Slide 1TopicsBackground – PolicyIntro to SnortSnort “Metrics”Snort DesignDetection EnginePlug-InsUsing SnortUsing Snort – Sniffer ModeWhat Do The Packet Dumps Look Like?Packet Logger ModeNIDS ModeSnort RulesSlide 15Slide 16Slide 17Slide 18Slide 19Snort ArchitectureData FlowDetection Engine: RulesDetection Engine: Internal RepresentationDetection Engine: Fully PopulatedThird-Party EnhancementsSnortSnarfSlide 27DemarcSlide 29Slide 30ConclusionModified slides from Martin RoeschSourcefire Inc.Topics•Background–What is Snort?•Using Snort•Snort Architecture•Third-Party EnhancementsBackground – Policy•Successful intrusion detection depends on policy and management as much as technology–Security Policy (defining what is acceptable and what is being defended) is the first step–Notification •Who, how fast?–Response CoordinationIntro to Snort•What is Snort?–Snort is a multi-mode packet analysis tool•Sniffer•Packet Logger•Forensic Data Analysis tool•Network Intrusion Detection System•Where did it come from?–Developed out of the evolving need to perform network traffic analysis in both real-time and for forensic post processingSnort “Metrics”•Portable (Linux, Windows, MacOS X, Solaris, BSD, IRIX, Tru64, HP-UX, etc)•Fast (High probability of detection for a given attack on 100Mbps networks)•Configurable (Easy rules language, many reporting/logging options•Free (GPL/Open Source Software)Snort Design•Packet sniffing “lightweight” network intrusion detection system•Libpcap-based sniffing interface•Rules-based detection engine•Plug-in system allows endless flexibilityDetection Engine•Rules form “signatures”•Modular detection elements are combined to form these signatures•Wide range of detection capabilities–Stealth scans, OS fingerprinting, buffer overflows, back doors, CGI exploits, etc.•Rules system is very flexible, and creation of new rules is relatively simplePlug-Ins•Preprocessor–Packets are examined/manipulated before being handed to the detection engine•Detection–Perform single, simple tests on a single aspect/field of the packet•Output–Report results from the other plug-insUsing Snort•Three main operational modes–Sniffer Mode–Packet Logger Mode–NIDS Mode–(Forensic Data Analysis Mode)•Operational modes are configured via command line switches–Snort automatically tries to go into NIDS mode if no command line switches are given, looks for snort.conf configuration file in /etcUsing Snort – Sniffer Mode•Works much like tcpdump•Decodes packets and dumps them to stdout •BPF filtering interface available to shape displayed network trafficWhat Do The Packet Dumps Look Like?=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+11/09-11:12:02.954779 10.1.1.6:1032 -> 10.1.1.8:23TCP TTL:128 TOS:0x0 ID:31237 IpLen:20 DgmLen:59 DF***AP*** Seq: 0x16B6DA Ack: 0x1AF156C2 Win: 0x2217 TcpLen: 20FF FC 23 FF FC 27 FF FC 24 FF FA 18 00 41 4E 53 ..#..'..$....ANS49 FF F0 I..=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+11/09-11:12:02.956582 10.1.1.8:23 -> 10.1.1.6:1032TCP TTL:255 TOS:0x0 ID:49900 IpLen:20 DgmLen:61 DF***AP*** Seq: 0x1AF156C2 Ack: 0x16B6ED Win: 0x2238 TcpLen: 200D 0A 0D 0A 53 75 6E 4F 53 20 35 2E 37 0D 0A 0D ....SunOS 5.7...00 0D 0A 0D 00 .....=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+Packet Logger Mode•Gee, it sure would be nice if I could save those packets to disk…•Multi-mode packet logging options available–Flat ASCII, tcpdump, XML, database, etc available•Log all data and post-process to look for anomalous activityNIDS Mode•Wide variety of rules available for signature engine (~1300 as of June 2001, grow to ~2900 at May 2005, now ~6000 rules)•Multiple detection modes available via rules and plug-ins–Rules/signature –Statistical anomaly–Protocol verificationSnort RulesSnort Rules•Snort rules are extremely flexible and are easy to modify, unlike many commercial NIDS•Sample rule to detect SubSeven trojan:alert tcp $EXTERNAL_NET 27374 -> $HOME_NET any (msg:"BACKDOOR subseven 22"; flags: A+; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids,485; reference:url,www.hackfix.org/subseven/; sid:103; classtype:misc-activity; rev:4;)•Elements before parentheses comprise ‘rule header’•Elements in parentheses are ‘rule options’Snort Rulesalert tcp $EXTERNAL_NET 27374 -> $HOME_NET any (msg:"BACKDOOR subseven 22"; flags: A+; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids,485; reference:url,www.hackfix.org/subseven/; sid:103; classtype:misc-activity; rev:4;)•alert action to take; also log, pass, activate, dynamic•tcp protocol; also udp, icmp, ip•$EXTERNAL_NET source address; this is a variable – specific IP is ok•27374 source port; also any, negation (!21), range (1:1024)•-> direction; best not to change this, although <> is allowed•$HOME_NET destination address; this is also a variable here•any destination portSnort Rulesalert tcp $EXTERNAL_NET 27374 -> $HOME_NET any (msg:"BACKDOOR subseven 22"; flags: A+; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids,485; reference:url,www.hackfix.org/subseven/; sid:103; classtype:misc-activity; rev:4;)•msg:”BACKDOOR subseven 22”; message to appear in logs•flags: A+; tcp flags; many options, like SA, SA+, !R, SF*•content: “|0d0…0a|”; binary data to check in packet; content without | (pipe) characters do simple content matches•reference…; where to go to look for background on this rule•sid:103; rule identifier•classtype: misc-activity; rule type; many others•rev:4; rule revision number•other rule options possible, like offset, depth, nocaseSnort Rules•bad-traffic.rules exploit.rules scan.rules•finger.rules ftp.rules telnet.rules•smtp.rules rpc.rules rservices.rules•dos.rules ddos.rules dns.rules•tftp.rules web-cgi.rulesweb-coldfusion.rules•web-frontpage.rules web-iis.rules web-misc.rules•web-attacks.rulessql.rules x11.rules•icmp.rules netbios.rules misc.rules•backdoor.rules shellcode.rules policy.rules•porn.rules info.rules icmp-info.rules•virus.rules local.rules attack-responses.rulesSnort Rules•Rules which actually caught intrusions–alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL xp_cmdshell - program execution"; content:
View Full Document
Unlocking...