RFC (make up a number not in use) - Blueprint for setting up snort + pfblocker

Ramosel

OK, no responses and no luck fixing this. Something with this list and my system just don't jibe and I'm not the only one. Doing a search here, at least 2 other postings from folks having trouble with this specific list.

Did some research and it looks like this list is almost 2 years old anyway… (Feb 10, 2012)
http://doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork

So that being the case is is best to abandon this list and just use the "emerging-rbn.rules" from within Snort?

Rick

Abandoning the list is not better, since you want to block all packets coming from those sources, not let through until snort decides that it should block.
Have you tried posting in the pfblocker thread? Maybe the guys over there can help.

Technically RBN was dismantled, but the "bad guys" are still on a large number of those IPs.

Mr. Jingles

Just as an update; it appears the lists were updated last night. Blocking cloudflare and perfectly legitime sites. I've been creating exceptions (dump them in an alias and allow that one before the block rule) for 1 hour :-[

Sometimes the pfblocker lists I use are updated and block legitimate sites. The reason is that the host that website is on, could be compromised and start throwing scans here and there and sooner or later it's detected. From my point of view, that host shouldn't be allowed, but considered as a hostile compromised host. It's the host's admin responsibility to check how the compromise happened, why it happened, what was compromised, correct all those, then notify the list maintainers to request removal from those lists.

An example is a host that scanned one of the networks I'm responsible for. That scan was detected by my rules (which, to be completely honest account for about 90% of all hosts snort blocks). Investigating it shows that it's supposed to be a mail gateway host, but it's scanning for webservers. Interesting behaviour for a mail gateway. I could notify the server admins, but why bother? Last time I bothered was after some of my hosts were hit with persistent scans. The hosting company's response was:
"Thank you for your report.

This client has assured us that they are performing benign research scans at a non-intrusive and non-destructive rate. We do not believe that they are in violation of any relevant laws or our terms of service at this time…." snipped

That's after I provided log snippets showing multiple scans to multiple hosts for well over half an hour.
Knowing most server admins come from the "hell bent to f*** up the user interface" company's environment, then I'm guessing one of 2 things will happen:

Not bother at all with their compromise
Not bother with their compromise for the next 5 years, at which point their whole infrastructure will be updated.
There are the exceptions to server admins, the best of the best, coming from the Linux/Unix environment. In that case only one thing will happen:
Bother with it after 6 months.

If anyone reading this thinks I'm overly trigger happy, I'll have you know I identified 2 things that need fixing in the infrastructure of one of the 3 largest banks in my country. I notified their "IT department" which I'm sure it's manned by the absolute best server admins, with multiple PhDs in "Computer Security" and regularly being inspected by the world's top white hat hackers to find ways in. 2 years later and both things identified to them are still there. 1 of those is using password storing (hashing) technology from even before the abacus was invented, and the other is a simple 1 line fix in their web interface to download your statements, which as is, gives more details than I would be happy to give to my server admins, let alone the public (hint:it's IIS running on an unpatched version of windows).

Disclaimer: This is not a libelus comment with regards to server administrators worldwide. It's a riducule attempt to the idiots pretending to be server admins. And the idiots that hire them.

To recap, there's a reason those hosts ended up on the lists I use. It's the server admin's responsibility to determine why. Then there's the hosting companies that cover up for their clients. Personally, I don't want any traffic from said hosts.

Ramosel

@jflsakfja:

Disclaimer: This is not a libelus comment with regards to server administrators worldwide. It's a riducule attempt to the idiots pretending to be server admins. And the idiots that hire them.

Bingo! Thats what happened when "bean counters" started getting into management. There is not a major corporation that is not infested with "bean counters" or worse yet, "wannabe bean counters". Attend a meeting at any level, any dept. within the corporate world and 90% of it will be Budget related - guaranteed!! Replace whatever bogus motto the marketing folks try to foist onto the public with "we are a budget business who moonlight in XYZ" XYZ being the core business or product of the business.
<soap box="" mode="" off="">Back on topic. I stll can't get this one RBN list to populate any field other than the list of lists… Is there a (corrupt) marker somewhere other than the main XML file that is hanging this up? If the error is being logged, where is that log... I've looked endlessly. Anyone have any ideas? I've also asked Marcello over on the pfblocker main thread... so far no response. I'll admit I'm from the MS world and spent little of my time in the unix/FreeBSD world (although I did do some work with Jordan Hubbard MANY years ago... when he was thinner, had a beard and long hair that was black).

