Snorby Labs @snorby-blog - Tumblr Blog

Introducing Snorby Cloud Firewall

Packet Stash is proud to announce the public beta of Snorby Cloud Firewall, an easy and effective way to manage firewall policies across your internal and cloud based infrastructure.

If you’ve been following the blog, this new product is the outcome of our first company Hackathon. As we mentioned, we are offering this firewall management solution free of charge for an unlimited amount of servers. In its current form, Snorby Cloud Firewall can help customers quickly reduce the overall attack surface on the publicly accessible infrastructure that they maintain.

Let’s walk through how the solution works:

First, click on the new option called “Firewall” on the main Snorby Cloud Dashboard. After clicking it, we will see a listing of all agents with the firewall management functionality deployed.

We can see two active agents that are connected. Let’s add our European web server. To do that we will click on “Add new agent.”

During the beta period, the firewall agent is separate from our primary incident response agent. The agents can co-mingle on the same server, without conflict. Let’s run the installer.

The agent is now deployed. We can see that it now appears on the agent listing page and has a status of “pending”.

We can click into the agent, see its properties and confirm the registration by clicking on the “Register” button.

Once registered, the agent will have our default firewall policy instantly applied. In our case, SSH is protected in our default policy, so we lose access.

We can regain SSH access by clicking on the “request access” button in the firewall rules table. Access can be bound to a specific IP, a range of IPs (defined with CIDR notation), or to all IP addresses. Access is time-bound and will auto-terminate once the lease has expired.

If we want, we can define a new policy for all of our cloud servers, by using the following screen.

Additional Notes

As mentioned above, this solution is still in early beta and while currently useful, is not feature complete. We plan on implementing the following features over the coming weeks:

Global Blacklist - A list of IP addresses that will be blocked from all infrastructure regardless of policy.

IP Whitelists - Lists of acceptable IP addresses that may be used for scoping specific firewall policies.

Multi-user support - Enable multiple users to access the Snorby Cloud UI to request access to protected infrastructure.

iOS Application - Request access remotely through a mobile application.

Bug Reporting & Support

If you run into bugs or issues, please open a support ticket by browsing to https://cloud.snorby.org/#/support or by emailing [email protected]. Feature requests and public feedback can be left at our UserVoice site at http://snorbycloud.uservoice.com/.

#hackathon #firewall

Snorby Cloud Firewall Management Teaser

Sorry for the late post everyone! The team has been hard at work deploying Snorby's new firewall management to our alpha test team. It has been an incredible weekend + Monday and we're all very proud of the outcome.

We will have a full-write up on our hackathon and a walkthrough of this amazing new Snorby Cloud functionality very soon!

#hackathon #firewall #snorby-cloud

Are you a security company? Be afraid of Packet Stash Hackathons

Packet Stash was founded by extremely passionate and competitive individuals that want to make the lives of IT generalists and overwhelmed security analysts better. We plan on doing this by releasing incredibly useful and high quality software, uniting the defensive security community, and making our products accessible through a great user experience and affordable pricing.

Unfortunately, this has not been the traditional security company’s business model. The tried and true plan for most of these organizations is to spread FUD (fear/uncertainty/doubt), offer a trivially-developed technology solution, put it behind an overpriced paywall or a team of sales people, and aggressively market and position the product as a fully-featured enterprise security product.

We plan to completely eliminate the effectiveness of this strategy and help out a ton of people with a new internal company activity called Packet Stash Hackathons. The goal of each Hackathon is to disrupt the market by building a competing security solution at a level of quality beyond the current competition and offering it at no cost.

This weekend’s Hackathon will be focused around cloud based firewall management. There are a slew of companies that offer downloadable agents that allow you to remotely configure firewall policies through a centralized cloud-based UI. Most of these companies' offerings are a simple wrapper on top of existing firewall technologies with a poorly designed user interface. At the time of this writing, Dome9, a popular player in this space, is charging customers $749 dollars a month for firewall management on just 75 servers.

On Monday we will be releasing a cloud firewall management solution to all users (not just paying customers) at no cost, for an unlimited amount of servers. At the time of this post we have zero code written. We’ll see you on Monday.

