[Snort-users] applications that hide themselves in SSL tunnels

Pedro Fortuna pedro.fortuna at ...11827...
Wed Oct 27 05:29:09 EDT 2004


I was wondering... Nowadays, peer 2 peer applications are getting very so
sophisticated. They can use different ports, use external connection
bouncers, tunnel connections in SSL, SSH,... and maybe copying other
techniques like tunnelling with UDP (UDP inside UDP).

We can't have a 100% bullet-proof solution against this kind of
activities inside our networks, but we can sure as hell try! Lately
I've detected an abnormal SSL bandwidth consumption (~4 Mbit/s), which
I bet that it isn't coming from HTTPS,POP3S,IMAPS connections.

How to deal with this? Some points that occurred to me:

1. Take note of remote SSL peers and block them at the perimeter firewall
This won't solve the problem, because there could be a large number of
different P2P servers/bouncers/insecure Proxies, and some P2P apps
already have built-in proxy scanners. Unfeasible solution if done by
hand.

2. With Snort, Snortsam and a firewall (e.g. iptables), one could
detect proxy scans and dynamically block the connections. Could this
be done with bleedingsnort rules? Im sure some of Snort's input
plugins should be able to detect these specific scannings. This could
be a practicable solution.

3 Hunt local p2p users.
3.1 Detect proxy scans, get the local machine IP and mac address, warn
or punish user.
3.2 Detect mac spoofing and mac flooding.
Can Snort detect this kind of activity?

Best Regards,
Pedro Fortuna

P.S: I had to resend this mail message because "p2p" in the subject
kept the mail servers marking this mail as spam.




More information about the Snort-users mailing list