Hackzone Cyber Security Blog

Tag: Cybersecurity Page 2 of 3

How to Install Suricata on pfSense

How to Install Suricata on pfSense: A Step-by-Step Guide

By

On August 25, 2024

In CyberSecurity, Network Security

Looking to enhance your network security with Suricata on pfSense? This comprehensive guide will walk you through the installation and configuration process, making it easy to set up this powerful Intrusion Detection System (IDS) on your pfSense firewall.

Introduction

Suricata is a versatile and powerful open-source network threat detection engine that can function as an IDS, IPS, and network security monitoring tool. When paired with pfSense, a popular open-source firewall and router platform, Suricata provides robust protection against network intrusions. In this guide, we’ll show you how to install and configure Suricata on pfSense, step by step.

Why Choose Suricata for pfSense?

Suricata offers several advantages when integrated with pfSense:

  • Deep Packet Inspection: Suricata provides comprehensive inspection of network traffic.
  • High Performance: It is optimized for multi-threading, making it suitable for modern networks.
  • Customizable Rules: Suricata allows for custom rule sets tailored to your specific security needs.
  • Real-Time Alerts: Get instant notifications when potential threats are detected.

Step 1: Preparing Your pfSense Environment 🔧

Before we dive into the installation, ensure that your pfSense environment is up to date and ready for Suricata.

  1. Log in to pfSense: Access your pfSense dashboard via your web browser.
  2. Update pfSense: Navigate to System > Update and apply any available updates to ensure you’re running the latest version.
  3. Backup Your Configuration: It’s always good practice to back up your pfSense configuration before making major changes. Go to Diagnostics > Backup & Restore and create a backup.

Step 2: Installing Suricata on pfSense 📦

Installing Suricata on pfSense is straightforward thanks to its integration into the pfSense package manager.

  1. Access the Package Manager: In your pfSense dashboard, go to System > Package Manager.
  2. Install Suricata:
    • Click on the Available Packages tab.
    • Search for Suricata.
    • Click Install and then Confirm. Wait for the installation to complete.

Step 3: Configuring Suricata on pfSense ⚙️

Once installed, it’s time to configure Suricata to suit your network security needs.

Interface Configuration 🌐

  1. Navigate to Suricata Settings: Go to Services > Suricata.
  2. Add an Interface:
    • Click on the Interfaces tab.
    • Click + Add to create a new Suricata interface.
    • Select the network interface you want Suricata to monitor (e.g., WAN or LAN).
    • Configure the interface settings, including enabling the interface and selecting your desired IPS mode.
  3. Save and Apply: After configuring the interface, click Save and then Apply Changes.

Setting Up Suricata Rules 📄

Suricata relies on rule sets to detect potential threats. Let’s configure those now.

  1. Download Rule Sets:
    • Go to the Updates tab within Suricata.
    • Enable automatic updates for the Emerging Threats (ET) rules or any other rule sets you prefer.
    • Click Update to download the latest rules.
  2. Assign Rules to Interfaces:
    • Go to the Rules tab.
    • Assign rule categories to the Suricata interface(s) you configured.
    • Enable or disable specific rules based on your network security needs.

Configuring Alerts and Logging 🔔

Proper alerting and logging are essential for monitoring your network security.

  1. Enable Logging:
    • Go to the Logging tab.
    • Enable EVE JSON output to get detailed logs.
    • Configure the log retention settings according to your storage capabilities.
  2. Set Up Alerts:
    • Under the Alerts tab, configure how and when Suricata should alert you.
    • You can also integrate with external logging systems like Syslog or Splunk for centralized monitoring.

Step 4: Testing Your Suricata Setup 🧪

Testing is a crucial step to ensure Suricata is working as expected.

Generate Test Traffic: Use tools like nmap to simulate network traffic and trigger Suricata alerts.

nmap -sS -Pn -p 80,443 <your-pfsense-ip>

Check Logs: Go to the Logs tab in Suricata and verify that alerts are being generated and logged as expected.

Step 5: Fine-Tuning Suricata for Optimal Performance 🎯

To get the best performance out of Suricata on pfSense, consider the following tips:

  • Adjust Rule Sets: Disable unnecessary rules that may slow down performance or generate false positives.
  • Optimize Hardware Settings: Ensure your pfSense hardware is adequate for the network load. Consider enabling multi-threading in Suricata for better performance.
  • Regular Updates: Keep both pfSense and Suricata rules up to date to protect against the latest threats.

