牛角麵包 - 防禦入侵系統
牛角麵包 (Croissants) 是一項開源項目，但有一項同名的項目是商業版本的，開源版本的名字為牛角麵包 (社區版，Community Edition)。收費版本具有禦防網絡掃描器的偵測和推送更新的技術，其他的與開源版本大致是一樣的。
牛角麵包與統一威脅管理系統 (Unified Threat Management System, UTM) 和下世代防火牆 (Next Generation Firewall, NG Firewall) 有相當程度是相若的，不同的只是牛角麵包並沒有防火牆。
牛角麵包是由黑客設計與開發出來對付黑客的一個系統，不論他們是道德黑客或者是惡意黑客。
開源版的特性 ：
她具有統一威脅管理系統和下世代防火牆的大部份特性，例如防禦漏洞利用、防止病毒攻擊、惡意網絡地址黑名單、防禦惡意軟件攻擊、惡意網頁攻擊過濾、防止洋蔥網絡 (Tor) 瀏覽、防止有敵意的網絡流量、偵測網絡掃描器掃描等。
至於效能方面，她有極低延遲性的特點，有效地提高網絡遊戲的可玩性，而且能夠有效地播放 4K 的多媒體，她更能夠處理大約 40GB 或以上的流量，當然這也與硬件的規格有相當大的關係。
至於配置方面，她幾乎可以配置在網絡中的任何位置，包括網外和網內。如果再配合奧德拉 (Audra) (偵測入侵系統)，這樣每個網段都涵蓋得到。奧德拉也是基於牛角麵包 (社區版) 而設計的偵測入侵系統，其元件是完全一樣的。
收費版的特性 ：
除了具有社區版的功能外，她還有推送更新技術，如遇緊急情況，可以立刻對牛角麵包作出遠端更新，以求達到防禦入侵的最佳效果。
另外她還可以擋格所有網絡掃描器的偵測，令黑客不能有效地得到意圖入侵目標的資訊，從而未能有效地作出攻擊。如果盲目地作出攻擊，這是徒勞無功的。這樣就可以防止或延遲被入侵的可能性，這功能特別適合於有伺服器配置在網絡中的環境。
Samiux
OSCE OSCP OSWP
************
Croissants - Intrusion Detection and Prevention System
Croissants is an open source project and commercial project at the same time. Open source project is namely Croissants (Community Edition, CE) while commercial one is Croissants. Croissants and Croissants CE are almost the same. However, Croissants has some outstanding technique, such as push update and upgrade as well as blocking network scanning.
Croissants is very similar with Unified Threat Management System (UTM) and Next Generation Firewall (NG Firewall). However, Croissants does not have firewall anyway.
Croissants is designed by a hacker to defend against hackers. He knows what hackers are doing and thinking, regardless of whether they are ethical or malicious.
Croissants CE Features :
Croissants CE has similar features as UTM and NG Firewall, such as preventing vulnerabilities exploits, anti-virus, malicious IP address blacklisting, preventing malicious software, filtering web page attacks, preventing Tor network from being accessed, blocking malicious traffic, detecting network scanning, and etc.
It is an ultra-low latency system which is ideal for demanding online games and 4K video streaming. The maximum bandwidth of Croissants is over 40GB which is depending on the hardware configuration.
Croissants CE can be placed at any place in the network which is including outside and inside the network segments. When implemented with Audra (Intrusion Detection System), the traffic monitoring in the network can be covered completely. Meanwhile, Audra is designed based on Croissants CE.
Croissants Features :
Croissants has all the features as Croissants CE but it also has push update and upgrade features. It provides an emergency update or upgrade in order to provide a better protection to the network when needed.
In addition, it also can block network scanning. Once the scanning is blocked, hackers cannot obtain the information of the services and ports of the network/servers. They cannot launch any attack to the network blindly. You can be prevent from being attacked or delay of being attacked as a result. Croissants is ideal for network that providing connections to the public.
Samiux
OSCE OSCP OSWP
Reference
InfoSec Ninjas 资安忍者
Showing posts with label Suricata. Show all posts
Showing posts with label Suricata. Show all posts
Sunday, September 09, 2018
Wednesday, December 28, 2016
HOWTO : Build An Affordable Intrusion Detection And Prevention System For Home Users
What is Intrusion Detection And Prevention System?
Intrusion detection and prevention system (IDPS) monitors incoming and outgoing traffic on your network and blocks the malicious traffic (packets) based on rules (blacklists).
Why home users need IDPS?
Not only big companies need IDPS but also home users as long as they are connecting to the internet. Almost all home users installed anti-virus but it is not enough. They do need more protection against the cyber criminals.
However, most IDPS appliances are very expensive for home users. Most open source solutions are also demanding for them as they do not familiar with networking and technology.
What is Almond Croissants and Why?
Almond Croissants is an open source intrusion detection and prevention system which is based on Suricata engine. Suricata is the next-generation IDPS engine with a lot of outstanding features.
Users of Almond Croissants are not required to be familiar with networking and technology. It is designed for them in mind. Not only that, it is designed for low-end hardware too. It is really "Plug, Play and Forget!".
What are the key features of Almond Croissants?
- Block ports and vulnerabilities scanning
- Block known exploitation on vulnerable systems
- Block known malicious IP addresses to access your systems
- Block known source of Secure Shell (SSH) brute forcing
- Block The Onion Router (TOR) to access your systems
- Prevent from accessing known malicious sites with Secure Sockets Layer (SSL) certificates
- Prevent from being infected by known virus and malware
- Block known annoying advertising servers
- Easy and straight forward analysis with charts on web interfaces
- Compatible with Bittorrent and 4K video streaming
- Ultra-low latency for online gaming
- Compatible with Windows, Linux, macOS, Apple iOS and Android
- Ultra-low latency throughput that drives your network to a limit
- No subscription fee
- More protection for web servers
- More protection from known malware
- Block known phishing sites
- Automatically update and upgrade
- Plug, Play and Forget!
What hardware is required?
If you have a small family with 4 members and have about 200-250Mbps bandwidth, Zotac Mini PC CI323 (Intel Celeron N3150 with 16GB RAM) is recommended. Meanwhile, you may also require a USB 3.0 Gigabit Ethernet dongle. Yes, 16GB RAM. The vendor states that it supports up to 8GB RAM, however, you can install a total of 16GB RAM on it. A 320GB hard drive is also required. It requires a total of 3 network interface cards. The price of the system is below $400-USD. It is low power consumption for long run.
More powerful CPU and more memory are recommended for demanding situation. Almond Croissants is running on dedicated hardware. The minimum requirements for Almond Croissants is 2-4 CPU threads and 16GB RAM.
How to install?
Since ultra-low latency of Almond Croissants, it is recommended to put Almond Croissants between modem and router. Furthermore, you can install it between router and switch too. However, if you have a wireless router, it is recommended to put Almond Croissants in front of the wireless router.
First of all, you need to install Ubuntu Server (LTS edition) on the box. SSH server is recommended to be installed for remote management inside your network. It may need 8 or more hours to install Almond Croissants on Zotac Mini PC CI323. Make sure the box is connecting to the internet as it fetches the packages and data from various servers in the internet.
The installation procedure is well documented on the Almond Croissants official site. It is easy but it kills time.
After the installation, you can plug the Zotac Mini PC CI323 between modem and router. The USB Ethernet Card is connecting to switch. A reboot is required. It needs about 10 minutes to let all the rules and data load into the memory once boot up.
What's next?
Make sure firewall on your router is enabled and do not allow SSH port to be accessed outside your network unless it is well protected. Anti-virus program to be installed on every computer is optional but is recommended.
For further protection on your laptop and smartphone outside your home, you are required to setup a VPN inside your network. When you are using laptop at coffee shop or using smartphone on the road, you can connect to your VPN and your connection will be protected by Almond Croissants.
All rules and upgrade will be conducted during mid-night between 0100 and 0800 hours. Therefore, the box requires running 24/7/365 and server grade hardware is recommended.
See also
Almond Croissants - Intrusion Detection And Prevention System
Zotac Mini PC C Series
Suricata IDPS Engine
Hardening Mobile Devices with Intrusion Prevention System
Know Your Enemies and Know Yourself
OpenVPN official site
How To Set Up an OpenVPN Server on Ubuntu 16.04
Configure OpenVPN on Ubuntu 16.04
Intel Celeron N3150 Specifications
That's all! See you.
Intrusion detection and prevention system (IDPS) monitors incoming and outgoing traffic on your network and blocks the malicious traffic (packets) based on rules (blacklists).
Why home users need IDPS?
Not only big companies need IDPS but also home users as long as they are connecting to the internet. Almost all home users installed anti-virus but it is not enough. They do need more protection against the cyber criminals.
However, most IDPS appliances are very expensive for home users. Most open source solutions are also demanding for them as they do not familiar with networking and technology.
What is Almond Croissants and Why?
Almond Croissants is an open source intrusion detection and prevention system which is based on Suricata engine. Suricata is the next-generation IDPS engine with a lot of outstanding features.
Users of Almond Croissants are not required to be familiar with networking and technology. It is designed for them in mind. Not only that, it is designed for low-end hardware too. It is really "Plug, Play and Forget!".
What are the key features of Almond Croissants?
- Block ports and vulnerabilities scanning
- Block known exploitation on vulnerable systems
- Block known malicious IP addresses to access your systems
- Block known source of Secure Shell (SSH) brute forcing
- Block The Onion Router (TOR) to access your systems
- Prevent from accessing known malicious sites with Secure Sockets Layer (SSL) certificates
- Prevent from being infected by known virus and malware
- Block known annoying advertising servers
- Easy and straight forward analysis with charts on web interfaces
- Compatible with Bittorrent and 4K video streaming
- Ultra-low latency for online gaming
- Compatible with Windows, Linux, macOS, Apple iOS and Android
- Ultra-low latency throughput that drives your network to a limit
- No subscription fee
- More protection for web servers
- More protection from known malware
- Block known phishing sites
- Automatically update and upgrade
- Plug, Play and Forget!
What hardware is required?
If you have a small family with 4 members and have about 200-250Mbps bandwidth, Zotac Mini PC CI323 (Intel Celeron N3150 with 16GB RAM) is recommended. Meanwhile, you may also require a USB 3.0 Gigabit Ethernet dongle. Yes, 16GB RAM. The vendor states that it supports up to 8GB RAM, however, you can install a total of 16GB RAM on it. A 320GB hard drive is also required. It requires a total of 3 network interface cards. The price of the system is below $400-USD. It is low power consumption for long run.
More powerful CPU and more memory are recommended for demanding situation. Almond Croissants is running on dedicated hardware. The minimum requirements for Almond Croissants is 2-4 CPU threads and 16GB RAM.
How to install?
Since ultra-low latency of Almond Croissants, it is recommended to put Almond Croissants between modem and router. Furthermore, you can install it between router and switch too. However, if you have a wireless router, it is recommended to put Almond Croissants in front of the wireless router.
First of all, you need to install Ubuntu Server (LTS edition) on the box. SSH server is recommended to be installed for remote management inside your network. It may need 8 or more hours to install Almond Croissants on Zotac Mini PC CI323. Make sure the box is connecting to the internet as it fetches the packages and data from various servers in the internet.
The installation procedure is well documented on the Almond Croissants official site. It is easy but it kills time.
After the installation, you can plug the Zotac Mini PC CI323 between modem and router. The USB Ethernet Card is connecting to switch. A reboot is required. It needs about 10 minutes to let all the rules and data load into the memory once boot up.
What's next?
Make sure firewall on your router is enabled and do not allow SSH port to be accessed outside your network unless it is well protected. Anti-virus program to be installed on every computer is optional but is recommended.
