Mitigation: Snort IPS (en)

SQL Injection is a cyber attack technique in which an attacker injects malicious SQL code into input data that is then executed by the database. The aim can be to steal sensitive data, corrupt the database, or even take control of the server.

IPS (Intrusion Prevention System) such as Snort serves as a first-line defense in detecting and preventing cyber attacks, including SQL Injection. Snort can analyze network traffic and compare it with a database of known attack signatures.

Steps to Mitigate SQL Injection with Snort on Ubuntu

Installing Snort

• Update the repository:

sudo apt update

• Install Snort and dependencies:

sudo apt install snort libdaq-mysql libdaq-pgsql libdaq-sqlite3

Make sure you install the dependencies that match the database you are using (MySQL, PostgreSQL, SQLite).

Basic Snort Configuration

• Copy the default configuration:

cp /etc/snort/snort.conf /etc/snort/snort.conf.custom

• Edit the configuration:

nano /etc/snort/snort.conf.custom

• Set the interface: Specify the network interface to be monitored.
• Set the log: Specify the location and format of the log.
• Set the rules: Load the appropriate rule set.

Configuring IPS Mode

• Enable IPS mode:

# In the snort.conf.custom file
preprocessor home_net

• home_net: Defines the internal network.
• external_net: Defines the external network.
• log: Specifies the action when an attack occurs (e.g., log to file).
• dynamic_rules: Allows dynamic rules.

Set Actions Upon Attack

• Default action: Snort will log attacks into the log.
• Custom action: You can configure Snort to take other actions such as:
  • Block packets: Prevent suspicious packets from reaching their destination.
  • Send alerts: Send notifications via email or SNMP.
  • Run scripts: Perform automated actions based on detection results.

Load Rule Set

• Download rule set: Snort has various rule sets available, such as Oink Master, Emerging Threats, and others.
• Configure rule set: Add the following line to the snort.conf.custom file:

var RULE_PATH /etc/snort/rules

• Place the rule set in the specified directory.

Start Snort

• Save the configuration: Save the snort.conf.custom file.
• Start Snort:

sudo snort -c /etc/snort/snort.conf.custom -A fast

Specific Configuration for SQL Injection

• Use a rule set specific for SQL Injection: Some rule sets have rules specifically designed to detect SQL Injection attacks.
• Adjust the rules: You may need to modify existing rules or create new rules to detect specific attack patterns.
• Watch for false positives: Overly sensitive rules can result in many false positives.

Additional Tips

• Update the rule set regularly: Rule set creators continuously update the rules to address new threats.
• Tune the configuration: Adjust Snort's configuration to achieve a balance between detection and false positives.
• Use log analysis tools: Regularly analyze Snort logs to identify attack patterns and enhance security.
• Combine with WAF: A Web Application Firewall (WAF) can provide additional protection against SQL Injection attacks.

Example Snort Configuration for SQL Injection

# ... (other configurations)
# Rule to detect SQL Injection
alert tcp any any -> any any (msg:"SQL Injection attempt"; content:"union select"; nocase; sid:1000001; rev:1;)
# ... (other configurations)

Note: The above configuration is a simple example. Actual configurations will be more complex and depend on your environment.

Important: Always conduct thorough testing after making Snort configuration changes to ensure there are no negative impacts on your network.

Interesting Links

• Forensic: IT