be crafted to match attack signatures such that alarms can be selectively triggered allowing a target IDS to be externally controlled by a malicious attacker.