New securityonion-bro-scripts and securityonion-web-page packages

As mentioned previously, Seth Hall has developed some comprehensive ShellShock detection scripts for Bro:

"This script detects successful exploitation of the Bash vulnerability with CVE-2014-6271 nicknamed "ShellShock". It's more comprehensive than most of the detections around in that it's watching for behavior from the attacked host that might indicate successful compromise or actual vulnerability."

https://github.com/broala/bro-shellshock
http://blog.securityonion.net/2014/09/bash-vulnerability-part-3.html
http://blog.securityonion.net/2014/09/new-securityonion-bro-scripts.html
http://blog.securityonion.net/2014/09/securityonion-bro-scripts-now-detects.html

Seth has updated these scripts again today to "Add shellscripts as a post-exploit detection mechanism.":
https://github.com/broala/bro-shellshock/commit/4be009f9b7bf8ce9b99533cb4c7b8dd76aba87b7

I've updated the securityonion-bro-scripts package to include these changes.  I've also updated the securityonion-web-page package to include some ELSA queries for "ShellShock Exploits" and "ShellShock Scanners".

New package versions:
securityonion-bro-scripts - 20121004-0ubuntu0securityonion38
securityonion-web-page - 20120722-0ubuntu0securityonion25

Issues Resolved
Issue 618: securityonion-bro-scripts: ShellShock Add shellscripts as a post-exploit detection mechanism
https://code.google.com/p/security-onion/issues/detail?id=618

Issue 617: securityonion-web-page: add queries for Bro ShellShock Notices
https://code.google.com/p/security-onion/issues/detail?id=617

Issue 583: securityonion-web-page: update "All OSSEC Logs" query
https://code.google.com/p/security-onion/issues/detail?id=583

Issue 599: securityonion-web-page: highlight current ELSA query
https://code.google.com/p/security-onion/issues/detail?id=599

Updating
The new packages are now available in our stable repo.  Please see the following page for full update instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

To apply the new Bro ShellShock detection, you'll need to restart Bro as follows:

sudo nsm_sensor_ps-restart --only-bro

Screenshots

Update Process

Restarting Bro with "sudo nsm_sensor_ps-restart --only-bro"

New ELSA Query for Notice - ShellShock Exploits

New ELSA Query for Notice - ShellShock Scanners

Feedback
If you have any questions or problems, please use our security-onion mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Training
Only 15 seats left for the 3-day Security Onion class in Richmond VA!
https://security-onion-class-20141020.eventbrite.com/

Commercial Support
Need commercial support?  Please see:
http://securityonionsolutions.com

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list:
http://groups.google.com/group/security-onion

We also need help testing new packages:
http://groups.google.com/group/security-onion-testing

Thanks!

securityonion-bro-scripts now detects the ShellShock Qmail SMTP "MAIL FROM" attack vector

Seth Hall added support for the ShellShock Qmail SMTP "MAIL FROM" attack vector to his Bro ShellShock scripts:
https://github.com/broala/bro-shellshock/commit/6ba280179e86243ecc0ed0b84d38e5906bbdcadc

I've updated the securityonion-bro-scripts package to include these changes.

New package version:
securityonion-bro-scripts - 20121004-0ubuntu0securityonion37

Issues Resolved
Issue 616: securityonion-bro-scripts: ShellShock Qmail SMTP "MAIL FROM" attack vector
https://code.google.com/p/security-onion/issues/detail?id=616

Updating
The new package is now available in our stable repo.  Please see the following page for full update instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

To apply the new Bro ShellShock detection, you'll need to restart Bro as follows:

sudo nsm_sensor_ps-restart --only-bro

Screenshots

Update Process

Restarting Bro to load new ShellShock detection

Feedback
If you have any questions or problems, please use our security-onion mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Training
Only 16 seats left for the 3-day Security Onion class in Richmond VA!
https://security-onion-class-20141020.eventbrite.com/

Commercial Support
Need commercial support?  Please see:
http://securityonionsolutions.com

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list:
http://groups.google.com/group/security-onion

We also need help testing new packages:
http://groups.google.com/group/security-onion-testing

Thanks!

New Setup package adds Snort Community Ruleset to VRT Ruleset

On Friday, I wrote a quick blog post about the ShellShock rules in the Snort Community ruleset:
http://blog.securityonion.net/2014/09/bash-vulnerability-part-5-shellshock.html

The new version of Setup mentioned in that blog post has been tested by Eddy Simons (thanks!) and is now available in our stable PPA.