Have any ideas for our next Hackathon? Please visit our User Voice page and post suggestions.

#hackathon #firewall #cloud

Snorby Cloud’s Rules Management Rules!

Tuning your IDS ruleset to limit false positive alerts and silence non-applicable rules is a critical part of running any competent IDS security strategy. Despite that fact, we've always been surprised at how difficult distributing, maintaining, synchronizing, and tuning an efficient set of rules can be.

More mature security shops have had to solve this problem, so they’ve turned to many of the great community and paid tools that are out there. We have seen sophisticated teams leverage everything from popular configuration management tools such as Puppet or Chef, to relying on bash scripts that utilize rsync or SCP to synchronize rules files and configurations across sensors. At the end of the day, none of these solutions are ideal as they still require manual effort and create a system operations expertise barrier to rules tuning.

Since the Snorby Cloud architecture allows us to control much of this experience automatically, we set out to create a rules management solution that solved many of the pain points we’ve experienced in our careers.

#1 - Messing with configuration files is not fun

Our top requirement was that the entire rules management experience should be contained within the Snorby Interface. Here is what it looks like:

Rules can be enabled or disabled globally directly from this screen by clicking the green label. These changes are sent immediately to the agents and within 60 seconds all agents will be aware that the rule is disabled. Our agent handles all the necessary modifications to the IDS' configuration files. There is no need to manually edit anything.

If you want fine-tune control, you can click “edit”, and assign that rule to only work with specific agents:

Once confirmed, the rule will show as "mixed" like this in the index view:

#2 - Significant manual barriers slow rule disablement

A lot of shops require their analysts to submit email request or physically talk to the IDS operations person when they want to tune out a noisy or worthless rule. Our goal was to allow a user (with the appropriate permissions) to do this daily task directly from the UI.

As you can see in the example above, we have the option of disabling this rule directly from the user interface. What’s important to note here is that we are tuning rules directly from the event that caused us to question the rule’s value.

What if we want more control? Well that brings us to our final point, #3.

#3 - Manual rule suppression and thresholding is a nightmare

Again, thresholding or advanced suppression of a rule in is a must-have when you don’t want to just squash a perfectly good rule when it only alerts noisily under certain circumstances.

You can now suppress or threshold rules by pivoting directly from an event:

Once there, you can configure threshold criteria and apply the appropriate scope:

Or configure suppression criteria (also with scoping):

As you can see, previously defined threshold or suppression rules show up as a count in the lower right-hand corner. You can view all other suppression rules and destroy them in the following interface:

Conclusions

This rules management interface is only possible thanks to the end-end control we have in Snorby Cloud architecture. Existing customers can leverage this new functionality by running `sudo snorby-cloud-agent upgrade`. New users will have this rules management enabled automatically. This is our first attempt at solving this problem and improvements and additions to the functionality will follow. For example, we plan on allowing our users to leverage this UI to write and maintain their own rulesets, and enable this workflow for our HIDS rules.

We also have some exciting rules partnership announcements on the horizon, so stay tuned!

#ids #rules #threshold #supression

APT Intelligence Update

Today, Virginia based cyber-security firm MANDIANT released a 60+ page intelligence report describing an Advanced Persistent Threat (APT) actor named APT-1 (others familiar with the group may know them as WebC2).

This report is unprecedented in its fidelity, and we recommend any security practitioner that believes they are being targeted by this specific actor, or any advanced attacker, to read it to completion as soon as possible.

This report contains several key details on how APT-1 compromises its victims, pivots throughout their infrastructure, and eventually exfiltrates coveted intellectual property. MANDIANT has described these tools and tactics in sufficient-enough detail where we have been able to write many high-fidelity indicators suitable for use in an incident detection system (IDS).

After reviewing and processing the report, the Snorby Cloud team is announcing the initial release of over 2000 network DNS indicators that can be used to quickly identify this specific actor (or other advanced attackers sharing the same tools and behaviors).

