[Bridge] IPS HLBR 1.0 released (off-topic)

[Bridge] IPS HLBR 1.0 released (off-topic)

[Eriberto]

IPS HLBR - Version 1.0 can detect malicious traffic using regular
expressions

Version 1.0 of Hogwash Light BR, released march 5th 2006, brings two
interesting new features. The first one is the ability of using
regular expressions to detect intrusion attempts and e-mails with
virus or phishing. The second is the use of lists with banned words.

HLBR is an IPS (Intrusion Prevention System) that reads network
traffic in the layer 2 of the OSI model. Since it works like a bridge,
it stays in-line in the network topology and doesn't need an IP
address. So, HLBR is invisible to attackers. Traffic filtering
(including the packets contents) can be done with simple rules.
Version 1.0 can use regular expressions to filter the packets. Below
is an example of rule with regular expressions:

<rule>
ip dst(email)
tcp dst(25)
tcp regex(filename="[^\n]+\.scr")
message=(mailvirus-1-re) .scr attach
action=virus
</rule>

In short, all TCP traffic destined to port 25 of the e-mail server
will be filtered. If the text:

filename="anything_different_of_line_breaks.scr"

is found inside the packet, that means there are an attachment .scr in
the e-mail (virus). So this packet will suffer the action named 'virus'.
This action logs the event, dumps the malicious traffic in tcpdump
format and drops the packet. Below is an example of rule against a type
of buffer overflow attempt against DNS servers:

<rule>
ip dst(dns)
udp dst(53)
udp nocase(|41cd 80c7 062f 6269 6ec7 4604 2f73 6800  89f0 83c0 0889 4608|)
message=(dnsattacks-1) tsl bind attack
action=action1
</rule>

In this case, due to the use of pipe characters (|), HLBR will check
the traffic for the hexadecimal sequence given as an attack signature.

HLBR lets you use rules for blocking attacks against network servers.
In order to fully understand it please read our documentation at
http://hlbr.sourceforge.net/ips-en.html - explanations about the IPS
concept including charts.

HLBR site is at http://hlbr.sourceforge.net.

(Translated from Portuguese by André Bertelli - andre (a) bertelli.name)

[Bridge] IPS HLBR 1.0 released (off-topic)

[Eriberto]

IPS HLBR - Version 1.0 can detect malicious traffic using regular
expressions

Version 1.0 of Hogwash Light BR, released march 5th 2006, brings two
interesting new features. The first one is the ability of using
regular expressions to detect intrusion attempts and e-mails with
virus or phishing. The second is the use of lists with banned words.

HLBR is an IPS (Intrusion Prevention System) that reads network
traffic in the layer 2 of the OSI model. Since it works like a bridge,
it stays in-line in the network topology and doesn't need an IP
address. So, HLBR is invisible to attackers. Traffic filtering
(including the packets contents) can be done with simple rules.
Version 1.0 can use regular expressions to filter the packets. Below
is an example of rule with regular expressions (please, ignore underIPS 
HLBR - Version 1.0 can detect malicious traffic using regular
expressions

Version 1.0 of Hogwash Light BR, released march 5th 2006, brings two
interesting new features. The first one is the ability of using
regular expressions to detect intrusion attempts and e-mails with
virus or phishing. The second is the use of lists with banned words.

HLBR is an IPS (Intrusion Prevention System) that reads network
traffic in the layer 2 of the OSI model. Since it works like a bridge,
it stays in-line in the network topology and doesn't need an IP
address. So, HLBR is invisible to attackers. Traffic filtering
(including the packets contents) can be done with simple rules.
Version 1.0 can use regular expressions to filter the packets. Below
is an example of rule with regular expressions:

<rule>
ip dst(email)
tcp dst(25)
tcp regex(filename="[^\n]+\.scr")
message=(mailvirus-1-re) .scr attach
action=virus
</rule>

In short, all TCP traffic destined to port 25 of the e-mail server
will be filtered. If the text:

filename="anything_different_of_line_breaks.scr"

is found inside the packet, that means there are an attachment .scr in
the e-mail (virus). So this packet will suffer the action named 'virus'.
This action logs the event, dumps the malicious traffic in tcpdump
format and drops the packet. Below is an example of rule against a type
of buffer overflow attempt against DNS servers:

<rule>
ip dst(dns)
udp dst(53)
udp nocase(|41cd 80c7 062f 6269 6ec7 4604 2f73 6800  89f0 83c0 0889 4608|)
message=(dnsattacks-1) tsl bind attack
action=action1
</rule>

In this case, due to the use of pipe characters (|), HLBR will check
the traffic for the hexadecimal sequence given as an attack signature.

HLBR lets you use rules for blocking attacks against network servers.
In order to fully understand it please read our documentation at
http://hlbr.sourceforge.net/ips-en.html - explanations about the IPS
concept including charts.

HLBR site is at http://hlbr.sourceforge.net.