New package versions:
securityonion-setup - 20120912-0ubuntu0securityonion122

Issues Resolved
Issue 613: Setup: if user chooses VRT rules, enable Community as well
https://code.google.com/p/security-onion/issues/detail?id=613

Updating
The new packages are now available in our stable repo.  Please see the following page for full update instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Screenshots

Update Process

ShellShock alert in Snorby

Feedback
If you have any questions or problems, please use our security-onion mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Training
Only 17 seats left for the 3-day Security Onion class in Richmond VA!
https://security-onion-class-20141020.eventbrite.com/

Commercial Support
Need commercial support?  Please see:
http://securityonionsolutions.com

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list:
http://groups.google.com/group/security-onion

We also need help testing new packages:
http://groups.google.com/group/security-onion-testing

Thanks!

Bash Vulnerability Part 6: YABU - Yet Another Bash Update

This is a continuation of the ShellShock posts from the last few days:
http://blog.securityonion.net/2014/09/bash-vulnerability.html
http://blog.securityonion.net/2014/09/bash-vulnerability-part-2.html
http://blog.securityonion.net/2014/09/bash-vulnerability-part-3.html
http://blog.securityonion.net/2014/09/bash-vulnerability-part-4-another.html
http://blog.securityonion.net/2014/09/bash-vulnerability-part-5-shellshock.html
http://blog.securityonion.net/2014/09/new-securityonion-bro-scripts.html

Ubuntu has now released yet another bash update:
http://www.ubuntu.com/usn/usn-2364-1/

You should install this updated package as soon as possible.  As always, we recommend using "soup" to apply package updates.  Please see the following page for full update instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

If you have any questions or problems, please use our security-onion mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Bash Vulnerability Part 5: ShellShock rules in Snort Community ruleset

This is a continuation of the ShellShock posts from the last few days:
http://blog.securityonion.net/2014/09/bash-vulnerability.html
http://blog.securityonion.net/2014/09/bash-vulnerability-part-2.html
http://blog.securityonion.net/2014/09/bash-vulnerability-part-3.html
http://blog.securityonion.net/2014/09/bash-vulnerability-part-4-another.html

If you're running the Snort VRT ruleset, please read this post in its entirety.

The Snort VRT added some ShellShock rules to the Community ruleset:
http://blog.snort.org/2014/09/snort-community-ruleset-out-of-band.html

If you look at your current /etc/nsm/pulledpork/pulledpork.conf file, you'll see that the Snort Community ruleset line is not enabled (or missing altogether if it's been a while since you ran Setup).  I've updated Setup so that when you run Setup and choose Snort VRT, it will also enable the Snort Community ruleset.  If you've already run Setup, the new Setup package will check your existing pulledpork.conf file and add/enable the Snort Community ruleset if necessary.

I've submitted securityonion-setup - 20120912-0ubuntu0securityonion122 for testing:
https://groups.google.com/d/topic/security-onion-testing/W_R_ejUc-Z4/discussion

If you're not already a member of the security-onion-testing Google Group, please join the group and help us test this new package so we can get it released as quickly as possible.

Thanks!

Setup updating pulledpork.conf

Snorby displaying ShellShock alert from Snort Community ruleset

UPDATE 20140927 07:59
Please see:
http://blog.securityonion.net/2014/09/new-securityonion-bro-scripts.html

UPDATE 20140929 08:25
The new Setup package has been tested and published:
http://blog.securityonion.net/2014/09/new-setup-package-adds-snort-community.html

Bash Vulnerability Part 4: Another updated bash package

Earlier today (http://blog.securityonion.net/2014/09/bash-vulnerability-part-2.html), I said:
"There are most likely other issues, so expect additional updates to bash in the near future."

Ubuntu has now released another new bash package:
http://www.ubuntu.com/usn/usn-2363-1/

You should install this updated package as soon as possible.  As always, we recommend using "soup" to apply package updates.  Please see the following page for full update instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

If you have any questions or problems, please use our security-onion mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

UPDATE 20140926 14:12
Please see Part 5:
http://blog.securityonion.net/2014/09/bash-vulnerability-part-5-shellshock.html

Bash Vulnerability Part 3

Earlier today, I wrote a quick blog post about detecting exploit attempts for this new Bash Vulnerability:
http://blog.securityonion.net/2014/09/bash-vulnerability-part-2.html

As mentioned in an update to that blog post, Seth Hall wrote a ShellShock detector for Bro that detects successful exploitation (not just an attempt):
https://github.com/broala/bro-shellshock

I've added these Bro scripts to our securityonion-bro-scripts package and submitted the package for testing:
https://groups.google.com/forum/#!topic/security-onion-testing/kOBEKrhKvTo

If you're not already a member of the security-onion-testing Google Group, please join the group and help us test this new package so we can get it released as quickly as possible.

