Suricata 7 Features You Need to Know

I am going to update you about much-anticipated release of Suricata 7, marking a significant milestone in the evolution of this high-performance Network Threat Detection, IDS, IPS, and Network Security Monitoring engine. The development team at the Open Information Security Foundation (OISF) and the vibrant community have worked tirelessly to bring forth a host of new features, performance improvements, and security enhancements.

Main Features

1. Enhanced Packet Processing with DPDK IDS/IPS Support

  • Suricata 7 introduces DPDK IDS/IPS 60 support for primary mode, enhancing packet processing capabilities and ensuring optimal performance.

2. Advanced AF_XDP IDS Support

  • Richard McConnell at Rapid7 contributes AF_XDP IDS 30 support, further expanding the engine’s capabilities for efficient and high-speed packet processing.

3. Extended HTTP/HTTP2 Inspection

  • New keywords for header inspection in HTTP/HTTP2 protocols provide enhanced visibility and control over web traffic.

4. TLS Improvements

  • Suricata 7 brings client certificate logging and detection in TLS, bolstering security measures for encrypted communications.

5. Bittorrent Parser

  • Aaron Bungay contributes a Bittorrent parser, adding support for this popular peer-to-peer file-sharing protocol.

6. Improved IPS Default DROP Behavior

  • Exception policies now default to DROP behavior, enhancing the default security stance for intrusion prevention.

7. EVE Documentation and Validation

  • Event (EVE) logging is documented and validated with a JSON schema, ensuring comprehensive and standardized event reporting.

8. Performance Improvements Across the Board

  • Suricata 7 boasts numerous performance improvements, including optimizations in file data processing, SMB, hash calculation, and flow management.

9. Stream Buffer Efficiency

  • The stream buffer, utilized by the stream engine, file tracking, and more, is now more memory-efficient, contributing to overall system optimization.

Secure Deployment and Security Enhancements

1. Linux Landlock Support

  • Eric Leblond introduces Linux Landlock support, enhancing the security posture of Suricata deployments.

2. Secure Settings by Default

  • Suricata 7 defaults to secure settings for Datasets and Lua, ensuring a robust and secure configuration out of the box.

3. Network Service Header

  • The addition of Network Service Header enhances network service identification, contributing to a more secure network environment.

Protocol and Rules Updates

1. Expanded Protocol Support

  • Suricata 7 adds support for QUICv1, GQUIC, PostgreSQL, VN-Tag, and IKEv1, among others, expanding the range of supported protocols.

2. Rule Keywords and Rule Set Updates

  • New rule keywords for DHCP, Kerberos, SNMP, TLS, QUIC, and experimental class of keywords through “frames API” have been introduced.

3. IPS Exception Policies

  • Exception policies have been added to provide better control over packet handling, especially in conditions like hitting memory caps.

Output and Dev Corner

1. Flexible Packet Capture

  • Conditional packet capture allows packets to be written to disk only after an alert has been triggered, providing flexibility in capturing relevant data.

2. Enhanced Logging and Debugging

  • The new “stream” EVE output type facilitates debugging of the stream engine, and log engine verdicts on rejected/dropped/passed packets for improved visibility.

3. Development Corner Updates

  • Suricata 7 includes total code changes, stricter C compiler flags, expanded CI, upgraded Rust parsers, and more, demonstrating a commitment to continuous improvement.

Upgrade Notes

1. Pcre2 Integration

  • Suricata 7.0 now uses pcre2 instead of pcre1 for regular expression matching.

2. Minimum Supported Rust Version

  • The MSRV (minimum supported Rust version) has been updated to 1.63.0 from 1.41.1 minimum in Suricata 6.0.

3. Library Updates

  • Support for Prelude (libprelude) has been removed, and Suricata 7.0 requires and bundles libhtp 0.5.45.

For more detailed information on upgrading from Suricata 6 to 7, refer to the official documentation [here](https://github.com/OISF/suricata/blob/master/Upgrading from 6 to 7).

In conclusion, Suricata 7 represents a substantial step forward in network security, with its comprehensive feature set, improved performance, and heightened security measures. The development team and the community continue to demonstrate their dedication to providing a robust and cutting-edge open-source security solution.

