COEN 252 Computer Forensics Network Analysis and Intrusion

  • Slides: 20
Download presentation
COEN 252: Computer Forensics Network Analysis and Intrusion Detection with Snort

COEN 252: Computer Forensics Network Analysis and Intrusion Detection with Snort

Snort n n n Freeware. Designed as a network sniffer. Useful for traffic analysis.

Snort n n n Freeware. Designed as a network sniffer. Useful for traffic analysis. Useful for intrusion detection. Warning: Has become a target of attackers.

Snort n n n Snort is a good sniffer. Snort uses a detection engine,

Snort n n n Snort is a good sniffer. Snort uses a detection engine, based on rules. Packets that do not match any rule are discarded. Otherwise, they are logged. Rule matching packets can also trigger an alert.

Snort n Forensic Use: n Filter logs of large size quickly.

Snort n Forensic Use: n Filter logs of large size quickly.

Snort: Architecture n Packet Decode Engine n n n Preprocessor Plug-ins n n Checks

Snort: Architecture n Packet Decode Engine n n n Preprocessor Plug-ins n n Checks packages against the various options in the snort rules files. Detection Plug-Ins n n Each preprocessors examines and manipulates packages, e. g. for alerts. Detection Engine n n Uses the libpcap package Packages are decoded for link-level protocols, then for higher protocols. Allow additional examinations Output Plug-Ins

Snort: Architecture Package View: n NIC in promiscuous mode. n Grab packages from the

Snort: Architecture Package View: n NIC in promiscuous mode. n Grab packages from the network card. n Decode packages n Run through various rule sets. n Output logs and alerts.

Snort Rules n Rule Header n n alert tcp $External_NET any -> $Home_Net 21

Snort Rules n Rule Header n n alert tcp $External_NET any -> $Home_Net 21 Rule Options n (msg: “ftp Exploit”; flow_to_server, established; content: “|31 c 031 db 41 c 9 b 046 cd 80 31 c 031 db|”; reference: bugtraq, 1387; classtype: attemptedadmin; sid 344; rev 4; )

Snort Rules n Rule Header n n n n Alert / log / pass

Snort Rules n Rule Header n n n n Alert / log / pass / dynamic / activate tcp: Protocol being used. UDP / ICMP $External_NET: This is the source IP, default is any: This is the source port set to “any” ->: Direction of conversation. $Home_Net: This is a variable that Snort will replace with 21: Port to be monitored. The header concerns all tcp packages coming from any port from the outside to port 21 on the inside.

Snort Rules Rule Options n n n n ( ): Rule option is placed

Snort Rules Rule Options n n n n ( ): Rule option is placed in parentheses. msg: “ftp Exploit”; flow_to_server, established; content: “|31 c 031 db 41 c 9 b 046 cd 80 31 c 031 db|”; Snort will look whether the package contains this string, the dangerous payload. reference: bugtraq, 1387; Snorts allow links to third-party warnings. classtype: attempted-admin; Class Types allow users to quickly scan for attack types sid 344; Snort rule unique identifier. Can be checked against www. snort. org/snort-db. rev 4; All rules are part of a revision process to limit false positives and detect new attacks.

Snort Rules n n Activation: Alert and then turn on another dynamic rule. Dynamic:

Snort Rules n n Activation: Alert and then turn on another dynamic rule. Dynamic: Log the traffic when called by the above activation rule. Pass: Ignore the traffic. Log: Log the traffic, but do not alert.

Snort Rules n n TCP: TCP protocol, for example SMTP, HTTP, FTP UDP: For

Snort Rules n n TCP: TCP protocol, for example SMTP, HTTP, FTP UDP: For example DNS traffic ICMP: For example ping, traceroute. IP: For example IPSec, IGMP

Snort Rules n n Content: Content checked by the Boyer Moore pattern matching algorithm.

Snort Rules n n Content: Content checked by the Boyer Moore pattern matching algorithm. Flow: Link to the detection plug-ins.

Using Snort n n Install with libcap / wincap. Move config / rule files

Using Snort n n Install with libcap / wincap. Move config / rule files to correct directory and alter them. Use Snort from the commandline. Snort can be used to sniff or to decode.

