Caros,
Essa semana postarei o post inicial da serie e logicamente será com o básico explicando o funcionamento do snort . Abaixo montei a agenda do que pretendo escrever, não necessariamente falarei nessa ordem exata (logicamente algumas coisas tem que ser na ordem) e caso necessário adicionarei artigos, bem como novidades que deverão aparecer no decorrer da serie.
Pretendo atualizar/postar a cada semana ou no máximo 10 dias sendo que alguns posts serão maiores e mais complexos e alguns mais simples.
Agenda:
1-) Introdução Snort - http://spookerlabs.blogspot.com/2012/01/introducao-ao-snort-serie-snortando.html
2-) DAQ - Data Aquisition - http://spookerlabs.blogspot.com/2012/02/posicionamento-sensores-daq-data.html
3-) Entendendo básico do snort.conf - http://spookerlabs.blogspot.com/2012/03/entendendo-basico-do-snortconf-serie.html
4-) Introdução Decoders - http://spookerlabs.blogspot.com/2012/03/serie-snortando-parte-4-introducao-aos.html
5-) Introdução Pre-Processadores- http://spookerlabs.blogspot.com.br/2012/07/introducao-pre-processadores-serie.html
6-) Preproc Rules
7-) Stream5
8-) Frag3 - http://spookerlabs.blogspot.com.br/2012/04/frag3-preprocessor-serie-snortando.html
9-) Reputation
10-) SMTP
11-) Pop / Imap
12-) FTP/Telnet
13-) SFPortScan
14-) http_inspect
15-) Sensitive Data
16-) Performance (PerfProfiling)
17-) dcerpc2
18-) Razorback
19-) SSL/SSH
20-) Introdução Regras Snort
21-) Básico Criação de Regras
22-) Laboratorio Básico
23-) Tags avançadas
24-) Laboratorio Tags avançadas
25-) Host Attribute Table
26-) IPv6
27-) Posicionamento
28-) Interfaces de Gerenciamento (Snorby / BASE)
Como podemos observar será uma serie longa mas que visa realmente explicar o funcionamento da ferramenta para que possamos tirar o maximo proveito da ferramenta.
Tentarei se possivel fazer webex de alguns assuntos que fiquem muito complexo escrever e tentarei ao maximo sempre criar ferramentas para demonstrar na pratica a importancia da configuracao correta.
Espero que todos acompanhem! Essa semana postarei a introdução!
Happy Snorting!
Rodrigo "Sp0oKeR" Montoro!
Mostrando postagens com marcador ids. Mostrar todas as postagens
Mostrando postagens com marcador ids. Mostrar todas as postagens
domingo, 22 de janeiro de 2012
quinta-feira, 19 de janeiro de 2012
[Snort-devel] Snort 2.9.2.1 Now Available
Snort 2.9.2.1 is now available on snort.org, at
http://www.snort.org/snort-
2.9.0 RC & later packages are signed with a new PGP key
(that is signed with the previous key).
Snort 2.9.2.1 includes the following updates and improvements:
* Added new alerts for HTTP (undefined methods & HTTP 0.9 simple
requests).
* Updates to Stream preprocessor in TCP session tracking to avoid
re-queuing retransmitted data that was already flushed. Also
various tweaks for PAF flushing.
* Updates to reputation preprocessor to handle shared memory
switching.
* Updates to the SCADA preprocessors in their handling of PAF
flushing and Modbus request/response length checking. Also tweaks
in alerts for reserved DNP3 functions.
* Updates to flowbit groups to always use the group when some rules
refer to a flow group while others do not refer to a group for the
same flowbit.
* Updates to GTP preprocessor to check invalid extension header
length for GTPv1.
* Updates to sfrt library, used in reputation preprocessor and target
based configuration, when calculating memory allocated and support
for IPv6.
Please see the Release Notes and ChangeLog for more details.
Please submit bugs, questions, and feedback to bugs@snort.org.
Happy Snorting!
The Snort Release Team
http://www.snort.org/snort-
2.9.0 RC & later packages are signed with a new PGP key
(that is signed with the previous key).
Snort 2.9.2.1 includes the following updates and improvements:
* Added new alerts for HTTP (undefined methods & HTTP 0.9 simple
requests).
* Updates to Stream preprocessor in TCP session tracking to avoid
re-queuing retransmitted data that was already flushed. Also
various tweaks for PAF flushing.
* Updates to reputation preprocessor to handle shared memory
switching.
* Updates to the SCADA preprocessors in their handling of PAF
flushing and Modbus request/response length checking. Also tweaks
in alerts for reserved DNP3 functions.
