Wow, I'm really kind of surprised there's this many people.
I'm going to start off with a warning for those of you who
are thinking that you might be able to attack other people
using what I'm going to talk about.
I have yet to figure out a black hat method,
a black hat use for this,
because if you already own the IDSS,
it's too late, you know, you can get everything,
and I'm only looking for the good things.
What I'm talking about is passive auditing.
We encountered a problem where I work where
we have so many users
that it became really difficult to find out
what they're doing, because nobody wanted to run
like a client or something, so we couldn't see
what activity they were doing, you know,
were they patching, stuff like this.
So we started developing signatures, actually,
that actually kind of takes that out,
and actually eliminates the need for us
to actually run a client on the end users.
And so that's what I'm going to talk about here,
is what the signatures are, the sort of things
you can find out in signatures,
just by watching the network passively.
So, of course, a brief introduction
to why you need to audit.
It identifies assets, so that
when you get your alerts going through,
you know, if there's an attack on IIS,
do you really care if it hit an
Apache box?
An inventory of what you have, where you have it,
you know, all that other good stuff.
The state of auditing today, basically,
it relies a lot on active scanning.
It uses the heavy usage of clients,
so you need to have a client on that
end machine, you connect to that client,
you know, it runs the scan, tells you
what's on the box, and it's difficult
or impossible in a decentralized environment.
I work at a major university,
we have about, we have
three class B
addresses and about a dozen
class Cs.
You know, it becomes really kind of difficult in that environment.
Especially since most of them
don't like us.
What we're
doing with passive auditing is we're using packets on the
network, stuff that they're doing anyways, to find out
what their patch levels are,
whether they're doing antivirus
software, whether they're updating at all,
what OSs are doing.
It does not affect
end system logging, that's one of the great things about it,
is we get a lot of complaints every time we do try
to scan, because they complain
ad nauseum about the amount of logs
they get. My feeling is
tough, but okay.
Also, we get to take advantage of all those
black hat scans that are coming through. When you're in a university,
you frequently don't have firewalls,
or you have very limited use of firewalls,
so I can find out what ports are open
without ever touching the box, because the traffic
goes across my sensors. I've got it.
It aids policy
enforcement. Some people like policies,
some people don't.
Ultimately, what it comes down to is event
correlation, and that's where it becomes a real
pain in the ass. And when you're looking
at that many hosts, you know, if you
want to keep track of what their patch level is,
that's, you know, every patch has its own
little line in that database,
correlated to IP address, or MAC.
If you can get access to them, our cache,
it's a lot easier.
So these are things that we can monitor passively,
OS.
OS updates, whether
they're getting antivirus and firewalls and spyware
updates. Network
services, are they using Telnet, FTP,
whatever.
Open ports,
service versions, network application
versions, that's mostly, that's more banner
grabbing, though if you really get into it,
there are ways of telling without
actually grabbing banners,
and policies.
The downsides of this is,
well, it's labor intensive, it takes up
a lot of disk space, it takes a lot of time
to build the big picture
that you need, because you will not get it in
the first week. In fact, you probably won't
get it in the first couple months. You have to
start really accumulating data before you know
what's happening.
It takes a lot of data.
It requires a commitment of time and money, and that's
not always something that works out well.
You know, if everybody's saying, well, we need to know this
data now, go buy a scanner.
Hopefully you get through the firewalls.
If you are willing to actually take the time, you'll
get a better, you'll get a different picture
than if you do scanning.
It can be bypassed.
If people manually download
stuff to one machine, and they copy
off that patch, I'm not going to see it.
Though you can bypass
all this stuff. You go back to that OS stuff, as long as they
want to talk to the network, I can find out what they've got.
It actually benefits from an ugly network.
It's one of those few places
that not having firewalls really helps.
Because I can see so much traffic.
So I'm going to start off with some rules.
I wanted to jump right into the rules because I've only got 20 minutes here.
So here's a basic
snort rule. Try to keep these all
nice and easy, very little
stuff done with
in bin hex.
I'm sorry,
in hex. I'm just looking at
the strings here, with a couple exceptions.
So this first one,
it looks for people actually updating antivirus
information.
Antivirus actually and firewalls, because that's
with the semantic corporate edition.
You notice here, you see the user agent.
User agents are your friend
if you want to do this. Because they really come in handy.
Everyone wants to advertise what they've got.
Well, this is where you get them handy.
So you capture on this.
You capture on that user agent, you can capture on
the host, because they actually, semantics
sends everything to one place.
Not everybody does that, so you have to watch that.
Then right down here, that last line,
you have the threshold, type limit,
track. So what we're going to do is
look at type limit, track by source.
So each source IP address.
