Snort

Just pushed build 152 to github (snortadmin/snort3):fixed config error for inspection of rebuilt packetsported smtp inspector from Snortstatic analysis fix for new_http_inspect

Just released:Snort Subscriber Rule Set Update for 05/14/2015We welcome the introduction of the newest rule release from Talos. In this release we introduced 19 new rules and made modifications to 2 additional rules. There were no changes made to ... [More] the snort.conf in this release. Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:Avery Tarasov3445234453Talos's rule release: Talos has added and modified multiple rules in the app-detect, browser-plugins, malware-cnc, policy-other and server-other rule sets to provide coverage for emerging threats from these technologies. In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats! [Less]

Just released:Snort Subscriber Rule Set Update for 05/12/2015We welcome the introduction of the newest rule release from Talos. In this release we introduced 97 new rules and made modifications to 31 additional rules. There were no changes made to ... [More] the snort.conf in this release. Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:James Lay34365Yaser Mansour3436634370Avery Tarasov3436734368Talos's rule release: Talos is aware of vulnerabilities affecting products from MicrosoftCorporation.Details:Microsoft Security Bulletin MS15-043:Microsoft Internet Explorer suffers from programming errors that may lead toremote code execution.Rules to detect attacks targeting these vulnerabilities are included in thisrelease and are identified with GID 1, SIDs 34379 through 34384, 34391 through34392, 34405 through 34412, 34415, 34417 through 34425, 34430 through 34433,34436 through 34437, and 34444 through 34445.Microsoft Security Bulletin MS15-044:A coding deficiency exists in Microsoft GDI+ that may lead to remote codeexecution.Rules to detect attacks targeting these vulnerabilities are included in thisrelease and are identified with GID 1, SIDs 34440 through 34441.Microsoft Security Bulletin MS15-045:A coding deficiency exists in Microsoft Windows Journal that may lead to remotecode execution.Rules to detect attacks targeting these vulnerabilities are included in thisrelease and are identified with GID 1, SIDs 34371 through 34372, 34385 through34390, 34399 through 34400, and 34403 through 34404.Microsoft Security Bulletin MS15-046:A coding deficiency exists in Microsoft Office that may lead to remote codeexecution.Rules to detect attacks targeting these vulnerabilities are included in thisrelease and are identified with GID 1, SIDs 34428 through 34429.Microsoft Security Bulletin MS15-048:A coding deficiency exists in the Microsoft .NET Framework that may lead to anescalation of privilege.Rules to detect attacks targeting these vulnerabilities are included in thisrelease and are identified with GID 1, SIDs 34401 through 34402 and 34434through 34435.Microsoft Security Bulletin MS15-051:A coding deficiency exists in Microsoft Kernel-Mode drivers that may lead to anescalation of privilege.Rules to detect attacks targeting these vulnerabilities are included in thisrelease and are identified with GID 1, SIDs 34377 through 34378, 34413 through34414, and 34442 through 34443.Microsoft Security Bulletin MS15-052:A coding deficiency exists in the Microsoft Kernel that may lead to a securityfeature bypass.Rules to detect attacks targeting these vulnerabilities are included in thisrelease and are identified with GID 1, SIDs 34426 through 34427.Microsoft Security Bulletin MS15-053:A coding deficiency exists in the Microsoft JScript and VBScript scriptingengines that may lead to a security feature bypass.Rules to detect attacks targeting these vulnerabilities are included in thisrelease and are identified with GID 1, SIDs 34393 through 34394.Microsoft Security Bulletin MS15-054:A coding deficiency exists in Microsoft Management Console that may lead to aDenial of Service (DoS).Rules to detect attacks targeting these vulnerabilities are included in thisrelease and are identified with GID 1, SIDs 34438 through 34439.Talos has also added and modified multiple rules in the blacklist, browser-ie,file-flash, file-identify, file-office, file-other, malware-cnc, malware-other,malware-tools, os-windows and server-webapp rule sets to provide coverage foremerging threats from these technologies.In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats! [Less]

Just pushed build 151 to github (snortadmin/snort3):new_http_inspect aborts on obvious non-HTTP ttrafficnew_http_inspect memory reduction changesnew_http_inspect parsing updatesdoc tweaksfix http inspect use of decompress_swf and decompress_pdfensure ... [More] that autotools and cmake install the same files in the same dirsadd doc/online_manual.sh to generate an all-in-1 HTML manual with embedded images [Less]

Just released:Snort Subscriber Rule Set Update for 05/07/2015We welcome the introduction of the newest rule release from Talos. In this release we introduced 13 new rules and made modifications to 4043 additional rules. There were no changes made to ... [More] the snort.conf in this release.Talos's rule release: Talos has added and modified multiple rules in the blacklist, browser-chrome, browser-firefox, browser-ie, browser-other, browser-plugins, browser-webkit, content-replace, exploit-kit, file-executable, file-flash, file-identify, file-image, file-java, file-multimedia, file-office, file-other, file-pdf, indicator-compromise, indicator-obfuscation, indicator-scan, indicator-shellcode, malware-cnc, malware-other, netbios, os-linux, os-mobile, os-other, os-solaris, os-windows, policy-other, policy-social, protocol-dns, protocol-ftp, protocol-icmp, protocol-imap, protocol-pop, protocol-rpc, protocol-scada, protocol-services, protocol-snmp, protocol-telnet, protocol-tftp, protocol-voip, pua-other, server-apache, server-iis, server-mail, server-mssql, server-mysql, server-oracle, server-other, server-samba, server-webapp and x11 rule sets to provide coverage for emerging threats from these technologies. In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats! [Less]

