[Snort-sigs] FPs on sid 159

Nigel Houghton nigel at ...435...
Thu Mar 9 11:00:05 EST 2006


On  0, Paul Schmehl <pauls at ...1311...> allegedly wrote:
> This rule has been bugging me for a while.  As you can see, all it looks 
> for is two hypens side by side.  Unfortunately, the Arachnids site appears 
> to be down, so I have no way of knowing how they decided to look for those 
> two characters, but, as you can see from the payload below, it's trivial to 
> trip this alert with encrypted or binary packets.
> 
> Here's the rule:
> 
> alert tcp $EXTERNAL_NET any -> $HOME_NET 5032 (msg:"BACKDOOR NetMetro File 
> List"; flow:to_server,established; content:"--"; reference:arachnids,79; 
> classtype:misc-activity; sid:159; rev:6;)

<big snip>
 
> Surely we can either can this rule or improve it so that it's more accurate?
> 
> At a minimum it should be:
> alert tcp $EXTERNAL_NET any -> $HOME_NET 5031 (msg:"BACKDOOR NetMetro File 
> List"; flow:to_server,established; content:"--"; reference:arachnids,79; 
> classtype:misc-activity; sid:159; rev:6;
> 
> If not:
> alert tcp $EXTERNAL_NET 5031 -> $HOME_NET any (msg:"BACKDOOR NetMetro File 
> List"; flow:to_server,established; content:"--"; reference:arachnids,79; 
> classtype:misc-activity; sid:159; rev:6;

NetMetro uses both 5031 and 5032 as it's server ports. However, the
content match in this rule is weak and the actual NetMetro Trojan is now
pretty hard to find in order to verify and come up with a better rule
than this.

Also, NetMetro is known to run on Windows 95, 98 and NT only and there
is no evidence to suggest it runs on anything else. My suggestion would
be to disable that rule.

+--------------------------------------------------------------------+
     Nigel Houghton      Research Engineer       Sourcefire Inc.
                   Vulnerability Research Team

         There is no theory of evolution, just a list
            of creatures Vin Diesel allows to live.




More information about the Snort-sigs mailing list