1

With so many devices that have internet connectivity, I really want to put something in place that can alert me if any application or device is communicating insecurely. How would I use something like OSSIM or Snort or something to be able to determine if credentials are being passed.

From my thinking, it appears that what I would need to do is to somehow place something between the router and everything else so I can intercept.

Edit: Here is a very basic mockup of the devices on my home network. My goal is to figure out a way to get the Security Onion VM running on my PC to be able to monitor all traffic throughout the network. I am unsure if I need/how to configure a TAP on the network. Do I need a managed switch rather than the unmanaged? Here is the mockup: https://www.lucidchart.com/documents/view/abc0cc81-dc4c-450c-84bd-c7aa33d7255f

|improve this question
3

Edit: I totally missed the home network part. Purchasing a network tap in this situation would be overkill. In your case Snort or Suricata could work. You could specifically make rules to search the packets for strings that would indicate insecure communication. You could further tune it by removing all rules not pertinent to what you're looking for, cleartext credentials. More details on making custom Snort rules here: http://www.sans.org/security-resources/idfaq/snort-detect-credit-card-numbers.php

Enterprisey solution: I've seen people run Suricata or Snort on their systems but that doesn't seem to scale so well if you have high bandwidth usage. You are right that a network tap might be useful in your situation. I'm not sure if you're dealing with fiber or copper, but you could get a suitable tap and feed the data from the monitoring ports into other tools. These tools, which could potentially be Snort or Suricata, could scan the packet data for specific strings such as you'd see in LDAP authentication. There may also be DLP tools that could work for this use case.

|improve this answer
  • If I plan on using a VM of Security Onion, what do you think is the best solution? i.e. I have an umanaged switch - do I need a managed switch to make sure that my VM will pick up all traffic? – appsecguy Oct 9 '14 at 18:15
  • There are probably ways to sniff all host traffic using an interface with VM. I just tested it a little and had no luck. Some people online report bridged networking can potentially introspect all of the traffic coming from the host's interface. If you can pull that off with a VM then it should work just fine, the IDS will see all the traffic. – theterribletrivium Oct 11 '14 at 21:48
  • I think this would be the best option if possible. Otherwise maybe a raspberry pi with a USB NIC. But I would prefer being able to use a VM if possible. – appsecguy Oct 12 '14 at 18:59
3

In this case you may want to get a network tap or set up port mirroring if your router supports it. From there you can install an IPS (either manually make an image or use security onion).

You might want a deployment style similar to below. However in your case the firewall will most likely be your internet modem and your LAN will be your router.: enter image description here

Or if you set up port mirroring it might look like this: enter image description here

|improve this answer
2

If you have some extra hardware around i recommend trying Security Onion.

It has snorby and suricata already installed and can be run in a few different deployment styles (one machine, listening posts etc).

Might be just enough information for you.

You could of course also hub out your home network and tcpdump/wireshark your traffic and see.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.