Rule:

--
Sid:
1443

--
Summary:
This event is generated when a TFTP GET request is made for the "passwd"
file.  This could be an indication that a remote attacker has 
compromised a system on the network and is transfering sensitive files 
back to the attacking system.  It may also be an indication of a generic
TFTP server scan that includes tests for generic system files.

--
Impact:
The "passwd" file normally stores users names for Unix based systems.  
If this file is being transfered over the network using TFTP it is 
normally an indication of a system compromise.

In some situations this rule may only indicate a generic TFTP scan 
attempt, as the attacker may be scanning a large range of IP addresses 
for TFTP improperly configured TFTP servers.

--
Detailed Information:
This rule searches for the filename "passwd" in TFTP GET requests.  The 
"passwd" file is used by Unix based systems to store users names for the
system.

--
Attack Scenarios:
After a successful system compromise an attacker may setup a tftp 
service to transfer files back to the attacking system.  Under this 
scenario the source address will point to the attack network and the 
destination address will be an address defined in the HOME_NET.

Attackers may also scan large subnets for TFTP servers and make numerous
generic GET request for common system files. 

--
Ease of Attack:
Simple: Numerous tools and automated scripts exist for scanning large 
subnets for improperly configured TFTP servers.

--
False Positives:
This rule was created to catch TFTP GET requests for "passwd", if this 
file name is being used during a legitimate TFTP session this rule will 
generate a false positive.

--
False Negatives:
None known

--
Corrective Action:
Depending on the situation blocking the attacker at the upstream router 
or firewall will eliminate the problem.  However, if the TFTP server is 
incorrectly configured and is actually serving the "passwd" file, it 
should be configured to only serve specific files from a safe directory.

--
Contributors:
Original rule writer unknown
Sourcefire Research Team
Matthew Watchinski Matt.Watchinski@sourcefire.com

--
Additional References

--
