Tips for Writing Good Rules from a n00b
It has been two months since I joined the VRT. Since then, I have learned a lot about Snort and want to share some tactics with other people who are new to Snort (as I was). More precisely, I want to talk about how to write good Snort rules with performance in mind. First of all
New byakugan functionality!
I've just added a new jutsu method to byakugan to help you find the address of a particular primitive (DWORD, WORD, or BYTE) in memory. Obviously, this isn't a terribly difficult task - you use the search function in windbg. What trackVal will do for you is allow you to s
Md5 actually harmful
You probably shouldn't take any other view of this vulnerability into consideration. Some amazing research and dedication went into proving this vulnerability is realistic and viable. You should note that detection of it is not really feasible; the bad certs look exactly like
The vuln before Christmas
* T'was the night before Christmas, and all through the net, * not a hacker was stirring, not even FX, * the servers all hummed in post-purchase daze, * to await the deluge of gift-card traffic craze, * * The VRT was drinking, three sheets to the wi
MS-SQL Quickie update
Hey folks, Since MS chose today to speak on this issue (see http://www.microsoft.com/technet/security/advisory/961040.mspx) We wanted to remind you that we released coverage for this rule on the 9th of December. The following SIDs address this issue: 15127, 15128, 15129, 15130
Rule release for today - December 23 2008
Mostly a maintenance release this one, some new rules in web-activex, web-client, backdoor and specific-threats. Check out the information here: http://www.snort.org/vrt/advisories/vrt-rules-2008-12-23.html
Snort Rule Coverage for MS08-078
A critical vulnerability in Microsoft Internet Explorer outlined in Microsoft Security Bulletin MS08-078, is covered by a previously released rule. The rule to detect attacks targeting this vulnerability was included in the release on 2008-12-11 and is identified with GID 1, SID
Rootkit takes advantage of MS08-078 vulnerability
On December 17 2008, Microsoft released security update MS08-078 to patch a vulnerability found in several versions of Microsoft Internet Explorer. The root cause for this vulnerability was found to be the incorrect handling of certain XML tags in Internet Explorer that reference
SPAN, The Heap, and esoteric memory buggery…
Have you ever heard someone say they needed a pointer that pointed to itself and was also a nop? Maybe one they could write to? No? Where are you hanging out? For the rest of you, I'll explain why this set of properties can be useful, and when you might want to make use of