The document discusses Snort, an open source intrusion detection system. It describes what an IDS is, types of attacks, how Snort works using preprocessors and output plugins, and how to position Snort sensors in a network to detect both external and internal threats.

1. Reducing network
attacks with Snort
cleber brandao
cleber.brandao[nospam]locaweb.com.br
sexta-feira, 18 de novembro de 11

2. Agenda
• What is an IDS
• Types of attack
• Snort structure
•
How snort works
•
Preprocessors
•
Output plugins
•
Operation modes
• Positioning
• Q&A
sexta-feira, 18 de novembro de 11

3. What is an IDS?
• Intrusion Detection System
• Layer 7 analysis
• Just a sensor
• IPS can drop packets
• Pattern match or behavior
sexta-feira, 18 de novembro de 11

4. Types of attack
sexta-feira, 18 de novembro de 11

5. External attacks
sexta-feira, 18 de novembro de 11

6. Internal attacks
sexta-feira, 18 de novembro de 11

7. Unstructured attacks
sexta-feira, 18 de novembro de 11

8. Structured attacks
sexta-feira, 18 de novembro de 11

9. Understanding the
Snort
• Created in 1998 just like sniff
• Becomes as IDS in 1999
• Last version 2.9.1.2
sexta-feira, 18 de novembro de 11

10. How snort works
sexta-feira, 18 de novembro de 11

11. Preproccessors
• sfPortScan
• Frag3
• httpInspect
sexta-feira, 18 de novembro de 11

12. sfPortscan
• Half connection scans
• Decoy scans
• Distributed scans
• Port sweep scans
sexta-feira, 18 de novembro de 11

13. Frag3
• Detect anomalies in fragmented packets
sexta-feira, 18 de novembro de 11

14. Frag3 evasion
sexta-feira, 18 de novembro de 11

15. Frag3 evasion (2)
sexta-feira, 18 de novembro de 11

16. httpInspect
• HTTP normalization
sexta-feira, 18 de novembro de 11

17. httpInspect (sample)
• / = %2f
• . = %2e
• alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS
$HTTP_PORTS (msg:”WEB-ATTACKS /usr/bin/id command
attempt”;flow:to_server,established; content:”/usr/
bin/id”;nocase;classtype:web-application-
attack;sid:1332;rev:7;)
• %2fusr%2fbin%2fid = bybass
sexta-feira, 18 de novembro de 11

18. Output plugins
• Databases (mysql, postgre, oracle)
• Syslog
• Pcap (tcpdump, wireshark)
• Unified2
sexta-feira, 18 de novembro de 11

19. Operation modes
• IDS
• IPS
• Sniffer
• pcaps analysis
sexta-feira, 18 de novembro de 11

20. Positioning
• Sensor (port-mirror, network tap)
• IPS (bridge, gateway)
• Internal
• External
sexta-feira, 18 de novembro de 11

21. Questions ?
sexta-feira, 18 de novembro de 11

22. Where to find me
• Freenode - #securityguys, #snort-br
• Security conferences
• Buy me a Beer ;)
sexta-feira, 18 de novembro de 11

23. Thank you
• www.locaweb.com.br
• www.snort.org.br
• www.snort.org
• clebeerpub.blogspot.com
sexta-feira, 18 de novembro de 11