* Updates to flowbit groups to always use the group when some rules
refer to a flow group while others do not refer to a group for the
same flowbit.
* Updates to GTP preprocessor to check invalid extension header
length for GTPv1.
* Updates to sfrt library, used in reputation preprocessor and target
based configuration, when calculating memory allocated and support
for IPv6.
Please see the Release Notes and ChangeLog for more details.
Please submit bugs, questions, and feedback to bugs@snort.org.
Happy Snorting!
The Snort Release Team
[Emerging-Sigs] Suricata 1.2 Available!
The OISF development team is proud to announce Suricata 1.2. This release brings HTTP file inspection and extraction and a whole lot more.
Get the new release here:
http://www.
The configuration file has evolved but backward compatibility is provided. We thus encourage you to update your suricata configuration file. Upgrade guidance is provided here:
https://redmine.
New features
- file name, type inspection and extraction for HTTP
- filename, fileext, filemagic and filestore keywords added
- "file" output for storing extracted files to disk
- file_data keyword support, inspecting normalized, dechunked, decompressed HTTP response body (feature #241)
- new keyword http_server_body, pcre regex /S option
- option to enable/disable core dumping from the suricata.yaml (enabled by default)
- human readable size limit settings in suricata.yaml (bug #333)
- PF_RING bpf support (required PF_RING >= 5.2) (feature #334)
- tos keyword support (feature #364)
- IPFW IPS mode does now support multiple divert sockets
- new IPS running modes, Linux and FreeBSD do now support "worker" and "autofp"
- app-layer-events keyword: similar to the decoder-events and stream-events, this will allow matching on HTTP and SMTP events
- auto detection of checksum offloading per interface (#311)
- urilen options to match on raw or normalised URI (#341)
- flow keyword option "only_stream" and "no_stream"
- unixsock output options for all outputs except unified2 (PoC python script in the qa/ dir) (#250)
- http_header and http_raw_header now also inspect HTTP response headers (#389, #397)
Improvements
- general performance improvements
- improved alert accuracy in autofp and single runmodes
- major performance optimizations for the ac-gfbs pattern matcher implementation
- unified2 output fixes
- PF_RING supports privilege dropping now (bug #367)
- improved detection of duplicate signatures
- improved performance in virtual machines (bug #382)
- PCRE-JIT is now enabled by default if available (#356)
- flowbits and flowints are now modified in a post-match action list
- bundled libhtp updated to 0.2.7
- fixed parsing really high sid numbers >2 Billion (#393)
- fixed ICMPv6 not matching in IP-only sigs (#363)
Fixes since 1.2rc1
- improved Windows/CYGWIN path handling (#387)
- fixed some issues with passing an interface or ip address with -i
- make live worker runmode threads adhere to the 'detect' cpu affinity settings
Known issues & missing features
If you encounter issues, please let us know! As always, we are doing our best to make you aware of continuing development and items within the engine that are not yet complete or optimal. With this in mind, please notice the list we have included of known items we are working on.
See http://redmine.
See http://redmine.
for a discussion and time line for the major issues.
Happy Detection!
Rodrigo Montoro
Get the new release here:
http://www.
The configuration file has evolved but backward compatibility is provided. We thus encourage you to update your suricata configuration file. Upgrade guidance is provided here:
https://redmine.
New features
- file name, type inspection and extraction for HTTP
- filename, fileext, filemagic and filestore keywords added
- "file" output for storing extracted files to disk
- file_data keyword support, inspecting normalized, dechunked, decompressed HTTP response body (feature #241)
- new keyword http_server_body, pcre regex /S option
- option to enable/disable core dumping from the suricata.yaml (enabled by default)
- human readable size limit settings in suricata.yaml (bug #333)
- PF_RING bpf support (required PF_RING >= 5.2) (feature #334)
- tos keyword support (feature #364)
- IPFW IPS mode does now support multiple divert sockets
- new IPS running modes, Linux and FreeBSD do now support "worker" and "autofp"
- app-layer-events keyword: similar to the decoder-events and stream-events, this will allow matching on HTTP and SMTP events
- auto detection of checksum offloading per interface (#311)
- urilen options to match on raw or normalised URI (#341)
- flow keyword option "only_stream" and "no_stream"
- unixsock output options for all outputs except unified2 (PoC python script in the qa/ dir) (#250)
- http_header and http_raw_header now also inspect HTTP response headers (#389, #397)
Improvements
- general performance improvements
- improved alert accuracy in autofp and single runmodes
- major performance optimizations for the ac-gfbs pattern matcher implementation
- unified2 output fixes
- PF_RING supports privilege dropping now (bug #367)
- improved detection of duplicate signatures
- improved performance in virtual machines (bug #382)
- PCRE-JIT is now enabled by default if available (#356)
- flowbits and flowints are now modified in a post-match action list
- bundled libhtp updated to 0.2.7
- fixed parsing really high sid numbers >2 Billion (#393)
- fixed ICMPv6 not matching in IP-only sigs (#363)
Fixes since 1.2rc1
- improved Windows/CYGWIN path handling (#387)
- fixed some issues with passing an interface or ip address with -i
- make live worker runmode threads adhere to the 'detect' cpu affinity settings
Known issues & missing features
If you encounter issues, please let us know! As always, we are doing our best to make you aware of continuing development and items within the engine that are not yet complete or optimal. With this in mind, please notice the list we have included of known items we are working on.
