Passive Host Auditing Using Snort And Other Free Tools by John Ives aka. jives

The Importance Of Auditing  Identify assets to better protect  Inventory of what you have and where it is on your network

The State Of Auditing Today  Relies primarily on active network scanning  Makes heavy usage of client agents  Difficult to impossible in chaotic decentralized environments

What Is Passive Auditing  Uses packets on the network to answer the question about the hosts  Does not affect end system logging  Uses black hat scans for white hat purposes  Aids policy enforcement  Ultimately its using event correlation to profile a host.

What Can Be Monitored Passively  OS  OS updates  Antivirus/firewall/spyware updates  Network services (e.g. telnet, ftp, http, etc.)  Open Ports  Service versions  Network Application Versions  Policies

What are its Downsides?  Getting started can be labor intensive.  It requires a lot of Data to build an accurate picture  It requires a commitment of time and money  It can be bypassed, but most end users won’t  It actually benefits from an ugly network!

Example Rule (AV/Firewall update) Symantec LiveUpdate alert tcp $HOME_NET any -> $EXTERNAL_NET 80 \ (msg:"PHA - user-agent Symantec liveupdate"; \ flow:to_server,established; \ content:"|0d0a|User-Agent\: Symantec LiveUpdate"; nocase; \ content:"|0d0a|Host\: liveupdate.symantecliveupdate.com"; nocase; \ threshold: type limit, track by_src, count 1, seconds 1800; )

Example packets (AV/Firewall update) Symantec LiveUpdate IP: > hlen=20 TOS=00 dgramlen=283 id=946B MF/DF=0/1 frag=0 TTL=126 proto=TCP cksum=CC44 TCP: port > 80 seq= ack= hlen=20 (data=243) UAPRSF= wnd=65535 cksum=74B4 urg=0 DATA: GET /symantec$20antivirus$20corporate$20client$20nt_9.0_english_livetri.zip HTTP/1.0. Accept: */*. Cache-Control: max-age=0. User-Agent: Symantec LiveUpdate. Host: liveupdate.symantecliveupdate.com : Pragma: no-cache..

Example Rule (OS Update) Windows updating for KB (MS05-026) alert tcp $HOME_NET any -> $EXTERNAL_NET 80 \ (msg:"PHA - Windows Update download KB MS05-026";\ content:"GET |2F|"; depth:5; nocase; \ content:"kb896358"; nocase; \ content:".exe HTTP|2F|1.1|0d0a|"; nocase;)

Example packets (OS Update) Windows ME updating for KB (MS05-026) IP: > hlen=20 TOS=00 dgramlen=282 id=2498 MF/DF=0/1 frag=0 TTL=125 proto=TCP cksum=EE37 TCP: port > 80 seq= ack= hlen=20 (data=242) UAPRSF= wnd=17520 cksum=8456 urg=0 DATA: GET /msdownload/update/v /cabpool/WindowsME-KB ENU_7e9ddccce2504c0ee808dffaf52c841.EXE HTTP/1.1. Accept: */*. Range: bytes= User-Agent: Progressive Download. Host: download.windowsupdate.com. Cache-Control: no-cache.

Example Rule (Anti-Spyware Detection) Microsoft Windows Malicious Software Removal Tool alert tcp $HOME_NET any -> $EXTERNAL_NET 80 \ (msg:"PHA - Windows Spyware Tool KB890830";\ content:"GET |2F|"; depth:5; nocase; \ content:"kb890830"; nocase; \ content:".exe HTTP|2F|1.1|0d0a|"; nocase;\ Content:"|0d0a|User-Agent: Microsoft BITS"; nocase;)

Example packets (Spyware Detection) Microsoft Windows Malicious Software Removal Tool IP: > hlen=20 TOS=00 dgramlen=326 id=0611 MF/DF=0/1 frag=0 TTL=125 proto=TCP cksum=4CFC TCP: port > 80 seq= ack= hlen=20 (data=286) UAPRSF= wnd=65535 cksum=0FBC urg=0 DATA: GET /msdownload/update/v /cabpool/windows-kb v1.5- delta-enu_21d25af a6b2dee41479b947829a529db.exe HTTP/1.1. Accept: */*. Accept-Encoding: identity. Range: bytes= User-Agent: Microsoft BITS/6.6. Host: au.download.windowsupdate.com. Connection: Keep-Alive.

Example Rule (OS Update Check-In) RedHat looking for updates via up2date alert tcp $HOME_NET any -> $EXTERNAL_NET 80 \ (msg:"PHA - RedHat Update Up2Date check-in"; flow:to_server,established; \ content:"GET |2F|"; depth:5; nocase; \ content:"header.info HTTP/1.1|0d0a|"; nocase;\ content:"|0d0a|User\-agent\: Up2date\/"; nocase;)

Example packets (OS Update Check-In) RedHat updating via up2date IP: > hlen=20 TOS=00 dgramlen=263 id=1C11 MF/DF=0/1 frag=0 TTL=61 proto=TCP cksum=B667 TCP: port > 80 seq= ack= hlen=32 (data=211) UAPRSF= wnd=1460 cksum=F466 urg=0 DATA: GET /pub/fedora/linux/core/3/i386/os/headers/header.info HTTP/1.1. Host: download.fedora.redhat.com. Accept-Encoding: identity. If-Modified-Since: Wed, 03 Nov :16:42 GMT. User-Agent: RHN-Applet/

Example Rule (another OS update) RedHat updating via up2date alert tcp $HOME_NET any -> $EXTERNAL_NET 80 \ (msg:"PHA - RedHat Update Up2Date check-in"; flow:to_server,established; \ content:"GET |2F|"; depth:5; nocase; \ content:“.rpm HTTP/1.1|0d0a|"; nocase;\ content:"|0d0a|User\-agent\: Up2date\/"; nocase;)

Example packets (another OS update) RedHat updating via up2date IP: > hlen=20 TOS=00 dgramlen=263 id=1C11 MF/DF=0/1 frag=0 TTL=61 proto=TCP cksum=B667 TCP: port > 80 seq= ack= hlen=32 (data=211) UAPRSF= wnd=1460 cksum=F466 urg=0 DATA: GET /pub/fedora/linux/core/updates/4/i386//kernel _FC4.i686.rpm HTTP/1.1 Accept-Encoding: identity Host: download.fedora.redhat.com Connection: close User-agent: Up2date /Yum

Misc. Example Rules Syn Packets for p0f alert tcp $HOME_NET any -> any any (msg:"PHA syn packet capture for p0f"; \ flags:s; threshold: type limit, track by_src, count 1, seconds 1800; ) IIS 5.1 on Windows XP alert tcp $HOME_NET 80 -> $EXTERNAL_NET any \ (msg:"PHA - IIS 5.1 running on Windows XP"; flow: from_server; \ content:"|0D 0A|Server\: Microsoft-IIS/5.1|0D 0A|"; nocase; \ threshold: type limit, track by_src, count 1, seconds 1800;)

Tools  Snort  p0f  tcpdump  tcpshow and/or ngrep  Bro IDS  Custom Scripts  Database

Thank You Thank you for coming today If you are interested in getting more information or volunteering to help out, you can me at Updated scripts, rules, etc will be available at