Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/14/2010
01:31 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Snort'ing Out Anomalies

Detecting determined attackers focused on getting your data -- and getting away with it is not an easy task. To that end, many security products have been created that attempt everything from separation of privileges and tight access control to full network packet inspection and data loss prevention.

Detecting determined attackers focused on getting your data -- and getting away with it is not an easy task. To that end, many security products have been created that attempt everything from separation of privileges and tight access control to full network packet inspection and data loss prevention.But there's a lot to be said for simply knowing your network inside and out so you know exactly what's normal and what isn't.

However, our time as security professionals is getting to be more and more scarce as we have more threats and attacks to deal with...like Adobe zero days and the latest rogue antivirus. One of the things that intrusion detection systems can do for you is not only detect attacks, but also provide information that helps you understand what's going on within your network, and even provide a forensic resource during investigations.

I have a few different examples that are based on real-world examples that I've dealt with, and some after-hours research. The first is Snort rules looking for Web browser User Agent strings to identify what Web browsers are being used on your network. Monitoring for new User Agents (Emerging Threats User Agent Snort rules) on your network can identify rogue applications in use by users or indicate a malware infection.

For a long time, I would use the Snort rule for wget, a command line Web fetching tool primarily used on Linux, to identify compromised systems. Once an attacker compromised a Unix-based system via something like a weak password, he would then download its tools using wget. I'd then download the same tools to analyze and have a jump-start to knowing what was done on the compromised system.

Years later, that same wget Snort rule worked for identifying malware infections that used a wget User Agent. Having User Agent rules in place could help pick up users who have installed or are running unauthorized "portable" Web browsers from a U3 USB drive to get around certain network restrictions.

Another interesting application of IDS for learning about your network and potentially catching bad things is similar to a poor man's data loss prevention (DLP) tool. There are already Snort rules for catching Social Security Numbers and credit cards, but looking for compressed files is something that could lead to detection of an attacker exfiltrating data from your network.

There are a handful of Snort rules available free from the Emerging Threats project that look for Zip files as they are transferred over the network (Emerging Threats Policy Snort rules). There are even a few that look for common Microsoft documents inside of the Zip files. There are not many rules for Rar, CAB, and other compressed file formats, but the Zip files are easy to copy and modify to match the other formats.

Encryption will make these rules practically useless, but that is something else you might detect that could be indicative of anomalous behavior and clue you in to something being amiss.

There are many different ways to monitor network traffic to learn what's normal and not. Network flow data is another. Depending on your environment, your options will vary, but the effort will not be wasted and will likely net you much success in detecting attacks, both internal and external.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31458
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...