For further protection on your laptop and smartphone outside your home, you are required to setup a VPN inside your network. When you are using laptop at coffee shop or using smartphone on the road, you can connect to your VPN and your connection will be protected by Almond Croissants.
All rules and upgrade will be conducted during mid-night between 0100 and 0800 hours. Therefore, the box requires running 24/7/365 and server grade hardware is recommended.
See also
Almond Croissants - Intrusion Detection And Prevention System
Zotac Mini PC C Series
Suricata IDPS Engine
Hardening Mobile Devices with Intrusion Prevention System
Know Your Enemies and Know Yourself
OpenVPN official site
How To Set Up an OpenVPN Server on Ubuntu 16.04
Configure OpenVPN on Ubuntu 16.04
Intel Celeron N3150 Specifications
That's all! See you.
Tuesday, December 13, 2016
Know Your Enemies and Know Yourself
Quotations
Sun Tzu's The Art of War (孙子兵法) says "If you know your enemies and know yourself, you will not be put at risk even in a hundred battles. If you only know yourself, but not your opponent, you may win or may lose. If you know neither yourself nor your enemy, you will always endanger yourself." (知彼知己，百战不殆；不知彼而知己，一胜一负；不知彼，不知己，每战必殆。) [source : Wikipedia]
Sun Tzu's The Art of War also says "All warfare is based on deception. Hence, when we are able to attack, we must seem unable; when using our forces, we must appear inactive; when we are near, we must make the enemy believe we are far away; when far away, we must make him believe we are near." (兵者，诡道也。故能而示之不能，用而示之不用，近而示之远，远而示之近。) [source : Wikipedia]
Reconnaissance
Most internet attack activities based on recon on the target. Recon can be conducted by active and passive methods. Active recon will cause a lot of noise to the target as it will collect information from the target directly while passive recon does not.
Once attackers gathered valuable information about the target, such as running services and versions on the target. They will launch exploits when there are vulnerable services running on the target. Once success, the target will be compromised and under the control of the attackers.
On the other hand, if there is no running vulnerable services on the target, attackers may launch social engineering attacks against the target, such as phishing mails, phishing sites, phishing phone calls, phishing downloads and etc. Social engineering may lead to compromise of the target as a result.
The captioned mention attacks can be based on randomly selected target or targeted victim. Furthermore, some attacks are directly by botnets which randomly selecting the targets and aimed to the vulnerable running services. Botnet attacks also have active recon stage as mentioned before.
Possible Defense
Besides some of social engineering attacks, we all know that all almost all attacks are following by recon. If attackers cannot get any valuable information from us, we can delay or even prevent the attack.
We all know that nmap can obtain information of the running services on the opening ports. If we can block nmap scanning from the beginning, attackers are required to guess which ports are opened and which services and versions are running on that ports. They cannot go further when they have no valuable information about us. If so, we can delay or even prevent the attacks. However, social engineering attacks may be launched soon by the attackers.
Commercial Solution
Some anti-virus for Windows system and some Unified Threats Management System (UTM) as well as some Intrusion Prevention System (IPS) can block port scanning. However, some of them failed to detect and block the nmap scan when it is scanning with special command flags. Meanwhile, anti-virus software and UTM as well as IPS may require to subscribe the signatures annually. In addition, commercial UTM and IPS are very expensive. It may cost a lot when long run.
Open Source Solution
Suricata and Snort are very famous Intrusion Detection and Prevention engines (IDPS). They are running based on blacklisting. Those blacklists are rules to alert or block the traffic when the traffic meets the criteria. There are open rules and paid rules available in the market. Some IDPS engines users can write their own rules to meet their requirements. However, some of the rules are written wrongly that causing false positive alert or even cannot detect the activities.
Not everyone is IDPS expert. Setting up a working Suricata or Snort appliance is painful. Users are required to troubleshoot all the problems that they are encountered. Sometimes are hardware limitations. Sometimes are false positive alerts/drops. Sometimes are IDPS engines limitations.
Plug, Play and Forget!
Almond Croissants is an open source IDPS based on Suricata engine. It is released under GPLv3 by Samiux since 2012. It is well tested on Windows, macOS, Linux, Apple iOS and Android. Engine and rules are updated automatically when they are available. Users are not required to be very familiar with IDPS. It not only can detect and block nmap scanning without pain but also have many outstanding features that most IDPS omitted. It is tasty and really "Plug, Play and Forget!"
That's all! See you.
Sun Tzu's The Art of War (孙子兵法) says "If you know your enemies and know yourself, you will not be put at risk even in a hundred battles. If you only know yourself, but not your opponent, you may win or may lose. If you know neither yourself nor your enemy, you will always endanger yourself." (知彼知己，百战不殆；不知彼而知己，一胜一负；不知彼，不知己，每战必殆。) [source : Wikipedia]
Sun Tzu's The Art of War also says "All warfare is based on deception. Hence, when we are able to attack, we must seem unable; when using our forces, we must appear inactive; when we are near, we must make the enemy believe we are far away; when far away, we must make him believe we are near." (兵者，诡道也。故能而示之不能，用而示之不用，近而示之远，远而示之近。) [source : Wikipedia]
Reconnaissance
Most internet attack activities based on recon on the target. Recon can be conducted by active and passive methods. Active recon will cause a lot of noise to the target as it will collect information from the target directly while passive recon does not.
Once attackers gathered valuable information about the target, such as running services and versions on the target. They will launch exploits when there are vulnerable services running on the target. Once success, the target will be compromised and under the control of the attackers.
On the other hand, if there is no running vulnerable services on the target, attackers may launch social engineering attacks against the target, such as phishing mails, phishing sites, phishing phone calls, phishing downloads and etc. Social engineering may lead to compromise of the target as a result.
The captioned mention attacks can be based on randomly selected target or targeted victim. Furthermore, some attacks are directly by botnets which randomly selecting the targets and aimed to the vulnerable running services. Botnet attacks also have active recon stage as mentioned before.
Possible Defense
Besides some of social engineering attacks, we all know that all almost all attacks are following by recon. If attackers cannot get any valuable information from us, we can delay or even prevent the attack.
We all know that nmap can obtain information of the running services on the opening ports. If we can block nmap scanning from the beginning, attackers are required to guess which ports are opened and which services and versions are running on that ports. They cannot go further when they have no valuable information about us. If so, we can delay or even prevent the attacks. However, social engineering attacks may be launched soon by the attackers.
Commercial Solution
Some anti-virus for Windows system and some Unified Threats Management System (UTM) as well as some Intrusion Prevention System (IPS) can block port scanning. However, some of them failed to detect and block the nmap scan when it is scanning with special command flags. Meanwhile, anti-virus software and UTM as well as IPS may require to subscribe the signatures annually. In addition, commercial UTM and IPS are very expensive. It may cost a lot when long run.
Open Source Solution
Suricata and Snort are very famous Intrusion Detection and Prevention engines (IDPS). They are running based on blacklisting. Those blacklists are rules to alert or block the traffic when the traffic meets the criteria. There are open rules and paid rules available in the market. Some IDPS engines users can write their own rules to meet their requirements. However, some of the rules are written wrongly that causing false positive alert or even cannot detect the activities.
Not everyone is IDPS expert. Setting up a working Suricata or Snort appliance is painful. Users are required to troubleshoot all the problems that they are encountered. Sometimes are hardware limitations. Sometimes are false positive alerts/drops. Sometimes are IDPS engines limitations.
Plug, Play and Forget!
Almond Croissants is an open source IDPS based on Suricata engine. It is released under GPLv3 by Samiux since 2012. It is well tested on Windows, macOS, Linux, Apple iOS and Android. Engine and rules are updated automatically when they are available. Users are not required to be very familiar with IDPS. It not only can detect and block nmap scanning without pain but also have many outstanding features that most IDPS omitted. It is tasty and really "Plug, Play and Forget!"
That's all! See you.
Monday, December 12, 2016
HOWTO : Traffic and Attack Map for Suricata
"Traffic & Attack Map for Suricata" is forked from Matthew May's Attack Map at GitHub
"Traffic & Attack Map for Suricata" is modified to work with Suricata's eve.json file. It shows the inbound traffic only which includes normal and attack traffic. It is designed for Python 3 and Ubuntu Server 16.04 LTS. It is also designed to install on the box of Suricata.
The map shows "DROP" or "ALERT" when the traffic is dropped or alerted by Suricata. Meanwhile, other traffic will be shown as its nature (Event Type), such as DNS, TLS, FILEINFO and etc.
License
"Traffic & Attack Map for Suricata" is released under GPLv3 by Samiux.
Requirements
(1) Working Suricata dedicate server as IDPS on Ubuntu Server
(2) Python 3.x
(3) Web server with websocket function
(4) Redis server
Package
Installation
Step 1 :
Change from :
To :
Step 2 :
Step 3 :
Step 4 :
Go to :
Go to :
replace the "192.168.20.180" with your Suricata IP.
Go to :
replace the value of L.LatLng with your location. You can go to http://latitudelongitude.org to find your Latitude and Longitude values.
Then configure your web server to point the root directory to "/var/www/geoip-attack-map/AttackMap". Make sure you have enabled "websocket" module or function on your web server. Meanwhile, the port for the websocket is 8888 by default.
*** Setting up web server to work with this project is out of scope of this guide.
Step 5 :
Since Redis server requires this setting to avoid performance issue, you need to edit the boot parameter in Grub.
Step 6 :
Once boot up, you can point your browser to the IP address that you entered in the above steps.
Troubleshooting
If there is no traffic on the map, it is properly the DataServer.py not working. Restart it is required.
*** Please note that it needs time to read the eve.json file from the beginning of the file on every restart.
Please also note that do not refresh or reload the page as it will corrupt the map. You need to restart the browser.
REFERENCE
Traffic and Attack Map for Suricata
That's all! See you!
"Traffic & Attack Map for Suricata" is modified to work with Suricata's eve.json file. It shows the inbound traffic only which includes normal and attack traffic. It is designed for Python 3 and Ubuntu Server 16.04 LTS. It is also designed to install on the box of Suricata.
The map shows "DROP" or "ALERT" when the traffic is dropped or alerted by Suricata. Meanwhile, other traffic will be shown as its nature (Event Type), such as DNS, TLS, FILEINFO and etc.
License
"Traffic & Attack Map for Suricata" is released under GPLv3 by Samiux.
Requirements
(1) Working Suricata dedicate server as IDPS on Ubuntu Server
(2) Python 3.x
(3) Web server with websocket function
(4) Redis server
Package
sha256sum fda369bd246048ce883fabb16e085caa022a492a7e188b4f0c99f37ea4bc8bdb attack-map-0.0.1.tar.gzInstallation
Step 1 :
sudo apt-get install python3-pip redis-server
sudo pip3 install tornado tornado-redis redis maxminddbsudo nano /etc/redis/redis.confChange from :
bind 127.0.0.1To :
bind 0.0.0.0Step 2 :
wget https://www.infosec-ninjas.com/files/attack-map-0.0.1.tar.gz
tar -xvzf attack-map-0.0.1.tar.gz
cd attack-map/geoip-attack-map
./db-dl.sh
cd ..
sudo cp -R geoip-attack-map /var/wwwStep 3 :
cd ..
sudo cp attackmap.service /lib/systemd/system/
sudo cp dataserver.service /lib/systemd/system/
sudo systemctl enable attackmap.service
sudo systemctl enable dataserver.serviceStep 4 :
cd /var/www/geoip-attack-map/DataServer
sudo nano DataServer.pyGo to :
hq_ip = '8.8.8.8' replace "hq_ip" with your external IP address.cd /var/www/geoip-attack-map/AttackMap
sudo nano trafficline.jsGo to :
var webSock = new WebSocket("ws://192.168.20.180:8888/websocket");replace the "192.168.20.180" with your Suricata IP.
