Recommended
Recommended
More Related Content
What's hot
What's hot (16)
Similar to The <$100 Cyber Sensor, You Can Build It!
Similar to The <$100 Cyber Sensor, You Can Build It! (20)
Recently uploaded
Recently uploaded (20)
The <$100 Cyber Sensor, You Can Build It!
- 1. THE <$100 CYBER SENSOR, YOU CAN BUILD IT! LUDWIG GOON @NFLTR8
- 2. #HXNJXN WHY BUILD IT & OBJECTIVES ▸$$$$$$ COST $$$$$$$ ▸Inspect Activity on LAN ▸Power & Uptime ▸OpenSource IDS tools ▸Understanding Threat Detection & Networking ▸DNS Tools & Penetration Testing Tools ▸Malware Analysis
- 3. #HXNJXN ISP 100 MBs Down / 50 MBs Up LAN HOME NETWORK WAN DD-WRT ROUTER FIREWALL
- 4. #HXNJXN ISP 100 MBs Down / 50 MBs Up 1.0 GBs Switch LAN AUGMENTED HOME NETWORK Mirror Port / I/O Traffic CyberSensor WAN DD-WRT ROUTER FIREWALL
- 5. #HXNJXN HARDWARE, SOFTWARE & BUDGET ▸ NETGEAR ProSAFE 5-port Gigabit Web Managed (Plus) Switch $40.00 ▸ Ameridroid Odroid C2 $45.00 ▸ USB 2.0 to Ethernet Adapter $15.00 ▸ Class 10 Micro SDHC Cards 16 Gb/ 32 Gb $8.00/$12.00 ▸ Intel NUC Celeron $130.00 ▸ 4 Gb Memory DDR3 $30.00 ▸ 120 Gb SSD $70.00 ▸ Linux Operating Systems FREE SBC Total: $72 SBC Total: $100
- 6. #HXNJXN SBC ODRIOD C2 VS RASPBERRY PI ▸ A53(ARMv8) 1.5Ghz quad-core CPU ▸ Mali™-450 GPU ▸ 2 GB DDR3 SDRAM ▸ 1.0 Gb Ethernet Port ▸ HDMI 2.0 4K/60Hz display ▸ ~5.0 W Max Power ▸ eMMC5.0 HS400 Flash Storage slot ▸ UHS-1 SDR50 MicroSD Card slot ▸ USB 2.0 Host x 4, USB OTG ▸ Infrared(IR) Receiver ▸ 1.2GHz 64-bit quad-core ARMv8 CPU ▸ 802.11n Wireless LAN ▸ Bluetooth 4.1 & Bluetooth Low Energy (BLE) ▸ 1GB RAM ▸ 4 USB ports ▸ 40 GPIO pins ▸ ~4.8W Max Power ▸ 100 Mb Ethernet Port ▸ Micro SD card slot ▸ VideoCore IV 3D graphics core $35$42
- 7. #HXNJXN INTEL NUC VS DESKTOP PC ▸ Intel Braswell 2.17GHz Celeron Dual Core ▸ 4.0 Gb DDR3 RAM ▸ 120 Gb SSD ▸ 65W Intel Power Supply ▸ Intel HD Graphics ▸ WiFi Enabled ▸ 4 x USB 3.0 Ports ▸ RealTek RTL8168 Gigabit NIC ▸ Intel Core i7 3770K @3.7GHz ▸ Gigabyte G1 Sniper Gamers Mobo ▸ 32 Gb DDR3 RAM ▸ 750W Corsair Power Supply ▸ Nvidia GTX 660 & GTX 1080 GPUs ▸ Tons of Storage ▸ 6 x USB 3.0 Ports ▸ Dual Intel 1.0 Gigabit NICs
- 8. #HXNJXN CYBER TOOLS!!!!! ▸Snort ▸BRO IDS ▸nmap ▸tcpdump ▸ netsniff-ng ▸syslog-ng ▸Log Analysis
- 9. #HXNJXN SNORT VS BRO ▸ Ethernet Packets or PCAP files ▸ OSI Layer (add here) ▸ Inline & Passive Modes ▸ Logs, Database, Unified data ▸ Signature Based Threat Intel ▸ VRT Ruleset ▸ Emerging Threats Ruleset ▸ Ethernet Packets or PCAP ▸ OSI Layer (add here) ▸ Passive Mode ▸ Logs based on Packet Steams & Traffic ▸ Detects Interesting Traffic Patterns ▸ Threat Intel based on Frameworks ▸ Critical Stack Intel for BRO IDS
- 10. #HXNJXN WHAT HAPPENED ON NOVEMBER 3, 2016?
- 12. #HXNJXN FIREWALL DROP ACCEPT TRAFFIC BY LOCATION
- 14. #HXNJXN BRO CONNECTIONS BY COUNTRY
- 15. #HXNJXN BRO INTEL BY COUNTRY & REGION
- 18. #HXNJXN NUC VS ODRIOD C2 ▸ Runs Both Snort BRO IDS ▸ USB 3.0 Gigabit Interface ▸ 65 W Max Power ▸ 4.0 GB DDR3 SDRAM ▸ 1.0 Gb Ethernet Port ▸ Ubuntu Linux - very stable ▸ USB 2.0 Host x 4, USB OTG ▸ Runs BOTH Snort & BRO IDS ▸ USB 2.0 Gigabit Interface ▸ ~4.8W Max Power ▸ Kali Linux for ARM ▸ 2.0 GB RAM ▸ LONG COMPILE TIMES ▸ BRO IDS w/ INTEL NOT STABLE ▸ SNORT w/ RULES NOT STABLE ▸ OS hangs or Runs out of Memory
- 19. #HXNJXN LAGNIAPPE & OBSERVATIONS ▸ Uninterruptible/Battery Power Backup & Protection - CyberPower ▸ Gigabit Rated Switches ▸ DOCIS Modems & Separate Router ( use DD-WRT enabled) ▸ Capabilities of ISPs - Verizon, Comcast, AT&T, C-Spire, Cox ▸ Cat 5E Cables, USB to Ethernet Adapters ▸ Kali Linux (ARM), CentOS, Ubuntu (ARM) ▸ Protect devices (Harden the Operating System) ▸ Good Application for PCAP, Network Forensics, Intrusion Detection, Linux, & Security Tools
- 20. #HXNJXN RESOURCES ▸ Hardware ▸ ameridroid.com, amazon.com, newegg.com, intel.com ▸ OpenSource Security Tools ▸ www.bro.org, www.snort.org, sectools.org, kali.org ▸ Commercial Tools ▸ Splunk, Nessus, Nexpose ▸ Books ▸ Packt Publishers, O’Rielly Books ▸ Nostarch Press, Syngress publishers
- 21. #HXNJXN #ABOUT ME ▸ From Greenville Mississippi ▸ Mississippi State University BS Electrical Engineering1995 ▸ Completed SANS Incident Handler Certification ▸ Completed CISSP Certification ▸ Worked in Information Technology Sector for over 20 years ▸ Resides in Arlington Virginia ▸ Works for Major Defense Contractor ▸ email: lagoon7@gmail.com ▸ twitter: @nfltr8