Latest Snort provides alarm for industrial control systems
Version 2.9.2 of open source network intrusion detection system (NIDS) Snort has been released with new preprocessors that add support for protocols used in industrial control systems. The additional functionality should allow Snort to detect targeted attacks on networked SCADA systems.
The two protocols implemented to date, DNP3 and Modbus, are industry standards. The addition of SCADA protocols to Snort is in part due to the presence of significant vulnerabilities in such systems. The development team is looking to implement further SCADA protocols and welcomes development and testing support. Exploit framework Metasploit added SCADA vulnerability detection in August 2011.
Further information about the release and how to write rules for these protocols is available in the release announcement. The documentation for 2.9.2 has also been updated. Snort source code and binaries are available to download from the web site. The source code for the Snort engine and community rules is released under the GPLv2, proprietary rules are provided under Sourcefire's own Non-Commercial Use License.
(ehe)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
