[Snort-sigs] scanning for emoticons in MSN messenger?

Eric Zheng zhengeric at ...12...
Tue May 4 02:40:26 EDT 2010


Would it be possible to detect when an emoticon is being used without looking at the format of the image being sent?  Doing so of course without 10 different string check rules for 10 different emoticons.  Basically a single rule to acknowledge that an emoticon has been sent.  I'm not sure if it's possible since snort treats an emoticon as plain text (ie, a smiley face is read as ":)" ).

Date: Mon, 3 May 2010 08:38:48 -0400
Subject: Re: [Snort-sigs] scanning for emoticons in MSN messenger?
From: jesler at ...435...
To: zhengeric at ...12...
CC: snort-sigs at lists.sourceforge.net

Eric,
You'd have to grab a pcap of traffic to see what format the emoticon is in.  Then you could write a simple content signature.
Joel

On Mon, May 3, 2010 at 3:07 AM, Eric Zheng <zhengeric at ...12...> wrote:






I want to see if it's possible to make a rule to look for any custom emoticon being sent over MSN messenger.  I believe this is possible since a custom emoticon image has to be sent over the network, but I'm not sure how to look for it (file type matching? but I don't know what format custom emoticons are in).  I'm new to snort rules but I have been familiarizing myself with their syntax and usage.


I believe it would be along the lines of:

alert tcp $EXTERNAL_NET 1863 -> $HOME_NET any (msg:"Emoticon detected"; <emoticon signature>;)

Where <emoticon signature> are the requisites to trigger the alert.  Port 1863 is used for MSN messenger.


Any help would be appreciated, thanks!
 		 	   		  
The New Busy is not the too busy. Combine all your e-mail accounts with Hotmail. Get busy.


------------------------------------------------------------------------------


_______________________________________________

Snort-sigs mailing list

Snort-sigs at lists.sourceforge.net

https://lists.sourceforge.net/lists/listinfo/snort-sigs



 		 	   		  
_________________________________________________________________
Hotmail is redefining busy with tools for the New Busy. Get more from your inbox.
http://www.windowslive.com/campaign/thenewbusy?ocid=PID28326::T:WLMTAGL:ON:WL:en-US:WM_HMP:042010_2
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20100504/e415e42e/attachment.html>


More information about the Snort-sigs mailing list