Did Any Zombie Creep Into Your Network During Halloween?
Now that Halloween is behind us we can put away the scary decorations and funny costumes. It may also be a good time to check our networks for zombie hosts or users. They can take many forms
- Clients infected with Malware which form part of an external botnet
- Faulty equipment which may be generating excessive broadcast traffic
- Rouge IoT devices eating bandwidth
- External clients scanning your network perimeter and exploiting firewall holes
- Misuse of network resources by one or more users
Many networks have lots of security devices at the network edge. From Firewalls to IPS type systems, securing the perimeter has been a priority for many IT managers. The trouble is that while this is a good thing to do, malware can still get in and unless you are monitoring what is going on inside your network you may be at risk. A user may bring in a USB stick laden with Malware for example and walk past your firewall.
I recently read about this network breach where unauthorized software was found on a server and it may have led to data loss. Some time ago I installed a trial version of our LANGuardian product onto a network and we found a client sending over 10,000 SPAM emails per hour. The interesting thing here was that the user of the computer was not complaining and an antivirus scan did not find anything. In the end the IT manager had to get the system reinstalled.
One way to find out what is happening on your internal network is to monitor network traffic moving through your core switch by setting up a SPAN or mirror port. Network traffic is an excellent source of user and application information. Once you have your data source in place a combination of network based intrusion detection and metadata analysis will root out any suspicious activity.
The image below taken from our own LANGuardian system shows an example of what to look out for. Events such as ET MALWARE Win32/InstallCore Initial Install Activity 1 or ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 need to be investigated and the associated clients need to be removed from the network.
Faulty Network Equipment
Technology can be wonderful when it works but when something goes bad it can be a nightmare to figure out what went wrong. A few years back there was massive disruption to air traffic at Dublin airport when a network card went faulty and caused the breakdown of a radar system. Our support team here worked with one of our own customers a while back when a faulty IP phone brought down an entire network segment by sending out large volumes of broadcast traffic.
Make sure you have some sort of internal traffic monitoring in place and watch out for what systems are sending large volumes of broadcast or multicast traffic. In other cases you may need to look at switch interface counters such as collisions or CRC rates. The image below is from our LANGuardian product and show a sample report which is the top clients associated with broadcast traffic. Any devices associated with hundreds of megabytes of broadcast traffic would need to be investigated.
Rogue IoT devices
Almost everything in today’s world is connected. From light bulbs to fridges, many devices now want to share data and metrics. However, this IoT world is not without its challenges. Recently security researches uncovered a botnet called Reaper which may have infected over 1 million networks.
IoT Botnets are Internet connected smart devices which have been infected by the same malware and are controlled by a threat actor from a remote location. They have been behind some of the most damaging cyberattacks against organizations worldwide, including hospitals, national transport links, communication companies and political movements.
You need to be aware of what is connecting to your network. One way to do this is to monitor all traffic going to and from your DHCP and DNS servers. This can reveal a lot about what is connecting to your network and what they are trying to get to. The images below from our LANGuardian product show how metadata captured from DHCP and DNS traffic can used to get an inventory of what is on your network.
If you do have IoT devices on your network, you need to make sure they are fully patched and not using any default passwords.
External Clients Targeting Your Network
As I mentioned previously there are large botnets out there ready to target unsuspecting businesses and organizations. If you re unlucky enough to be targeted you could be on the receiving end of large DDoS attack. Typically NTP or DNS traffic is used to overload your Internet gateways resulting in a loss of connectivity for internal and external clients. Make sure you are monitoring all traffic at your network edge especially the levels of UDP based protocols such as NTP or DNS.
Also watch out for any external clients scanning your network looking for open ports on firewalls. Common scans would be on RDP (TCP 3389), SSH (TCP 22) or SQL (1433). You need to take action if you see any connections on your internal network from clients which are outside the network. Either block the external IP address or shutdown the port they are using on your firewall. Don’t forget to carry out a forensic investigation on any incidents and see if any other client was targeted inside your network.
The image below from our LANGuardian product shows and example of what to watch out for. Here we can see an external IP which is registered in Russia connecting to servers on the local network over TCP port 445.
Rogue Network Users
Sometimes a network user can go bad. Maybe they install an application such as Bittorrent and hog all of the Internet bandwidth or maybe someone accidentally or deliberately deletes data. Can you track down all activity by username? One way to do this is to capture user logon information from Active Directory and use this to match it to IP addresses so you can see who is doing what.
The image below from our LANGuardian product shows a sample user report which lists the top users active on the network based on data downloaded or uploaded. You may want to consider getting alerts if users go above certain levels.