da_667 on Nostr: took me most of the morning, but I've been working on some improvements for detecting ...

took me most of the morning, but I've been working on some improvements for detecting ErlangOTP/SSH exploitation attempts.

Runzero identified a range of vulnerable ssh banners (www.runzero.com/blog/erlang-otp-ssh/), so a I used that to create a rule that sets a flowbit. Flowbits are a way of telling Snort or Suricata to "watch this stream of network traffic that meets this criteria."

If the SSH server banner is vulnerable, AND we see Null Init cookies, OR an unencrypted channel open, or an unencrypted channel request message, only then will the alerts trigger.

of course, this means stuff like cisco products that are vulnerable, Because they use ErlangOTP under the hood, who also had to make their own unique SSH server banners for reasons beyond my comprehension (like, say, making it that much fucking harder to get a software bill of materials for all the shit running under their hood) won't trigger with these rules.