New Year, New Snort
(I'm doing this now mainly to bump the bosses post down a slot... :)) Hey folks, we have some updated Snort information for you. Here is some information ofon the latest production build of Snort, and our first beta build of Snort 2.8.6. Snort 2.8.5.2 Update: A quick note
The Last List of 2009 - Predicting Security in 2010
As the guy in charge I've been too busy with the day-to-day operations of the Sourcefire VRT to create the cliched, annual "Top 10 List" of things that have come and gone, or things that will happen in the future. However I've procrastinated long enough on this
Matt's Guide to Vendor Response
Well...it's that weird period between Christmas and New Years, and I've realized that I hadn't gotten anything for those wonderful people that keep the VRT employed.So as a gift to you, software vendor, I present Matt's Guide to Vendor Response.Now...this is a com
DEP and Heap Sprays
Usually when you need to use a heap spray, you're SOL when it comes to DEP. The reason for this has to do with why you used the heap spray in the first place. In the case of a vtable overwrite you need a chain of pointers to get the job done. A neat way to deal with this is t
Sourcefire VRT Labs
We are opening the Sourcefire VRT Labs for business. We've had a few useful things floating around in the jungle for a while now and we decided to make everything available, in one place, for everyone to use. Right now, Labs has a few resources on it we thought folks might fi
Adobe Reader media.newPlayer() Analysis (CVE-2009-4324)
First off its not Friday, and hopefully you'll have a better weekend. The reason for that is you are set with rules and clam sigs. Now what the heck am I talking about…. Last night Adobe released an advisory detailing an in the wild exploit for Adobe Acrobat that is current
Rule release for today - December 15th, 2009
More problems with Adobe Acrobat and Acrobat Reader via the media.newPlayer function. Couple of rules to cover it, check here: http://www.snort.org/vrt/advisories/2009/12/15/vrt-rules-2009-12-15.html for more details and changelog.
Operation: Don't Tell Lurene We're Working On This
If you've been following this blog for a while, you might have noticed that Lurene only shows up when there is evil to be done. This is why she is here; she's really, really good at it. She is also the analyst team lead and makes sure we are all keeping the fuzzers runnin
I hope you're happy Bejtlich...you cost me a ton of sleep
So after two days of getting up at the crack of dawn, having to deal with other VRT folks before they've had their coffee and then driving through commuter traffic and getting on the Metro, I came home from the SANS Incident Detection Summit completely exhausted. But as my he