CS6262 Project 4 writeup

GT CS 6262: Network Security FTP / SSH is attacked via a Kali Linux machine( the attacker machine), and Ubuntu 14.0 system is the victim machine. There is a large dictionary that contains 90 million words that were used for the list of passwords to brute force. It is your task to identify which one(FTP or SSH) of them is present in the evaluation pcap given to you. A 4 mins Video that has some useful tips for Bruteforce attack. We do not provide you with the sample pcap for SSH. However, we encourage you to do some research on the differences between FTP traffic and SSH traffic. Also, the 4 mins video might include some hints. (iii) Web Attacks: There are 3 possible web attacks, one of which would be present in your pcap. (a) DVWA-based: Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is vulnerable. An attacker might try to hijack it. (b) XSS-based: An attacker might try to launch an XSS attack. (c) SQL Injection: An attacker might try an SQL injection attack. (We do not provide a video for webAttack or Botnet, but the sample pcaps we provided should be sufficient to guide you through this part of the project. Tips: Look at the contents of the traffic, that’s the key!) (iv) Botnet : Zeus is a trojan horse malware that runs on Microsoft Windows. It might be presented in the pcap. It can be used to carry out many malicious and criminal tasks and it is often used to steal banking information by man-in-the-browser keystroke logging and form grabbing. It is used to install the Crypto-Locker ransomware as well. Zeus spreads mainly through drive-by downloads and phishing schemes. The Ares botnet might also be presented in the pcap. It is an open-source botnet and has the following capabilities: (a) remote cmd.exe shell (b) persistence (c) file upload/download (d) screenshot (e) keylogging Either Zeus or Ares could be present in your evaluation. pcap, it is your task to identify which one. Sample traffic: For each type of traffic mentioned above, we provide a sample of that category/type of traffic. These samples are only for illustration purposes. These samples are only examples , and they are not the same as the actual traffic that is included in the evaluation pcap, which the students will need to label. ● Legitimate background traffic: For this exercise, we assume normal traffic to include HTTP, DNS. An example of normal (attack free) traffic can be found in: ○ sample_background.pcap ● BruteForce: ○ sample_bruteforce_ftp.pcap ○ We do not provide a sample bruteforce ssh pcap. If you see that in the folder, you can ignore that file. ● Botnet: The host generates this traffic explicitly to communicate with a C&C server. The host communicates with the C&C server to receive commands, updates, etc. ○ sample_bot.pcap ● Web Attack: ○ sample_web.pcap ○ sample_xss.pcap ○ sample_sqlinjection.pcap. ● DDoS:

GT CS 6262: Network Security 1. JSONDecoderError - This occurs when the file is too big for python to handle. This also means that you have too many false positives and your snort rule needs to be made more precise. 2. Comments: {'unknown message: abc'} - This occurs when your snort alert raises a message that cal_unique_connection_2022.py doesn't expect. It has to be one of: 1. "DdoS" 2. "Bruteforce" 3. "WebAttack" 4. "Botnet". The grader/script is looking for the attack types to be spelled/capitalized exactly the way we described. 3. If you don't see "Attack type: ..., unique connections: ..." for a particular attack but see it for others - This means your snort rule was too strict/incorrect and filtered out all connections. Deliverables/Rubric: For this project, you should submit Two files on Gradescope ● rules.py - This is where you paste your Snort rules. This is for us to grade your rules! Just copy and paste what you have in eval.rules into rules.py (create a new text file and name it rules.py). You are not allowed to hardcode a single IP (like 192.0.11.11) in their rules. Instead, you should specify subnets and use the features of the attacks to capture them. 10 points will be deducted if this file is missing. The minimum score for the project is 0. If you get a -10 as your final grade, the grade will be adjusted manually later. ● connections.txt - the result file generated by running `python3 cal_unique_connection_2022.py alert_json.txt`. The connections.txt file is generated by the command. Do not change the connections.txt file Note: ● Incorrect or missing files will lead to a 10 point grade deduction per file ● There is a limit on the number of submissions on gradescope. Please refer to “How to validate your answer” in the session below. ● Don’t zip the file. Just upload them as separate files. Make sure the filename is correct. ● (Optional) If you wish to take your Canvas submission as your final submission after you used all your chances on gradescope , you will have to let us know through this form . We will compare your canvas submission with the gradescope submission and take the highest submission among all your submissions. ● All the late submissions will be on Gradescope . You do not need to make a post on piazza. How to validate your answer: 1. We consider a connection to be “ src_ip:src_port:dest_ip:dest_port ”. You can utilize the ` cal_unique_connection.py ` to check the unique connections of your alert_json.txt. You can compare the number of DDoS/BruteForce/WebAttack/Botnet you got with the statistics below. If the number is close, you are likely on the right track. 2. You can view the pcap file in Wireshark to confirm you are finding the right connections. 3. Last, you can verify your result by submitting your answer to the gradescope (See steps 4&5). As the number of trials is limited, perform step 2 first! 4. We have provided you a way to verify your results on the Gradescope. You need to upload your connections.txt and you will see your current score. And you can verify your results at most 10 times! Uploading more than 10 times in gradescope will result in an error which notifies you that you cannot verify your result anymore. (Technically, you can still submit your work after the 10th submission. You can upload your final submission to canvas. However, you won't be able to validate your canvas submissions.) 5. Running a single snort rule against the evaluation.pcap can get a different result when you run it along with other snort rules. This is related to the limitation of Snort. So please run all your rules together to get the result we want.