Thanks!

Bro Notice for ShellShock::Exploit

Bro http.log showing ShellShock::HIT

UPDATE 20140926 14:12
Please see Part 4:
http://blog.securityonion.net/2014/09/bash-vulnerability-part-4-another.html

UPDATE 20140927 08:01
The updated securityonion-bro-scripts package has been released to our stable PPA:
http://blog.securityonion.net/2014/09/new-securityonion-bro-scripts.html

Bash Vulnerability Part 2

Yesterday, a vulnerability in bash was announced and I wrote a quick blog post on updating your Security Onion sensors to the latest version of bash:
http://blog.securityonion.net/2014/09/bash-vulnerability.html

There are most likely other issues, so expect additional updates to bash in the near future.

To monitor your network for exploit attempts, IDS signatures are now available from Snort VRT and Emerging Threats (ET).  Assuming you have PulledPork configured correctly, you should have received the VRT and/or ET rules in your rule update this morning.

https://www.snort.org/advisories/vrt-rules-2014-09-24.html

(copied from link above)
1:31978 <-> ENABLED <-> OS-OTHER Bash CGI environment variable injection attempt (os-other.rules)
1:31977 <-> ENABLED <-> OS-OTHER Bash CGI environment variable injection attempt (os-other.rules)
1:31976 <-> ENABLED <-> OS-OTHER Bash CGI environment variable injection attempt (os-other.rules)
1:31975 <-> ENABLED <-> OS-OTHER Bash CGI environment variable injection attempt (os-other.rules)

http://emergingthreats.net/daily-ruleset-update-summary-09242014/

(copied from link above)
2019231 – ET WEB_SERVER Possible CVE-2014-6271 Attempt in URI (web_server.rules)
2019232 – ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers (web_server.rules)
2019233 – ET WEB_SERVER Possible CVE-2014-6271 Attempt in Client Body (web_server.rules)
2019234 – ET WEB_SERVER Possible CVE-2014-6271 Attempt in Client Body 2 (web_server.rules)

Also, a Bro script is now available from Critical Stack and Hectaman:
https://github.com/CriticalStack/bro-scripts

UPDATE 20140925 14:04
Here's another Bro script from Broala and Seth Hall:
https://github.com/broala/bro-shellshock

If you have any questions or problems, please use our security-onion mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

UPDATE 20140925 16:37
Please see Part 3:
http://blog.securityonion.net/2014/09/bash-vulnerability-part-3.html

Bash Vulnerability

A vulnerability in bash was announced this morning:

https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

http://seclists.org/oss-sec/2014/q3/649

You can test your system to see if it's vulnerable using the POC shown here:
https://twitter.com/kbsingh/status/514801829633593345

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

For example:

Vulnerable

Ubuntu has released an updated version of bash to resolve this:
http://www.ubuntu.com/usn/usn-2362-1/

You should install this updated package as soon as possible.  As always, we recommend using "soup" to apply package updates.  Please see the following page for full update instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

After installing the updated package, you can verify using the POC again:

New version of bash

UPDATE 20140925 16:38:
Please see Part 2:
http://blog.securityonion.net/2014/09/bash-vulnerability-part-2.html

Grepping an Active Log File and Mailing Matches

Recently, I had a need to be alerted by email each and every time a certain user logged in. After a few false starts, I eventually settled on something like this (sanitized and simplified for this blog):

tail -n0 -f /var/log/secure | grep --line-buffered "user" | while read line; do echo $line | mail myemail@example.com -s "Found"; done

We use the standard "tail -f" to follow the /var/log/secure file. The "-n0" option is used so that tail will start 0 lines from the end of the file. We only care about new entries in the file, so we start at the very end of the file, ignoring any existing entries.

Next, we pipe that to grep, looking for the username "user". The "--line-buffered" option is used to force grep to flush each and every line of output (instead of waiting for its default buffer to fill). Per the man page, this option can be a performance penalty, but this is not a concern in this scenario.

Then, we pipe that to a while loop that iterates over each line. For each line of output, we generate an email with a subject of "Found" and include what was found in the body of the email.

This solution works quite nicely and can very easily be extended in the following ways:

• adding multiple grep criteria
• modifying format of log entry to be emailed
• changing final action from email to something else (like adding an IPTables drop rule)

Enjoy!