It is a very nice idea: when thinking about it spam filtering is quite
similar.
Unfortunately my experience shows me that when you get to the small
details there is a lot of work (usually too much) when changing the
monitored protocol. We have though about applying our technology to
non-http environments, and while the underlying technology would
probably fit, the implementation itself requires way too much work.
Some of the work needed is in the infrastructure elements (parsing for
example), but it also seems that when translated to a product the
technology gathered a lot of "know-how" of the specific environment it
work on.
Ofer Shezaf
CTO, Breach Security
Tel: +972.9.956.0036 ext.212
Cell: +972.54.443.1119
ofers@breach.com
http://www.breach.com
-----Original Message-----
From: Martin Schapendonk [mailto:martin.schapendonk@gmail.com]
Sent: Monday, January 24, 2005 9:29 AM
To: Ofer Shezaf
Cc: webappsec@securityfocus.com
Subject: Re: Content monitorting in Application Security
I like the suggestion to check for (multiple) occurrences of
SQL-statements etc.. If you think of it, it's just like UCE/UBE
filtering.
Maybe it's possible to use software like SpamAssassin and/or
BogoFilter to determine if a file is "definitely insecure",
"definitely secure" or "not sure". Of course, they would require a
whole different ruleset and perhaps some extra training depending on
the site, but I do think this may have some perspective.
Also, performance wise this may be a good idea: SA and BF are designed
for realtime email processing, so I don't see why they shouldn't be
able to process a sufficient number of files, even on modest hardware.
Regards,
Martin
--
Martin Schapendonk, martin.schapendonk@gmail.com
