Detectia atacurilor supernova utilizand snort

[aelius]

Scurta introducere:

Pentru cei care nu stiu inca ce este "Supernova" si cum anume functioneaza: Este o aplicatie ce se foloseste de versiunile vechi de verlihub si da instructiuni participantilor dupa hub sa se conecteze la o aplicatie externa cu scopul de a face un serviciu inaccesibil (ddos). Tintele cele mai preferate sunt site-urile web si stream-urile de radio.

Aceasta forma de atac face sa deschida un numar foarte mare de socketi (depinde de cati utilizatori sunt online pe hub-ul de dc++). Cele mai afectate servere web sunt cele non threaded, cum ar fi apache prefork, unde consumul de resurse este de aproximativ 16 MB per process.

O regula snort care detecteaza atacurile supernova:

alert tcp any any -> any 80 (msg: "Supernova DDoS Attack"; content: "MyNick"; sid: 0000004; )

Daca aveti variabile definite (external_net, home_net):

alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg: "Supernova DDoS Attack"; content: "MyNick"; sid: 0000004; )

Un scurt fragment din log-urile generate (pentru a vedea cum arata):

Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 82.79.181.158:3563 -> 94.177.xxx.xxx:80
Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 82.79.181.158:3563 -> 94.177.xxx.xxx:80
Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 84.232.201.51:4315 -> 94.177.xxx.xxx:80
Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 84.232.201.51:4315 -> 94.177.xxx.xxx:80
Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 79.112.234.88:2155 -> 94.177.xxx.xxx:80
Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 79.112.234.88:2157 -> 94.177.xxx.xxx:80
Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 79.112.234.88:2155 -> 94.177.xxx.xxx:80
Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 79.112.234.88:2157 -> 94.177.xxx.xxx:80
Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 82.79.181.158:3792 -> 94.177.xxx.xxx:80
Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 82.79.181.158:3792 -> 94.177.xxx.xxx:80
Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 109.96.161.105:3894 -> 94.177.xxx.xxx:80
Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 109.96.161.105:3894 -> 94.177.xxx.xxx:80
Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 79.117.24.98:4127 -> 94.177.xxx.xxx:80
Dec  4 19:12:38 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 79.117.24.98:4127 -> 94.177.xxx.xxx:80
Dec  4 19:12:39 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 89.36.11.91:1480 -> 94.177.xxx.xxx:80
Dec  4 19:12:39 idsplus snort[10177]: [1:3:0] Supernova DDoS Attack {TCP} 89.36.11.91:1480 -> 94.177.xxx.xxx:80

Note:

- Regula snort este facuta de mine iar string-ul l-am “detectat” cu ettercap.

- Nu recomand utilizarea default a snort-ului. Fisierele de configuratie sunt mult prea mari si consuma resurse inutil. Inspectia pachetelor la o rata mare de transfer implica delay-uri si resurse epuizate. Orice ciclu CPU utilizat nu mai poate fi recuperat usor.

- Puteti face un fisier separat de configuratie cu cateva reguli (ex: "rules.conf") si sa rulati snort cu "snort -p -c rules.conf -D"

Edited January 20, 2012 by aelius