Go to :
var hqLatLng = new L.LatLng(33.936051, -81.048565);replace the value of L.LatLng with your location. You can go to http://latitudelongitude.org to find your Latitude and Longitude values.
Then configure your web server to point the root directory to "/var/www/geoip-attack-map/AttackMap". Make sure you have enabled "websocket" module or function on your web server. Meanwhile, the port for the websocket is 8888 by default.
*** Setting up web server to work with this project is out of scope of this guide.
Step 5 :
Since Redis server requires this setting to avoid performance issue, you need to edit the boot parameter in Grub.
sudo nano /etc/default/grub
GRUB_CMDLINE_LINUX_DEFAULT="transparent_hugepage=never"
sudo update-grub
sudo rebootStep 6 :
Once boot up, you can point your browser to the IP address that you entered in the above steps.
Troubleshooting
If there is no traffic on the map, it is properly the DataServer.py not working. Restart it is required.
sudo systemctl restart dataserver*** Please note that it needs time to read the eve.json file from the beginning of the file on every restart.
Please also note that do not refresh or reload the page as it will corrupt the map. You need to restart the browser.
REFERENCE
Traffic and Attack Map for Suricata
That's all! See you!
Thursday, January 14, 2016
HOWTO : Network Security for Home and SOHO Users
Never think of Intrusion Prevention System (IPS) can be deployed at home or SOHO environment because of expensive cost? I have a good news for you that you can deploy IPS at home or SOHO with a very low price.
Croissants is an Intrusion Detection and Prevention System (IDPS) which is developed by me (Samiux). Its engine is next generation IDPS - Suricata. It is a very high performance engine.
Features of Croissants :
- Plug, Play and Forget!
- Suricata as IDPS Engine which is the Next Generation IDPS
- Based on ET Open rules (can use ET Pro rules with minimal settings)
- Work with ClamAV (Open Source Anti-Virus) MD5 signatures
- Work with LMD (Linux Malware Detect) MD5 signatures
- Work with IP Reputation blacklists
- Work with SSL Certificate blacklist
- Work with Denyhost SSH blacklist
- Work with Advertising Domains blacklist
- Drop certain traffic with minimal settings
- Disable and Enable rules with minimal settings
- Auto update ET Open rules, MD5 signatures and Blacklists
- Data analysis with charts on web interface
- 4K video streaming playback capable
- Can play common online games (but not ideal for playing demanding First Person Shooting games as it may has spikes) Demo videos
Zotac CI323 Nano Plus with Windows 10 equipped with 2 wired network interfaces and 1 wireless interface as well as 4GB RAM and onboard 32GB M.2 SSD.
Zotac CI323 Nano Plus is ideal to install Croissants when you insert extra 4GB RAM or replaced it with two 8GB RAM (total 16GB). I recommend to install 16GB RAM on it for better performance. Meanwhile, you need a wireless router. Croissants (special version for CI323) can be installed on the 32GB M.2 SSD with Ubuntu 14.04 LTS Server previously installed. However, it is better to install to hard drive or SSD drive.
You can get the special version at the following (the current version is 1.0-RELEASE). Please also note that the performance of 16GB version is higher than 8GB version :
8GB RAM Zotac CI323 - https://www.infosec-ninjas.com/files/croissants-1.0/croissants-home-ci323-1.0.1-RELEASE.tar.gz
sha256sum - a12f78ae571fa93dce0ee68f383c8b5af39a903ccaac09336dcaf0b9c5fd6278 croissants-home-ci323-1.0.1-RELEASE.tar.gz
16GB RAM Zotac CI323 - https://www.infosec-ninjas.com/files/croissants-1.0/croissants-smb-ci323-1.0.1-RELEASE.tar.gz
sha256sum - 759616b21235353953ab363f6ca8f6ecbe05e48a7988b0c771675596045959ba croissants-smb-ci323-1.0.1-RELEASE.tar.gz
Please refer to the Croissants website for the installation procedure. The procedure is similar to standard version of Croissants. Meanwhile, this special version will only keep 60 days data.
Make sure you connect Zotac CI323 between ISP and wireless rotuer and the monitoring cable should be connected to the router or switch (if any).
Before installing Croissants, you need to edit nsm.conf :
WIFI_SSID - The SSID of your wireless router
WIFI_PASSWORD - The password of your wireless router
The default monitoring IP will be x.x.x.180, such as 192.168.1.180.
To extend the security of your network, you may consider to add the following OpenDNS servers to your router.
OpenDNS FamilyShield DNS servers have build-in fraud and phishing protection as well as pre-configured to block adult content :
208.67.222.123
208.67.220.123
OpenDNS Home DNS servers have the captioned features but it can customized what content to be filtered. You can register to OpenDNS Home for the customization or just use the following servers without customization. They all use the following addresses :
208.67.222.222
208.67.220.220
OpenDNS DNS servers are compatible to Croissants.
REFERENCE
5 DNS Services to Block Porn Sites without Installing Software
HOWTO : Hardening and Tuning Ubuntu 14.04 LTS
That's all! See you.
Croissants is an Intrusion Detection and Prevention System (IDPS) which is developed by me (Samiux). Its engine is next generation IDPS - Suricata. It is a very high performance engine.
Features of Croissants :
- Plug, Play and Forget!
- Suricata as IDPS Engine which is the Next Generation IDPS
- Based on ET Open rules (can use ET Pro rules with minimal settings)
- Work with ClamAV (Open Source Anti-Virus) MD5 signatures
- Work with LMD (Linux Malware Detect) MD5 signatures
- Work with IP Reputation blacklists
- Work with SSL Certificate blacklist
- Work with Denyhost SSH blacklist
- Work with Advertising Domains blacklist
- Drop certain traffic with minimal settings
- Disable and Enable rules with minimal settings
- Auto update ET Open rules, MD5 signatures and Blacklists
- Data analysis with charts on web interface
- 4K video streaming playback capable
- Can play common online games (but not ideal for playing demanding First Person Shooting games as it may has spikes) Demo videos
Zotac CI323 Nano Plus with Windows 10 equipped with 2 wired network interfaces and 1 wireless interface as well as 4GB RAM and onboard 32GB M.2 SSD.
Zotac CI323 Nano Plus is ideal to install Croissants when you insert extra 4GB RAM or replaced it with two 8GB RAM (total 16GB). I recommend to install 16GB RAM on it for better performance. Meanwhile, you need a wireless router. Croissants (special version for CI323) can be installed on the 32GB M.2 SSD with Ubuntu 14.04 LTS Server previously installed. However, it is better to install to hard drive or SSD drive.
You can get the special version at the following (the current version is 1.0-RELEASE). Please also note that the performance of 16GB version is higher than 8GB version :
8GB RAM Zotac CI323 - https://www.infosec-ninjas.com/files/croissants-1.0/croissants-home-ci323-1.0.1-RELEASE.tar.gz
sha256sum - a12f78ae571fa93dce0ee68f383c8b5af39a903ccaac09336dcaf0b9c5fd6278 croissants-home-ci323-1.0.1-RELEASE.tar.gz
16GB RAM Zotac CI323 - https://www.infosec-ninjas.com/files/croissants-1.0/croissants-smb-ci323-1.0.1-RELEASE.tar.gz
sha256sum - 759616b21235353953ab363f6ca8f6ecbe05e48a7988b0c771675596045959ba croissants-smb-ci323-1.0.1-RELEASE.tar.gz
Please refer to the Croissants website for the installation procedure. The procedure is similar to standard version of Croissants. Meanwhile, this special version will only keep 60 days data.
Make sure you connect Zotac CI323 between ISP and wireless rotuer and the monitoring cable should be connected to the router or switch (if any).
Before installing Croissants, you need to edit nsm.conf :
WIFI_SSID - The SSID of your wireless router
WIFI_PASSWORD - The password of your wireless router
The default monitoring IP will be x.x.x.180, such as 192.168.1.180.
To extend the security of your network, you may consider to add the following OpenDNS servers to your router.
OpenDNS FamilyShield DNS servers have build-in fraud and phishing protection as well as pre-configured to block adult content :
208.67.222.123
208.67.220.123
OpenDNS Home DNS servers have the captioned features but it can customized what content to be filtered. You can register to OpenDNS Home for the customization or just use the following servers without customization. They all use the following addresses :
208.67.222.222
208.67.220.220
OpenDNS DNS servers are compatible to Croissants.
REFERENCE
5 DNS Services to Block Porn Sites without Installing Software
HOWTO : Hardening and Tuning Ubuntu 14.04 LTS
That's all! See you.
Monday, October 26, 2015
HOWTO : Detect and Prevent ICMP Tunnel Attack on Suricata
Recently, I read an article about ICMP Tunnel attack. It demo how to upload a file by encoding the content with Base64 via ICMP protocol.
There is a suricata rule for detecting large ICMP packet but it is disabled by default (dated Oct 26, 2015) currently, which is :
We can enable it by removing the "#" in front of the rule and change it to "drop".
However, it cannot detect the packet that is encoded with Base64. I draft the following Suricata rule and make it to "drop" base on the previous rule :
That's all! See you.
There is a suricata rule for detecting large ICMP packet but it is disabled by default (dated Oct 26, 2015) currently, which is :
#alert icmp any any -> any any (msg:"GPL ICMP Large ICMP Packet"; dsize:>800; reference:arachnids,246; classtype:bad-unknown; sid:1000029; rev:5;)We can enable it by removing the "#" in front of the rule and change it to "drop".
However, it cannot detect the packet that is encoded with Base64. I draft the following Suricata rule and make it to "drop" base on the previous rule :
drop icmp any any -> any any (msg:"LOCAL ICMP Large ICMP Packet (Base64)"; dsize:>800; content:"="; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/"; reference:url,www.notsosecure.com/2015/10/15/icmp-tunnels-a-case-study/; classtype:bad-unknown; sid:1000028; rev:1;)That's all! See you.
Thursday, October 22, 2015
HOWTO : Self-signed Certificate on Suricata
Problem
The most common weakness of Intrusion Detection and Prevention System is encrypted traffic inspection. The encrypted SSL/TLS traffic requires signed certificate for decryption. Some malicious activities may use self-signed certificate for the SSL/TLS connection.
Solution
How we can do that? If you are running Suricata as IPS, you can do it very easy with the reference of this blog. The rule will detect self-signed certificate without concerning of port number.
Make sure you have configure the Suricata properly according to the blog.
You can also use this rule for other purpose too.
Quick Reference
self-signed-cert.lua
The suricata rule is :
HOWTO : LuaJIT on Suricata
That's all! See you.
The most common weakness of Intrusion Detection and Prevention System is encrypted traffic inspection. The encrypted SSL/TLS traffic requires signed certificate for decryption. Some malicious activities may use self-signed certificate for the SSL/TLS connection.
Solution
How we can do that? If you are running Suricata as IPS, you can do it very easy with the reference of this blog. The rule will detect self-signed certificate without concerning of port number.
Make sure you have configure the Suricata properly according to the blog.
You can also use this rule for other purpose too.
Quick Reference
self-signed-cert.lua
The suricata rule is :
alert tls any any -> any any (msg:"SURICATA TLS Self Signed Certificate"; flow:established; luajit:self-signed-cert.lua; tls.store; classtype:protocol-command-decode; sid:999666111; rev:1;)HOWTO : LuaJIT on Suricata
That's all! See you.
Thursday, October 15, 2015
HOWTO : Detect and Prevent SSH Tunnel On Suricata
Problem
The most common weakness of Intrusion Detection and Prevention System is encrypted traffic inspection. The SSH encrypted traffic requires private/public keys for encryption/decryption and it is very hard to obtain the private key from attackers.
