TaoSecurity Blog

Recently I tried interacting with one of my lab Security Onion sensors running the Suricata IDS. I found the Sguil server was taking a really long time to offer services on port 7734 TCP. Since I hadn't worked with this lab system in a while, I guessed that there might be too many uncategorized events in the Sguil database. I dusted off an old blog post titled More Snort and Sguil Tuning from 2006 and took a look at the system. First I stopped the NSM applications on the server. sudo service nsm stop Stopping: securityonion * stopping: sguil server [ OK ] Stopping: HIDS * stopping: ossec_agent (sguil) [ OK ] Stopping: Bro stopping ds61so-eth1-1 ... stopping proxy ... stopping manager ... Stopping: ds61so-eth1 * stopping: netsniff-ng (full packet data) [ OK ] * stopping: pcap_agent (sguil) [ OK ] * stopping: snort_agent (sguil) [ OK ] * stoppi...

No sooner do I get Snort 2.9.0.1 running than something breaks. However, thanks to Niels Horn I know a little more about two new tools included with Snort. First is u2spewfoo, which reads Unified2 output files and outputs them as text. [sguil@r200a /nsm/r200a]$ u2spewfoo snort.unified2.1289360307 | head -20 (Event) sensor id: 0 event id: 1 event second: 1289360859 event microsecond: 881345 sig id: 2011032 gen id: 1 revision: 4 classification: 3 priority: 2 ip source: 192.168.2.107 ip destination: 172.16.2.1 src port: 44597 dest port: 3128 protocol: 6 impact_flag: 0 blocked: 0 Packet sensor id: 0 event id: 1 event second: 1289360859 packet second: 1289360859 packet microsecond: 881345 linktype: 1 packet_length: 1168 00 15 17 0B | 7D 4C 00 13 | 10 65 2F AC | 08 00 45 00 04 82 C2 E3 | 40 00 3F 06 | 03 6E C0 A8 | 02 6B AC 10 02 01 AE 35 | 0C 38 73 6F | 02 7F 12 37 | D9 A8 80 18 03 EA 6D 85 | 00 00 01 01 | 08 0A 01 2A | 34 44 75 11 33 8C 41 46 | 69 72 73 74 | 25 32 43 25 | 32 30 ...

Before today I never committed anything using Git . Previously I used CVS, but never got around to trying something more modern like SVN. However, I know several developers at work use Git, so I figured I would try committing my FreeBSD Sguil scripts (lame as they are) to Git at Sourceforge. This would allow me to keep track of changes and get the code out of my own repository for sharing and safekeeping. I started by cleaning up the directory where I kept the scripts. After following the instructions to enable Git , I took these actions. richard@macmini:~/taosecurity_freebsd_sguil$ git init Initialized empty Git repository in /home/richard/taosecurity_freebsd_sguil/.git/ richard@macmini:~/taosecurity_freebsd_sguil$ git config user.name "Richard Bejtlich" richard@macmini:~/taosecurity_freebsd_sguil$ git config user.email \ "taosecurity@users.sourceforge.net" richard@macmini:~/taosecurity_freebsd_sguil$ git remote add origin \ ssh://taosecurity@taosecurity.git.s...

Early last year I posted Notes on Installing Sguil Using FreeBSD 7.1 Packages where I examined using the various FreeBSD ports for Sguil . In that post I showed that a lot of work was required to deploy Sguil, even if you used the ports or packages. Previously I've written about a set of scripts I maintain for deploying Sguil platforms in my lab. I decided to take a look at those scripts and update them for a modern environment, since a lot has happened in the almost two years since I last used the scripts. First, I tested my old scripts on FreeBSD 7.x, and now 8.x is common. Second, Snort 2.9.0.1 is available, and with it the new DAQ mechanism for accessing network traffic. Third, Barnyard has been deprecated in favor of Barnyard2, thanks to the guys at the NSMNow project. There have been a lot of changes with rules and other areas. I also wanted to try running a 64 bit environment on a Dell R200 as my primary lab sensor. Finally, I decided to switch from using CVS at Sou...

Today I installed a Sguil client on a fresh installation of Ubuntu 9.10. It was really easy with the exception of one issue I had to troubleshoot, explained below. First notice that tcl8.4 and tk8.4 is already installed on Ubuntu 9.10. richard@janney:~$ dpkg --list | grep -i tcl ii tcl8.4 8.4.19-3 Tcl (the Tool Command Language) v8.4 - run-t ii tk8.4 8.4.19-3 Tk toolkit for Tcl and X11, v8.4 - run-time richard@janney:~$ sudo apt-get install tclx8.4 tcllib iwidgets4 tcl-tlsReading package lists... Done Building dependency tree Reading state information... Done The following extra packages will be installed: itcl3 itk3 Suggested packages: itcl3-doc itk3-doc iwidgets4-doc tclx8.4-doc The following NEW packages will be installed: itcl3 itk3 iwidgets4 tcl-tls tcllib tclx8.4 0 upgraded, 6 newly installed, 0 to remove and 0 not upgraded. Need to get ...