See http://redmine.
See http://redmine.
for a discussion and time line for the major issues.
Happy Detection!
Rodrigo Montoro
quarta-feira, 7 de julho de 2010
Intrusion Prevention Summit (Online) – July 8, 2010
Meio de ultima hora mas recebi isso no linkedin e achei bem interessante pois alem de ser free tambem sera online (em ingles).
I have included below links to a free online summit on Intrusion Prevention that takes place on July 8. At this summit, leading experts will look at the emerging threat landscape and provide tips to ensure your security management program can best overcome these new challenges in intrusion prevention. It will also cover key aspects in detecting, patching and immunizing your network to prevent repeated attacks from occurring. Hear leading industry experts from TechTarget, Vodafone, SecureWorks, ISACA, Fortinet and more as they discuss the latest innovations, best practices, barriers to implementation and measurable benefits of intrusion prevention.
Register here: http://www.brighttalk.com/r/svf
Intrusion Prevention Summit Presentations Include:
“When Prevention Fails: The Role of IPS in Incident Response”
C. Matthew Curtin, Founder, Interhack
“Threat Prevention for 2010 and Beyond”
Jason Clark, SE Manager, US Channels, Fortinet
“Network Intrusion Prevention vs. Anomaly Detection
Mike Fratto, Editor, Network Computing
“Top Risks Associated with Implementing IPS”
Marco Ermini, Network Security Manager, Vodafone Group Services
“The Digital Disaster – Dealing with Computer Incidents”
Jan Collie, Manager Director & Principal Investigator, The Digital Detective Ltd.
“Why “Human Intelligence” is Critical to Effective IPS
Paul Pearston, Security Solutions Architect, SecureWorks
“Intrusion Prevention, Are We Joking?
Mark Henshaw, Director, ISACA London & Chairman, ISACA Winchester
“What’s the Future for Intrusion Prevention? Key 2011 Trends”
Ron Condon, UK Bureau Chief, TechTarget
Register here: http://www.brighttalk.com/r/svf
Posted By Holger Schulze
Happy Detection!
Rodrigo Montoro(Sp0oKeR
I have included below links to a free online summit on Intrusion Prevention that takes place on July 8. At this summit, leading experts will look at the emerging threat landscape and provide tips to ensure your security management program can best overcome these new challenges in intrusion prevention. It will also cover key aspects in detecting, patching and immunizing your network to prevent repeated attacks from occurring. Hear leading industry experts from TechTarget, Vodafone, SecureWorks, ISACA, Fortinet and more as they discuss the latest innovations, best practices, barriers to implementation and measurable benefits of intrusion prevention.
Register here: http://www.brighttalk.com/r/svf
Intrusion Prevention Summit Presentations Include:
“When Prevention Fails: The Role of IPS in Incident Response”
C. Matthew Curtin, Founder, Interhack
“Threat Prevention for 2010 and Beyond”
Jason Clark, SE Manager, US Channels, Fortinet
“Network Intrusion Prevention vs. Anomaly Detection
Mike Fratto, Editor, Network Computing
“Top Risks Associated with Implementing IPS”
Marco Ermini, Network Security Manager, Vodafone Group Services
“The Digital Disaster – Dealing with Computer Incidents”
Jan Collie, Manager Director & Principal Investigator, The Digital Detective Ltd.
“Why “Human Intelligence” is Critical to Effective IPS
Paul Pearston, Security Solutions Architect, SecureWorks
“Intrusion Prevention, Are We Joking?
Mark Henshaw, Director, ISACA London & Chairman, ISACA Winchester
“What’s the Future for Intrusion Prevention? Key 2011 Trends”
Ron Condon, UK Bureau Chief, TechTarget
Register here: http://www.brighttalk.com/r/svf
Posted By Holger Schulze
Happy Detection!
Rodrigo Montoro(Sp0oKeR
Assinar:
Postagens (Atom)