Conclusion 🎉

Congratulations! You have successfully installed and configured Suricata on pfSense. Your network is now fortified with one of the most powerful IDS/IPS tools available. Remember to regularly monitor your logs, update your rules, and fine-tune your settings to maintain optimal security.

Have any questions or run into issues? Drop a comment below, and we’ll be happy to help! 😊

How ‘Muddled Libra’ Cybercrime Group Exploits BPO Sector with Sophisticated Social Engineering Techniques

By

On June 24, 2023

In CyberSecurity, Phishing Attack

The BPO sector is currently under attack by a cybercrime group known as Muddled Libra, which employs sophisticated social engineering tactics to gain unauthorized access. These persistent attacks have raised concerns within the cybersecurity community.

Palo Alto Networks Unit 42, in a technical report, revealed that the emergence of the 0ktapus phishing kit in late 2022 introduced a new attack style associated with Muddled Libra. The kit provided a ready-made hosting framework and bundled templates, leading to its widespread adoption. The name “Libra” is used by the cybersecurity company to designate cybercrime groups, while the term “muddled” reflects the uncertainty surrounding the utilization of the 0ktapus framework.

The 0ktapus framework, also referred to as Scatter Swine, was initially discovered in August 2022 in connection with smishing attacks on numerous organizations, including Twilio and Cloudflare. CrowdStrike later disclosed a series of cyber assaults targeting telecom and BPO companies since June 2022. These attacks involved a combination of credential phishing and SIM swapping, and the cluster responsible for them is tracked under different names, such as Roasted 0ktapus, Scattered Spider, and UNC3944.

Kristopher Russo, a senior threat researcher, explained that Muddled Libra was named due to the perplexing landscape surrounding the 0ktapus phishing kit. He noted that while many threat actors have incorporated the kit into their arsenal, merely using it does not classify them as part of Muddled Libra, according to Unit 42’s classification.

The attacks initiated by this e-crime group employ smishing and the 0ktapus phishing kit to gain initial access. They typically culminate in data theft and the establishment of long-term persistence. Another notable characteristic is the group’s utilization of compromised infrastructure and stolen data to carry out subsequent attacks on the customers of their victims. In some instances, they even target the same victims repeatedly to replenish their dataset.

Unit 42, after investigating several Muddled Libra incidents from June 2022 to early 2023, described the group as relentless, methodical, and highly adaptable in their attack strategies. They swiftly adjust their tactics when faced with obstacles. Alongside using a variety of legitimate remote management tools to maintain persistent access, Muddled Libra tamper with endpoint security solutions to evade detection. They also exploit the fatigue caused by multi-factor authentication (MFA) notifications to steal credentials.

Furthermore, the threat actors have been observed gathering lists of employees, their job roles, and cellular phone numbers to execute smishing and prompt bombing attacks. If this approach fails, Muddled Libra actors resort to contacting the organization’s help desk, pretending to be the victims, in order to enroll a new MFA device under their control.

The researchers emphasized the notable success of Muddled Libra’s social engineering tactics. They have demonstrated a remarkable level of confidence when interacting with help desk personnel and other employees over the phone, successfully persuading them to engage in unsafe actions.

The attacks also involve the use of credential-stealing tools like Mimikatz and Raccoon Stealer to escalate privileges. Additionally, various scanners are employed for network discovery, enabling the extraction of data from platforms such as Confluence, Jira, Git, Elastic, Microsoft 365, and internal messaging systems.

Unit 42 speculated that the creators of the 0ktapus phishing kit do not possess the same advanced capabilities as Muddled Libra, and despite some similarities in their tradecraft, there is no definitive connection between the actor and UNC3944.

what is arkime (moloch)?