A comment on my last post, Reminder: Bejtlich Teaching at Black Hat DC 2010 , a reader asked: I am trying to get my company sponsorship for your class at Black Hat. However, I was ask to justify between your class and SANS 503, Intrusion Detection In-Depth. Would you be able to provide some advice? That's a good question, but it's easy enough to answer. The overall point to keep in mind is that TCP/IP Weapons School 2.0 is a new class, and when I create a new class I design it to be different from everything that's currently on the market. It doesn't make sense to me to teach the same topics, or use the same teaching techniques, found in classes already being offered. Therefore, when I first taught TWS2 at Black Hat DC last year, I made sure it was unlike anything provided by SANS or other trainers. Beyond being unique, here are some specific points to consider. I'm sure I'll get some howls of protest from the SANS folks, but they have their own platform t...

Keep your eyes open for the latest printed BSD Magazine , with my article Keeping FreeBSD Up-To-Date: OS Essentials . This article is something like 18 pages long, because at the last minute the publishers had several authors withdraw articles. The publishers decided to print the extended version of my article, so it's far longer than I expected! We're currently editing the companion piece on keeping FreeBSD applications up-to-date. I expect to also submit an article on running Sguil on FreeBSD 8.0 when I get a chance to test the latest version in my lab.

In my off time I'm still busy organizing the SANS WhatWorks in Incident Detection Summit 2009 , taking place in Washington, DC on 9-10 Dec 09. The agenda page should be updated soon to feature all of the speakers and panel participants. Wednesday is the last day to register at the discounted rate . I wrote the following to provide more information on the Summit and explain its purpose. All of us want to spend our limited information technology and security funds on the people, products, and processes that make a difference. Does it make sense to commit money to projects when we don’t know their impact? I’m not talking about fuzzy “return on investment” (ROI) calculations or fabricated “risk” ratings. Don’t we all want to know how to find intruders, right now, and then concentrate on improvements that will make it more difficult for bad guys to disclose, degrade, or deny our data? To answer this question, I’ve teamed with SANS to organize a unique event -- the SANS WhatWorks ...

A blog reader recently asked: I've been tasked with reevaluating our current NSM / SIEM implementation, and I see that you posted about a NetFlow book you are techediting for Lucas. My question is this, Outside of Sguil, what do you prefer/recommend in the way of NSM products/solutions? Our current NSM uses a modified version NetFlow and our Networking team also uses Cisco Netflow elsewhere... While I find it useful to collect header data, the current implementation lacks payload information. So while we may be able to turn back the clock to look at flows for a given duration, its not always possible to see valuable contents... Another wall I have hit with NetFlow is that the communication of the protocol takes place in somewhat of a half duplex manner (I.E. it is possible to receive the response flow before you receive the request flow) thus making it difficult to assure a particular direction without some processing... I have yet to see a blog post covering any consolidated ...

This month I was pleased to attend a public meeting of the Open Information Security Foundation in Washington, DC. I got a chance to meet several people I have known for many years through their work with Snort, such as Matt Jonkman , Will Metcalf , Victor Julien , Frank Knobbe , and two guys from a federal agency that have extended Sguil way beyond what I knew anyone was doing! The group posted DC Brainstorming Meeting Notes , but I wanted to record a few thoughts here. OISF is a US nonprofit, a 501c(3). Their goal is to produce a new network inspection and filtering engine (IDS/IPS) that will be released under GPLv2. They can not and will not commercialize, sell, patent, copyright, or profit from the engine. Rather, others who participate in the OISF Consortium (listed on their Web site) are donating coders, equipment, and financial support in exchange for the ability to commercialize the engine. OISF works with the Open Source Software Institute , famous for getting FIPS vali...

After publishing Black Hat Budgeting last month, several readers asked me how to spend the same $1 million on defense. This is a more difficult question. As I wrote in the previous post, for $1 million per year an adversary could fund a Western-salaried black hat team that could penetrate and persist in roughly any target it chose to attack. That does not hold true for defense, i.e., for $1 million per year a defender could not fund a Western-salaried white hat team that could plan, resist, detect, and respond to any $1 million black hat team. So, if you had $1 million to spend on defense, how could you spend it? I turned to my 2008 post Defensible Network Architecture 2.0 as a guide. One interesting aspect of the eight DNA 2.0 tenets is that half of them are IT responsibilities (or at least I would strongly argue they are): inventoried, claimed, minimized, current. All of that is just "good IT." Security can provide inputs, but IT should own those aspects. That ...