Solution
How we can do that? If you are running Suricata as IPS, SSH Dynamic, Reverse and Port Forwarding tunnel will be detected by the following rules :
The first rule will alert you that there is a SSH connection to the port 22. The second rule will block the traffic the not SSH protocol but connect to port 22. The last rule will block the SSH connection that are not connecting to port 22, 5228 or 6697, where port 5228 is Google Talk and port 6697 is IRC.
If you do not use standard port 22 for SSH, please change the value when necessary.
Reference
SSH Brute Force and Suricata
Protocol Anomalies Detection
That's all! See you.
The most common weakness of Intrusion Detection and Prevention System is encrypted traffic inspection. The SSH encrypted traffic requires private/public keys for encryption/decryption and it is very hard to obtain the private key from attackers.
Solution
How we can do that? If you are running Suricata as IPS, SSH Dynamic, Reverse and Port Forwarding tunnel will be detected by the following rules :
# ssh (port 5228=Google Talk, port 6697=IRC)
alert tcp any any -> any 22 (msg:"LOCAL SSH connect"; flow:established,to_server; app-layer-protocol:ssh; sid:1000008; rev:1;)
drop tcp any any -> any 22 (msg:"LOCAL not SSH but Port 22"; flow:established,to_server; app-layer-protocol:!ssh; sid:1000009; rev:1;)
drop tcp any any -> any ![22,5228,6697] (msg:"LOCAL SSH but not Port 22"; flow:established,to_server; app-layer-protocol:ssh; sid:1000010; rev:1;)The first rule will alert you that there is a SSH connection to the port 22. The second rule will block the traffic the not SSH protocol but connect to port 22. The last rule will block the SSH connection that are not connecting to port 22, 5228 or 6697, where port 5228 is Google Talk and port 6697 is IRC.
If you do not use standard port 22 for SSH, please change the value when necessary.
Reference
SSH Brute Force and Suricata
Protocol Anomalies Detection
That's all! See you.
Wednesday, October 14, 2015
HOWTO : LuaJIT on Suricata
What is LuaJIT?
LuaJIT is a Just-In-Time Compiler (JIT) for the Lua programming language. Lua is a powerful, dynamic and light-weight programming language. It may be embedded or used as a general-purpose, stand-alone language.
LuaJIT can be used as scripting lauguage for Suricata detection rules. Emerging Threats creates some lua scripts for Suricata at here.
Lua is not enabled by default on Suricata. You need to re-compile it to make it works.
If you compile Suricata from GitHub, you can :
Compile and Install of LuaJIT :
The current version at the writing is 2.0.4.
Compile and Install of Suricata on Ubuntu 14.04.3 LTS :
Works with ET Lua scripts :
# install lua related packages
# compile and install ltn12ce
# compile and install zlib
# compile and install lua-zlib
Make sure the ET lua scripts and related rules are placed at "/etc/suricata/rules" and the "luajit-drop.rules" or "luajit.rules" is loaded in suricata.yaml.
Bug Fix on ET Lua scripts :
Please note that CVE-2015-1770.lua and CVE-2015-2375.lua have a small bug when using with luajit. You can fix them like this :
Finally, if you are using Snorby, you need to copy the all rules files (except lua scripts) to another place, such as "/etc/suricata/rules/snorby" for Snorby; otherwise, Snorby cannot display the rules when requested. Meanwhile, you need to edit "/var/www/snorby/config/snorby_config.yml" for the new rules path.
One more thing, the value of "prealloc" at "flow" section at suricata.yaml should not more than "4000000"; otherwise, the lua scripts cannot be loaded.
After that, restart Suricata.
That's all! See you.
LuaJIT is a Just-In-Time Compiler (JIT) for the Lua programming language. Lua is a powerful, dynamic and light-weight programming language. It may be embedded or used as a general-purpose, stand-alone language.
LuaJIT can be used as scripting lauguage for Suricata detection rules. Emerging Threats creates some lua scripts for Suricata at here.
Lua is not enabled by default on Suricata. You need to re-compile it to make it works.
If you compile Suricata from GitHub, you can :
Compile and Install of LuaJIT :
The current version at the writing is 2.0.4.
cd ~
git clone http://luajit.org/git/luajit-2.0.git
cd luajit-2.0
make
sudo make installCompile and Install of Suricata on Ubuntu 14.04.3 LTS :
cd ~
git clone git://phalanx.openinfosecfoundation.org/oisf.git
cd oisf
git clone https://github.com/ironbee/libhtp.git
./autogen.sh
./configure --prefix=/usr/ --sysconfdir=/etc/ --localstatedir=/var/ --enable-luajit \
--enable-geoip --with-libnss-libraries=/usr/lib --with-libnss-includes=/usr/include/nss/ \
--with-libnspr-libraries=/usr/lib --with-libnspr-includes=/usr/include/nspr \
--with-libcap_ng-libraries=/usr/local/lib --with-libcap_ng-includes=/usr/local/include \
--with-libluajit-includes=/usr/local/include/luajit-2.0/ \
--with-libluajit-libraries=/usr/local/lib/
make clean
make
sudo make install
sudo ldconfigWorks with ET Lua scripts :
# install lua related packages
sudo apt-get -y install cmake lua-zip lua-zip-dev lua-zlib lua-zlib-dev \
luarocks libzzip-dev libzzip-0.13 lua-apr lua-apr-dev lua-socket \
lua-socket-dev lua-sec lua-sec-dev lua-rex-gnu lua-rex-gnu-dev \
lua-rex-pcre lua-rex-pcre-dev lua-bitop lua-bitop-dev liblua5.1 \
libzip-dev
sudo apt-get -y install cmake build-essential
sudo luarocks install struct
sudo luarocks install bitlib
sudo cp /usr/lib/x86_64-linux-gnu/liblua5.1.so /usr/local/lib/liblua.so# compile and install ltn12ce
cd ~
git clone https://github.com/mkottman/ltn12ce.git
cd ltn12ce
mkdir build && cd build
cmake ..
make
sudo make install
sudo mkdir -p /usr/local/lib/lua/5.1/ltn12ce
sudo cp ~/ltn12ce/build/src/ltn12ce/core.so /usr/local/lib/lua/5.1/ltn12ce# compile and install zlib
cd ~
wget http://zlib.net/zlib-1.2.8.tar.gz
tar -xzvf zlib-1.2.8.tar.gz
cd zlib-1.2.8
./configure
make
sudo make install# compile and install lua-zlib
cd ~
git clone https://github.com/brimworks/lua-zlib.git
cd lua-zlib
make linux
sudo mkdir -p /usr/lib/lua/5.1
sudo mkdir -p /usr/local/lib/lua/5.1
sudo cp zlib.so /usr/local/lib/lua/5.1
sudo make install
sudo cp /usr/lib/x86_64-linux-gnu/lua/5.1/zip.so /usr/local/lib/lua/5.1
sudo mkdir -p /usr/local/lib/lua/5.1/apr
sudo cp /usr/lib/x86_64-linux-gnu/lua/5.1/apr/core.so /usr/local/lib/lua/5.1/aprMake sure the ET lua scripts and related rules are placed at "/etc/suricata/rules" and the "luajit-drop.rules" or "luajit.rules" is loaded in suricata.yaml.
Bug Fix on ET Lua scripts :
Please note that CVE-2015-1770.lua and CVE-2015-2375.lua have a small bug when using with luajit. You can fix them like this :
sudo sed -i -e 's/activeX%d+\\.xml/activeX%d+.xml/g' /etc/suricata/rules/CVE-2015-1770.lua
sudo sed -i -e 's/table%d+\\.xml/table%d+.xml/g' /etc/suricata/rules/CVE-2015-2375.luaFinally, if you are using Snorby, you need to copy the all rules files (except lua scripts) to another place, such as "/etc/suricata/rules/snorby" for Snorby; otherwise, Snorby cannot display the rules when requested. Meanwhile, you need to edit "/var/www/snorby/config/snorby_config.yml" for the new rules path.
One more thing, the value of "prealloc" at "flow" section at suricata.yaml should not more than "4000000"; otherwise, the lua scripts cannot be loaded.
After that, restart Suricata.
That's all! See you.
Friday, October 09, 2015
HOWTO : ClamAV For Suricata
Suricata is an Intrusion Detection and Prevention System and it can work with ClamAV too. One of the features of Suricata is using MD5 hash with the file. We can use ClamAV signature MD5 hash for every file download inspection. We can also save the malicious file for further analysis.
Install and Configure of ClamAV
We will not use ClamAV engine for Suricata but use ClamAV MD5 signature instead.
Prepare ClamAV MD5 Signature for Suricata
Create cron job :
* The cron job will run the script (nsm_clamav_md5) at 0300 hours every day and it should be earlier than the Suricata rules update script/procedure.
Create your Suricata Local Rule
Append the following to the file :
Configure suricata.yaml
Make the following settings as the following :
* If you do not like to save the malicious file for further analysis, you can disable the "file-store" setting at suricata.yaml and remove the "filestore" keyword from the local.rules.
Make It To Work Together
Restart suricata or reboot the box. For Croissants, you can restart the Suricata by issuing the following command :
The Suricata will block the malicious files from downloading when the MD5 hash is matched and the malicious files will be saved at /var/log/suricata/files for further inspection.
Known Issue
libhtp 0.5.x cannot handle the file download re-try with browser at the moment. It is recommended that all users should not re-try to download any file when it cannot be downloaded in the beginning. According to the developer of libhtp, 0.6.x can handle this problem.
Another limitation is that Suricata can detected the malicious files (MD5 hash) that known to ClamAV only.
Reference
Filemd5 and white or black listing with MD5 hashes
That's all! See you.
Install and Configure of ClamAV
sudo apt-get update
sudo apt-get install clamav
sudo update-rc.d clamav-freshclam disableWe will not use ClamAV engine for Suricata but use ClamAV MD5 signature instead.
Prepare ClamAV MD5 Signature for Suricata
sudo nano /usr/bin/nsm_clamav_md5sudo chmod +x /usr/bin/nsm_clamav_md5Create cron job :
sudo crontab -e
0 03 * * * /usr/bin/nsm_clamav_md5* The cron job will run the script (nsm_clamav_md5) at 0300 hours every day and it should be earlier than the Suricata rules update script/procedure.
Create your Suricata Local Rule
sudo nano /etc/suricata/rules/local.rulesAppend the following to the file :
# rules for file extraction
# this rule drop all the file that matches the clamav md5 hash
drop http any any -> any any (msg:"LOCAL Malicious file - Clamav MD5 Hash"; flow:established; filestore; filemd5:blacklist_md5; classtype: suspicious-filename-detect; sid:1000000; rev:1;)Configure suricata.yaml
sudo nano /etc/suricata/suricata.yamlMake the following settings as the following :
* If you do not like to save the malicious file for further analysis, you can disable the "file-store" setting at suricata.yaml and remove the "filestore" keyword from the local.rules.
Make It To Work Together
sudo nsm_clamav_md5Restart suricata or reboot the box. For Croissants, you can restart the Suricata by issuing the following command :
sudo restart suricataThe Suricata will block the malicious files from downloading when the MD5 hash is matched and the malicious files will be saved at /var/log/suricata/files for further inspection.
Known Issue
libhtp 0.5.x cannot handle the file download re-try with browser at the moment. It is recommended that all users should not re-try to download any file when it cannot be downloaded in the beginning. According to the developer of libhtp, 0.6.x can handle this problem.
Another limitation is that Suricata can detected the malicious files (MD5 hash) that known to ClamAV only.
