Quantcast
Channel: BOT24
Viewing all articles
Browse latest Browse all 8064

Looking for malicious traffic in electrical SCADA networks - part 1

$
0
0
When infosec guys are performing intrusion detection, they usually look for attacks like portscans, buffer overflows and specific exploit signature. For example, remember OpenSSL heartbleed vulnerability? The following is the snort alert for this vulnerability, taken from the snort community rules:

alert tcp $EXTERNAL_NET any -> $HOME_NET [25,443,465,636,992,993,995,2484] (msg:"SERVER-OTHER OpenSSL SSLv3 heartbeat read overrun attempt"; flow:to_server,established; content:"|18 03 00|"; depth:3; detection_filter:track by_src, count 3, seconds 1; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:cve,2014-0160; classtype:attempted-recon; sid:30510; rev:5;)

When you perform inline detection within electrical SCADA networks, latency is a big issue.

more here.......https://isc.sans.edu/diary/Looking+for+malicious+traffic+in+electrical+SCADA+networks+-+part+1/17967

Viewing all articles
Browse latest Browse all 8064

Trending Articles