Snort Ids Introduction

Snort

Layout by orngjce223, CC-BY

Using version 2.8.1 (Newest: 2.8.4.1)

Snort Open Source Network IDS / Network IPS Commercially Developed by SourceFire Commercial Services by SourceFire

Layout by orngjce223, CC-BY

Hardware / Software / Certification / Rule Updates

SourceFire Vulnerability Research Team (VRT) 3 Million Downloads 225,000 Active Users

Why Run an IDS? Provide an Audit Trail Data Analysis Research Because you can

Layout by orngjce223, CC-BY

To Detect ...

What can an IDS do? Detect Skiddies Worms Other Potential Threats DOS Attack

Layout by orngjce223, CC-BY

Create Alerts Create False Positives / False Negative Attacks that aren't Missed attacks due to evasion / dos

Signatures Signature Detection Created by known traffic patterns that match rules Low on false positives May miss new / unknown attacks 0-Day. (false negative)

Layout by orngjce223, CC-BY

Anomaly Detection “Learns” what's normal, throws a fit when something isn't normal. High on false positives Low on false negatives (less likely not to alert on a 0-Day)

Installing Snort Download Binaries (Windows / Linux) http://www.snort.org/downloads

OR Install from Repository

Layout by orngjce223, CC-BY

Configure Download / Write Rules Install Rules Run!

Using Snort Test your configuration file snort -T -c /etc/snort/snort.cfg

Using as an IDS snort -c /etc/snort/snort.conf -i ethX

Packet Sniffer (tcpdump -vvi ethX) Layout by orngjce223, CC-BY

snort -v -i ethX

Output Log File Tcpdump format Plaintext Binary (for reading with Barnyard) Syslog/ng stdout Layout by orngjce223, CC-BY

SQL (postgres, mySQL) Graphical Clients ACID (Analysis Console for Intrusion Detection) Many others

Writing Rules Setup Your Rule Path include $RULE_PATH/.rules Log / alert

Layout by orngjce223, CC-BY

log tcp 192.168.1.18/32 any -> any 80 (msg:"eBaying"; uricontent:"ebay.com";) alert tcp $EXTERNAL_NET any -> 172.16.30.7 25 (msg:"Found hacking reference in e-mail"; content:"hacking";)

Regular Expressions!

Layout by orngjce223, CC-BY

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"SQL Injection - Paranoid"; flow:to_server,established;uricontent:".ph p";pcre:"/(\%27)|(\')|(\-\-)|(%23)|(#)/i"; classtype:Web-application-attack; sid:9099; rev:5;) SQL Injection '-- Attack More SQL Injection / XSS http://www.securityfocus.com/infocus/1768

Demonstration

Nikto http://www.cirt.net/nikto2 Make Sure Perl's installed wget http://www.cirt.net/nikto/nikto-current.tar.gz tar xvzf nikto-current.tar.gz perl nikto.pl -h 192.168.X.X

Layout by orngjce223, CC-BY

On Snort Box: snort -c /etc/snort/snort.conf -i wlan0

Developments IP Blacklist depending on Reputation

http://securitysauce.blogspot.com/2009/05/ip-blacklisting-for-sno

SAM (Snort Alert Monitor) E-Mail, Audio/Visual Warnings http://projects.darkaslight.com/projects/show/sam

Pscan Plugin to Portscan on certain keywords Layout by orngjce223, CC-BY

http://sourceforge.net/projects/pscan-plugin/

BlockIt Modify Firewall Rules (IPTables, IPChains, IPFWADM, IPFilter, PF, or Checkpoint) http://www.teknofx.com/

Additional Resources Community Maintained Signatures http://www.emergingthreats.net/ Snort for Dummies (ISBN:9780764568350) Cheat Sheet Good General Introduction

Layout by orngjce223, CC-BY

Snort.org/docs Manual, FAQ, Webinar recordings / slides

Google