Reference
Filemd5 and white or black listing with MD5 hashes
That's all! See you.
Monday, July 13, 2015
HOWTO : Performance Test on Croissants
Croissants is an Intrusion Detection and Prevention System and it is running AF_PACKET as inline mode.
Hardware
Croissants :
Motherboard : ASRock Rack C2750D4I server board
CPU : Intel Atom C2750
RAM : 4 x 8GB (32GB) DDR3-1600
The performance of C2750 is similar to Xeon E3-1220L. Please refer to the comparison page at here.
Laptop(A) :
Model : Lenovo Thinkpad X200
RAM : 4 GB
Laptop(B) :
Model : Lenovo Thinkpad X201s
RAM : 8 GB
Software
Croissants
Croissants is installed with nsm_install_4core_16ram (version 0.1.5 dated July 13, 2015).
Laptop(A) and Laptop(B)
Connection
Laptop(A) --- Croissants --- Laptop(B)
Laptop(A) is set to 111.111.111.111 IP address and it is acting as server of iperf.
Laptop(B) is set to 111.111.111.112 IP address and it is acting as client of iperf.
Make sure Laptop(A) and Laptop(B) are pingable.
Performance Test
Croissants
Laptop(A)
Laptop(B)
Result
Crossiants - about 920 Mbps
Laptop(B) - about 820 Mbps
That's all! See you.
Hardware
Croissants :
Motherboard : ASRock Rack C2750D4I server board
CPU : Intel Atom C2750
RAM : 4 x 8GB (32GB) DDR3-1600
The performance of C2750 is similar to Xeon E3-1220L. Please refer to the comparison page at here.
Laptop(A) :
Model : Lenovo Thinkpad X200
RAM : 4 GB
Laptop(B) :
Model : Lenovo Thinkpad X201s
RAM : 8 GB
Software
Croissants
Croissants is installed with nsm_install_4core_16ram (version 0.1.5 dated July 13, 2015).
sudo apt-get update
sudo apt-get install glancesLaptop(A) and Laptop(B)
sudo apt-get update
sudo apt-get install iperfConnection
Laptop(A) --- Croissants --- Laptop(B)
Laptop(A) is set to 111.111.111.111 IP address and it is acting as server of iperf.
Laptop(B) is set to 111.111.111.112 IP address and it is acting as client of iperf.
Make sure Laptop(A) and Laptop(B) are pingable.
Performance Test
Croissants
glancesLaptop(A)
sudo iperf -s -p 80Laptop(B)
sudo iperf -c 111.111.111.111 -p 80 -P 50Result
Crossiants - about 920 Mbps
Laptop(B) - about 820 Mbps
That's all! See you.
Thursday, July 02, 2015
HOWTO : Protect My Home Network With Croissants 2
What is Croissants?
Croissants is an Intrusion Detection and Prevention System and running with Suricata. The components also including Snorby (Event Manager & Web Interface), Pigsty (Event Spooler) and Pulledpork (Rules Manager).
Suricata is a high performance Network IDS, IPS and Network Security Monitoring Engine. Croissants running on AF_PACKET with Suricata and it throughtput is up to 10Gbps traffic. AF_PACKET is one of Linux kernal modules since version 3.6 and it is designed for packet capturing. It is almost plug and play.
AF_PACKET can be running on a very low power consumption x86 computer, such as Intel Avoton C2750 Octa-Core CPU with 8GB RAM or more. This CPU is only running at 20W. I recommend to use at least 8GB RAM for home security purpose. More memory and faster as well as more cores Intel CPU for Home Office or larger business is suggested.
What Is My Home Network Looks Like?
I have 10Mbps internet connection. I do not run with any modem. I have a home router (TP-LINK TL-WR1043 v1.x with stock firmware). I have two home switches (TP-LINK TL-SG1008D, it is like a hub more than a switch in general).
I have a Linux web server, a Windows 7 desktop, several Linux boxes and some Mac machines as well as a Time Capsule. I connect these boxes to the home switches. I disabled the wireless function on my home router and use Time Capsule as wireless router and Time Machine for Mac machines.
I implement two IPS on my home network. The IPS is connected between ISP and the home router. The other IPS is connected between home router and home switches. Therefore, I can monitor the traffic outside and inside my home network. I do not trust internet and intranet at all.
What Is The Hardware?
I use Asrock Rack C2750D4I motherboard with one more Intel Gigabit Desktop LAN card as my IPS.
Since Asrock Rack C2750D4I motherboard comes with 2 network interfaces, I need one more Intel Gigabit Desktop network interface on each box for monitoring purpose.
I installed 32GB RAM and 320GB Hard Drive on each box as IPS.
Internet -- IPS -- router -- IPS -- switch -- PCs and Time Capsule (including web server)How About The Installation?
I select Ubuntu 14.04.2 LTS Server as the OS of the IDS/IPS. Since the network interfaces of Asrock Rack C2750D4I are Intel i210, the name of the interfaces on Ubuntu 14.04 is p119p1 and p121p1. While the Intel Gigabit Desktop network interface is eth0.
Install Ubuntu Server on the Asrock Rack C2750D4I as usual. Make sure you only connect the network cable to one of the network interfaces. I recommend you to install the OpenSSH when asks. Update and/or upgrade the Ubuntu Server when necessary.
Download the Croissants from here. The current version at the time of this writing is version 0.1.2 dated July 01, 2015.
Please follow the instructions on the official site to install. Configure the nsm.conf. Make sure to remember the password of MySQL as it will be asked when install. The username and password of control panel (Snorby) will also be configured. At the end of the installation, you will be asked for the time zone. Please select UTC. By the way, you may notice that there will have some error warning on the screen when installing. You just ignore it.
After the installation is completed, you can plug in the other network cables. Then, reboot the box. One more important thing is that you should configure your router to either DHCP or static IP addresses. If you selected DHCP, make sure it is reserved for the monitor interfaces (that is the Intel Gigabit Desktop network interfaces). The p119p1 and p121p1 do not have any IP address.
If everything correct, you can access to the monitor interfaces by using your browser, such as http://192.168.20.180. Enter your pre-set username and password when login. At the top right corner, select "Settings" to configure your time zone. Make sure you enter your password at "Current password (we need your current password to confirm your changes)" and then update the settings.
At this moment, your two boxes are in IDS mode. How to enable it to IPS mode?
You may need to change the name of the Intel Gigabit Desktop network interfaces when they are changed unexpected. You can change the name back to eth0 with the following command :
sudo nano /etc/udev/rules.d/70-persistent-net.rulesHow To Configure To IPS?
Log in to the two boxes via ssh or terminal. Then run the following command to configure the DROP rules.
sudo nano /etc/pulledpork/dropsid.confI suggest to append the following lines at the end of the files. They will block most unwanted traffic.
# HTTP request header invalid
1:2221013
# HTTP missing host header
1:2221014
# masscan port scanner
1:2017615,1:2017616
# DOS possible ssdp amplification scan
1:2019102
# DoS attacks -- UDP & ICMP Invalid checksum & packet too small
1:2200075,1:2200038,1:2200076,1:2200024
# IP & TCP Invalid checksum
1:2200073,1:2200074
# TCP packet too small
1:2200033
# stream established retransmission packet before last ack
#1:2210021
# stream established packet out of window
#1:2210020
# GPL attack response id check returned root
1:2100498
# COMPROMISED & DROP & CINS Active Threats
pcre:ET\sCOMPROMISED
pcre:ET\sDROP
pcre:ET\sCINS
# MALWARE, TROJAN, WORM, MOBILE_MALWARE, Amplification DoS, DDoS
pcre:ET\sMALWARE
pcre:ET\sTROJAN
pcre:WORM
pcre:ET\sMOBILE_MALWARE
pcre:ET\sSCAN
#pcre:ET\sSHELLCODE
pcre:Amplification
pcre:ET\sDOS
pcre:ET\sEXPLOIT
pcre:ET\sUSER_AGENTS
pcre:ET\sWEB_SERVER
pcre:GPL\sSNMP
#pcre:SURICATA\sSTREAM
pcre:ET\sCURRENT_EVENTS
pcre:ET\sWEB_SPECIFIC_APPS
# Outgoing basic auth base64 http password
1:2006380
# Quantum Insert Attack (by NSA)
# (SURICATA STREAM reassembly overlap with different data - 2210050)
# (LOCAL QI 302 and possible inject - 12345)
# https://github.com/fox-it/quantuminsert/tree/master/detection/suricata
1:2210050,1:12345
# GPL WEB_SERVER 403 Forbidden
1:2101201
# ET POLICY Suspicious inbound to MSSQL port 1433
1:2010935
# ET POLICY Suspicious inbound to mySQL port 3306
1:2010937
# SURICATA HTTP Host header ambiguous
1:2221015
# ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
1:2016149*** Please remember that you may enable some already disabled rules by the captioned setting. If you encounter any false positive alert, you can disable such rule(s) by the following.
sudo nano /etc/pulledpork/disablesid.confAppend the following at the end of the file, for example.
# TROJAN 1.1.1.1
1:2017000
# DELETED
pcre:ET\sDELETED
# MOBILE_MALWARE Google Android Device HTTP Request
1:2012251
# MALWARE WhenUClick.com Weather App Checkin (2)
1:2000915
# SURICATA STREAM alerts
#pcre:SURICATA\sSTREAM
# SURICATA STREAM
#1:2210000-1:2210049
#1:2210051-1:2210057
# SURICATA STREAM alert when downloading
1:2210021
1:2210020
1:2210029
1:2210045
1:2200074
1:2210038
1:2210044
# ET CURRENT_EVENTS Possible Dynamic DNS Exploit Pack
1:2014445
# ET WEB_SERVER WebShell
1:2016683
1:2016992
# ET TROJAN Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)
1:2009207
1:2009205
1:2009208
# ET TROJAN UPX compressed file download possible malware
1:2001046
# ET TROJAN VMProtect Packed Binary Inbound via HTTP
1:2009080
# ET WEB_SERVER Fake Googlebot UA 1 Inbound
#1:2015526After that, you can reload the rules by the following command.
sudo nsm_cronjob_rules_updateor
sudo nsm_rules_updateHow To Delete All Testing Traffic?
It is very easy to delete all testing traffic if you want to. However, it only delete all the traffic in the Snorby and leave all other setting untouched.
sudo nsm_snorby_db_reinstallIn addtion, I also suggest you to install anti-virus program on your Windows boxes for play safe. Meanwhile, you can classified the traffic on Snorby too.
The last thing should inform you that you are recommend to set the QoS at your router. Otherwise, the bandwidth will be consumed by one of the connections.
How About Performance Tuning?
You can follow this guide to tune the IDS/IPS to make it running more smoothly.
To have a more secured IDS/IPS, you can append the following line to the "
/etc/fstab".tmpfs /tmp tmpfs mode=1777,nosuid,nodev,noexec 0 0Then run the following commands before reboot. If you encountered any error, please do not reboot your boxes or you cannot boot them up.
sudo mount -a
sudo mount -o remount /Hope you enjoy your secured home network.
That's all! See you.
Monday, June 15, 2015
REVIEW : Shield - Intrusion Prevention System for Home Users
What is Shield?
Shield is a very small device that can protect your home and small business network from being attack by malicious hackers. The attacks include viruses, scams, phishing, website and browser exploits as well as operating system and application exploits. Shield protects your incoming and outgoing traffic. Even your system or network is compromised before using Shield, malicious hackers cannot control and access your system or network any further when Shield is implemented. Shield is also protecting your system or network from being scanning of vulnerabilities. That is excellent for preventing your system or network from being attack.