Count one, so we're only looking for
we only need one packet here, to find out
this is working. And we only
record this every...
180 seconds.
Sorry, 1800
seconds. The reason I had to do this
with this particular rule, is that it
will go and do that so many times,
for so many different things, it was filling up logs.
All I need to know is they did it, I don't need to know how many times
they did it. And this is
what the traffic you get out of this is.
You notice in that, when you get down to the
data,
it tells you right in that line,
what they're updating. Semantic, antivirus,
corporate, client,
NT 9.0, English,
so it's language, you know, you have everything
there.
So, by that
those 20s are going to be the
space characters, that's what they'll be using
them.
So, another rule. This is an
OS update. We're looking for a specific
Windows update here.
I wrote a rule that just looks
for the KB article. If you're actually really
quick, they actually release the
article numbers before they
release the patches, but you have to know where to find them
at Microsoft site. I didn't include
that in the slide, which I should have.
And so you can get a slight
jump. Now, actually I really
recommend using generic rules that will catch everything
and post-processing.
I'm really big on post-processing.
It speeds up the whole process
from a machine point. And so what we're
looking for is, it has that string that says
the get space, and that's a slash
character. For some reason,
well, this is me, I like using
hex in those points.
And you have a depth
of five, so this has to be in the first five
hex decimals, the first five
characters coming from that host in the TCP
field,
level. So then you're
looking for the knowledge base article, and you want this
line to end off with the exe
basically the get,
this is the whole get string. These are
elements out of it. One of these days I'm going to get around to
rewriting these in PCRE so that I have
the per compatible regular expressions
to make the whole line a little easier to read.
However,
there's a penalty hit there and I haven't quite figured
out if it's going to be something I can keep up with.
So out of this,
we then find out it's a Windows ME
host, because it's right there in that string
that it actually downloaded.
So you say msdownload, update,
version, capital, you get down to
Windows ME, knowledge base article,
and this is also an English box.
So this is all the stuff you see
in their files that they're downloading from Microsoft.
Also, this
progressive download there, that's the user agent for ME
when you do the automatic update
through them.
Next
rule, Windows malicious
software removal tool, their new
anti-spyware stuff.
Again, this is a rule using similar
functionalities to the last one.
Right now we're going with the Windows, the Microsoft
bits for the agent. That is the normal
XP2000
agent that you're going to see.
And this is what you see here.
You see this packet come through.
For this one, I actually, just in case
anybody's curious, this one was
TCP show I used to grab these packets out.
I've also written some scripts for just extracting
text from
TCP dump files, UP caps.
So you have, you find out this is
Windows. It doesn't really specify
which one. Knowledge base
article, name
of the program and everything. Again, English.
Now this is where it starts getting a little more fun.
Now with Red Hat, you seem to
see a lot of people using their automatic update,
the up-to-date stuff.
This one is just checking in.
It's saying, are there any updates available?
This really answers
questions about OSes also.
All of a sudden, you don't know just that it's a
Linux box, you know it's
Red Hat.
So you get this whole string. The header info
file is the one that actually says, what is
the differences between now
and what I have and what is available.
So you're going to see this one anytime it checks in, whether it gets
a download or not. So this actually
allows you to actually map out who is
trying to be a good network
citizen.
And here's what you get. But if you look
at the get string on this one, you see the pub,
Fedora, Linux, Core 3,
so you know they're running Core 3.
And
i3, i6, so you now see, you have an idea of
the architecture.
Though there's a better one for that one in the next
write-up. And you see they're using
the Red Hat applet. Now you can actually rewrite
these so that
you can download and stack anything.
You have to draw a line here.
Where is the privacy? You don't want to actually
be capturing everything they do.
But you also have to say, you know,
this is the information we need to know to protect the network.
And that is the biggest problem we've
had, is actually, where do you draw that line?
Now this one,
this is another update.
Looking for the...
Actually, I rewrote
this one early this morning. I messed up.
It's not a check-in anymore.
You're actually looking for
the actual downloading of the
update.
Well, when you get to this one...
What happened to my slide here?
Crap.
Okay, well, I'll tell you what that one did download.
It actually saw the kernel.
And when you see the kernel goes by, you get to see
the architecture at a different level. You get to see it as
I-686. You get to see the language.
You get to see
the specific kernel version.
So once you take this stuff out, you post-process
it, you can actually find out a lot of stuff in
that one kernel, in that one get
request about the box.
Actually, I'm going a lot faster than I thought I would.
I should include more
rules.
So this
is the check-in again.
Okay, now this is where it gets a little more
obscure. This top one here,
all this pat
and all this snort signature does
is it catches one sin for each
host every half hour.
It just tapes a pdump file, a
pcap dump of this stuff.
