2

If you use a passive network tap and a server with an Ethernet port in promiscuous mode to monitor all traffic between WAN port of your router and RJ45 port of your ISP cable modem.

Is the IDS instance running snort and snorby vulnerable to attacks from the Internet? Because it's placed outside the router, which usually acts as a firewall.

The connection to check the snorby website is done over a separate Ethernet port than the server which is connected to a LAN port of the router. You can only check the snorby website when you're within the LAN.

Improve this question

2 Answers 2

Reset to default
1

Yes.

There have been known vulnerabilities in the snort code that allow specially crafted packets to cause remote code execution and DoS. The problem for the attacker is knowing that snort is running, and which vulnerable version is running, but you still need to design your IDS to defend against such a possibility.

Improve this answer
1
  • So can u use Snort's listening network device (eth0 promisc-mode) as a 'gate' to compromise Snort? Could u abandon all remote attacks on Snort by simply only allow connection to admin or webgui from and to an IP thats within the same LAN (10.0.0.x)?
    – user3200534
    Commented Mar 27, 2014 at 23:56
-1

Not everything that is placed "outside of the router/DMZ/secured perimeter" is exploitable which is the key word you're confusing. There is a difference in vulnerability and exploit. Just because it is public facing, does not mean it is exploitable. It may be vulnerable to say scanning, information disclosure, unauthorized attempts at access, but exploit and vulnerability are two very different things.

You have a house with windows. It is vulnerable to someone throwing a rock through the window and possibly getting in (vulnerability). You also have a Rottweiler (a firewall, IDS, IPS, etc) inside, so you're jewelry won't get stolen (exploited).

Improve this answer
5
  • I'm not sure you understand his question. To use your analogy, he's asking if his guard dog is exploitable...
    – schroeder ♦
    Commented Mar 27, 2014 at 17:58
  • @schroeder - only he can know whether or not this is the case by matching his version with CVE data, or testing it on his on.
    – munkeyoto
    Commented Mar 27, 2014 at 18:57
  • Then your answer makes no sense. You reduced the definitions to a point where they lost meaning. His wording is what he wanted to say "is it vulnerable to attacks" - he did not ask if it was exploitable.
    – schroeder ♦
    Commented Mar 27, 2014 at 19:56
  • How can it be vulnerable to info-disclosure or unauthorized access when the only network interface (eth0) outside my firewall is in promiscuous mode? How does the attacker get any information back, when Snort is only listening?
    – user3200534
    Commented Mar 28, 2014 at 0:04
  • @schroeder - then it STILL is vulnerable to attacks like sneeze, and other Denial of Service/disinformation attacks securiteam.com/tools/5DP0T0AB5G.html
    – munkeyoto
    Commented Mar 28, 2014 at 19:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .