Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/14/2010
01:31 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Snort'ing Out Anomalies

Detecting determined attackers focused on getting your data -- and getting away with it is not an easy task. To that end, many security products have been created that attempt everything from separation of privileges and tight access control to full network packet inspection and data loss prevention.

Detecting determined attackers focused on getting your data -- and getting away with it is not an easy task. To that end, many security products have been created that attempt everything from separation of privileges and tight access control to full network packet inspection and data loss prevention.But there's a lot to be said for simply knowing your network inside and out so you know exactly what's normal and what isn't.

However, our time as security professionals is getting to be more and more scarce as we have more threats and attacks to deal with...like Adobe zero days and the latest rogue antivirus. One of the things that intrusion detection systems can do for you is not only detect attacks, but also provide information that helps you understand what's going on within your network, and even provide a forensic resource during investigations.

I have a few different examples that are based on real-world examples that I've dealt with, and some after-hours research. The first is Snort rules looking for Web browser User Agent strings to identify what Web browsers are being used on your network. Monitoring for new User Agents (Emerging Threats User Agent Snort rules) on your network can identify rogue applications in use by users or indicate a malware infection.

For a long time, I would use the Snort rule for wget, a command line Web fetching tool primarily used on Linux, to identify compromised systems. Once an attacker compromised a Unix-based system via something like a weak password, he would then download its tools using wget. I'd then download the same tools to analyze and have a jump-start to knowing what was done on the compromised system.

Years later, that same wget Snort rule worked for identifying malware infections that used a wget User Agent. Having User Agent rules in place could help pick up users who have installed or are running unauthorized "portable" Web browsers from a U3 USB drive to get around certain network restrictions.

Another interesting application of IDS for learning about your network and potentially catching bad things is similar to a poor man's data loss prevention (DLP) tool. There are already Snort rules for catching Social Security Numbers and credit cards, but looking for compressed files is something that could lead to detection of an attacker exfiltrating data from your network.

There are a handful of Snort rules available free from the Emerging Threats project that look for Zip files as they are transferred over the network (Emerging Threats Policy Snort rules). There are even a few that look for common Microsoft documents inside of the Zip files. There are not many rules for Rar, CAB, and other compressed file formats, but the Zip files are easy to copy and modify to match the other formats.

Encryption will make these rules practically useless, but that is something else you might detect that could be indicative of anomalous behavior and clue you in to something being amiss.

There are many different ways to monitor network traffic to learn what's normal and not. Network flow data is another. Depending on your environment, your options will vary, but the effort will not be wasted and will likely net you much success in detecting attacks, both internal and external.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25514
PUBLISHED: 2020-09-22
Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://<site>/lms/admin.php.
CVE-2020-25515
PUBLISHED: 2020-09-22
Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books > New Book , http://<site>/lms/index.php?page=books.
CVE-2020-14022
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts ("Import Contacts" functionality) from a file. It is possible to upload an executable or .bat file that can be executed with the help of a functionality (E.g. the "Application Star...
CVE-2020-14023
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF or RSS To SMS.
CVE-2020-14024
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the Mailbox feature, (2) OZFORM_GROUPNAME field in the Group configuration of addresses, (3) listname field in the Defining address lists configuratio...