I made an attempt at it, there's a rule up here:
http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/Stable/EXPLOIT_IE_Vulnerabilities?rev=1.23&content-type=text/vnd.viewcvs-markup
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE
EXPLOIT IE IFRAME Exploit";
pcre:"/(EMBED|FRAME|SRC)\s*=\s*["']*?(file|http)\://\w{578}|/W{578}/im";
pcre:"/(EMBED|FRAME|SRC|NAME)\s*=\s*["']\w{2086}|\W{2086}/im";
content:"\/IFRAME"; nocase; flow:from_server,established; sid:2001401;
rev:9;)
The one detected the exploit that was originally released, but the
variations have been significant.
The paper you noted we helped feed data to from other bleeding snort
sigs. The authors there did a lot of great work which let us put up
about 80 new spyware sigs from that investigation. About all we learned
about the iframe vuln through that was that the sigs we had weren't
working. There were versions that were encoded, versions with just small
portions encoded, and versions being delivered in zip files to be opened
locally, etc. It seemed rather useless to try to work on that sig more
while we were finding that many new spyware packages to detect.
Interestingly, this sig from Joseph detects the original exploit as
well. It had no better luck with getting any variants either though.
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE
IFRAME ExecCommand vulnerability"; content:"<IFRAME"; nocase;
pcre:"/SRC[\s]*=[\s]*["']*[\x09\x0a\x0b\x0c\x0d]*f[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*e[\x09\x0a\x0b\x0c\x0d]*\:/Ri";
reference:url,www.securiteam.com/exploits/3D5Q4RFPPK.html;
classtype:misc-activity; flow:from_server,established; sid:2001095; rev:2;)
Brian had mentioned privately he was working on a sig for release, but I
haven't noticed it yet. You still have something in the works Brian?
Matt
Chris Mills wrote:
Hi all-
Yesterday, microsoft released the patch for the IFrame exploit, but
I'm looking for a good signature to detect it still. Given the
randomness of the way they are doing this exploit, it seems the only
common string in these http documents to look for is "iframe." Please
lend some advice for signatures for this that will reduce false
positives. A good source of info on this is at
http://www.vitalsecurity.org/xpire-splitinfinity-serverhack_malwareinstall-condensed.pdf
Thanks,
Chris
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
--
--------------------------------------------
Matthew Jonkman, CISSP
Senior Security Engineer
Infotex
765-429-0398 Direct Anytime
765-448-6847 Office
866-679-5177 24x7 NOC
my.infotex.com
www.offsitefilter.com
--------------------------------------------
NOTICE: The information contained in this email is confidential
and intended solely for the intended recipient. Any use,
distribution, transmittal or retransmittal of information
contained in this email by persons who are not intended
recipients may be a violation of law and is strictly prohibited.
If you are not the intended recipient, please contact the sender
and delete all copies.
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
