Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/14/2010
01:31 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Snort'ing Out Anomalies

Detecting determined attackers focused on getting your data -- and getting away with it is not an easy task. To that end, many security products have been created that attempt everything from separation of privileges and tight access control to full network packet inspection and data loss prevention.

Detecting determined attackers focused on getting your data -- and getting away with it is not an easy task. To that end, many security products have been created that attempt everything from separation of privileges and tight access control to full network packet inspection and data loss prevention.But there's a lot to be said for simply knowing your network inside and out so you know exactly what's normal and what isn't.

However, our time as security professionals is getting to be more and more scarce as we have more threats and attacks to deal with...like Adobe zero days and the latest rogue antivirus. One of the things that intrusion detection systems can do for you is not only detect attacks, but also provide information that helps you understand what's going on within your network, and even provide a forensic resource during investigations.

I have a few different examples that are based on real-world examples that I've dealt with, and some after-hours research. The first is Snort rules looking for Web browser User Agent strings to identify what Web browsers are being used on your network. Monitoring for new User Agents (Emerging Threats User Agent Snort rules) on your network can identify rogue applications in use by users or indicate a malware infection.

For a long time, I would use the Snort rule for wget, a command line Web fetching tool primarily used on Linux, to identify compromised systems. Once an attacker compromised a Unix-based system via something like a weak password, he would then download its tools using wget. I'd then download the same tools to analyze and have a jump-start to knowing what was done on the compromised system.

Years later, that same wget Snort rule worked for identifying malware infections that used a wget User Agent. Having User Agent rules in place could help pick up users who have installed or are running unauthorized "portable" Web browsers from a U3 USB drive to get around certain network restrictions.

Another interesting application of IDS for learning about your network and potentially catching bad things is similar to a poor man's data loss prevention (DLP) tool. There are already Snort rules for catching Social Security Numbers and credit cards, but looking for compressed files is something that could lead to detection of an attacker exfiltrating data from your network.

There are a handful of Snort rules available free from the Emerging Threats project that look for Zip files as they are transferred over the network (Emerging Threats Policy Snort rules). There are even a few that look for common Microsoft documents inside of the Zip files. There are not many rules for Rar, CAB, and other compressed file formats, but the Zip files are easy to copy and modify to match the other formats.

Encryption will make these rules practically useless, but that is something else you might detect that could be indicative of anomalous behavior and clue you in to something being amiss.

There are many different ways to monitor network traffic to learn what's normal and not. Network flow data is another. Depending on your environment, your options will vary, but the effort will not be wasted and will likely net you much success in detecting attacks, both internal and external.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
5 Common Errors That Allow Attackers to Go Undetected
Matt Middleton-Leal, General Manager and Chief Security Strategist, Netwrix,  2/12/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5613
PUBLISHED: 2020-02-18
In FreeBSD 12.0-RELEASE before 12.0-RELEASE-p13, a missing check in the ipsec packet processor allows reinjection of an old packet to be accepted by the ipsec endpoint. Depending on the higher-level protocol in use over ipsec, this could allow an action to be repeated.
CVE-2020-7450
PUBLISHED: 2020-02-18
In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE before 11.3-RELEASE-p6, URL handling in libfetch with URLs containing username and/or password components is vulnerable to a heap buffer over...
CVE-2019-10792
PUBLISHED: 2020-02-18
bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
CVE-2019-10793
PUBLISHED: 2020-02-18
dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
CVE-2019-10794
PUBLISHED: 2020-02-18
All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.