Apologies to the moderator. Thanks for indulging my little rant at the start, but "jflsakfja" just hit a nerve still a bit raw even after being retired for several years.

Rick</soap>

Diagnostics>table remains blank even if left overnight? (assuming you set it up to auto update sometime during that night).
As far as I can remember pfblocker will not update a list during bootup, so I'll leave the "have you tried turning it on and off?" comment aside :P
If it's only 1 list, then I'm guessing it's something to do with that list. Have you tried contacting the maintainers? (will not help, try convincing the nano text editor creator that CTRL + W for search is a bug not a feature for example)

Edit: forgot the bean counter bashing.
I expect all my sys admins to stand up in a meeting and ask the bean counter making the decissions "are you a f***ing idiot? do you prefer to spend 100K on mitigating a compromise, or spend 10K and not worry about the compromise?". If nobody stands up, both the beancounter in question and the sys admins are fired. It's in their contract actually. And the bonus is, both of them have to reimburse the company.

Mr. Jingles

@Ramosel:

Bingo! Thats what happened when "bean counters" started getting into management. There is not a major corporation that is not infested with "bean counters" or worse yet, "wannabe bean counters". Attend a meeting at any level, any dept. within the corporate world and 90% of it will be Budget related - guaranteed!! Replace whatever bogus motto the marketing folks try to foist onto the public with "we are a budget business who moonlight in XYZ" XYZ being the core business or product of the business.
<soap box="" mode="" off=""></soap>

@jflsakfja:

Edit: forgot the bean counter bashing.
I expect all my sys admins to stand up in a meeting and ask the bean counter making the decissions "are you a f***ing idiot? do you prefer to spend 100K on mitigating a compromise, or spend 10K and not worry about the compromise?". If nobody stands up, both the beancounter in question and the sys admins are fired. It's in their contract actually. And the bonus is, both of them have to reimburse the company.

;D ;D ;D

I happen to know somebody, also a member on this forum, I think he ain't too bad - at least he tries to be kind -, who I think is what you refer to as 'bean counter'. Actually, if I am not mistaken, he has mastered 'the art of bean counting' to the post academic level. As I know him rather well, I think he won't be too offended by your statements. Aux contraire, I think he is laughing very hard right now :P

When you talk with him again, lay out this scenario:

In our organization, Company ABC, we use exclussively Windows XP boxes. The EOL for XP is coming in April 14 (do correct me in the extremely rare occassion I'm wrong. Non-transferable license etc..etc..). Our projected cost for replacing all of our infrastructure is $13,000. That includes buying new workstations with Windows 7 installed on them, and taking a week off for user re-training.
Do you approve the expenditure?

A true bean counter will say: "$13,000!!!!! Omg were are we going to find that much money!?!???!oneelevenonehundredandeleven"

A wannabe bean counter will say: "Well according to our projections, the Return on Investment has not yet being achieved on those workstations. I recommend we use the old systems for now and upgrade in the future"

A bean counter trained by me: "Windows XP? And they let you go? Without even providing the funny shirt with buttons on the back?" At this point any attempt to react will lead to you attending "rapid training school", if you catch my drift (no pun intended).

As stated, bean counters are the plague of modern world. I don't care if he is fresh into school, just born, or a seasoned professor. Any person who says that saving $1 now is better than saving $3 in the long term shouldn't be let out of the asylum.

Mr. Jingles

@jflsakfja:

When you talk with him again, lay out this scenario:

In our organization, Company ABC, we use exclussively Windows XP boxes. The EOL for XP is coming in April 14 (do correct me in the extremely rare occassion I'm wrong. Non-transferable license etc..etc..). Our projected cost for replacing all of our infrastructure is $13,000. That includes buying new workstations with Windows 7 installed on them, and taking a week off for user re-training.
Do you approve the expenditure?

