[Snort-sigs] New idea in change tracking for nets

Matt Jonkman matt at ...2436...
Tue Aug 31 21:05:08 EDT 2004


A new idea came our way to augment an organization's change control 
measures. We're writing signatures to track when devices on the network 
have config changes made remotely.

First step is routers and switches. Most are managed via telnet (even 
though ssh is better), and the configuration modes are easily recognizable.

alert tcp $HOME_NET 23 -> any any (msg:"BLEEDING-EDGE Cisco Device in 
Config Mode"; classtype:not-suspicious; flow:established; content:"Enter 
configu
ration commands, one per line"; nocase; nocase; sid:2001239; rev:3;)
alert tcp $HOME_NET 23 -> any any (msg:"BLEEDING-EDGE Cisco Device New 
Config Built"; classtype:not-suspicious; flow:established; 
content:"Building co
nfiguration..."; nocase; sid:2001240; rev:3;)

The idea is such a simple one, but a great one we think. If you've got a 
few minutes next time you make a change on a router, firewall, switch, 
proxy server, web interface to a device, whatever, please get a packet 
dump. Either send it in or make a rule up and send that in. I think this 
could be a great project. Simple idea, but very effective.

If you can think of other devices where changes would be detectable via 
network traffic please let us know as well.

Just another argument for having IDS on your net as well. :)

Matt




More information about the Snort-sigs mailing list