Shield acts as Intrusion Prevention System (IPS) or Unified Threat Management System (UTM). When it acts as IPS, the core engine is Suricata (Intrusion Detection and Prevention System). It is the simplest way to implement the device and its throughput is more than 1 Gbps. When it acts as UTM, its core engine is Snort (Intrusion Detection and Prevention System). This mode has a lot of features, such as web content filtering, anti-virus, VPN, QoS and etc. However, the slower throughput is the drawback for UTM mode.
Suricata and Snort are using Emerging Threats Open Rules for the operation. Emerging Threats Open Rules include malicious IP addresses, virus signatures, exploit signatures and attack signatures. It also include scanner signatures. According to Suricata developers, the maximum throughput of Suricata is more then 30 Gbps.
Shield includes a free lifetime subscription to stay up-to-date against the latest threats with automatic essential security updates. There is no number of user limitation in the device. It is designed for general users with no professional training in Information Security. It is very easy to setup and use. Plug, Play and Forget!
Business or DIY
There are some UTM or IDS/IPS available in the market. Those devices are developed for business and the prices are not reasonable for home or small business users. The cost will be over $1,000-USD. Meanwhile, the power consumption of those devices would be higher than Shield. Shield is only between 10W and 15W. Commercial UTM or IDS/IPS will have number of users restriction as well as cost for subscription annually of the rules and services.
On the other hand, we can build an UTM with Untangle; or, we can build a Suricata or Snort based IDS/IPS without paying for the software. However, the cost of hardware would be higher than the Shield for sure. For example, this motherboard costs about $399.99-USD. You also need to purchase hard drive, memory and computer case too. The power consumption for this hardware is between 35W to 80W. Shield would be cost around $300-USD only.
Recommended Setup
We suggest to plug Shield between your modem (if any) or Internet Service Provider (ISP) and router (wired or wireless) in Bridge Mode for excellent performance and protection.
If you do not have any router or you have a slower internet connection and the speed of the intranet is less than 1 Gbps, Router Mode can be implemented. The setup for Bridge and Router Modes are very easy and simple. No skill is required, believe me.
IPS (Bridge Mode)
UTM (Router Mode)
Technical Specifications
- 2 x 1.0 GHz MIPS64 CPU
- 1 GB DDR3 RAM
- 4 GB eMMC
- 3 x 1 GB Ethernet
- 1 x RJ45 Serial console port
- 5 x 3.5 x 1 inches
- between 10W and 15W power consumption
Features
Router Mode and Gateway Mode (UTM)
- Snort Engine
- Emerging Threats Rules
- Intrusion Prevention
- Network Anti-Virus
- NAT Firewall
- Content Filtering
- Web Proxying
- Dynamic DNS
- SSLVPN
- Quality of Service
- Graphical Web User Interface
- Realtime Traffic Monitor
- Realtime Connection Monitor
- Advanced and Basic Mode
- 10 Mbps throughput
- Plus More!
Bridge Mode (IPS)
- Suricata Engine
- Emerging Threats Rules
- Intrusion Prevention
- Graphical Web User Interface
- Realtime Traffic Monitor
- Realtime Connection Monitor
- Advanced and Basic Mode
- 40 Mbps throughput
Conclusion
Shield is well designed and the performance will not worse than other similar devices in the market. However, the price is rivalry. It is the first IDS/IPS/UTM for home users and small business. Being a Shield beta tester and developer of Croissants, I am fully satisfied with the performance, price, size and power consumption of Shield. It is really can be "Plug, Play and Forget!". Recommended!
That's all! See you.
Review in Chinese version
Monday, March 30, 2015
HOWTO : Trouble Shooting for Croissants
There may be a chance that your Croissants not working. We now talking about how to trouble shoot it.
Step 1 :
To see if "
Step 2 :
If you encounter no alert on the Snorby, you can check if the "
If you find more than one
Step 2a :
One more area to check for no alert is at Snorby.
Open the browser and point to the Snorby. "
Step 3 :
If you encounter any error, you can try to reboot the sensor (Croissants) to see if the problem is gone or not.
Step 4 :
To check the suricata.log to see if there is any error.
That's all! See you.
Step 1 :
To see if "
suricata", "pigsty" and "snorby" are working (existing) or not.sudo ps aux | grep suricata
sudo ps aux | grep pigsty
sudo ps aux | grep delayedStep 2 :
If you encounter no alert on the Snorby, you can check if the "
unified2.alert.*" is there. Please also note that it should be only one "unified2.alert.*" file.ls /var/log/suricataIf you find more than one
unified2.alert.*, delete the oldest and keep the current. Or simply delete all and then reboot.Step 2a :
One more area to check for no alert is at Snorby.
Open the browser and point to the Snorby. "
Administration" -- "Worker & Job Queue" is showing "OK" at the "Status".Step 3 :
If you encounter any error, you can try to reboot the sensor (Croissants) to see if the problem is gone or not.
Step 4 :
To check the suricata.log to see if there is any error.
nano /var/log/suricata.logThat's all! See you.
Thursday, March 26, 2015
HOWTO : Protect My Home Network With Croissants
*** THE CURRENT VERSION OF CROISSANTS IS 0.1.2 (CROISSANTS-20150701.TAR.GZ) which is released on July 01, 2015 ***
What is Croissants?
Croissants is an Intrusion Detection and Prevention System and running with Suricata. The components also including Snorby (Event Manager & Web Interface), Pigsty (Event Spooler) and Pulledpork (Rules Manager).
Suricata is a high performance Network IDS, IPS and Network Security Monitoring Engine. Croissants running on AF_PACKET with Suricata and it throughtput is up to 10GB traffic. AF_PACKET is one of Linux kernal modules since version 3.6 and it is designed for packet capturing. It is almost plug and play.
AF_PACKET can be running on a very low-end x86 computer, such as Intel ATOM D2550 CPU with 4GB or 8GB RAM. I recommend to use at least 8GB RAM for home security purpose. More memory and faster as well as more cores Intel CPU for Home Office or larger business is suggested.
What Is My Home Network Looks Like?
I have 10Mbps internet connection. I do not run with any modem. I have a home router (TP-LINK TL-WR1043 v1.x with stock firmware). I have two home switches (TP-LINK TL-SG1008D, it is like a hub more than a switch in general).
I have a Linux web server, a Windows 7 desktop, several Linux boxes and some Mac machines as well as a Time Capsule. I connect these boxes to the home switches. I disabled the wireless function on my home router and use Time Capsule as wireless router and Time Machine for Mac machines.
I implement two IPS on my home network. The IPS is connected between ISP and the home router. The other IPS is connected between home router and home switches. Therefore, I can monitor the traffic outside and inside my home network. I do not trust internet and intranet at all.
What Is The Hardware?
I use MINIX Mini HD PC as my IPS. You can watch its unboxing at YouTube.
Since MINIX Mini HD PC comes with 2 network interfaces, I need one more USB Gigabit Network interface on each box for monitoring purpose. You can either choose Level One USB-0401 USB Gigabit Ethernet Adapter or PCi USB 3.0 Gigabit LAN Adapter UE-1000T-G3 as they are fully compatible to Linux.
I installed 8GB RAM and 4GB RAM on IPS for experiment purpose. I suggest you to install 8GB RAM as MINIX Mini HD PC supports up to 8GB RAM even the official does not claimed that.
For better performance, I suggest you to use this motherboard with one more Intel LAN card and at least 8 GB RAM.
How About The Installation?
I select Ubuntu 14.04.2 LTS Server as the OS of the IDS/IPS. Since the network interfaces of MINIX Mini HD PC are Broadcom, the name of the interfaces on Ubuntu 14.04 is p2p1 and p4p1. While the USB Gigabit network interface is eth0.
Install Ubuntu Server on the MINIX Mini HD PC as usual. Make sure you only connect the network cable to one of the network interfaces. I recommend you to install the OpenSSH when asks. Update and/or upgrade the Ubuntu Server when necessary.
Download the Croissants from here. The current version at the time of this writing is version 0.1.2 dated July 01, 2015.
Please follow the instructions on the official site to install. Configure the nsm.conf. Make sure to remember the password of MySQL as it will be asked when install. The username and password of control panel (Snorby) will also be configured. At the end of the installation, you will be asked for the time zone. Please select UTC. By the way, you may notice that there will have some error warning on the screen when installing. You just ignore it.
After the installation is completed, you can plug in the other network cables and the USB network interface. Then, reboot the MINIX Mini HD PC(s). One more important thing is that you should configure your router to either DHCP or static IP addresses. If you selected DHCP, make sure it is reserved for the monitor interfaces (that is the USB Gigabit network interfaces). The p2p1 and p4p1 do not have any IP address.
If everything correct, you can access to the monitor interfaces by using your browser, such as http://192.168.20.180. Enter your pre-set username and password when login. At the top right corner, select "Settings" to configure your time zone. Make sure you enter your password at "Current password (we need your current password to confirm your changes)" and then update the settings.
At this moment, your two MINIX Mini HD PC are in IDS mode. How to enable it to IPS mode?
How To Configure To IPS?
Log in to the MINIX Mini HD PC via ssh or terminal. Then run the following command to configure the DROP rules.
I suggest to append the following lines at the end of the files. They will block most unwanted traffic.
*** Please remember that you may enable some already disabled rules by the captioned setting. If you encounter any false positive alert, you can disable such rule(s) by the following.
Append the following at the end of the file, for example.
After that, you can reload the rules by the following command.
or
How To Delete All Testing Traffic?
It is very easy to delete all testing traffic if you want to. However, it only delete all the traffic in the Snorby and leave all other setting untouched.
In addtion, I also suggest you to install anti-virus program on your Windows boxes for play safe. Meanwhile, you can classified the traffic on Snorby too.
The last thing should inform you that you are recommend to set the QoS at your router. Otherwise, the bandwidth will be consumed by one of the connections.
How About Performance Tuning?
You can follow this guide to tune the IDS/IPS to make it running more smoothly.
To have a more secured IDS/IPS, you can append the following line to the "
Then run the following commands before reboot. If you encountered any error, please do not reboot your boxes or you cannot boot them up.
Hope you enjoy your secured home network.
That's all! See you.
What is Croissants?
Croissants is an Intrusion Detection and Prevention System and running with Suricata. The components also including Snorby (Event Manager & Web Interface), Pigsty (Event Spooler) and Pulledpork (Rules Manager).
Suricata is a high performance Network IDS, IPS and Network Security Monitoring Engine. Croissants running on AF_PACKET with Suricata and it throughtput is up to 10GB traffic. AF_PACKET is one of Linux kernal modules since version 3.6 and it is designed for packet capturing. It is almost plug and play.
AF_PACKET can be running on a very low-end x86 computer, such as Intel ATOM D2550 CPU with 4GB or 8GB RAM. I recommend to use at least 8GB RAM for home security purpose. More memory and faster as well as more cores Intel CPU for Home Office or larger business is suggested.
What Is My Home Network Looks Like?
I have 10Mbps internet connection. I do not run with any modem. I have a home router (TP-LINK TL-WR1043 v1.x with stock firmware). I have two home switches (TP-LINK TL-SG1008D, it is like a hub more than a switch in general).
I have a Linux web server, a Windows 7 desktop, several Linux boxes and some Mac machines as well as a Time Capsule. I connect these boxes to the home switches. I disabled the wireless function on my home router and use Time Capsule as wireless router and Time Machine for Mac machines.
I implement two IPS on my home network. The IPS is connected between ISP and the home router. The other IPS is connected between home router and home switches. Therefore, I can monitor the traffic outside and inside my home network. I do not trust internet and intranet at all.
What Is The Hardware?
I use MINIX Mini HD PC as my IPS. You can watch its unboxing at YouTube.
