Microsoft pptp vpn vulnerabilities Exploits in Action

2.1.5 Monitoring & IDS
Most of the network monitoring in the simple tests illustrated in this 
document, was performed from the “attacker” machine, though occasionally 
another system would be put into the same network segment to gather 
additional network traffic information. Later experiments involved more advanced 
monitoring and logging and additional systems performing these functions, 
these tests are beyond the scope of this revision of this document.
Logging was increased to maximum on the PPTP and internal LAN’s 
Domain PDC server, and when applicable on the PPTP client(s).
IDS was not implemented in the early experiments, although later 
experiments showed that most IDS systems (Snort and Tripwire were used the 
most in this lab, among other products that were sampled) easily detected the 
signatures of the packets from the active DoS attacks. Only if IDS was setup in 
the “ISP” network was it possible to detect the password/hash “sniffing” attacks, 
IDS at the PPTP server network were of course not able to detect such attacks 
since it is passive and the IDS software is not able to detect the attackers 
network interface being in promiscuous mode since it was several routers and 
switches away from the IDS systems. If the attacker was on the same subnet 
however (non-switched) the IDS products typically quickly detected the attackers 
network interface “sniffing” attempts. 
2.2 Tools used
Anger.c
Ntpptp.c
Ipsend
Apsend
0

---