A true bean counter will say: "$13,000!!!!! Omg were are we going to find that much money!?!???!oneelevenonehundredandeleven"

A wannabe bean counter will say: "Well according to our projections, the Return on Investment has not yet being achieved on those workstations. I recommend we use the old systems for now and upgrade in the future"

A bean counter trained by me: "Windows XP? And they let you go? Without even providing the funny shirt with buttons on the back?" At this point any attempt to react will lead to you attending "rapid training school", if you catch my drift (no pun intended).

As stated, bean counters are the plague of modern world. I don't care if he is fresh into school, just born, or a seasoned professor. Any person who says that saving $1 now is better than saving $3 in the long term shouldn't be let out of the asylum.

I just spoke with him. He says this:

You have good and bad bean counters, and good and bad sys admins. That would give a nice matrix if you apply game theory to it. To make the matter worse, in general, bean counters are from Mars, and sysadmins from Venus. Now make them communicate.

The bean counter I was talking about would probably simply have asked you: "can you give me differential cost- and profit break down, direct- and indirect, fixed and variable, and justify the assumptions you are making, preferably with own historic data as well as peer group data? Then I'll make a business case of it and support your proposal to the board from my department's point of view".

There's bean counters and bean counters, and sys admins and sys admins. Most of the time, world peace would benefit from them working in different companies. Unfortunately, any company needs both.

;D

Ramosel

@jflsakfja:

Diagnostics>table remains blank even if left overnight? (assuming you set it up to auto update sometime during that night).

Exactly. This one list shows up in the "Lists" tab after I create it and never shows up anywhere else. I've left it for 3 days over the weekend and its just not going beyond the list creation point

Have you tried contacting the maintainers? (will not help, try convincing the nano text editor creator that CTRL + W for search is a bug not a feature for example)

I did, left a message at "emerging threats" but prefaced it by stating there must be a lot of you here that are not having any issues with this list so I'm assuming its something local… I'm just not well versed in this so I'm having trouble even finding any indication of where its falling flat.

Edit: forgot the bean counter bashing.
I expect all my sys admins to stand up in a meeting and ask the bean counter making the decissions "are you a f***ing idiot? do you prefer to spend 100K on mitigating a compromise, or spend 10K and not worry about the compromise?". If nobody stands up, both the beancounter in question and the sys admins are fired. It's in their contract actually. And the bonus is, both of them have to reimburse the company.

Having lots of problems with a product I was responsible for… and constantly fighting for the time/funding/updates it needed... In a top/down meeting, actually asked an EVP what his intentions were. Did we want to release the best product possible or the worst one we could get away with?? I could do either, but I need to know what he really wanted before I proceeded. He slapped his notebook closed, stood up, glared at me and left the room. His only response 2 days later was that I should never put him on the spot like that again... <sigh>Rick</sigh>

Hollander: he has clearly never read the BOFH. Direct him to theregister.co.uk

Ramosel: Don't know how I can help you anymore. If you don't find a fix for this, the alternative is snort's rbn rules. Doesn't provide the same security (through obscurity, but I don't personally know of anyone leaving their jewelery on the pavement outside their house) but at least it's something.

Ramosel

@jflsakfja:

As stated, bean counters are the plague of modern world.

That and "political correctness" <ducking>> I don't care if he is fresh into school, just born, or a seasoned professor. Any person who says that saving $1 now is better than saving $3 in the long term shouldn't be let out of the asylum.

But that is the axiom of modern corporate officers. Save the dollar now… make your budget look good (at all costs), get promoted and leave the mess to the next guy.

Sorry for going off topic again.... had to... and it is your thread.

rick</ducking>

Mr. Jingles

@jflsakfja:

Hollander: he has clearly never read the BOFH. Direct him to theregister.co.uk

What is 'BOFH' ???

Mr. Jingles

@Ramosel:

I did, left a message at "emerging threats" but prefaced it by stating there must be a lot of you here that are not having any issues with this list so I'm assuming its something local…

I am having the same problem as you. With spontaneous messages in the Dashboard 'pfBlocker crashed', just as you did. So I ditched the offending list for the time being.

