Embed Size (px)
Citation preview
Snort for the Road Warrior
Soapbox
What is Snort?
• Snort is an open source network Intrusion Prevention and Detection System (IDS/IPS) developed by Sourcefire.
• Snort is the most widely deployed IDS/IPS technology worldwide. Snort has become the de facto standard for IPS.
pfSense is a free, open source firewall and router platform based on NanoBSD/FreeBSD that includes most all of the features of expensive, commercial firewalls.The pfSense stateful firewall for embedded applications supports:
• Stateful firewall based on OpenBSD pf• Captive portal with MAC filtering, RADIUS support, etc.• NAT support• Load balancing• VPN: IPsec, OpenVPN, PPTP• Dynamic DNS client• DHCP Server and Relay functions• PPPoE Server• Reporting and monitoring features with real time information• The m1n1wall arrives pre-loaded with pfSense 2.0.3 software. You can reload the CF card
with your own operating system / software to support your application. Possibilities include FreeBSD, NetBSD, OpenBSD, m0n0wall, OpenWRT, Voyage Linux, STYX, iMedia ALIX Linux, Fluxbuntu, fli4l, Zeroshell, Ikarus OS, Embed-it, Mikrotik RouterOS.
Network Layout
m1n1wall Hardware
Soekris Crypto Accelerator
Dashboard
pfSense Packages
Hardware / Software costs
Netgate m1n1wall 2D3/2D13 appliance• Assembled ($225.00)/ Unassembled ($205.00)
Soekris VPN1411: Crypto accelerator ($72.00)• http://store.netgate.com/Soekris-VPN1411-Crypto-accelerator-P319.aspx
Sourcefire VRT rules ($29.99, personal license, 1 sensor)• http://www.snort.org/vrt/buy-a-subscription
m1n1wall Appliance Features
ALIX.2D13 System Board with• 500 MHz AMD Geode LX800 CPU• 3 10/100 Ethernet ports (VIA VT6105M 10/100)• 1 miniPCI slot for future expansion (VPN Acceleration, wireless, etc.)• 2 USB ports• 256 MB DDR DRAM• Pre-installed battery• I2C header• COM2 header• internal USB header for port 3 and 4
4 GB Industrial SLC CF Card pre-loaded with pfSense 2.0.3
Russian Business Network
• The Russian Business Network (commonly abbreviated as RBN) is a multi-faceted cybercrime organization, specializing in and in some cases monopolizing personal identity theft for resale.
• The RBN, which is notorious for its hosting of illegal and dubious businesses, originated as an Internet service provider for child pornography, phishing, spam, and malware distribution physically based in St. Petersburg, Russia.
• By 2007, it developed partner and affiliate marketing techniques in many countries to provide a method for organized crime to target victims internationally.
Russian Business Network (RBN) Structure (circa 2007)
RBN Activities
• According to VeriSign, RBN was registered as an internet site in 2006
• Initially, much of its activity was legitimate. But apparently the founders soon discovered that it was more profitable to host illegitimate activities and started hiring its services to criminals.
• The RBN has been described by VeriSign as "the baddest of the bad".
RBN & Red October• Red October was a cyber espionage malware program discovered in October
2012 and uncovered in January 2013 by Russian firm Kaspersky Lab. • The malware was reportedly operating worldwide for up to five years prior to
discovery, transmitting information ranging from diplomatic secrets to personal information, including from mobile devices.
• Red October was termed an advanced cyber espionage campaign intended to target diplomatic, governmental and scientific research organizations worldwide.
• After being revealed, domain registrars and hosting companies shut down as many as 60 domains used by the virus creators to receive information. The attackers themselves shut down their end of the operation as well.
• According to Kaspersky’s report, the oldest domain name used in the Red October network was registered in November, 2007, and the newest in May, 2012. The RBN Network went dark on November 4, 2007 and temporarily moved operations to China. Then, after a few weeks, disappeared again.
Russian Cyber OperationsDavid J. Smith
• “Unlike China,” Jeff Carr, the CEO of Taia Global, explains on his Digital Dao blog, “Russian cyber operations are rarely discovered, which is the true measure of a successful op.”
• Russia-its government and motley crew of government-sponsored cyber-criminals and youth group members-has integrated cyber operations into its military doctrine and is conducting strategic espionage against the United States.
• http://www.afpc.org/files/august2012.pdf
Other Cyber Operations of Note
• Hidden Lynx group– http://www.symantec.com/content/en/us/enterprise/media/security_
response/whitepapers/hidden_lynx.pdf
• Syrian Electronic Army– http://en.wikipedia.org/wiki/Syrian_Electronic_Army
• Mandiant Exposes APT1– http://www.mandiant.com/apt1
• Anonymous (group)– http://en.wikipedia.org/wiki/Anonymous_%28group%29
Questions?
Appendix
pfSense Information
m1n1wall Quick Start Guide• http://bit.ly/m1n1wallQSG
Web Interface• https://192.168.1.1
Free Support• http://www.fpsense.org
Paid Support• http://www.bsdperimeter.com (502) 442 7080
References
pfSense• http://www.pfsense.org/• Commercial Support
– https://portal.pfsense.org/
Snort • http://www.sourcefire.com/security-technologies/open-source/snort
Netgate• http://store.netgate.com/
VRT Subscription
Tips: Packageshttp://doc.pfsense.org/index.php/Category:Packages
