¿Por qué utilizar un IDS?: Un caso real con Snort

En un artículo anterior expliqué como instalar de forma sencilla un sistema de detección de intrusos (IDS), más concretamente Snort con la interfaz Snorby. Hoy voy a mostrar la potencia de este tipo de aplicaciones a través de un ejemplo que me encontré en mi trabajo como consultor.
Para situarnos un poco imaginemos una PYME sin ningún responsable del área de sistemas, como muchas en España. Cuando llegas tardas un tiempo en conocer el funcionamiento de todo el sistema (ya que no hay una persona a quien consultarle las dudas) y un IDS ayuda mucho en esta tarea detectando anomalías en el tráfico de red de la organización.

En la primera imagen (vista del último año) se observa que al principio se detectaron mas de 70 incidencias clasificadas como graves y muchísimas leves, las medias las provoqué yo probando con el nmap. Ésto me llevó a investigar un poco más y resultó que el antivirus no escaneaba (o no lo hacía bien del todo) un tipo de ficheros específico de una aplicación y ahí se escondía el archifamoso gusano Conficker en algunos de los equipos. Podemos ver en la gráfica anterior que tras la eliminación del virus se redujeron drásticamente las alertas hasta llegar a la situación actual de la siguiente imagen (vista del último mes).
NOTA: Es importante revisar también las de severidad baja aunque siempre se tratan de falsos positivos.

Lo que quiero destacar es que nos ayudó a detectar un problema que no sabíamos que existía como lo puede hacer con muchos otros. Otra ventaja de su uso es que ayuda a conocer un poco más sobre el funcionamiento de la red de la organización. :)

Jesús Pérez

SIP INVITE attack with Metasploit

Some days ago my friend @pepeluxx wrote another post about INVITE attacks. He spoke about a @sinologic project which allows to everybody passing some security tests to SIP servers. Furthermore he also published a perl script to do the same task. So I implemented it on Metasploit because I think It could be really useful during a pentesting. It’s interesting because these attacks are really dangerous, normally, attackers try to call to expensive locations. This target numbers often have special charges and they make money with this. Here there are two well known examples: http://blog.sipvicious.org/2010/12/11-million-euro-loss-in-voip-fraud-and.html http://snapvoip.blogspot.com.es/2009/02/calls-to-cuba-and-voip-attacks.html I’m not going to deep in this vector because of being a well known (and old!!) one. Basically the attacker tries to make a call using a misconfigured PBX. This is allowed because SIP RFC says that an ...

Flooding Asterisk, Freeswitch and Kamailio with Metasploit

Hi, it has been a long time since my last post because of my new job and my final year project ("VoIP denegation of service attacks" for curious) but there is something I found during my tests with Freeswitch , Kamailio and Asterisk that I want to share. NOTE: Really, guys of Security By Default blog published us (my good friend Roi Mallo and me) two articles about how to develop modules for Metasploit framework, another two are coming. ;) During my project, among others, I developed a Metasploit module which can flood SIP protocol with common frames (INVITE, OPTIONS, REGISTER, BYE), I wrote it at Quobis (nice job ;) in order to use it for some private tests because actual software didn´t fit our needs, so we are going to probe how is the behavior of different GPL VoIP servers against this kind of attacks: - Asterisk: I think it needs no introduction, the famous softswitch/PBX software. - Freeswitch: It´s a newer soft...

SIP extension enumeration in Bluebox-ng

There are some well known SIP extension enumeration vulnerabilities in different VoIP servers, specially in Asterisk. This brute-force vector is based on the study of the authentication responses of the target server. Sometimes its replies are different in the case that the client uses a valid extension, so it's easy to discover them. This vector is normally classified as a low security risk. Moreover we're moving towards a federated SIP environment , in which the extension is the public email address of the user. But it's still important in some cases: To guide next steps during a penetration test. In example, you can use the discovered extension to reduce the number of attempts in the phase of SIP extensión brute-force. Some RCE (Remote Code Execution) exploits need a valid extension to work. After a little research, these are the known vulns: CVE-2009-3727 : It's quite old and it's practically not present in real environments. It's still not imple...

Ni ceros ni unos ...

Search This Blog