On Tue, 22 Mar 2005, Mike Pomraning wrote:
However, you do still shoot the bullet. :) I'd temper your last remark --
after all, http_inspect *is* application layer smarts, however limited,
inside
Snort. Comprehensive and perfect? No. Useful? Certainly.
Yes, I agree that I was over criticizing. Better have a working solution
that does part of the work than have nothing.
Jeremiah Grossman's article "The 80/20 Rule for Web Application Security"
http://www.webappsec.org/articles/013105-plain.html), which I like very
much, follows your line of thought that there is no perfect solution and we
should look for a sufficient solution, especially to deter the masses of
casual hackers.
Regarding http_inspect, it does not help the signatures themselves, but
rather fights different IDS evasion techniques such as encoding, and is
exactly the reason I did not include IDS evasion as part of the 1365 and
alternative signature limitations.
Saying that, signatures for rm or cc are still very weak in Snort, prone to
false positives and if used with regular expressions resource consuming.
When trying to handle other application layer attacks such as SQL injection,
signatures are even less effective. While rm by itself is not an English
word (how lucky we are that UNIX is designed for geeks :-)) SQL (and Windows
for that matter) do use English words so keywords such as "select", "union"
and "copy" cannot be used as signatures at all.
What we need are much more complex signatures that detect multiple patterns
and than make decisions based on the number of patterns matched, their
order, their distance and probably other attributes as well. I call these
application layer signatures.
~ Ofer
Ofer Shezaf
CTO, Breach Security
Tel: +972.9.956.0036 ext.212
Cell: +972.54.443.1119
ofers@breach.com
http://www.breach.com
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