I use this one actually
to map OSes because I can
take this, the pcap file, post
process it through p0f
and all of a sudden, you have a list of
every IP address and what it's talking
and what the OS is.
Now there are, I have
this every half hour. You will
start encountering problems when you get to
VMware or they're running
NAT boxes. This is where that
ARP cache comes in. Using that ARP cache,
if you have access to the ARP table, you can say
at this point, was it the same
MAC address
as the one that was there before?
So you can say, if it's
two different MAC addresses, it's probably two different machines.
However, if you have the same MAC address,
you're now looking at VMware or NATing.
If you go over and look up the MAC address,
you can probably tell if it links this
little router
or if it is actually
a Dell
box, in which case you know it's VMware.
So it's actually all about collecting so much data
that you can actually then make logical
choices about what's happening on the
host themselves.
The second one
here is the ability to
actually map what services they're doing.
This one actually uses banner grabbing.
There's also some signatures for doing what versions of
SSH they're running.
When you actually get down to versions, that becomes really important
because you actually can say, hey, there's a
vulnerable version here. And you can actually
notify people, say, you know, you need
to fix this. You never have to scan the box.
You just watch them doing their traffic on their
own.
So in that one, you're looking
for basically the server return field from
the server. This is one of the places where you can start
mapping out what's happening on your
host that aren't them doing
things, it's people coming into them.
So this here, we're looking at Microsoft
IIS 5.1.
That version actually only exists
in XP. So you know
that they're running XP also.
This can be spoofed, of course,
with Apache, you can compile it with
any browser, with any server, you can actually
compile this stuff in and change
it. I say any, and
it's actually an overstatement.
But the idea is that the people
who are really trying to do that stuff, these are people
who are good admins anyways, and I'm not
worried about them. I'm worried about the
idiot who runs their box, you know, they
have never patched it. They just
put it up on the network, and five minutes
later, you know, it's a warehouse box, and it's attacking
30 million other hosts. That's my
issue. I don't have a, I don't care about the person
who's actually sitting there doing their job.
It's all the ones that aren't doing their job that I'm trying to find
with this. This also
gets by, the biggest problem that we had on campus
really was dealing with
firewalls. Windows XP
2, XP 2 came out, every, all
these firewalls, all of a sudden we can't get into these boxes
with the scanners we do have.
If you want to write a rule that will
allow an IP address to talk to
a box like that, you actually end up
writing 65,535
TCP rules, 65,535
UDP rules, because they don't
actually allow you to set
a trusted IP.
Microsoft's firewall does not have that concept.
It's trusted ports, trusted programs, that's it.
This way, we don't
have to worry about that. We actually see the patching,
we don't have to do the vulnerabilities.
Scanning is still great. Scanning will help you a lot.
It will answer questions faster than
this will. But in the long run, you get
a different picture here. Because if you look at those
user agent stuff, you can see, are
they running Kazaa? Are they using
Outlook? You can see
all this stuff by looking at the traffic
that comes out of this box. Things that you
will never see. You can't tell what browser somebody
is using by a scanner.
Are they running a three-year-old
version of IE?
I got a break-in yesterday,
two days ago,
on campus. They were running a version of IE
that had a flaw in it that was fixed two years
ago.
Now, all of a sudden, they've
got a whole batch of extra stuff
on their computer they didn't know about.
This, I can tell.
I mean, by actually watching
the get request that comes
out of that box.
How they request things, because that's
also in there. I mean, when you say
you're going to download this,
if I go back a couple of screens,
that's where you... let's see...
that user agent
comes in. Because the user agent is
trying... it's not required.
You don't see this in Debian.
When it does patching, it doesn't do this.
Actually, I didn't include all my...
I have a lot of signatures
for this. I didn't include all of them, but I have
patches for Suse,
Debian, Mandrake,
you know, all these things.
These are all available out there. The information
is available. The hardest one
I actually had to come up with was one for Solaris.
Because if you look at, like, Solaris 10,
this automatic update feature, it encrypts
the whole channel.
However, when you look at an SSL
certificate, when you do that key exchange
at the beginning, and it sends what the
certificate is, there's a place in there where it
says who bought the license
and what machine it goes on.
Well, it just so happens that Sun, that machine
is like sunupdate.
You know, it's like solarisupdate.sun.com
or something like that.
So you find that string, you know what's happening.
You know they're now being a good network citizen.
You don't know what patches they
grabbed. And I'm sorry that
I haven't figured out a way to get around the SSL.
And if anybody has any ideas, come and talk
to me. You know, we have a lot of other things we can do with that one.
Um...
I won't have to go back
to work on Monday.
