[Snort-sigs] FP for psyBNC (493)

Hi,

We just had a false positive where a user (ok, me) read an email
where the email body text contained a psyBNC banner string

(the email was discussing an incident involving psyBNC...)

Looking at the rule, the FP is not surprising, as it appears to look for 
the string *anywhere* in the packet:

  alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"INFO psyBNC access";
   flow:from_server,established; content:"Welcome!psyBNC@lam3rz.de";
   classtype:bad-unknown; sid:493; rev:5;)

A real psyBNC banner (on a hacked machine etc) will always be at the start 
of the packet.  In every case we've seen, the string being tested for 
appears after a colon - e.g:

  :Welcome!psyBNC@lam3rz.de NOTICE * :MaZuRRel

Thus, I suggest adding a "depth: 25" condition to this rule (hope I've 
counted right) which should eliminate most FPs and speed things up too.

Chris

--
Chris Edwards, Glasgow University Computing Service






-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs