Re: [Snort-sigs] DNS Cache Poisoning

On Thu, 2005-04-07 at 14:46 -0500, Joe Stewart wrote:
> byte_jump:1,-3,relative,from_beginning; content:"|03|com|00|"; nocase; 
> within:5; classtype:misc-attack; sid:1600; rev:4;)
>
> Basically the changes are: it looks a for packet with fewer than 7 
> authority records (there should usually be 12 or 13, but who knows if 
> you find a server with an old root hints file) and where the .com label 
> follows an IP address (meaning it's probably the start of a new record 
> and not part of a larger text label).

Of course this only applies to the .com domain (and with a slight
change, the .net domain). Do you have any signatures for the other
domains? We had quiet a few on Bleeding, but these triggered not only on
responses from the root-servers reporting the authoritative gTLD and
ccTLD servers, but also on responses from those TLD servers on who is
the authoritative name server and on responses from those name servers.
We finally removed them again a couple day ago.

You said you're not getting false positives. Have you actually caught
TRUE positives with this sig?

Cheers,
Frank

signature.asc
Description: This is a digitally signed message part