Having lots of problems with a product I was responsible for… and constantly fighting for the time/funding/updates it needed... In a top/down meeting, actually asked an EVP what his intentions were. Did we want to release the best product possible or the worst one we could get away with?? I could do either, but I need to know what he really wanted before I proceeded. He slapped his notebook closed, stood up, glared at me and left the room. His only response 2 days later was that I should never put him on the spot like that again... <sigh>Rick</sigh>

I think I understand both you and your EVP. One from Mars, the other from Venus, really ;)

Mr. Jingles

@Ramosel:

@jflsakfja:

As stated, bean counters are the plague of modern world.

That and "political correctness" <ducking>> I don't care if he is fresh into school, just born, or a seasoned professor. Any person who says that saving $1 now is better than saving $3 in the long term shouldn't be let out of the asylum.

But that is the axiom of modern corporate officers. Save the dollar now… make your budget look good (at all costs), get promoted and leave the mess to the next guy.

Sorry for going off topic again.... had to... and it is your thread.

rick</ducking>

Mars- and Venus ;D ;D ;D ;D ;D

Gentlemens, might I introduce you into the concepts of the time value of money and the DCF (discounted cash flow method)?

@Hollander:

@jflsakfja:

Hollander: he has clearly never read the BOFH. Direct him to theregister.co.uk

What is 'BOFH' ???

:o don't know what BOFH stands for? what do you read when idle at work?

What is this "idle at work" of which you speak?

The time when instead of being on fb, you actually read something related to your work?
There are people that will say they work 8 hours a day, straight, without a single break, neither for relaxing, nor for eating. While I understand that there are employees in third world countries which get whipped when not working, in most civilised countries you are allowed a break for relaxing and eating.
People I work with are free to take a nap break, or a snack break anytime they see fit.

There are only two categories of people really: Those that work for a living, and those that live to work. We don't like working with people in the first category. A typical characteristic of the first category is multiple Cisco certifications. Those are the first to go when interviewing for a job. A typical characteristic of the second category is sleeping on the datacenter floor after working 48 hours straight to troubleshoot a server, just because THEY chose to work those hours, nobody forced them to. It's simple exhaustion that forced them to sleep while listening to the whine of 6K rpm deltas. Those are the people that stay, and those people produce more in a single week than people of the first category produce in a year.

Update:

Some people reported problems with the RBN list. I have therefore stopped using that list, as well as the rbn-malvertisers.

So, red becomes blue:
DO NOT USE! > emerging-rbn > use pfblocker with: http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt >>>>
DO NOT USE! > emerging-rbn > use pfblocker with: http://rules.emergingthreats.net/blockrules/rbn-ips.txt

and….

DO NOT USE! > emerging-rbn-malvertisers > use pfblocker with: http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/emerging-rbn-malvertisers.txt >>>>
DO NOT USE! > emerging-rbn-malvertisers > use pfblocker with: http://rules.emergingthreats.net/blockrules/rbn-malvertisers-ips.txt

both of those are txt format of course.

Any ideas/corrections/hints are welcomed.

These will be merged in the next update.

segfooled

Thanks much! This thread is extremely helpful!
As I'm new to Snort, I have also followed the beginner's guide and configured the blueprint for WAN to start with. I only use IPS Policy - Security (in Blueprint config) right now (plus pfBlocker with Blueprint lists) - no ET lists yet. Next step is to add a LAN interface in order to block trojans etc. and there are only few remaining questions - grateful for your thoughts:

I understand that the Snort Blueprint on WAN is a waste of resource if I configure Snort LAN with Blueprint settings as well. So it's recommended to use a lighter set of ETs for WAN only. Question given that meanwhile the ET lists recommended in the initial post have essentially been replaced by pfBlocklist recommendations: Would I now only configure LAN blueprint and rely on the pfBlock blueprint alias for the WAN - or would I rather keep a Snort WAN interface also and use ET rules or e.g. IPS Policy - Balance?
As a more general point, given that the beginner's guide recommends IPS and I'm subscribed now: Once you have a subscription to the IPS list, do additional ET lists make much sense or are they mutually exclusive?

Great work anyway! Have very few false positives but do have correct blocks :)