[Snort-sigs] backdoored ssh-decorator package

Y M snort at outlook.com
Thu May 10 12:23:03 EDT 2018


Hi Phillip,

Thanks for the feedback. I do agree with the assessment of not adding the rule to community ruleset, given the fast_patterned 'index.php'. The concern was about existing installation base of the package, or if their are other packages exhibiting the same compromise.

For the sake of self-improvement, I have done some python documentation reading, the following statements standout:

"... urllib.request module uses HTTP/1.1 and includes Connection:close header in its HTTP requests."
"... If this header has not been provided and data is not None, Content-Type: application/x-www-form-urlencoded will be added as a default."
"... The default is 'GET' if data is None or 'POST' otherwise ..."

https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen

With the above in mind, the second revision becomes:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC backdoored ssh-decorator package outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/index.php"; fast_pattern:only; http_uri; content:"pkey="; http_uri; content:"port="; http_uri; content:"server="; http_uri; content:"password="; http_uri; content:"user="; http_uri; content:"Connection: close|0D 0A|"; http_header; content:"Content-Type: application/x-www-form-urlencoded"; http_header; metadata:ruleset community, service http; reference:url,https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_sshdecorator_package; classtype:trojan-activity; sid:8000050; rev:2;)

This is not to dispute the decision of not adding the rule to the community ruleset 😊. Its still not unique enough.

Thanks.
YM
________________________________
From: Snort-sigs <snort-sigs-bounces at lists.snort.org> on behalf of Phillip Lee <phillile at sourcefire.com>
Sent: Thursday, May 10, 2018 6:38 PM
To: wkitty42 at windstream.net
Cc: snort-sigs at lists.snort.org
Subject: Re: [Snort-sigs] backdoored ssh-decorator package

Hi Yaser,
After reviewing the rule, we have decided not to add it to the community ruleset.  Their are two reasons:
1. The pip package in question has been taken down
2. The rule content would likely result in FPs due to generic use of parameters seen in other applications. Your general rule is OK (other than using ‘index.php’ as a fast_pattern - would enter way too often), its just that with those parameters, its not something unique to only the ssh-decorator package.

We sincerely appreciate your contribution.

Regards,
Phil Lee
Cisco Talos

> On May 10, 2018, at 10:24 AM, wkitty42 at windstream.net wrote:
>
> On 05/09/2018 04:03 PM, Y M via Snort-sigs wrote:
>> Hi,
>> The below rule is derived from the reference. Simple testing with python is show below as illustrated in the screenshot in the reference.
>
>
> was this thing fixed from the original(?) one? i've seen another one that misspells "password" one time... the 'w' and the 'o' are reversed...
>
>
> --
> NOTE: No off-list assistance is given without prior approval.
>       *Please keep mailing list traffic on the list unless*
>       *a signed and pre-paid contract is in effect with us.*
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.snort.org
> https://lists.snort.org/mailman/listinfo/snort-sigs
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
>
> Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!

_______________________________________________
Snort-sigs mailing list
Snort-sigs at lists.snort.org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20180510/1e83a97c/attachment-0001.html>


More information about the Snort-sigs mailing list