Re: [Snort-users] Rules to block FT

permalink · #1 (**permalink**) 06-28-2007

This is a multi-part message in MIME format.

--===============0121369884==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C7B99A.C7028322"

This is a multi-part message in MIME format.

------_=_NextPart_001_01C7B99A.C7028322
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hi Dwane,

There is a problem with this rule. The content detection portion of the =
rule looks good, it looks for the 530 response from FTP for an incorrect =
login.=20
The problem lies within the rule header though (alert tcp $HOME_NET any =
-> $EXTERNAL_NET 21), this content that is being looked for is from the =
client to the server, where it is really the server that sends the 530 =
error code so by switching the direction your monitoring this pattern =
for you should be good to go (alert tcp $EXTERNAL_NET 21 -> $HOME_NET =
any).

//Joel=20

StillSecure
Joel Ebrahimi
Senior Software Engineer

http://www.stillsecure.com/
The information transmitted is intended only for the person
to whom it is addressed and may contain confidential material.
Review or other use of this information by persons other than
the intended recipient is prohibited. If you've received
this in error, please contact the sender and delete
from any computer.=20

-----Original Message-----
From: snort-users-bounces@lists.sourceforge.net on behalf of Atkins, =
Dwane P
Sent: Wed 6/27/2007 9:18 AM
To: Snort-users@lists.sourceforge.net
Subject: [Snort-users] Rules to block FT
=20
I have a testbed set up and have already alerted and blocked via
snortsam for SSH. I am now working on FTP.

=20

My rule:

=20

alert tcp $HOME_NET any -> $EXTERNAL_NET 21 ( msg:"BLOCKED Potential
FTP Brute-Force attempt";flow:from_server,established; content:"530 ";
pcre:"/^530\s+(Login|User|Failed)/smi";classtype:unsuccessful-user;
threshold: type threshold, track by_dst, count 10, seconds 60;
sid:1000002; rev:1; fwsam: src, 5 minutes;)

=20

Does this look like it will work? I am not that adept about building
rules and am learning. This was from bleeding edge, I think.

=20

Dwane

=20

------_=_NextPart_001_01C7B99A.C7028322
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
6.5.7652.24">
<TITLE>RE: [Snort-users] Rules to block FT</TITLE>
</HEAD>
<BODY>


Hi Dwane, 
 
There is a problem with this rule. The content detection portion of the =
rule looks good, it looks for the 530 response from FTP for an incorrect =
login. 
The problem lies within the rule header though (alert tcp $HOME_NET any =
-> $EXTERNAL_NET 21), this content that is being looked for is from =
the client to the server, where it is really the server that sends the =
530 error code so by switching the direction your monitoring this =
pattern for you should be good to go (alert tcp $EXTERNAL_NET 21 =
->  $HOME_NET any). 
 
//Joel 
 
StillSecure 
Joel Ebrahimi 
Senior Software Engineer 
 
 
<A =
HREF=3D"http://www.stillsecure.com/">http://www.stillsecure.com/</A> 
The information transmitted is intended only for the person 
to whom it is addressed and may contain confidential material. 
Review or other use of this information by persons other than 
the intended recipient is prohibited. If you've received 
this in error, please contact the sender and delete 
from any computer. 
 
 
 
-----Original Message----- 
From: snort-users-bounces@lists.sourceforge.net on behalf of Atkins, =
Dwane P 
Sent: Wed 6/27/2007 9:18 AM 
To: Snort-users@lists.sourceforge.net 
Subject: [Snort-users] Rules to block FT 
 
I have a testbed set up and have already alerted and blocked via 
snortsam for SSH.  I am now working on FTP. 
 
 
 
My rule: 
 
 
 
alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (   =
msg:"BLOCKED Potential 
FTP Brute-Force attempt";flow:from_server,established; =
content:"530 "; 
pcre:"/^530\s+(Login|User|Failed)/smi";classtype:unsuccessful-u=
ser; 
threshold: type threshold, track by_dst, count 10, seconds 60; 
sid:1000002; rev:1; fwsam: src, 5 minutes;) 
 
 
 
Does this look like it will work? I am not that adept about building 
rules and am learning.  This was from bleeding edge, I think. 
 
 
 
Dwane 
 
 
 
 



</BODY>
</HTML>
------_=_NextPart_001_01C7B99A.C7028322--

--===============0121369884==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
--===============0121369884==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users
--===============0121369884==--

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode