"Ripple20" Treck IOT/ICS device discovery and exploit detection (v0.2)

Summary:

A Zeek package for the passive detection of Treck devices, discovery/scanning attempts and exploitation of the "Ripple20" set of vulnerabilities in the Treck TCP/IP stack.

References:

• https://corelight.blog/2020/06/30/ripple20-zeek-package-open-sourced/
• https://www.jsof-tech.com/ripple20/
• python/scapy scanning package provided by JSOF.
• https://treck.com/vulnerability-response-information/
• https://www.us-cert.gov/ics/advisories/icsa-20-168-01
• https://www.kb.cert.org/vuls/id/257161

Notices raised :

High Fidelity means high confidence of a True Positive.
Medium Fidelity means that there could well be False Positives, however if a device has more than one Medium Fidelity notice type, then it is more likely to be a True Positive. For this reason, by default all notices are enabled, however if the medium fidelity notices are too noisy you can disable them with enable_medium_fidelity_notices = F in scripts/config.zeek.

Where helpful, notices include a small amount of packet metadata which is useful for triage and refinement.

Usage and recommendations:

• To use against a pcap you already have zeek -Cr your.pcap scripts/__load__.zeek

• Version (v0.2) additional notices and fully supports clustered OR non clustered live environments.

• You may also wish to disable Medium Fidelity notices via enable_medium_fidelity_notices = F in scripts/config.zeek if there is a performance impact bought on by this package. In particular in high Packets per Second environments, for example Internet facing taps where there are a lot of connections including SYN scans, this package uses the connection_established event which will be frequent and expensive in this environment. Disabling the medium fidelity notices will make a large improvement on performance in this case. When installing this package, make sure to profile your system before and after so to ensure that performance isn't an issue for you