If you are already a Snorby Cloud customer, these rules have been automatically deployed to your Network IDS agents and are already active. If not, we are open-sourcing these rules under GPL and you may use them in popular open-source IDS software such as Snort (http://www.snort.org/) or Suricata (http://www.openinfosecfoundation.org/). You can find the rules here https://github.com/packetstash/packetstash-rules

As we grow, the Snorby Cloud team will be maintaining our own GPL rule-set for the benefit the community starting by improving and adding to this set of indicators as we digest the report. We encourage users of the rules to contact with us any improvements so we can disseminate them to the group.

If you have any questions, please contact [email protected]

Thanks

- Snorby Cloud Team.

#apt #mandiant #rules #indicators #intel #apt-1

Snorby Cloud Intel Update - Rails Vulnerability Detection

These last few weeks have been rough on Rails developers. Over the past few weeks there have been several vulnerabilities involving the parsing of Rails parameters, with one leading to arbitrary code execution (CVE-2013-0155, and CVE-2013-0156). Our friend Postmodern, the creator of Ronin (an excellent ruby platform for vulnerability and exploit development), wrote a great blog post explaining vulnerabilities with working PoC code.

If you believe you have a vulnerable Rails application, please visit the Rails blog and follow their mitigation instructions.

To assist our users, the Snorby Cloud team has issued detection signatures to our customers for the vulnerabilities described in the CVEs. You can see these new rules (appended with [SC]) in the screenshot below.

The reason I love Snorby Cloud is not only does it show us the event notification, but also gives us the tools we need to confirm compromise. Let’s see how it works.

First we click into an interesting alert.

If we look at the flow data, we can see the attacker attempted to create a basic reverse shell using netcat.

We can confirm the box was compromised in two ways:

First, we can see network traffic for all of the attacker’s commands to the victim computer.

Second, we can also see that netcat with a shell listed on the victim computer’s process list

What I love about this is that we didn’t have to leave the Snorby Cloud UI a single time in order to pivot to all of these different data sources and successfully confirm a compromise.

Snorby Cloud is Now Available

Packet Stash, Inc is proud to announce that Snorby Cloud is now available to the public. For those of you just joining us, Snorby Cloud is an instantly deployable, analyst-friendly, and hassle free Network and Host Security monitoring solution by the creators of Snorby.

Interested in giving us a test run? Looking for that little form where you fill out your information and an over-eager sales guy calls you a week later? As security practitioners, we’ve always hated this practice as the product should be able to speak for itself without someone actively convincing you over the phone. We want to try something different. Starting today, you can try out the fully functional Snorby Cloud for free and without a credit card. Since the beta in November, we’ve added a ton of amazing features. Each one of them deserves its own blog post and we will be extolling their virtues over the coming weeks. Briefly, these features are:

The Unified Snorby Agent

Full Packet Capture

Session Tracking

Detailed Packet Analysis

Fully-Featured Host Base Intrusion Detection System

On Demand Forensic Data

The New Snorby Cloud UI

Fluid Width Layout

Real-time Analyst Chat

Event Collaboration Features

Direct Communication with Snorby Agents - Request PCAP, Sessions, and Forensic Data

Blazing Fast Agent Deployment

One Command Installation script

Five Minute Agent Deployment

Custom Two-Factor Authentication

Two Factor Authentication via Smart Phone App, Text Message, or Phone call

OAuth2 Provider - Leverage our auth for your security app

To put this into perspective, the majority of this development has taken place over the last thirty days. We’re excited about this rate of development and hope to provide our customers with many more innovations throughout 2013 and beyond.

Why the Cloud?

When Dustin Webber created and launched Snorby in 2009, he had a vision of creating an application that made the process of analyzing and classifying events as accessible and simple as possible for security analysts. Now in 2013, the typical security analyst needs more than a single packet payload to analyze. They need to stand up sensor infrastructure quickly, interrogate systems in real-time, view logs from hundreds of sources, track compromised assets, obtain immediate containment and collaborate with colleagues in a trusted community. We want to solve these problems, and to do it we need more than an innovative web application. We need an ecosystem of software and services that work together seamlessly under a single unified interface. The Snorby Cloud platform allows us to instantly deploy this ecosystem of software and tools to you with an experience that meets our standards.

