mitigando ataques com_snort

Reducing network attacks with Snort

cleber brandaocleber.brandao[nospam]locaweb.com.br

sexta-feira, 18 de novembro de 11

Agenda• What is an IDS

• Types of attack

• Snort structure

• How snort works

• Preprocessors

• Output plugins

• Operation modes• Positioning• Q&A


What is an IDS?

• Intrusion Detection System

• Layer 7 analysis

• Just a sensor

• IPS can drop packets

• Pattern match or behavior


Types of attack


External attacks


Internal attacks


Unstructured attacks


Structured attacks


Understanding the Snort

• Created in 1998 just like sniff

• Becomes as IDS in 1999

• Last version 2.9.1.2


How snort works


Preproccessors

• sfPortScan

• Frag3

• httpInspect


sfPortscan

• Half connection scans

• Decoy scans

• Distributed scans

• Port sweep scans


Frag3

• Detect anomalies in fragmented packets


Frag3 evasion


Frag3 evasion (2)


httpInspect

• HTTP normalization


httpInspect (sample)

• / = %2f

• . = %2e• alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS

$HTTP_PORTS (msg:”WEB-ATTACKS /usr/bin/id command attempt”;flow:to_server,established; content:”/usr/bin/id”;nocase;classtype:web-application-attack;sid:1332;rev:7;)

• %2fusr%2fbin%2fid = bybass


Output plugins

• Databases (mysql, postgre, oracle)

• Syslog

• Pcap (tcpdump, wireshark)

• Unified2


Operation modes

• IDS

• IPS

• Sniffer

• pcaps analysis


Positioning

• Sensor (port-mirror, network tap)

• IPS (bridge, gateway)

• Internal

• External


Questions ?


Where to find me

• Freenode - #securityguys, #snort-br

• Security conferences

• Buy me a Beer ;)


Thank you

• www.locaweb.com.br

• www.snort.org.br

• www.snort.org

• clebeerpub.blogspot.com


http://www.snort.org.br




http://www.snort.org

http://www.snort.org

mitigando ataques com_snort

Technology

snort workssextafeira

internal attackssextafeira

external attackssextafeira

beer sextafeira

frag3 evasionsextafeira

internal externalsextafeira

wireshark unied2sextafeira

fragmented packetssextafeira