On 0, Paul Schmehl <pauls@utdallas.edu> allegedly wrote:
This rule has been bugging me for a while. As you can see, all it looks
for is two hypens side by side. Unfortunately, the Arachnids site appears
to be down, so I have no way of knowing how they decided to look for those
two characters, but, as you can see from the payload below, it's trivial to
trip this alert with encrypted or binary packets.
Here's the rule:
alert tcp $EXTERNAL_NET any -> $HOME_NET 5032 (msg:"BACKDOOR NetMetro File
List"; flow:to_server,established; content:"--"; reference:arachnids,79;
classtype:misc-activity; sid:159; rev:6;)
<big snip>
Surely we can either can this rule or improve it so that it's more accurate?
At a minimum it should be:
alert tcp $EXTERNAL_NET any -> $HOME_NET 5031 (msg:"BACKDOOR NetMetro File
List"; flow:to_server,established; content:"--"; reference:arachnids,79;
classtype:misc-activity; sid:159; rev:6;
If not:
alert tcp $EXTERNAL_NET 5031 -> $HOME_NET any (msg:"BACKDOOR NetMetro File
List"; flow:to_server,established; content:"--"; reference:arachnids,79;
classtype:misc-activity; sid:159; rev:6;
NetMetro uses both 5031 and 5032 as it's server ports. However, the
content match in this rule is weak and the actual NetMetro Trojan is now
pretty hard to find in order to verify and come up with a better rule
than this.
Also, NetMetro is known to run on Windows 95, 98 and NT only and there
is no evidence to suggest it runs on anything else. My suggestion would
be to disable that rule.
+--------------------------------------------------------------------+
Nigel Houghton Research Engineer Sourcefire Inc.
Vulnerability Research Team
There is no theory of evolution, just a list
of creatures Vin Diesel allows to live.
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