Since MINIX Mini HD PC comes with 2 network interfaces, I need one more USB Gigabit Network interface on each box for monitoring purpose. You can either choose Level One USB-0401 USB Gigabit Ethernet Adapter or PCi USB 3.0 Gigabit LAN Adapter UE-1000T-G3 as they are fully compatible to Linux.
I installed 8GB RAM and 4GB RAM on IPS for experiment purpose. I suggest you to install 8GB RAM as MINIX Mini HD PC supports up to 8GB RAM even the official does not claimed that.
Internet -- IPS -- router -- IPS -- switch -- PCs and Time Capsule (including web server)For better performance, I suggest you to use this motherboard with one more Intel LAN card and at least 8 GB RAM.
How About The Installation?
I select Ubuntu 14.04.2 LTS Server as the OS of the IDS/IPS. Since the network interfaces of MINIX Mini HD PC are Broadcom, the name of the interfaces on Ubuntu 14.04 is p2p1 and p4p1. While the USB Gigabit network interface is eth0.
Install Ubuntu Server on the MINIX Mini HD PC as usual. Make sure you only connect the network cable to one of the network interfaces. I recommend you to install the OpenSSH when asks. Update and/or upgrade the Ubuntu Server when necessary.
Download the Croissants from here. The current version at the time of this writing is version 0.1.2 dated July 01, 2015.
Please follow the instructions on the official site to install. Configure the nsm.conf. Make sure to remember the password of MySQL as it will be asked when install. The username and password of control panel (Snorby) will also be configured. At the end of the installation, you will be asked for the time zone. Please select UTC. By the way, you may notice that there will have some error warning on the screen when installing. You just ignore it.
After the installation is completed, you can plug in the other network cables and the USB network interface. Then, reboot the MINIX Mini HD PC(s). One more important thing is that you should configure your router to either DHCP or static IP addresses. If you selected DHCP, make sure it is reserved for the monitor interfaces (that is the USB Gigabit network interfaces). The p2p1 and p4p1 do not have any IP address.
If everything correct, you can access to the monitor interfaces by using your browser, such as http://192.168.20.180. Enter your pre-set username and password when login. At the top right corner, select "Settings" to configure your time zone. Make sure you enter your password at "Current password (we need your current password to confirm your changes)" and then update the settings.
At this moment, your two MINIX Mini HD PC are in IDS mode. How to enable it to IPS mode?
How To Configure To IPS?
Log in to the MINIX Mini HD PC via ssh or terminal. Then run the following command to configure the DROP rules.
sudo nano /etc/pulledpork/dropsid.confI suggest to append the following lines at the end of the files. They will block most unwanted traffic.
# HTTP request header invalid
1:2221013
# HTTP missing host header
1:2221014
# masscan port scanner
1:2017615,1:2017616
# DOS possible ssdp amplification scan
1:2019102
# DoS attacks -- UDP & ICMP Invalid checksum & packet too small
1:2200075,1:2200038,1:2200076,1:2200024
# IP & TCP Invalid checksum
1:2200073,1:2200074
# TCP packet too small
1:2200033
# stream established retransmission packet before last ack
#1:2210021
# stream established packet out of window
#1:2210020
# GPL attack response id check returned root
1:2100498
# COMPROMISED & DROP & CINS Active Threats
pcre:ET\sCOMPROMISED
pcre:ET\sDROP
pcre:ET\sCINS
# MALWARE, TROJAN, WORM, MOBILE_MALWARE, Amplification DoS, DDoS
pcre:ET\sMALWARE
pcre:ET\sTROJAN
pcre:WORM
pcre:ET\sMOBILE_MALWARE
pcre:ET\sSCAN
#pcre:ET\sSHELLCODE
pcre:Amplification
pcre:ET\sDOS
pcre:ET\sEXPLOIT
pcre:ET\sUSER_AGENTS
pcre:ET\sWEB_SERVER
pcre:GPL\sSNMP
#pcre:SURICATA\sSTREAM
pcre:ET\sCURRENT_EVENTS
pcre:ET\sWEB_SPECIFIC_APPS
# Outgoing basic auth base64 http password
1:2006380
# Quantum Insert Attack (by NSA)
# (SURICATA STREAM reassembly overlap with different data - 2210050)
# (LOCAL QI 302 and possible inject - 12345)
# https://github.com/fox-it/quantuminsert/tree/master/detection/suricata
1:2210050,1:12345
# GPL WEB_SERVER 403 Forbidden
1:2101201
# ET POLICY Suspicious inbound to MSSQL port 1433
1:2010935
# ET POLICY Suspicious inbound to mySQL port 3306
1:2010937*** Please remember that you may enable some already disabled rules by the captioned setting. If you encounter any false positive alert, you can disable such rule(s) by the following.
sudo nano /etc/pulledpork/disablesid.confAppend the following at the end of the file, for example.
# TROJAN 1.1.1.1
1:2017000
# DELETED
pcre:ET\sDELETED
# MOBILE_MALWARE Google Android Device HTTP Request
1:2012251
# MALWARE WhenUClick.com Weather App Checkin (2)
1:2000915
# SURICATA STREAM alerts
#pcre:SURICATA\sSTREAM
# SURICATA STREAM
#1:2210000-1:2210049
#1:2210051-1:2210057
# SURICATA STREAM alert when downloading
1:2210021
1:2210020
1:2210029
1:2210045
1:2200074
1:2210038
1:2210044
# ET CURRENT_EVENTS Possible Dynamic DNS Exploit Pack
1:2014445
# ET WEB_SERVER WebShell
1:2016683
1:2016992
# ET TROJAN Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)
1:2009207
1:2009205
1:2009208
# ET TROJAN UPX compressed file download possible malware
1:2001046
# ET TROJAN VMProtect Packed Binary Inbound via HTTP
1:2009080
# ET WEB_SERVER Fake Googlebot UA 1 Inbound
#1:2015526After that, you can reload the rules by the following command.
sudo nsm_cronjob_rules_updateor
sudo nsm_rules_updateHow To Delete All Testing Traffic?
It is very easy to delete all testing traffic if you want to. However, it only delete all the traffic in the Snorby and leave all other setting untouched.
sudo nsm_snorby_db_reinstallIn addtion, I also suggest you to install anti-virus program on your Windows boxes for play safe. Meanwhile, you can classified the traffic on Snorby too.
The last thing should inform you that you are recommend to set the QoS at your router. Otherwise, the bandwidth will be consumed by one of the connections.
How About Performance Tuning?
You can follow this guide to tune the IDS/IPS to make it running more smoothly.
To have a more secured IDS/IPS, you can append the following line to the "
/etc/fstab".tmpfs /tmp tmpfs mode=1777,nosuid,nodev,noexec 0 0Then run the following commands before reboot. If you encountered any error, please do not reboot your boxes or you cannot boot them up.
sudo mount -a
sudo mount -o remount /Hope you enjoy your secured home network.
That's all! See you.
Friday, July 18, 2014
Defense your Network and Servers
Intruders will conduct reconnaissance on your network and servers before performing the attack. After that, intruders will perform the attack based on the information in hand.
In my opinion, the best way to defense your network and servers from being attacked is to interfere with the intruders' reconnaissance. When intruders cannot get any valuable information, they cannot perform the attack properly.
Most of the intruders use automatic tools, such as vulnerability scanners, to perform the reconnaissance and they seldom do it manually as it is harder for them especially for web applications. However, a small portion of advanced intruders may do it manually.
Hiawatha, a secure and advanced web server, can be configured to block vulnerability scanners from scanning the web server. Since the vulnerability scanners do not work properly, intruders cannot get any valuable information on the web server in order to launch an attack.
Suricata, a high performance network IDS, IPS and network security monitoring engine, used with Emerging Threats rules can be configured to drop the packet of the vulnerability scanners from scanning.
Web Application Firewall (WAF) and Intrusion Detection/Prevention System (IDS/IPS) as well as firewall can be bypassed by some of the advanced intruders. Therefore, blocking the vulnerability scanners is one of the good ways to defense your network and server from being attacked.
That's all! See you.
In my opinion, the best way to defense your network and servers from being attacked is to interfere with the intruders' reconnaissance. When intruders cannot get any valuable information, they cannot perform the attack properly.
Most of the intruders use automatic tools, such as vulnerability scanners, to perform the reconnaissance and they seldom do it manually as it is harder for them especially for web applications. However, a small portion of advanced intruders may do it manually.
Hiawatha, a secure and advanced web server, can be configured to block vulnerability scanners from scanning the web server. Since the vulnerability scanners do not work properly, intruders cannot get any valuable information on the web server in order to launch an attack.
Suricata, a high performance network IDS, IPS and network security monitoring engine, used with Emerging Threats rules can be configured to drop the packet of the vulnerability scanners from scanning.
Web Application Firewall (WAF) and Intrusion Detection/Prevention System (IDS/IPS) as well as firewall can be bypassed by some of the advanced intruders. Therefore, blocking the vulnerability scanners is one of the good ways to defense your network and server from being attacked.
That's all! See you.
Monday, May 19, 2014
Croissants - Intrusion Detection and Prevention System
INTRODUCTION
In 2013, I joined the SmoothSec project and modified it to adopt to Intrusion Detection and Prevention System by using Suricata with AF_PACKET. Since SmoothSec 3.4 is developed on Debian 7 (Wheezy), the Linux kernel 3.2.x is too old for Suricata with AF_PACKET. I used the backport kernel to complete the task. However, it makes the system not so easy to maintain.
Meanwhile, the SmoothSec project seems to be dead. The core developer does not active in the project and IRC channel. Therefore, I make up my mind to create a new project namely "Croissants" based on the SmoothSec. Croissants is designed for Ubuntu Server LTS or higher (Long Team Support only) and targeted to work with Suricata on AF_PACKET only. It is an Open Source Project under GPLv3 License by Samiux.
Croissants is a bash script instead of a Linux distribution likes SmoothSec. It downloads and compiles as well as setup the applications almost automatically. It combines with Suricata (IDPS Engine), Snorby (Event Manager & Web Interface), Pigsty (Event Spooler) and Pulledpork (Rules Manager). It will use the latest verion of the software on every installation but the only drawback is requiring internet.
WHY UBUNTU AND AF_PACKET?
I am a long term user of Ubuntu since 2006 (Ubuntu 6.06). I find that Ubuntu uses newer packages and kernel. Ubuntu can be set to update the system automatically, although you can do it with cron job. It makes the system almost up-to-date in order to avoid some known vulnerabilities attack. Therefore, you can focus on your business and network security monitoring (NSM). Furthermore, Ubuntu is free forever according to the founder, Mark Richard Shuttleworth.
AF_PACKET can be running on a very low-end computer, such as Intel ATOM D2550. The performance of the AF_PACKET is very good under this CPU on my home network. I can watch 720p Youtube video without lagging on my network (10Mbit internet and Gigabit internal network with Untangle UTM and Croissants). The amount of RAM is 8GB on this default setup. However, home router will be lagged while watching 720p Youtube video. This poor performance should be caused by the home router.
WHY CROISSANTS?
Croissants (food) is delicious and common as well as cheap in price. I would like Intrusion Detection and Prevention System is common and cheap in price that everyone can affort.
Croissants can run on a low-end computer such as Intel ATOM D2550 with 3 network interface cards and 4GB RAM. This configuration is ideal for home network and home office. For business, I recommended to have a more high-end multi-core computer and more than 32GB RAM for Croissants with some tuning on Suricata engine.
INSTALLATION
Make sure your computer can access to the internet when installing. Meanwhile, the "automatically update" should also be selected when installing Ubuntu Server. Set the Ubuntu Server LTS to UTC time zone at the end of the setup; otherwise, the time stamp of Snorby (event manager web application) will be incorrect. You are required to install OpenSSH only during the installation of Ubuntu Server.