To experience the power of Suricata 7 firsthand, download the latest release here.

Suricata rules install karne ka tarika

Suricata rules ko install karne ke liye, neeche diye gaye kuch steps hain. Yeh steps Kali/Debian/Ubuntu Linux distribution ke liye hain. Agar aapka distribution alag hai, toh aapko package manager aur command mein thoda sa badlao karna hoga.

Suricata Install Kare:

1. Kali/Debian/Ubuntu Opreating Sysetm main Suricata install karne ke liye, terminal mein ye commands type karein:

sudo apt update

sudo apt install suricata

Installation process complete hone tak wait karein.

2. Suricata Rules Download Kare:

Suricata rules ko download karne ke liye aap Emerging Threats ya Snort Community ke official websites se rules ko obtain kar sakte hain. Yeh rules Suricata ke liye compatible hote hain. Ek popular source hai

Emerging Threats Open Rules:

sudo suricata-update update-sources

sudo suricata-update enable-source et/open

sudo suricata-update

Isse Suricata rules updated ho jayenge.

3. Suricata Configuration File Ko Update Kare:

Suricata ko aapke system ke requirements ke Mutabiq configure karna important hai. Configuration file Zada tar /etc/suricata/suricata.yaml mein hoti hai. Aap is file ko text editor se edit kar sakte hain, jaise ki nano:

sudo nano /etc/suricata/suricata.yaml

File mein default-rule-path ya rule-files section ko check karein aur yeh confirm karein ki yeh rules ke liye sahi path ko point kar rahe hain.

4. Suricata Restart Kare:

Configuration changes ke baad Suricata ko restart karein:

sudo service suricata restart
  1. Restart ke baad, Suricata rules apply hokar traffic monitor karna shuru karega.

Yeh tarike aapko Suricata rules ko install karne mein madad karenge. Dhyan rahe ke security ke liye suricata properly configured aur regularly updated rehna chahiye.

Delhi Private School Admissions Step-by-Step

Enrollment process for 2024 -2025 session in nursery, KG, and Class I admissions in private schools in Delhi is currently open.

To apply, you’ll likely need to visit the official website of the particular school you are interested in. Many schools are offering online registration forms, so you may find the application details on their official website.

To apply, you’ll likely need to visit the official website of the particular school you are interested in. Many schools are offering online registration forms, so you may find the application details on their official website.

Here are some general steps you can take:

  1. Visit the School’s Website: Go to the official website of the school you are interested in. The website should have a dedicated section for admissions where you can find information about the application process.
  2. Read the Official Notification: Look for the official notification or admission guidelines provided by the school. This document should contain important details about the admission process, eligibility criteria, and required documents.
  3. Follow Application Instructions: Follow the instructions provided in the official notification for filling out the application form. Some schools may provide the option for online submission, while others may require a hard copy.
  4. Submit Required Documents: Ensure that you have all the required documents for proof of address, as mentioned in the notification. These may include documents like a ration card, domicile certificate, voter ID card, electricity bill, etc.
  5. Submit the Application by the Deadline: Be mindful of the deadline for form submission. The information provided mentions that the deadline is December 15.

If you encounter any specific difficulties or have questions about the application process, it would be best to contact the school directly. School contact details are often available on their official website.

Remember to thoroughly review the official notification of the specific school for accurate and detailed information on the admission process.

iphone hack

iPhone Zero-Day Vulnerabilities Up for Sale in Russia

  • A cybersecurity corporation focuses on acquiring and trading undisclosed software vulnerabilities (zero-day exploits).
  • Recent headline: Corporation offering a remarkable $20 million to security researchers for crafting advanced hacking tools for breaching iPhones and Android devices.
  • Announcement: “Operation Zero” proclaimed the increased incentive, raising zero-day exploit rewards from $200,000 to $20 million.
  • Objective: Encourage development teams to actively engage with their innovative platform through competitive arrangements and supplementary rewards.
  • Origin: Established in Russia in 2021, targeting end users in non-NATO nations exclusively.
  • CEO’s stance: Guarded about targeting non-NATO nations, hinting at strategic reasoning without elaboration.
  • Market dynamics: Suggested the $20 million rewards could be temporary, reflecting the complex nature of hacking into iOS and Android platforms.
  • Valuation of exploits: Highly influenced by availability in the zero-day marketplace, particularly targeting comprehensive mobile device exploitation techniques.
  • Unique approach: Divergence from traditional bug bounty platforms by not notifying vendors, instead selling to discerning government clients.
  • Clandestine market: Operates in secrecy with fluctuating prices and undisclosed customer identities.
  • Publicized price lists: Operation Zero disclosed their pricing, offering insight into the enigmatic world of cybersecurity deals.

