Visualizing, Analyzing and Filtering Zeek Events using a graphical - PowerPoint PPT Presentation

Visualizing, Analyzing and Filtering Zeek Events using a graphical frontend and OpenGL Nick Skelsey ZeekWeek 2019 Seattle, WA 11 October, 2019

AGENDA Motivation 1. State of the art 2. Monopticon 3. Related research 4. 2

CONNECTIVITY ISSUES: do not suffer in silence > ping google.com > ping 8.8.8.8 > ip a > ping 192.168.1.0 > dhcp -4 iface_name *check cable* *check unpaid bills* *check news for regional disaster* 3

MOTIVATION Graphics can have high information density. 1. No certifications required. 2. 3 . Develop intuition. 4

IVRE Lalet, Pierre, Florent Monjalet, and Camille Mougey. "IVRE, a network recon framework." ivre.rocks (2017). 5

ZENMAP & RADIALNET RadialNet: An Interactive Network Topology Visualization Tool with Visual Auditing Support, CRITIS 2008 João P. S. Medeiros, Selan R. dos Santos at Federal University of Rio Grande do Norte – UFRN 6

MONOPTICON A GPLv3 application built with C++, zeek and Mangum for POSIX systems. 7

minicps WATER TREATMENT > ip link add name feth1 type dummy > ip link set dev feth1 up > tcpreplay -v -i feth1 SWaT_plc_test.pcapng Antonioli, Daniele, and Nils Ole Tippenhauer. "MiniCPS: A toolkit for security research on CPS networks." Proceedings of the First ACM workshop on cyber-physical systems-security and/or privacy. ACM, 2015. 8

Bettercap ARP Spoofing > set arp.spoof.internal true; > set arp.spoof.targets 192.168.1.20,192.168.1.30; > set arp.spoof.full_duplex on; > arp.spoof on; 9

OBSERVATIONS Limit scope: Ethernet and IPv4 1. Must be modular: Represent the OSI stack as a stack 2. Must be passive: offline packet analysis 3. Must be quick: native or web assembly 4. Should be extensible: zeek and bash scripts 5 . 10 10

DESIGN 11 11

MODELING DEVICES IN A BROADCAST DOMAIN IEEE 802.1* defines ethernet 38:30:f9:61:97:6f 12

MAGNUM.GRAPHICS 13

THE GRAPHICS PIPELINE 14 14

OBJECT SELECTION 3 1 2 15

OBJECT LAYOUT 16 16

LIMITATIONS 17

802.1 BROADCAST DOMAINS All devices addressable by their MAC. Frames traverse switches based on: - Destination address - The type of address - The switches (routing) tables - Structure of the spanning tree - Optimizations like 802.1aq Fedyk, D., et al. "IS-IS extensions supporting IEEE 802.1 aq shortest path bridging." Internet Engineering Task Force (IETF), RFC 6329 (2012): 2070-1721. 18

AAALM zeek package that passively infers the structure of an IPv4 network over Ethernet 19

INFERRING NETWORK STRUCTURE 20

DRAWING A BROADCAST DOMAIN 21

Port knocking 22

FUTURE WORK Extensible event monitoring 1. Sane packaging 2. L2 & L3 model to identify network security 3. policy violations. 23

THANK YOU Check out: Monopticon on github or in the AUR aaalm zeek package Bibliography: nskelsey.com/zweek bvtech.it securenetwork.it 24