We hope this doesn’t worry our open source users. As long as there is breath in our bodies, Snorby will remain remain free, open source, and most importantly, useful.

Product Philosophy

Like most security vernacular, the phrases “Network Security Monitoring” and “Host Security monitoring” have become overloaded and abused by the commercial industry. When we built Snorby Cloud we kept the following philosophies in mind:

Security solutions should be opinionated

Security tools built by experts should have their experience and expertise codified into the workflow and design of the software. Unfortunately, we continually see this process hijacked by individuals and organizations attempting to make software broader in an effort to increase sales. These wimpy products don’t guide an inexperienced user, they simply present them with endless amounts of arbitrary configuration options. Ultimately the user digitizes and speeds up their already flawed analysis workflows and they end up unsatisfied. Part of the value of our software is that we remove these arbitrary decisions and present you with a logical user interface that mimics the workflow we’ve used in our professional security careers to successfully detect the bad guys. We think this is important and will continue to codify the expertise and experience of our staff into every product we produce.

Humans are still King

We believe human confirmation of security events is essential prior to escalation. Our software is built to augment the value-add step of human analysis, not replace it.

Collaboration is Key

Speaking of humans, they apparently like to work together to solve problems. We firmly believe that security analysts should be able to collaborate using the software they use to investigate security events.

Accessible to All

When we built Snorby Cloud we tried to keep in mind our friend Brett. Perhaps you know Brett? He’s that IT guy for that small or medium sized business you know. Poor Brett. He is in charge of the entire company’s IT services and infrastructure and even user support. Brett doesn’t have two things that he desperately needs, time and money. That means Brett doesn’t want to plunk down 20% of his IT budget for that security appliance and that extra 50k a year for the mandatory support contract. Brett also doesn’t have time to learn how to use poorly designed software and attend that customer seminar. What Brett needs is an opinionated solution built by experts for a generalist to help him protect his infrastructure. We are committed to keeping our product accessible from a price and usability perspective to our friend Brett. He deserves it.

Tech Stars Cloud 2013

One last thing we would like to announce is Packet Stash’s acceptance into Tech Stars Cloud 2013. We’re excited to be a part of Tech Stars as they are considered one of the top startup accelerators in the world. From their website:

TechStars Cloud is a thematic accelerator that will fund companies focused on cloud computing and cloud infrastructure. Because TechStars Cloud is targeting cloud startups exclusively, we’ve assembled the world’s best and brightest mentors with deep cloud technology expertise. Mentors including Pat Condon (Founder, Rackspace Hosting), Jeff Lawson(Founder/CEO, Twilio), Brad Feld (Foundry Group), George Karidis (CSO, SoftLayer), Rajat Bhargava (Founder/CEO, StillSecure), and dozens more are all joining our mission to help promising cloud technology companies become the best in the world

Next week the Packet Stash founders will be relocating to San Antonio for three months to work with these amazing mentors with the goals of rapidly scaling our infrastructure and further improving our solution for new and existing customers. If you are an investor interested in learning more, please contact us at [email protected]

Our new Snorby Cloud sensor setup is amazing

When Dustin developed and launched Snorby in 2009, he had a vision of creating an application that made the process of analyzing and classifying events accessible as simple as possible for analysts. While this helped make NSM accessible to more people, the process of actually deploying the sensor infrastructure remains cumbersome.

If you search for "Snorby Tutorial" on Google, you'll find Corelan's Snorby Cheat Sheet for setting up Suricata. It's a great comprehensive tutorial, but it's over 2800 words and 15 printed pages. It shouldn't take this many steps and hours for someone to get a competent network security monitoring infrastructure setup.

With Snorby Cloud, one of our main goals was to solve this problem. In our private beta it is now possible to sign-up, login, spin up a snorby box, and setup network sensors in less than 5 minutes without any additional instruction. This is possible thanks to Jen Andre's new sensor installation script. Here is how it works: When you add a sensor through the UI, you can choose to download a file with everything you need.

From here you can execute a single command on the target Linux or OS X computer to complete the sensor installation. You don't need to manually SCP files across, muck with file permissions, or build any software.

Once the command is executed, the rest of the installation is guided for your specific OS in the terminal and takes less than 60 seconds to complete.