GT CS 6262: Network Security 20. Why am I getting many more connections than necessary in DdoS and how should I lower it? - Try using the frequency as a filter type. Remember that the direction of tracking matters (by src VS. by dst) Resources: Readings on botnets behavior: Please read through the following papers, to get an understanding of what a bot is, and how botnets behave. Please note that we are not asking you to implement the proposed methodologies, e.g. a machine learning method to detect bots. ● ”BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation” , Gu et. al. http://faculty.cs.tamu.edu/guofei/paper/Gu_Security07_botHunter.pdf ● ”BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic” , G. Gu, J. Zhang, W. Lee, http://faculty.cs.tamu.edu/guofei/paper/Gu_NDSS08_botSniffer.pdf ● ”BotMiner: Clustering Analysis of Network Traffic for Protocol-and Structure-Independent Botnet Detection” , G. Gu, R. Perdisci, J. Zhang, W. Lee, https://www.usenix.org/legacy/event/sec08/tech/full_papers/gu/gu.pdf Snort resources: Here you can find some examples of Snort rules, and some resources so that you get familiar with Snort rules. The purpose of these resources is only to get you familiar with how Snort rules look like. You are expected to write your own Snort rules. - https://usermanual.wiki/Document/snortmanual.760997111/view - https://snort-org-site.s3.amazonaws.com/production/document_files/files/000/000/596/original/ Rules_Writers_Guide_to_Snort_3_Rules.pdf When you google snort syntax, you should be aware that we are using snort 3 not snort 2. There are some subtle differences between Snort 2 and Snort 3 syntax. Snort 2 syntax might result in errors when you run your rules locally. Example: Writing Snort rules to detect DDoS traffic: This is an example to give you an idea about how we can use our understanding of an attack, and write Snort rules with potentially long shelf life, to detect this attack. Intro reading for dos: https://en.wikipedia.org/wiki/Denial-of-service_attack . Snort for DDoS: Please read this to get a general idea about how Snort can be used for this purpose. Please focus on sections 3 and 4. After reading the above, one way to detect dos traffic is to monitor the rate of incoming traffic. Here is an example Snort rule based on traffic rate: http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node35.html (Notice that this link is actually the snort 2 manual. However, the syntax for detection_filter is the same in snort 2 and 3. The Snort 2 manual in this case provides a better example to illustrate this filter. For other filters, especially the URL content filters, you should double check the snort 3 manual and other resources online) Useful tools/commands: ● You can SCP the files from the VM to your local machine and view them using Wireshark. ● SCP: http://www.hypexr.org/linux_scp_help.php ● Redirecting a program's output: http://linuxcommand.org/lc3_lts0070.php ● You can install Wireshark from here: https://www.wireshark.org/ We do recommend you to install Wireshark on your own machine for evaluation pcap analysis because the pcap file is big and your VM might be significantly slower than your laptop. ● Wireshark display filters to view part of the traffic: https://wiki.wireshark.org/DisplayFilters ● How to scp a file named file to the VM: scp file student@<VM’s ip>:/home/student . If your VM has a different IP address than the above then you can find it by starting the VM, then log-in, and then do: ip a . ● The above scp command is just an example. Modify it accordingly. Resource for scp syntax: http://www.hypexr.org/linux_scp_help.php