Cybercriminals Exploit Chinese Surveillance Cameras for Profit

Cybercriminals Exploit Chinese Surveillance Cameras for Financial Gain

A multitude of surveillance cameras, numbering in the tens of thousands, have neglected to address a critical security vulnerability that has persisted for 11 months, consequently leaving numerous organizations susceptible to potential breaches.

Recent research findings reveal that a staggering 80,000 Hikvision surveillance cameras worldwide remain vulnerable to an 11-month-old flaw that enables command injection attacks.

Hikvision, an abbreviation for Hangzhou Hikvision Digital Technology, represents a Chinese government-owned enterprise specializing in the production of video surveillance equipment. Despite the Federal Communications Commission (FCC) denoting Hikvision as “an unacceptable risk to U.S. national security” in 2019, their clientele spans across more than 100 countries, including the United States.

In the autumn of the previous year, the discovery of a command injection vulnerability in Hikvision cameras prompted the assignment of the Common Vulnerabilities and Exposures (CVE) identifier CVE-2021-36260. This particular exploit received a critical severity rating of 9.8 out of 10 from the National Institute of Standards and Technology (NIST).

Alarming as it may be, even after nearly a year has elapsed since the exposure of this vulnerability, a substantial number of affected devices, exceeding 80,000 in quantity, remain unpatched. Disturbingly, researchers have unearthed multiple instances of hackers seeking to collaborate in exploiting the command injection flaw present in Hikvision cameras. These collaborative efforts have predominantly materialized within Russian dark web forums, where leaked credentials associated with the vulnerable devices have been offered for sale.

The full extent of the damage inflicted thus far remains uncertain. The authors of the report could merely speculate that various threat groups originating from China, such as MISSION2025/APT41, APT10, and their affiliates, alongside unidentified Russian threat actors, possess the potential to exploit the vulnerabilities present in these devices for their own objectives, which may include geopolitical considerations.

The Vulnerabilities Inherent in IoT Devices

When confronted with accounts such as this, it is tempting to attribute the negligence of individuals and organizations who fail to patch their software to mere laziness. However, the reality is often far more complex.

According to David Maynor, the senior director of threat intelligence at Cybrary, Hikvision cameras have remained vulnerable due to a multitude of factors, and this susceptibility has persisted for a considerable period. Maynor asserts that the products manufactured by Hikvision contain systemic vulnerabilities that are easily exploitable, or even worse, rely on default credentials. Furthermore, the absence of effective means to conduct forensic analysis or verify the complete removal of an attacker further compounds the security challenges. Significantly, no discernible indication of an enhanced security posture within Hikvision’s development cycle has been observed.

This problem transcends Hikvision alone, afflicting the entire industry. Paul Bischoff, a privacy advocate affiliated with Comparitech, emphasized the inherent difficulties in securing Internet of Things (IoT) devices such as cameras, noting that they do not possess the same ease of securing as applications on mobile phones. Unlike smartphones, which promptly notify users of available updates and often install them automatically upon reboot, IoT devices necessitate manual downloading and installation of updates, a task that many users overlook. Moreover, IoT devices frequently fail to provide any indications of being unsecured or outdated, further exacerbating the issue.

While unsuspecting users remain oblivious, cybercriminals can exploit vulnerable devices by scanning for them using search engines like Shodan or Censys. The problem is further compounded by users’ negligence, as Bischoff highlighted, due to the fact that Hikvision cameras are shipped with a limited set of predetermined passwords, and a significant number of users neglect to modify these default credentials.

Page 1 of 4

Powered by WordPress & Theme by Anders Norén