[Snort-sigs] BROWSER-OTHER TRUFFLEHUNTER SFVRT-1024 attack attempt (3:42014:1) alerts

Joel Esler (jesler) jesler at ...3865...
Fri Mar 17 07:18:06 EDT 2017


Charlie,

Can you submit that to us with a pcap so we can take a look?

http://blog.snort.org/2016/11/reporting-false-positives-with-snortorg.html<http://blog.snort.org/2016/11/reporting-false-positives-with-snortorg.html?m=1>

--
Sent from my iPhone

On Mar 17, 2017, at 03:09, Charlie Dyer <charlierwdyer at ...2420...<mailto:charlierwdyer at ...2420...>> wrote:

Following on from the previous message, the repeating http://<host> in the URI is only present in the http.request.full_uri, it does not repeat when using http.request.uri.
It also repeats in the Sourcefire GUI under Full Request URI.

Was this a hastily released rule as I cannot see the SID in any recent release.

On Fri, Mar 17, 2017 at 7:47 AM, Charlie Dyer <charlierwdyer at ...2420...<mailto:charlierwdyer at ...2420...>> wrote:
Hello

Below are a list of hosts that are the destination of HTTP GETs that are triggering the above rule, obviously not much detail on why, can't really post all the URI data but here are a few:

http://media.rightmove.co.ukhttp://media.rightmove.co.uk/dir/1k/505/58618708/505_BAI170129_IMG_06_0000_max_656x437.JPG<http://media.rightmove.co.uk/dir/1k/505/58618708/505_BAI170129_IMG_06_0000_max_656x437.JPG>

http://ib.adnxs.comhttp://ib.adnxs.com/setuid?entity=43&code=4044211960863159294<http://ib.adnxs.com/setuid?entity=43&code=4044211960863159294>

http://sync.adaptv.advertising.comhttp://sync.adaptv.advertising.com/turn_user_sync<http://sync.adaptv.advertising.com/turn_user_sync>?

Weird how the URI has two 'http://' prefixes, in fact all the URIs have this.

Any ideas?

Below are the hosts.

a.tribalfusion.com<http://a.tribalfusion.com>
aax-eu.amazon-adsystem.com<http://aax-eu.amazon-adsystem.com>
ads.stickyadstv.com<http://ads.stickyadstv.com>
ads.yahoo.com<http://ads.yahoo.com>
b.scorecardresearch.com<http://b.scorecardresearch.com>
bat.bing.com<http://bat.bing.com>
bat.r.msn.com<http://bat.r.msn.com>
bcp.crwdcntrl.net<http://bcp.crwdcntrl.net>
beacon-eu-ams3.rubiconproject.com<http://beacon-eu-ams3.rubiconproject.com>
bh.contextweb.com<http://bh.contextweb.com>
cdn.adacado.com<http://cdn.adacado.com>
choices-or.truste.com<http://choices-or.truste.com>
ckm-m.xp1.ru4.com<http://ckm-m.xp1.ru4.com>
dsum.casalemedia.com<http://dsum.casalemedia.com>
dt.adsafeprotected.com<http://dt.adsafeprotected.com>
evtvpaid.bfmio.com<http://evtvpaid.bfmio.com>
ib.adnxs.com<http://ib.adnxs.com>
image2.pubmatic.com<http://image2.pubmatic.com>
impression.mediaiqdigital.com<http://impression.mediaiqdigital.com>
match.adsrvr.org<http://match.adsrvr.org>
media.rightmove.co.uk<http://media.rightmove.co.uk>
ox-d.justpremium.com<http://ox-d.justpremium.com>
p.rfihub.com<http://p.rfihub.com>
pix04.revsci.net<http://pix04.revsci.net>
pixel.adsafeprotected.com<http://pixel.adsafeprotected.com>
pixel.mathtag.com<http://pixel.mathtag.com>
pixel.quantserve.com<http://pixel.quantserve.com>
pixel.rubiconproject.com<http://pixel.rubiconproject.com>
pixel-eu.rubiconproject.com<http://pixel-eu.rubiconproject.com>
sp.adbrn.com<http://sp.adbrn.com>
srv-2017-03-17-07.pixel.parsely.com<http://srv-2017-03-17-07.pixel.parsely.com>
ssum.casalemedia.com<http://ssum.casalemedia.com>
su.addthis.com<http://su.addthis.com>
sync.adaptv.advertising.com<http://sync.adaptv.advertising.com>
sync.mathtag.com<http://sync.mathtag.com>
sync.search.spotxchange.com<http://sync.search.spotxchange.com>
tamil.oneindia.com<http://tamil.oneindia.com>
tapestry.tapad.com<http://tapestry.tapad.com>
tca-115.tca-rtb1.rfihub.net<http://tca-115.tca-rtb1.rfihub.net>
tps20204.doubleverify.com<http://tps20204.doubleverify.com>
tps611.doubleverify.com<http://tps611.doubleverify.com>
trc.taboola.com<http://trc.taboola.com>
w88.espn.com<http://w88.espn.com>
www.google-analytics.com<http://www.google-analytics.com>
www.rightmove.co.uk<http://www.rightmove.co.uk>
www.wtp101.co<http://www.wtp101.co>

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org<http://Slashdot.org>! http://sdm.link/slashdot
_______________________________________________
Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net<mailto:Snort-sigs at lists.sourceforge.net>
https://lists.sourceforge.net/lists/listinfo/snort-sigs

http://www.snort.org

Please visit http://blog.snort.org for the latest news about Snort!

Visit the Snort.org<http://Snort.org> to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20170317/2b839d86/attachment.html>


More information about the Snort-sigs mailing list