Just released:Snort Subscriber Rule Set Update for 05/05/2015We welcome the introduction of the newest rule release from Talos. In this release we introduced 14 new rules and made modifications to 8 additional rules. There were no changes made to ... [More] the snort.conf in this release. Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:Avery Tarasov34318Yaser Mansour343073430834309343103431134312343133431434315343163431734335Talos's rule release: A new base policy, Maximum Detection, has been added in this release. TheMaximum Detection policy will grow to encompass a selection of vulnerabilitiesfrom 2005 or later with a CVSS score of at least 7.5, along with criticalmalware and exploit kit rules.The "Maximum Detection" policy favors detection over rated throughput. In somesituations this policy can and will cause significant throughput reductions.Cisco's Talos continues to recommend the "Balanced Connectivity and Security"policy for most networks, and the "Security Over Connectivity" policy forcustomers with more rigorous security requirements.Talos has also added and modified multiple rules in the browser-ie,exploit-kit, file-other and server-webapp rule sets to provide coverage foremerging threats from these technologies.In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats! [Less]

Just released:Snort Subscriber Rule Set Update for 04/30/2015We welcome the introduction of the newest rule release from Talos. In this release we introduced 42 new rules and made modifications to 11 additional rules. There were no changes made to ... [More] the snort.conf in this release. Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:James Lay342873429134292Talos's rule release: Talos has added and modified multiple rules in the blacklist, browser-ie, browser-plugins, file-flash, file-image, file-other, malware-cnc, pua-adware, server-other and sql rule sets to provide coverage for emerging threats from these technologies. In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats! [Less]

Snort++ build 150 is now available on snort.org.  This is the latest monthly update of the downloads.  You can also get the latest updates from github (snortadmin/snort3) which is updated weekly.New features:pop and imap inspectors portedadded ... [More] publish-subscribe handling of data eventsadded data_log plugin example for pub-subadded build of snort_manual.text if w3m is installed (all in one file)added default_snort_manual.text w/o w3mBug fixes and enhancements:fix http_inspect mpse searchfixed urg rule optionchange daq.var to daq.vars to support multiple params; reported by Sancho Panzaensure unknown sources are analyzedfixed default validation issue reported by Sancho Panzafixed xcode static analysis issueschange PT_DATA to IT_PASSIVE; supports named instances, reload, and consumersPlease submit bugs, questions, and feedback to [email protected] or the Snort-Users mailing list.Happy Snorting!The Snort Release Team [Less]

One of the goals of Snort++ is to provide a more flexible framework for packet processing by implementing an event-driven approach.  Another is to produce data only when needed, to minimize expensive normalizations.  To help explain these concepts ... [More] , let's start by examining how Snort processes packets.  The key steps are given in the following figure:Snort 2X Packet ProcessingThe preprocess step is highly configurable.  Arbitrary preprocessors can be loaded dynamically at startup, configured in snort.conf, and then executed at runtime.  Basically, the preprocessors are put into a list which is iterated for each packet.  Recent versions have tweaked the list handlingsome, but the same basic architecture has allowed Snort to grow from a sniffer, with no preprocessing, to a full-fledged IPS, with lots of preprocessing.While this "list of plugins" approach has considerable flexibility, it hampers future development where the flow of data from one preprocessor to the next depends on traffic conditions, a common situation with advanced features like application identification.  In this case, a preprocessor like HTTP may be extracting and normalizing data that ultimately is not used, or app ID may be repeatedly checking for data that is just not available.Callbacks help break out of the preprocess straightjacket.  This is where one preprocessor supplies another with a function to call when certain data is available.  Snort has started to take this approach to pass some HTTP and SIP preprocessor data to app ID.  However, it remains a peripheral feature and still requires the production of data that may not be consumed.The basic processing steps Snort++ takes are similar to Snort's as seen in the following diagram.  The preprocess step employs specific inspector types instead of a generalized list, but the basic procedure includes stateless packet decoding, TCP stream reassembly, and service specific analysis in both cases.  (Snort++ provides hooks for arbitrary inspectors, but they are not central to basic flow processing and are not shown.)Snort 3X Packet ProcessingHowever, Snort++ also provides a more flexible mechanism than callback functions.  By using inspection events, it is possible for an inspector to supply data that other inspectors can process.  This is known as the observer pattern or publish-subscribe pattern.Note that the normalized data is not actually published.  Instead, access to the data is published, and that means that subscribers can access the raw or normalized version(s) as needed.  Normalizations are done only on the first access, and subsequent accesses get the previously normalized data.  This results in just in time (JIT) processing.A basic example of this in action is provided by the extra data_log plugin. It is a passive inspector, ie it does nothing until it receives the data it subscribed for ('other' in the above diagram).  By adding the following to your snort.lua configuration, you will get a simple URI logger:data_log = { key = 'http_raw_uri' }Inspection events coupled with pluggable inspectors provide a very flexible framework for implementing new features.  And JIT buffer stuffers allow Snort++ to work smarter, not harder.  These capabilities will be leveraged more and more as Snort++ development continues.  Look for weekly updates on github (snortadmin/snort3) and monthly updates on snort.org. [Less]

Just released:Snort Subscriber Rule Set Update for 04/28/2015We welcome the introduction of the newest rule release from Talos. In this release we introduced 94 new rules and made modifications to 44 additional rules. There were no changes made to ... [More] the snort.conf in this release. Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:Yaser Mansour3423634237Avery Tarasov34136Talos's rule release: Talos has added and modified multiple rules in the blacklist, browser-ie, file-flash, file-multimedia, file-other, indicator-obfuscation, indicator-shellcode, malware-cnc, protocol-ftp, pua-adware and server-webapp rule sets to provide coverage for emerging threats from these technologies. In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats! [Less]