[Snort-sigs] New idea in change tracking for nets
matt at ...2436...
Tue Aug 31 21:05:08 EDT 2004
A new idea came our way to augment an organization's change control
measures. We're writing signatures to track when devices on the network
have config changes made remotely.
First step is routers and switches. Most are managed via telnet (even
though ssh is better), and the configuration modes are easily recognizable.
alert tcp $HOME_NET 23 -> any any (msg:"BLEEDING-EDGE Cisco Device in
Config Mode"; classtype:not-suspicious; flow:established; content:"Enter
ration commands, one per line"; nocase; nocase; sid:2001239; rev:3;)
alert tcp $HOME_NET 23 -> any any (msg:"BLEEDING-EDGE Cisco Device New
Config Built"; classtype:not-suspicious; flow:established;
nfiguration..."; nocase; sid:2001240; rev:3;)
The idea is such a simple one, but a great one we think. If you've got a
few minutes next time you make a change on a router, firewall, switch,
proxy server, web interface to a device, whatever, please get a packet
dump. Either send it in or make a rule up and send that in. I think this
could be a great project. Simple idea, but very effective.
If you can think of other devices where changes would be detectable via
network traffic please let us know as well.
Just another argument for having IDS on your net as well. :)
More information about the Snort-sigs