Taking action for exploit attempts

Question

Just recently I see I have had about 40 hits in one second for the following Snort rule- signature id 1:16008, which corresponds to the CVE-2007-6239: "... allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers...". Both source and destination IPs are internal (private) IPs.

What does general wisdom say in this regard? - should such one-off hits be taken seriously and some action be taken, like blocking the source IP? (well I just run Snort in IDS mode, so I cant actually take any action, but wanted to know this to have more understanding of this) Or should Admins usually wait to see repeated hits before deciding that this is not some false trigger but an actual alert?

Next, putting myself in the shoes of the network admin, do I need to do anything? I understand this one might be a little difficult to answer with the limited info I have, but I hope to get some idea- check the machines for a possibility of being compromised, temporarily block traffic to the IPs etc...

Answer 1

You have an 'event' but you need to qualify it as an 'incident' or not. Do some investigation to discover the root cause, and if there is not enough data to make a decision, set up additional monitoring on the suspected host and the target.

Not all events are incidents, but each event needs to be properly qualified.

For the 'general wisdom' look at 'Incident Response' policies and procedures.

For practical immediate steps, I would monitor the host, look for other network events that might be related, and review my Snort rules to make sure that I'm up-to-date and if there are tweaks to the CVE-2007-6239 rules that I could make.

Answer 2

If you are seeing repeated exploit attempts from a particular IP address it makes sense to block it, or better yet NAT it to a honeypot. Sure, many attackers will have a whole set of compromised servers they can try from, so blocking one of them won't stop them, however it will force them to respond to you and may convince them that other targets are worth while.

Don't obsess over it though, you could spend all day blocking IPs and there will still be a million more.