By

On March 29, 2023

In CyberSecurity, Ethical Hacking, Network Security

Arkime, formerly known as Moloch, is a powerful tool for full packet capture and analysis. It offers a wide range of features that make it a must-have tool for network security professionals. Some of the main features of Arkime include:

  1. Packet capture: Arkime can capture all network traffic passing through a particular network interface, allowing security analysts to analyze the traffic and identify potential threats.
  2. Indexing and search: Arkime uses Elasticsearch to store and index captured packets, which makes it easy for analysts to search for specific packets or packets containing specific patterns or keywords.
  3. Web-based user interface: Arkime includes a powerful web-based user interface that allows analysts to search and analyze captured traffic, as well as visualize network traffic data in real-time. The user interface is highly customizable, and analysts can create custom dashboards and visualizations to meet their specific needs.
  4. Advanced analysis capabilities: Arkime can perform advanced network traffic analysis, including protocol decoding, session reassembly, and file carving. This makes it possible for analysts to detect and investigate a wide range of security threats, including malware, phishing attacks, and data exfiltration.
  5. Support for multiple file formats: Arkime can capture and analyze a wide range of network protocols, including TCP, UDP, HTTP, and SSL. It also supports a variety of file formats, including PCAP, JSON, and ASCII.
  6. Scalability: Arkime is designed to be highly scalable, and it can be deployed in large-scale environments. It can handle large amounts of network traffic data, making it suitable for use in high-bandwidth environments.

Overall, Arkime is a comprehensive tool that offers a wide range of features for full packet capture and analysis. Its advanced analysis capabilities, support for multiple file formats, and scalability make it a must-have tool for any organization that needs to monitor and secure its network.

What is Kali Linux Purple?

By

On March 29, 2023

In CyberSecurity, Ethical Hacking, Network Security

Kali Linux 2023.1 is a popular Linux distribution that is used by security professionals and hackers alike to test the security of computer systems and networks. It comes with advanced penetration testing tools and techniques that can help users identify vulnerabilities in their systems.

The new Kali Linux 2023.1 release features a new flavor of the distribution called Kali Linux Purple. This new flavor is focused on purple teaming and defense, rather than just red teaming or offensive security. The Kali Linux Purple distribution aims to provide a security operations center (SOC) all in one great machine.

Kali Linux Purple comes with over a hundred new defensive tools, including Archive for Full Packet Capture, Cyber Chef, Elastic, The Hive, GVM, Malcolm, Suricata, and Zeek. It also includes Cali Autopilot, a tool for automating attacks, and Cali Purple Hub, a platform for the community to share practice packet captures.

To download Kali Linux Purple, you need to create a virtual machine manually from the ISO file which is available for download from the Kali Linux website. The ISO file is about 3.5 GB in size.

The new Kali Linux 2023.1 release features an updated kernel version 6.1.0 and updated desktop environments for XFCE, KDE, and GNOME. It also includes new features and improvements such as new sub-menus for identify, protect, detect, respond and recover.

Kali Linux is an open-source operating system that has been designed to provide users with advanced penetration testing tools and techniques. It is widely used by security professionals and hackers alike to test the security of computer systems and networks.

The new Kali Linux Purple distribution has been specifically designed to help security professionals improve their defensive capabilities by providing them with a range of powerful tools and techniques that can be used to detect and respond to cyber threats.

If you are interested in learning more about Kali Linux or would like to download the latest version of the operating system, you can visit the official Kali Linux website at https://www.kali.org/

MyloBot: The Sophisticated Botnet Affecting Thousands of Systems Worldwide

By

On March 7, 2023

In CyberSecurity, Ethical Hacking, Malware, Network Security, Trojan

BitSight, a cybersecurity company, has revealed that a sophisticated botnet called MyloBot has affected thousands of systems across the globe.

Most of the compromised systems are located in India, the United States, Indonesia, and Iran.

MyloBot

BitSight has also found that MyloBot’s infrastructure is linked to a residential proxy service named BHProxies, implying that the compromised machines are being used by the latter.

The botnet was initially observed in 2017 and was first documented in 2018. It is known for its anti-analysis methods and its ability to act as a downloader.

MyloBot has the potential to download any other type of malware that the attacker wants. It also waits for 14 days before attempting to contact the command-and-control (C2) server to avoid detection.

MyloBot receives instructions from C2 and transforms the infected computer into a proxy. The malware has been observed sending extortion emails from hacked endpoints as part of a financially motivated campaign.

MyloBot continues to evolve over time, and BitSight has been sinkholing the botnet since November 2018.

Page 2 of 3

Previous

Next

Powered by WordPress & Theme by Anders Norén