root wrote:
I have just been playing with flowbits, and am wondering if there would be
adverse effects to linking rules to specific service version where applicable.
I think that's a great idea. The snag may be making sure your research
is good on some of the sigs, and being certain that it affects only a
certain version.
A potential problem would be any versions of servers that the version
string has been altered, as many people do with apache servers, etc.
This would have to be an optional modification. Probably not something
we could put in the mail sets of rules. At Bleeding snort I generally
prefer to have the default set of rules work for as many situations as
possible and local changes can be made to further customize.
I think it'd be worth it to have a secoind set of rules that are
modified in this way, so that if you knew you hadn't altered the version
string on any of your servers then you could run those rules.
I am curious about the performance impacts. Can any of the snort folks
comment on whether this would cause a significant load increase?
Very good idea.
Matt
Simple example
alert tcp $HTTP_SERVERS $HTTP_PORTS -> any any \
(msg:"IS IIS4"; sid:2000000; \
rev:0; classtype:not-suspicious; \
content: "Server\: Microsoft-IIS\/4.0"; \
flowbits: set,isiis4; \
flowbits: noalert;)
Alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS \
(msg:"New IIS4 fpcount attempt"; \
sid:2000002; rev:0; classtype:web-application-attack; \
flow:to_server,established; \
uricontent:"/fpcount.exe"; \
content:"Digits="; nocase; reference:bugtraq,2252; reference:cve,1999-1376; \
flowbits: isset,isiis4;)
How much of a resource hit would there be on a system to track connections
in this way?
-N
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