Several IP-enabled devices in the lab use TFTP to retrieve configuration files from various locations on the Internet. This pains me. You can probably imagine what these devices are. Unfortunately I don't control how these devices work. I run Sguil at my lab gateway to the Internet. I watch traffic right before the gateway, before it is NAT'd. I really don't care what's on the other side. I mostly care what is leaving the network, so I concentrate my NSM activities there. I noticed one of these TFTP-enabled devices trying to retrieve a file repeatedly. I looked closer at the traffic (thanks to Sguil I keep a record of traffic leaving for the Internet) and noticed I never saw any replies. Simultaneously I received an email from tech support for this device. They told me to unplug all Internet devices from my cable modem and plug the troublesome device into the cable modem overnight (!) My answer to that: "heck no." I decided to run an experiment with...

I've been trying to describe to management how close various individual information assets (primarily computers -- desktops, laptops, etc.) are to the doomsday scenario of sensitive data exfiltrated by unauthorized parties . This isn't the only type of incident that worries me, but it's the one I decided to tackle first. I view this situation as a continuum, rather than a "risk" rating. I'm trying summarize the state of affairs for an individual asset rather than "model risk." In the far left column I've listed some terms that may be unfamiliar. The first three rows bear "Vuln" ratings. I list these because some of my businesses consider the discovery of a vulnerability in an asset to be an "incident" by itself. Traditional incident detectors and responders don't think this way, but I wanted to include this aspect of our problem set. For these first three rows, I consider these assets to exist without any discoverab...

Last year I wrote Run Apps on Cisco ISR Routers . That was two weeks after our April Fool's joke that the Sguil Project Was Acquired by Cisco . I am wondering if any TaoSecurity Blog readers are using Cisco AXP in production? Looking at the data sheet for the modules, they appear too underpowered for NSM applications, especially at the price point Cisco is advertising. Richard Bejtlich is teaching new classes in Europe and Las Vegas in 2009. Online Europe registration ends by 1 Apr, and seats are filling. Early Las Vegas registration ends 1 May.

It's been a while since I've looked at the Sguil ports for FreeBSD, so I decided to see how they work. In this post I will talk about installing a Sguil sensor and server on a single FreeBSD 7.1 test VM using packages shipped with FreeBSD 7.1. To start with the system had no packages installed. After running pkg_add -vr sguil-sensor, I watched what was added to the system. I'm only going to document that which I found interesting. The sguil-sensor-0.7.0_2 package installed the following into /usr/local. x bin/sguil-sensor/log_packets.sh x bin/sguil-sensor/example_agent.tcl x bin/sguil-sensor/pcap_agent.tcl x bin/sguil-sensor/snort_agent.tcl x etc/sguil-sensor/example_agent.conf-sample x etc/sguil-sensor/pcap_agent.conf-sample x etc/sguil-sensor/snort_agent.conf-sample x etc/sguil-sensor/log_packets.conf-sample x share/doc/sguil-sensor x etc/rc.d/example_agent x etc/rc.d/pcap_agent x etc/rc.d/snort_agent Note that you have to copy pcap_agent.conf-sample log_packets.conf-...

In my post NSM-Friendly VMware Lab Setup I mentioned wanting to use NSMNow to install Sguil on Ubuntu 8.04 for student use in my next class. I had tried the Securix-NSM live CD but I had not tried installing Sguil using the same project's NSMNow scripts. I just did it: root@twsu804:/usr/local/src# wget http://www.securixlive.com/download/nsmnow/NSMnow-1.1.1.tar.gz --22:14:38-- http://www.securixlive.com/download/nsmnow/NSMnow-1.1.1.tar.gz => `NSMnow-1.1.1.tar.gz' Resolving www.securixlive.com... 202.191.61.156 Connecting to www.securixlive.com|202.191.61.156|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 164,613 (161K) [application/x-gzip] 100%[====================================>] 164,613 53.85K/s 22:14:42 (53.80 KB/s) - `NSMnow-1.1.1.tar.gz' saved [164613/164613] root@twsu804:/usr/local/src# tar -xzvf NSMnow-1.1.1.tar.gz NSMnow-1.1.1/ NSMnow-1.1.1/NSMnow-core NSMnow-1.1.1/RELEASE.NOTES NSMnow-1.1.1/templ...