That's it! After this step is completed, the sensor will be correctly setup and securely communicating to the Snorby front-end where you can view any reported events.

As analysts ourselves having a simple preconfigured sensor package that can be easily deployed to a node is invaluable. We hope you think so too! If you are curious to try this out for yourself before we launch, sign up at https://cloud.snorby.org!

#snorby #snorby-cloud #sensor #download #curl

Snorby Mobile 1.0.0 Now Available

Snorby Mobile 1.0.0 is now available on the app store (https://itunes.apple.com/us/app/snorby/id570584212?ls=1&mt=8). The mobile application will work with any Snorby install >= 2.5.3. Snorby Cloud (https://cloud.snorby.org) integration will be added in the next release making the process of adding multiple collection servers painless. Let us know what you think and if you have any suggestions.

Snorby Mobile 1.0.0 - We are 100% done with development and testing of the first Snorby mobile application. It is currently waiting in queue to be approved and released on the Apple App store with a price tag of $1.99. All proceeds will go to helping the Snorby project.

Snorby Cloud Screenshots!

Snorby Cloud - Let's make Network Security Monitoring work.

It's 2012. Why is Network Security Monitoring still so hard?

...

Well, truthfully, there's a lot of legitimate reasons why it's so hard. There's a lot of factors that go into Network Security Monitoring: understanding TCP/IP traffic, distinguishing real attacks from false positives in events, and once identifying some traffic may be a real incident, figuring out how to respond. However, there's still a lot of (in my opinion) non-legitimate reasons why people don't do network security monitoring:

If you go the open source route, it's difficult to configure and maintain the ecosystem (though projects like SecurityOnion have made a world of difference in this respect).

It's too hard to maintain sensors rules and keep them up to date.

If you buy one of these "get up and go" security appliances, it's expensive (Sourcefire's "entry level" offering (IPSx) starts at 18k!) -- and there's no guarantee you'll have any easier time installing it!

With Snorby Cloud, our goal is remove some of these pains so at the very least setting up an inexpensive NSM system isn't a several-day ordeal. If you believe (and we certainly do) there is no "silver bullet" to security, Network Security Monitoring is just a good idea for a well rounded security program - your AV and firewall aren't going to catch everything. If you have a store full of valuable merchandise, are you going to stop at expensive locks -- if you could, wouldn't you install "alarm system" that will trigger when something out of the ordinary happens? This is just as true for the data assets at your 100 person business as it is for a 10,000 node enterprise corporation. You might not have a sophisticated security team and a million dollar security budget, but let's make it easier for your IT guy to get started.

We're developers who have a history in the security community developing products for network security monitoring. We know how people use and attempt to use these products, and frankly, we know the whole experience should be much better. There are some amazing capabilities already in open source software and tools -- we think it's our duty to make it available to the masses in a way where you don't need a computer science degree and a deep understanding of compiler output to get up and running.

How does it work?

We provision and deploy a Snorby Cloud server for you on your own private VPS (e.g. https://<mysnorbycloudserver>.snorby.org.

You download a prebuilt Snorby Cloud IDS agent ready to go (it has Suricata + Barnyard + Emerging Threat rules, plus secure TLS certificates for secure communications to your server) OR, download certificates to hook up your existing Snort or Suricata instance and start sending logs to Snorby!

Why didn't you guys use Security Onion?

Good question. Security Onion has a lot of awesome features and for people who want to host/control their own NSM platforms, it's the premier choice for getting up and running really fast with a really powerful solution (e.g., Sguil). We're in the process of developing some cool features that would make our platform just as powerful as Sguil for network security monitoring.

What about full packet capture?

We are in the process of developing full packet capture features for our agent. Stay tuned!

What other features do guys have planned?

Full packet capture agents (with a secure mechanism to query it from your Snorby Cloud server)

HIDS support

Partner branding

Automatic backups (daily)

Easier rules management

... Your suggestions! Supply or vote for them at http://snorbycloud.uservoice.com.

Thanks!

-The Cloud Snorby Team

[email protected]

Trending Blogs

Recently Viewed Blogs

Snorby Labs