Using Snort Sniffer Mode n Run-time switches: n n n -v verbose -d dump

Using Snort Sniffer Mode n Run-time switches: n n n -v verbose -d dump package payloads -x dump entire package in hex -a display arp packages -e display link layer data snort -dvae

Using Snort Packet Logger Mode n Tell snort to output packages to a log

Using Snort Packet Logger Mode n Tell snort to output packages to a log file. n Command line options: n n n -l dump packages into log directory -b log packages in binary (tcpdump) format Example: snort –b –l /temp/snort

Using Snort n n n Binary log files are in tcpdump format Can be

Using Snort n n n Binary log files are in tcpdump format Can be read by snort with the –r switch Readback can be used to dump, log, or perform detection

Using Snort Full Text Logging n Packets are logged in plain ascii format n

Using Snort Full Text Logging n Packets are logged in plain ascii format n One file created per protocol port pair n A port scan creates too many files.

Using Snort NIDS Mode n Load snort with a set of rules, configure packet

Using Snort NIDS Mode n Load snort with a set of rules, configure packet analysis plug-ins, and let it monitor hostile network activity

Using Snort n Use –c switch to specify configuration file. n n Snort –c

Using Snort n Use –c switch to specify configuration file. n n Snort –c snort. conf If no config file is specified, snort looks in the /etc directory.

Using Snort NIDS mode: n Specify an alternative logging directory with –l n Specify

Using Snort NIDS mode: n Specify an alternative logging directory with –l n Specify an alternate alert mode n n -AL fast, full, none, console -M <wrkstn> Send SMB (popup) alerts

COEN 252 Computer Forensics Network Analysis and IntrusionCOEN 252 Computer Forensics Network Analysis and Intrusion
COEN 252 Computer Forensics Network Analysis and IntrusionCOEN 252 Computer Forensics Network Analysis and Intrusion
COEN 252 Computer Forensics Network Analysis and IntrusionCOEN 252 Computer Forensics Network Analysis and Intrusion
COEN 252 Computer Forensics Challenges of Network ForensicsCOEN 252 Computer Forensics Challenges of Network Forensics
COEN 252 Computer Forensics Introduction to Computer ForensicsCOEN 252 Computer Forensics Introduction to Computer Forensics
COEN 252 Computer Forensics Writing Computer Forensics ReportsCOEN 252 Computer Forensics Writing Computer Forensics Reports
COEN 252 Computer Forensics Intrusion Detection Systems IDSCOEN 252 Computer Forensics Intrusion Detection Systems IDS
COEN 252 Computer Forensics Intrusion Detection Systems BookCOEN 252 Computer Forensics Intrusion Detection Systems Book
COEN 152 Computer Forensics Introduction to Computer ForensicsCOEN 152 Computer Forensics Introduction to Computer Forensics
COEN 252 Computer Forensics Data Analysis Techniques forCOEN 252 Computer Forensics Data Analysis Techniques for
COEN 252 Computer Forensics Tools for Package AnalysisCOEN 252 Computer Forensics Tools for Package Analysis
Forensics and Auditing Computer Forensics Computer forensics isForensics and Auditing Computer Forensics Computer forensics is
Phishing COEN 252 Computer Forensics Thomas Schwarz SPhishing COEN 252 Computer Forensics Thomas Schwarz S
COEN 252 Computer Forensics Forensic Duplication of HardCOEN 252 Computer Forensics Forensic Duplication of Hard
Password Cracking COEN 252 Computer Forensics Social EngineeringPassword Cracking COEN 252 Computer Forensics Social Engineering
Password Cracking COEN 252 Computer Forensics Social EngineeringPassword Cracking COEN 252 Computer Forensics Social Engineering
COEN 252 Computer Forensics Hard Drive Geometry DriveCOEN 252 Computer Forensics Hard Drive Geometry Drive
COEN 252 Computer Forensics Process for Hard DriveCOEN 252 Computer Forensics Process for Hard Drive
COEN 252 Computer Forensics Router Investigation Significance ofCOEN 252 Computer Forensics Router Investigation Significance of