(Translated from Portuguese by André Bertelli - andre (a) bertelli.name)

lines in s_c_r):

<rule>
ip dst(email)
tcp dst(25)
tcp regex(filename="[^\n]+\.s_c_r")
message=(mailvirus-1-re) .s_c_r attach
action=virus
</rule>

In short, all TCP traffic destined to port 25 of the e-mail server
will be filtered. If the text:

filename="anything_different_of_line_breaks.s_c_r"

is found inside the packet, that means there are an attachment .scr in
the e-mail (virus). So this packet will suffer the action named 'virus'.
This action logs the event, dumps the malicious traffic in tcpdump
format and drops the packet. Below is an example of rule against a type
of buffer overflow attempt against DNS servers:

<rule>
ip dst(dns)
udp dst(53)
udp nocase(|41cd 80c7 062f 6269 6ec7 4604 2f73 6800  89f0 83c0 0889 4608|)
message=(dnsattacks-1) tsl bind attack
action=action1
</rule>

In this case, due to the use of pipe characters (|), HLBR will check
the traffic for the hexadecimal sequence given as an attack signature.

HLBR lets you use rules for blocking attacks against network servers.
In order to fully understand it please read our documentation at
http://hlbr.sourceforge.net/ips-en.html - explanations about the IPS
concept including charts.

HLBR site is at http://hlbr.sourceforge.net.

(Translated from Portuguese by André Bertelli - andre (a) bertelli.name)

[Bridge] IPS HLBR 1.0 released (off-topic)

[Eriberto]

IPS HLBR - Version 1.0 can detect malicious traffic using regular
expressions

Version 1.0 of Hogwash Light BR, released march 5th 2006, brings two
interesting new features. The first one is the ability of using
regular expressions to detect intrusion attempts and e-mails with
virus or phishing. The second is the use of lists with banned words.

HLBR is an IPS (Intrusion Prevention System) that reads network
traffic in the layer 2 of the OSI model. Since it works like a bridge,
it stays in-line in the network topology and doesn't need an IP
address. So, HLBR is invisible to attackers. Traffic filtering
(including the packets contents) can be done with simple rules.
Version 1.0 can use regular expressions to filter the packets. Below
is an example of rule with regular expressions:

(please see http://hlbr.sourceforge.net/hlbr-rule-1.gif)

In short, all TCP traffic destined to port 25 of the e-mail server
will be filtered. If the text:

filename="anything_different_of_line_breaks.s__c__r"

(please ignore underlines in s__c__r)

is found inside the packet, that means there are an attachment .scr in
the e-mail (virus). So this packet will suffer the action named 'virus'.
This action logs the event, dumps the malicious traffic in tcpdump
format and drops the packet. Below is an example of rule against a type
of buffer overflow attempt against DNS servers:

(please see http://hlbr.sourceforge.net/hlbr-rule-2.gif)

In this case, due to the use of pipe characters (|), HLBR will check
the traffic for the hexadecimal sequence given as an attack signature.

HLBR lets you use rules for blocking attacks against network servers.
In order to fully understand it please read our documentation at
http://hlbr.sourceforge.net/ips-en.html - explanations about the IPS
concept including charts.

HLBR site is at http://hlbr.sourceforge.net.

(Translated from Portuguese by André Bertelli - andre (a) bertelli.name)

Re: [Bridge] IPS HLBR 1.0 released (off-topic)

[Stephen Hemminger]

On Mon, 06 Mar 2006 13:09:59 -0300
Eriberto <eriberto@eriberto.pro.br> wrote:

> IPS HLBR - Version 1.0 can detect malicious traffic using regular
> expressions
> 
> Version 1.0 of Hogwash Light BR, released march 5th 2006, brings two
> interesting new features. The first one is the ability of using
> regular expressions to detect intrusion attempts and e-mails with
> virus or phishing. The second is the use of lists with banned words.
> 
> HLBR is an IPS (Intrusion Prevention System) that reads network
> traffic in the layer 2 of the OSI model. Since it works like a bridge,
> it stays in-line in the network topology and doesn't need an IP
> address. So, HLBR is invisible to attackers. Traffic filtering
> (including the packets contents) can be done with simple rules.
> Version 1.0 can use regular expressions to filter the packets. Below
> is an example of rule with regular expressions:
> 
> <rule>
> ip dst(email)
> tcp dst(25)
> tcp regex(filename="[^\n]+\.scr")
> message=(mailvirus-1-re) .scr attach
> action=virus
> </rule>
> 
> In short, all TCP traffic destined to port 25 of the e-mail server
> will be filtered. If the text:
> 
> filename="anything_different_of_line_breaks.scr"
> 
> is found inside the packet, that means there are an attachment .scr in
> the e-mail (virus). So this packet will suffer the action named 'virus'.
> This action logs the event, dumps the malicious traffic in tcpdump
> format and drops the packet. Below is an example of rule against a type
> of buffer overflow attempt against DNS servers:
> 
> <rule>
> ip dst(dns)
> udp dst(53)
> udp nocase(|41cd 80c7 062f 6269 6ec7 4604 2f73 6800  89f0 83c0 0889 4608|)
> message=(dnsattacks-1) tsl bind attack
> action=action1
> </rule>
> 
> In this case, due to the use of pipe characters (|), HLBR will check
> the traffic for the hexadecimal sequence given as an attack signature.
> 
> HLBR lets you use rules for blocking attacks against network servers.
> In order to fully understand it please read our documentation at
> http://hlbr.sourceforge.net/ips-en.html - explanations about the IPS
> concept including charts.
> 
> HLBR site is at http://hlbr.sourceforge.net.
> 
> (Translated from Portuguese by André Bertelli - andre (a) bertelli.name)
> 
>

Ebtables can do the same thing and it does it with in the existing
general netfilter framework.  Or is this just a wrapper on existing netfilters?