[Snort-sigs] False positive - sid 1365

Ofer Shezaf ofer at ...2970...
Tue Mar 22 06:20:07 EST 2005

On Tue, 22 Mar 2005, Mike Pomraning wrote:
> However, you do still shoot the bullet. :)  I'd temper your last remark --
> after all, http_inspect *is* application layer smarts, however limited,
> inside
> Snort.  Comprehensive and perfect?  No.  Useful?  Certainly.

Yes, I agree that I was over criticizing. Better have a working solution
that does part of the work than have nothing.

Jeremiah Grossman's article "The 80/20 Rule for Web Application Security"
http://www.webappsec.org/articles/013105-plain.html), which I like very
much, follows your line of thought that there is no perfect solution and we
should look for a sufficient solution, especially to deter the masses of
casual hackers.

Regarding http_inspect, it does not help the signatures themselves, but
rather fights different IDS evasion techniques such as encoding, and is
exactly the reason I did not include IDS evasion as part of the 1365 and
alternative signature limitations.

Saying that, signatures for rm or cc are still very weak in Snort, prone to
false positives and if used with regular expressions resource consuming.

When trying to handle other application layer attacks such as SQL injection,
signatures are even less effective. While rm by itself is not an English
word (how lucky we are that UNIX is designed for geeks :-)) SQL (and Windows
for that matter) do use English words so keywords such as "select", "union"
and "copy" cannot be used as signatures at all.

What we need are much more complex signatures that detect multiple patterns
and than make decisions based on the number of patterns matched, their
order, their distance and probably other attributes as well. I call these
application layer signatures.

~ Ofer

Ofer Shezaf
CTO, Breach Security

Tel: +972.9.956.0036 ext.212
Cell: +972.54.443.1119
ofers at ...2971...

More information about the Snort-sigs mailing list