Download the Croissants from here. Extracts it and runs the script namely "nsm_install" with "sudo". After that, re-cabling the computer when necessary and then reboot. That's all! However, the installation may take hours which is depending on the power of your hardware and the internet speed.
You can even reinstall the Snorby database by running "nsm_snorby_db_reinstall" after the trial run.
When you write some local rules, you can update them to the system by running the script "nsm_rules_update". When you want to update the Ubuntu Server, you can run "update_ubuntu". When updating the Croissants, you can run "update_nsm" which will update the system by compiling from source code that download from the internet. Make sure to run those scripts with "sudo".
In addition, Croissants will update the rules file on every 4 hours automatically.
That's all! See you.
Wednesday, December 18, 2013
HOWTO : Build a Fortress for Your Home/SOHO Network
**** Content is updated for SmoothSec 3.4-1 on January 30, 2014 ****
Hardware(A) Unified Threat Management System (UTM)
Minix Mini HD PC (J&W) :
CPU - Intel ATOM D2550 (dual-core and 4 Hyper-Threading)
Chipset - Intel NM10
GPU - Intel GMA 3600 Series
RAM - 2 x 2GB (DDR3-1066 SO-DIMM) 4GB
Hard Drive - 1 x 2.5-inch Hard Drive (80GB or above)
Networking - Dual Broadcom 57788 Gigabit Ethernet
(B) Intrusion Detection/Prevention System (IDS/IPS)
Minix Mini HD PC (J&W) :
CPU - Intel ATOM D2550 (dual-core and 4 Hyper-Threading)
Chipset - Intel NM10
GPU - Intel GMA 3600 Series
RAM - 2 x 4GB (DDR3-1066 SO-DIMM) 8GB
Hard Drive - 1 x 2.5-inch Hard Drive (120GB or above)
Networking - Dual Broadcom 57788 Gigabit Ethernet
USB Networking - PCi USB 3.0 Gigabit LAN Adapter UE-1000T-G3 or Level One USB Gigabit Ethernet USB-0401
* A switch is also required for this setup if you have more than one computer.
I prefer the setup is as the following :
Internet - SmoothSec (Suricata) - Router (Untangle UTM) - Switch (any switch) - ComputersSoftware
(A) Untangle 10.0 (64-bit) as UTM
Make sure you install the Lite Package which is free of charge. If you want to purchase their services, such as Standard, you can install Standard Package. For home/SOHO, Lite Package is enough.
After the basic installation, you need to create an account to the untangle.com in order to install Lite Package (or Standard Package).
(B) SmoothSec 3.4-1 (64-bit) as IDS/IPS with Suricata
Before setting up your SmoothSec, you need to upgrade the SmoothSec scripts to 3.6 and follow the instruction at the link just provided.
To set up IDS/IPS with Suricata, you can follow this section. Make sure you select “suricata” as AF_ENGINE in the configure file. Meanwhile, you should follow this section to set up.
For rules handling, you can refer to this link.
To fully understand the setup, you can read this article even it is written for 3.6 (not yet released at the moment) and the concept is the same.
Conclusion
Due to the high performance of AF_PACKET of Suricata, Broadcom 57788 Gigabit Ethernet and the Intel ATOM D2550 CPU, the network can play 1440p Youtube video without problem. The QoS is set to Medium in the Untangle 10.0 is recommended.
Meanwhile, Minix Mini HD PC is around $120-US (barebone without RAM and Hard drive) and the hardware cost is not too expensive to setup a fortress to your home/SOHO network. The running cost of this setup is very low as the software are free of charge. The footprint of the Minix Mini HD PC is very small. Smaller than a standard ITX computer case.
If you do not know how to manage SmoothSec (Suricata), you can install Untangle only.
Tuesday, September 24, 2013
HOWTO : High Performance IDS/IPS with SmoothSec 3.4
The following Intrusion Detection/Prevention System (IDS/IPS) setup is using AF_PACKET with SmoothSec 3.4. The following setup is for low traffic flow home and SOHO users (or you can say that it is a Proof-of-Concept). If your traffic is heavy, please consider to use a high-end hardware.
(A) Hardware
IDS/IPS -
Motherboard - Intel Desktop Board D510MO CPU - Intel Atom D510 (Dual-core with HT) RAM - 4GB (2 x 2GB) Hard Drive - 320GB Network Card 0 (eth0) - Onboard Gigabit Network Card 1 (eth1) - TP-Link TG-3269 Gigabit PCI Network Adapter (with low profile) Network Card 2 (eth2) - D-Link DUB-E100 USB 2.0 Fast Ethernet Adapter (up to 200MB) * You can select (1) Level One USB-0401 USB Gigabit Ethernet Adapter or (2) PCi USB 3.0 Gigabit LAN Adapter UE-1000T-G3 for eth2. However, you need to compile and install the driver yourself. Update : If you are using Backports latest kernel, the Level One USB-0401 and PCi UE-1000T-G3 are workable out of the box. Router - Motherboard - Intel Desktop Board D510MO CPU - Intel Atom D510 (Dual-core with HT) RAM - 4GB (2 x 2GB) Hard Drive - 320GB Network Card 0 (eth0) - Onboard Gigabit Network Card 1 (eth1) - TP-Link TG-3269 Gigabit PCI Network Adapter (with low profile) (B) Software IDS/IPS - Operating System - Debian 7.0 (Wheezy) IDS/IPS Pre-configure system - SmoothSec 3.4 (64-bit) IDS/IPS Engine - Snort (or Suricata) Unified2 Spooler - Pigsty Web Interface - Snorby Rules Management - PulledPork Router - Operating System - Untangle 9.4.2 (64-bit) * Basically, Untangle is a router and Unified Threat Management System (UTM). (C) Hardware Setup
After installed SmoothSec, type the following :
That's all! See you.
Motherboard - Intel Desktop Board D510MO CPU - Intel Atom D510 (Dual-core with HT) RAM - 4GB (2 x 2GB) Hard Drive - 320GB Network Card 0 (eth0) - Onboard Gigabit Network Card 1 (eth1) - TP-Link TG-3269 Gigabit PCI Network Adapter (with low profile) Network Card 2 (eth2) - D-Link DUB-E100 USB 2.0 Fast Ethernet Adapter (up to 200MB) * You can select (1) Level One USB-0401 USB Gigabit Ethernet Adapter or (2) PCi USB 3.0 Gigabit LAN Adapter UE-1000T-G3 for eth2. However, you need to compile and install the driver yourself. Update : If you are using Backports latest kernel, the Level One USB-0401 and PCi UE-1000T-G3 are workable out of the box. Router - Motherboard - Intel Desktop Board D510MO CPU - Intel Atom D510 (Dual-core with HT) RAM - 4GB (2 x 2GB) Hard Drive - 320GB Network Card 0 (eth0) - Onboard Gigabit Network Card 1 (eth1) - TP-Link TG-3269 Gigabit PCI Network Adapter (with low profile) (B) Software IDS/IPS - Operating System - Debian 7.0 (Wheezy) IDS/IPS Pre-configure system - SmoothSec 3.4 (64-bit) IDS/IPS Engine - Snort (or Suricata) Unified2 Spooler - Pigsty Web Interface - Snorby Rules Management - PulledPork Router - Operating System - Untangle 9.4.2 (64-bit) * Basically, Untangle is a router and Unified Threat Management System (UTM). (C) Hardware Setup
Internet ---- Router ---- SmoothSec ---- Switch ---- Personal Computers
Router -- eth0 connect to Internet; eth1 connect to SmoothSec
SmoothSec -- eth0 connect to Router; eth1 connect to Switch (uplink or port 1); eth2 connect to Switch (any port at 2 to 4)
* You can use any router to replace Untangle.
(D) Installation of SmoothSec
Download SmoothSec 3.4 at here or here.
Make sure the SmoothSec box can surf the internet; otherwise, installation will be failed. Or, you may re-arrange the cables when necessary.
Updated : Since the scripts for 3.4 has been updated to 3.4.1, you should follow the below link to upgrade the script to 3.4.1.
Upgrade to scripts version 3.4.1
The scripts 3.4.1 will install Backports newest kernel instead of Unstable kernel for Suricata IPS mode with AF_PACKET.
After installed SmoothSec, type the following :
smoothsec.first.setup
Snort -
Select "ips-standard" and following the instruction to install. Please also refer to here for the configuration of the config file. Make sure "AF_ENGINE" is set to "snort". The rules are "et" by default.
After install, reboot your box.
Suricata -
Select "ips-standard" and following the instruction to install. Please also refer to here for the configuration of the config file. Make sure "AF_ENGINE" is set to "suricata". The rules are "et" by default.
A new Linux kernel 3.10.2 will be installed at the end.
After install, reboot your box.
(E) Configuration of IDS/IPS
You may need to disable or/and drop some rules (sid).
Snort -
You may need to configure the /etc/snort/snort.conf :
nano /etc/snort/snort.conf
For example, the subnet is 192.168.1.0/24.
Replace "ipvar HOME_NET any" with "ipvar HOME_NET [192.168.1.0/24]"
Replace "ipvar EXTERNAL_NET any" with "ipvar EXTERNAL_NET ![192.168.1.0/24]"
Restart Snort :
/etc/init.d/snort restart
Disable rules :
nano /etc/pulledpork/snort/disablesid.conf
Drop rules :
nano /etc/pulledpork/snort/dropsid.conf
After doing that, reload the rules :
smoothsec.snort.rules.update
Suricata -
Disable rules :
nano /etc/pulledpork/suricata/disablesid.conf
Drop rules :
nano /etc/pulledpork/suricata/dropsid.conf
After doing that, reload the rules :
smoothsec.suricata.rules.update
* If the rule is too long to disable or drop, you may consider to edit "modifysid.conf". For example, to disable and drop the following rule :
To disable the rule :
2013437 "alert" "##alert";
To drop the rule :
2013437 "alert" "drop";
(F) Configuration of Snorby
For example, the sensor IP address is 192.168.1.180.
Point your browser to https://192.168.1.180. Enter the username and password of Snorby.
Setup the Snorby according to SmoothSec WiKi.
* If you want to sent your Snorby reports by Postfix, you need to install yourself and configure it then.
sudo apt-get install postfix
Select "Internet Site" when asked.
(G) IDS/IPS Tuning
There may be some false positive records. You need to tune the setting by adding the sid to the disablesid.conf or dropsid.conf when necessary. When use with dropsid.conf, yon may need to set firewall at Router to make the job done.
(H) Remarks
In the captioned setting, the SmoothSec acts as IDS and IPS in one box.
If you want to install IDS only, your SmoothSec only requires one Network Card which is connected to Switch.
In addition, SmoothSec 3.4 comes with Distributed IDS/IPS which allows you to deploy multi-sensors with one control panel (Snorby).
Furthermore, you can also reset your box to the fresh install environment :
smoothsec.reset
When using Snorby, you may need to browse for the rules sid. This link is for the rules lookup.
Make sure you create an empty file namely restart.txt under /var/www/snorby/tmp :touch /var/www/snorby/tmp/restart.txtThat's all! See you.
Monday, September 09, 2013
HOWTO : 15 Minutes to Deploy an IDS with SmoothSec 3.4
You can deploy your IDS (Intrusion Detection System) to your LAN within 15 minutes with SmoothSec 3.4. You can install SmoothSec 3.4 in virtual machine, such as VMWare, VirtualBox or Parallels.
The virtual machine is required at least one CPU, 1GB RAM and 8G+ HDD to run the IDS. The NIC is a bridged adaptor.
That's all! See you.
Subscribe to:
Posts (Atom)