Re: Tor Tactics...rules? Bueller? Bueller?

["David J. Bianco" <david () vorant com>]

Ryan Trost wrote:
> I'm somewhat unfamiliar with the Tor servers and their packet signatures.  
> Has anybody written any rules to alert on Tor traffic (internal or 
> external)?

Hi, Ryan! I wrote a Tor rule quite some time ago, and it's working well for
me.  Feel free to use it if you like:

alert tcp any any -> $HOME_NET any (msg: "LOCAL Tor Proxy Connection 
Attempt."; content: "TOR"; content: "<identity>"; within:30; 
classtype:policy-violation; resp:rst_all; sid:9000030; rev:1;)

As written, the rule includes "resp:rst_all;" which attempts to shut
down the TCP session.  This doesn't work reliably, but it does have the
effect of slowing down the Tor session considerably, so I keep it in
there.  If you want to use it, you need to make sure snort is compiled
with the "flexible response" (flexresp) option, otherwise just
delete that part.

The Bleeding Snort project has a set of TOR rules that are good, too.
They're part of the bleeding-policy.rules files at bleedingsnort.com.

No matter whether you use my rules or the bleeding snort rules, you'll
want to apply an alert threshold so you don't get overwhelmed.  Tor
creates lots of connections, meaning lots of alerts.

> What's the general feeling towards it's abilities?  [feel free to take these 
> offline]

Tor's great!  I use it frequently, and I have the annoying green
T-shirt. 8-)  In my opinion, every security analyst should have access,
because there are just some times when you want to be anonymous
while contacting Internet-based resources (downloading malware samples
from an active distribution point, for example).

        David


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users