Snort startup script for Ubuntu
#! /bin/sh ### BEGIN INIT INFO # Provides: Snort # Required-Start: $local_fs $remote_fs $syslog $network mysql # Required-Stop: $local_fs $remote_fs $syslog $network mysql # Default-Start: 2 3 4 5 # Default-Stop: S 0 1 6 # Short-Description: Init script
AWBO4!
Some of you tore through awbo3 pretty quickly, but I wanted to give others time to catch up before posting this one. We're going to start getting into some issues you'll see in live software when working on exploits. This one in particular might remind you of a certain ba
Logical signatures in ClamAV 0.94
Up until ClamAV 0.93, the following formats have been used the most to write signatures to detect malware: SignatureName;TargetDescriptionBlock;LogicalExpression;Subsig0;Subsig1;Subsig2;... Logical signatures should be stored in .ldb files. Let us illustrate how logical signat
Webcast Teaser -- Basic Buffer Overflow Detection
Our next webcast, Performance Rules Creation: Rules Options and Techniques, is scheduled for 1pm EST on Wednesday, September 17th. We’ll be using actual published VRT rules to demonstrate common rule structures, rule options and some of the gotchas that you might run across when
AWBO Part Deux
Since some people have been chomping at the bit for the next challenge, so here it is. The same rules apply as did last time. When we say no static stack return addresses, this also means of course that there's no need for NOP sleds, so I shouldn't see them in solutions.
Checking Multiple Bits in a Flag Field
Sometimes, it is necessary to check a value in a flag field that is not a power of two (1, 2, 4, 8, etc.) and therefore requires multiple bits to be represented, yet other values in the byte are not part of that flag field. Such is the case for DNS where server status codes are r
Defcon, testing and exploiting
This year at Defcon Immunity trotted out the first iteration of their NOP cert test, and I had the pleasure of giving it a test run. I still think it's a great indicator of ability, despite the Immunity tools focus; I'm not a user of any of their tools generally, but I ma
DNS Vulnerability Paper
Now that Defcon is over and the Kaminsky DNS Vulnerability is completely out in the open, the Sourcefire VRT has a new whitepaper that discusses the issue and suggests detection methods using Snort rules. Download it here.
Flash Vulnerability Info
On 5-27-2008 Symantec issued a 0-day vulnerability alert pertaining to malicious flash (SWF) files circulating in the wild. The initial Symantec report stated that this issue was unknown and that it affected the latest version 9.0.124.0 of flash player and several other Adobe pro