Rule release for today - April 26th, 2010
This release contains support for Snort 2.8.6.0. Additionally, new packages have been added that contain 4 digit version numbers. New package names: 1. snortrules-snapshot-2853_s.tar.gz 2. snortrules-snapshot-2860_s.tar.gz Details: The packages have been updated with support fo
A New Detection Framework
We just completed a talk here in Dubai on some detection capability research the VRT has been doing. The subtitle of the presentation, "What would you do with a pointer and a size?" pretty much sums up the potential of the project. It all started last December at the
Rule release for today, Thursday April 15th, 2010
Maintenance release, a few new rules and modifications to existing ones. Check here for details.
April 2010 Vulnerability Report
Rule release for today, Tuesday April 13th, 2010
Microsoft Tuesday and Adobe Quarterly Patch. Details available here. Microsoft Security Advisory (MS10-019): The Microsoft CAB Subject Interface Package (SIP) implementation contains a programming error that may allow a remote attacker to bypass the authentication mechanism. Mi
Rule release for today, Thursday April 8th, 2010
Mostly some small fixes, couple of reference changes and some new rules. Check it out here
WTF, Ubuntu?
I just finished installing Ubuntu 9.10 server edition on a shiny new Dell PowerEdge R805 box, as part of expanding our malware analysis labs. No big deal - half an hour of babysitting an installer, right? Wrong. It took me 5 hours, thanks to some really stupid decisions made by
Matt's Primer for PDF Analysis
For obvious reasons, the VRT has been spending a lot of time on the PDF format lately. While the attack researchers have been concentrating on fuzzing, reverse engineering and data flow analysis, the defense researchers have been automating the backend analysis of PDF submissions
What in the name!...
If you are confused by the naming of ClamAV products, here's a quick breakdown: * ClamAV®: open source (GPL) anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. Available here. * ClamAV® (Win32 binaries): Win32 port of ClamAV. Availa