So I can't get around that one,
but I can help, you know, give you an idea of
who is actually helping on the network. Who's being
good? Got a question?
Yeah, using statistic
analysis, you actually could do that.
There's a program I'm going to mention at the end.
It's a different IDS system called Bro.
Um, it's kind of a...
I refer to it as a bastard stepchild out of LBNL,
but actually they love it and they use it a lot.
It is written by Vern Paxton
and it does some great
anomaly detection, but it also
keeps a connection log that says
this IP address on this port
talked to this IP on this port. This is how much traffic
went by and this is what time it happened and how long
it took. Using that, you can go
back and do the statistical analysis and actually
get a good idea of did they download one patch
or did they update the whole system?
I really didn't think I'd go through this this fast.
Um,
so on here. So these
are the tools that I use for doing this. Snort.
I'm a big snort fan.
It's easy. You can really get
into it and it's really, fairly powerful
if you get into it. P0F.
You know that OS
fingerprinting that I do?
Post processing through there, it helps
a lot. Make sure you do have
one of the latest versions because
the one I first installed, it didn't give me
a timestamp. It just kind of
said relative to when I started running P0F.
Didn't really help me identify
when you had to go back to that ARP table to figure it out.
You need that timestamp. So make sure you have
the latest one. TCP dump.
I use TCP dump for everything. I'm sure
everybody here does. Got a question?
Yeah?
Actually,
our network group on campus, they actually
have a database that they keep of it.
They dump the ARP cache from every switch
and every router on campus every
15 minutes. So we go back to
the database.
What was that?
Too many years of punk concerts.
I'm really going to...
Do I have a suggestion?
Unfortunately, I don't.
It's just not something I've had to encounter yet.
I haven't had to figure out how to do it.
Yes.
Okay.
TCP show and ngrep.
Those are tools that actually will help you
pull out those strings. Now, actually,
TCP show
has one
flaw in that it doesn't give you an accurate time.
It actually doesn't dump
the time in a format that I could use well.
And ngrep does that, however,
core dumped on large files.
So I wrote my own.
It really is just a simple Perl script.
If you think about it, you pull out the Perl.
Actually, if you wrap the...
you do the
minus lowercase
x of the TCP dump, it gives you that
whole binary. It gives you the hex, actually.
Well, you can just
process through it, measure out, okay,
this is the IP header, this is the TCP header.
Now you want the data after that.
So, actually, on the website that I will give you,
I have that script. It's really
actually a very simple script.
And so I use,
that's where I go back to, I use TCB dump
more than anything else, and Perl.
Perl is great. Now I mentioned
that bro-ids, if you are
interested in that, it's a really great
IDS system, awesome anomaly detection.
Really kind of hard to
use, though. I mean, be prepared.
But it's bro-ids.
bro-ids.org
It is a really good one.
It's just...
And it will never file into Windows, so don't even try
if you're running Windows.
A lot of custom scripts.
You really have to be able to write your own programs
to do this stuff.
At least for now. I'm hoping that eventually I'll get
enough of them that I can just hand them off to people and say,
hey, use this. But for now,
you're going to want to write some of your own.
I have some example scripts that I use.
So if you want them, they'll be on the website.
They should be on your CD, though I update all of them.
So, go to the website.
And a database.
At the end of the day, you are going to need
a database more than you're going to need
anything else that I talk about.
Because if you figure that
Microsoft has released about 35
major patches this year
already.
Those are the major, the MS05.
They've already released like 35.
And this is actually kind of a slow year for them.
And you look at like 40,000 hosts.
And then you look at all the
antivirus programs. And then you look at
all the OSs they're running.
You need a database.
I mean, I've been doing it actually for a while with
NGREP.
Sorry, not NGREP.
FGREP.
So I just grep out flat files.
And we're building the database now. I had to prove that it could be done
before they built it. And then somebody would take the time to build
the database for me.
So at the end of the day, though, you are going to need a database to do this.
So, I'm going to say
thank you for coming.
I've got an address there. If you go to www.passiveaudit.org
you'll see all the scripts I have, all the signatures.
And I really would like to actually have more people writing
signatures than just me.
I do this at home at like 3 o'clock
in the morning. So,
help.
This is how I, when I have time, I do this
because I find it fun. I'm kind of curious, how far
can I go? Can I actually, you know,
I can actually find out if they've got office
and stuff, but how much can I learn
about the computer?
I don't want to let anybody think that I'm actually
trying to learn stuff about the people.
That'd be wrong.
At least I would on campus.
Okay, thank you.
Applause
I'll be
outside if anybody wants to get questions
or wants to volunteer.
Laughter
Alright,
thank you. We need everyone
out those doors there.
Laughter
Uh...
Silence