We have EDR for endpoints and NDR/Next-gen firewalls looking for network anomalies, but how do you protect/detect compromised network devices like routers and switches. They're common attack points for APTs but I feel like I have no visibility.
Posted Sep 14, 2023, 10:46 PM UTC
Most of the health and bank entities in my area use a product called ordr, we demoed it and it was very nice in finger print and detection, but out of our budget.
Honestly sometimes NDR/firewall should do it. Like your Citrix appliance/firewall shouldn’t be downloading a port scanner.
Honestly though the best you can do is focus on post exploitation activity and following the trail back to the popped device. Even without EDR you have a chance. I’ll use example of the Volt Typhoon stuff a couple months ago, you should never see your firewall service account logging in to a workstation and stuff like that. But to do that you need to have really, really good environmental knowledge.
Personal side: I was working on getting wazuh agentless scans on some unifi gear, then forwarding to a siem.
Isolate as much as you can into different vlans and restrict the network flows as much as possible.
You can address this with two detection bases: Network signatures, see a device doing something it shouldn't be? Most switches have syslog functionality, you could trim down and read the auth log only in your siem.
Wouldn’t plugging in an IDS to a span port on the devices in question with specific detection rules and sending to the SEIM do this? Or even an IPS inline with your router and firewall?
ERSPAN over IPsec tunnel to an IDS is a better methodology.
Thank you for the insight and recommendations. I have some research to do now.
I have another piece of insight about this for you. If you're really worried about the bandwidth utilization caused by ERSPAN duplication of traffic and QoS or limiting the source/destination or enforcing just rx or tx values, you can use an NPB (Network Packet Broker) solution as a collector to feed your ERSPAN traffic into and then have it truncate the resulting output before it gets fed to an IDS. I would recommend Gigamon for doing that, personally. But again, that's more money so it's very budget dependent.
Move away from on-prem hardware to SaaS? j/k sort of.
syslog and audit logs are your best bet. Run Nessus or other scanners against their admin portal looking for holes or vulns.
The easiest way to detect intruders on your network infrastructure (routers, switches, firewalls, wireless APs, etc...) is to look for traffic originating from those devices. In it's simplest form, you would look for traffic originating from the L3 addresses associated with your infrastructure.
It gets more complicated when you are looking for sophisticated actors. To be honest, nobody in their right mind would risk a tool that valuable (10s of millions of dollars in exploits and development cycles, and years in the making) unless the payout is worth it.
That being said, deeply implanted network devices can be detected. You will need physical taps placed around the network (you cannot rely on SPANs if you are starting from the assumption your network infrastructure is compromised). That raw data, feed into a tool for processessinh and correlating pcap data (like zeek) should give you the analytic starting point.
Late to the party, but for public facing devices I'd keep an eye on the likes of Shodan and SecurityTails that index public facing infra.
If you can find it on there, so can a threat actor and a subscription that also provides known vulnerabilities associated with indexed devices isn't that expensive (for you, or the Threat Actor).
Do you have log monitoring/SIEM? Routers and switches should be able to forward their events, like syslog.
We do have a SIEM so that can definitely be done. Any idea if there's a good base of detection knowledge? I did a quick search for Sigma rules for routers and switches and didnt see much.
The most I've done is track account logins and method of logon (telnet or SSH).