A new idea came our way to augment an organization's change control
measures. We're writing signatures to track when devices on the network
have config changes made remotely.
First step is routers and switches. Most are managed via telnet (even
though ssh is better), and the configuration modes are easily recognizable.
alert tcp $HOME_NET 23 -> any any (msg:"BLEEDING-EDGE Cisco Device in
Config Mode"; classtype:not-suspicious; flow:established; content:"Enter
configu
ration commands, one per line"; nocase; nocase; sid:2001239; rev:3;)
alert tcp $HOME_NET 23 -> any any (msg:"BLEEDING-EDGE Cisco Device New
Config Built"; classtype:not-suspicious; flow:established;
content:"Building co
nfiguration..."; nocase; sid:2001240; rev:3;)
The idea is such a simple one, but a great one we think. If you've got a
few minutes next time you make a change on a router, firewall, switch,
proxy server, web interface to a device, whatever, please get a packet
dump. Either send it in or make a rule up and send that in. I think this
could be a great project. Simple idea, but very effective.
If you can think of other devices where changes would be detectable via
network traffic please let us know as well.
Just another argument for having IDS on your net as well. :)
Matt
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
