1

One of our OpenBSD firewalls experienced a flood of UDP traffic from a compromised host within our internal network. The traffic was exchanged between the compromised internal host and a single external host but across a large number of UDP ports.

(example traffic, names have been changed to protect the innocent)

all udp 1.2.3.4:7613 <- 10.0.0.10:49520       NO_TRAFFIC:SINGLE
all udp 10.0.0.10:49520 -> 1.2.3.4:7613       SINGLE:NO_TRAFFIC
all udp 1.2.3.4:4097 <- 10.0.0.10:60908       NO_TRAFFIC:SINGLE
all udp 10.0.0.10:60908 -> 1.2.3.4:4097       SINGLE:NO_TRAFFIC
all udp 1.2.3.4:32541 <- 10.0.0.10:37535       NO_TRAFFIC:SINGLE
all udp 10.0.0.10:37535 -> 1.2.3.4:32541       SINGLE:NO_TRAFFIC
all udp 1.2.3.4:33677 <- 10.0.0.10:59357       NO_TRAFFIC:SINGLE
all udp 10.0.0.10:59357 -> 1.2.3.4:33677       SINGLE:NO_TRAFFIC
all udp 1.2.3.4:37129 <- 10.0.0.10:51998       NO_TRAFFIC:SINGLE
all udp 10.0.0.10:51998 -> 1.2.3.4:37129       SINGLE:NO_TRAFFIC
all udp 1.2.3.4:22155 <- 10.0.0.10:57033       NO_TRAFFIC:SINGLE
all udp 10.0.0.10:57033 -> 1.2.3.4:22155       SINGLE:NO_TRAFFIC
all udp 1.2.3.4:43867 <- 10.0.0.10:60893       NO_TRAFFIC:SINGLE
all udp 10.0.0.10:60893 -> 1.2.3.4:43867       SINGLE:NO_TRAFFIC
all udp 1.2.3.4:52591 <- 10.0.0.10:53902       NO_TRAFFIC:SINGLE
all udp 10.0.0.10:53902 -> 1.2.3.4:52591       SINGLE:NO_TRAFFIC
all udp 1.2.3.4:32984 <- 10.0.0.10:56988       NO_TRAFFIC:SINGLE
all udp 10.0.0.10:56988 -> 1.2.3.4:32984       SINGLE:NO_TRAFFIC
all udp 1.2.3.4:38585 <- 10.0.0.10:56435       NO_TRAFFIC:SINGLE
all udp 10.0.0.10:56435 -> 1.2.3.4:38585       SINGLE:NO_TRAFFIC
all udp 1.2.3.4:8121 <- 10.0.0.10:41506       NO_TRAFFIC:SINGLE

How might we automatically detect this kind of abusive traffic (given OpenBSD/pf's capabilities) and then react appropriately by banning the offending IP?

We already have a rule and pf table which contains banned IP addresses - It would be ideal if a solution could leverage this existing construct.

(It strikes me this question may be better suited for unix.SE; I posted it here because of the security specific nature and its relationship to firewalls/IDS. If it belongs over there, let it be so!)

  • 1
    yeah - this is more of a server-specific config question. You're also looking for something like snort IDS to catch and alert and things like this. – schroeder Oct 23 '14 at 21:31
1

Take a look at the sfPortscan rule for Snort. It is designed to detect traffic to many different ports. This normally would indicate a portscanning tool like nmap is in use, but it should trigger on the situation you describe.

On the other hand, since you've already detected the attack, I assume you've already eliminated the threat (wiped the hard drive of the infected PC or whatever.) What are the odds that this same vulnerability will be exploited in the same way by the same malware again? The good news is that if you install an IDS like Snort, and subscribe to their rules, it'll help continuously protect you against new threats.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.