VRT tivemos alguns updates essa semana listados abaixo:
16424 <-> WEB-ACTIVEX Windows Script Host Shell Object ActiveX clsid access (web-activex.rules, High)Como podemos observar a maioria dos updates é relacionado a produtos mais especificos não facilmente utilizados em todas as redes o que valeria ver a real necessidade.
16425 <-> WEB-CLIENT Portable Executable binary file transfer (web-client.rules, Low)
16426 <-> WEB-MISC Sun Java System Web Server 7.0 WebDAV format string exploit attempt - PROPFIND method (web-misc.rules, High)
16427 <-> WEB-MISC Sun Java System Web Server 7.0 WebDAV format string exploit attempt - LOCK method (web-misc.rules, High)
16428 <-> EXPLOIT Microsoft Outlook Express and Windows Mail NNTP handling buffer overflow attempt (exploit.rules, High)
16429 <-> WEB-MISC Novell iManager eDirectory plugin schema buffer overflow attempt - GET request (web-misc.rules, High)
16430 <-> WEB-MISC Novell iManager eDirectory plugin schema buffer overflow attempt - POST request (web-misc.rules, High)
16431 <-> SQL generic sql with comments injection attempt - GET parameter (sql.rules, High)
16432 <-> WEB-ACTIVEX Trend Micro Web Deployment ActiveX clsid access (web-activex.rules, High)
16433 <-> EXPLOIT Microsoft Active Directory LDAP query handling denial of service (exploit.rules, Medium)
16434 <-> POLICY Ultimate Packer for Executables/UPX v0.51-v0.61 packed file download attempt (policy.rules, Low)
16435 <-> POLICY Ultimate Packer for Executables/UPX v0.62-v1.22 packed file download attempt (policy.rules, Low)
16436 <-> POLICY Ultimate Packer for Executables/UPX v2.90,v2.93-3.00 packed file download attempt (policy.rules, Low)
16437 <-> EXPLOIT CVS Entry line flag remote heap overflow attempt (exploit.rules, High)
Um regra mais generica e legal caso você proteja servidores web é a regra SQL generic sql with comments injection attempt - GET parameter
Outra proteção se seus usuários utilizam IE6 ou IE7 essa regra WEB-ACTIVEX Windows Script Host Shell Object ActiveX clsid access visto que o exploit pode ser facilmente baixado aqui http://www.exploit-db.com/exploits/11457 .
A regra WEB-CLIENT Portable Executable binary file transfer é uma regra que seta o flowbits para download de binarios .exe . A regra não gera alerta mas a mesma é necessaria para outras regras funcionarem corretamente . Por exemplo no update atual os SID http://www.snort.org/search/sid/16434 , http://www.snort.org/search/sid/16435 e http://www.snort.org/search/sid/16436 so funcionarão se essa regra tiver ativada vista que a mesma seta o flowbits http.exe .
O Release completo das regras dessa semana em http://www.snort.org/vrt/docs/ruleset_changelogs/CURRENT/changes-2010-02-17.html2010794 - ET WEB_SERVER DFind w00tw00t GET-Requests (emerging-web_server.rules)
2010795 - ET ATTACK_RESPONSE Matahari client (emerging-attack_response.rules)
2010796 - ET CURRENT_EVENTS MALWARE Unknown Malware Download Attempt (emerging-current_events.rules)
2010797 - ET POLICY Twitter Status Update (emerging-policy.rules)
2010798 - ET CURRENT_EVENTS Possible Microsoft Internet Explorer URI Validation Remote Code Execution Attempt (emerging-current_events.rules)
2010799 - ET CURRENT_EVENTS Internet Explorer CVE-2010-0249 srcElement Remote Code Execution Attempt (emerging-current_events.rules)
2010800 - ET WEB_SPECIFIC_APPS F5 Data Manager DiagLogListActionBody.do Local File Inclusion Attempt (emerging-web_specific_apps.rules)
2010801 - ET WEB_SPECIFIC_APPS F5 Data Manager DiagCaptureFileListActionBody.do Local File Inclusion Attempt (emerging-web_specific_apps.rules)
2010802 - ET WEB_SPECIFIC_APPS F5 Data Manager ViewSatReport.do Local File Inclusion Attempt (emerging-web_specific_apps.rules)
2010803 - ET WEB_SPECIFIC_APPS F5 Data Manager DiagCaptureFileListActionBody.do capture parameter LFI Attempt (emerging-web_specific_apps.rules)
2010804 - ET WEB_SPECIFIC_APPS F5 Data Manager ViewInventoryErrorReport.do Local File Inclusion Attempt (emerging-web_specific_apps.rules)
2010805 - ET WEB_SPECIFIC_APPS Joomla com_yelp Component cid Parameter SELECT FROM SQL Injection Attempt (emerging-web_specific_apps.rules)
2010806 - ET WEB_SPECIFIC_APPS Joomla com_yelp Component cid Parameter DELETE FROM SQL Injection Attempt (emerging-web_specific_apps.rules)
2010807 - ET WEB_SPECIFIC_APPS Joomla com_yelp Component cid Parameter UNION SELECT SQL Injection Attempt (emerging-web_specific_apps.rules)
2010808 - ET WEB_SPECIFIC_APPS Joomla com_yelp Component cid Parameter INSERT INTO SQL Injection Attempt (emerging-web_specific_apps.rules)
2010809 - ET WEB_SPECIFIC_APPS Joomla com_yelp Component cid Parameter UPDATE SET SQL Injection Attempt (emerging-web_specific_apps.rules)
2010810 - ET TROJAN FakeAlert/FraudPack/FakeAV/Guzz/Dload/Vobfus/ZPack HTTP Post (emerging-virus.rules)
2010811 - ET TROJAN FakeAlert/FraudPack/FakeAV/Guzz/Dload/Vobfus/ZPack HTTP Post (emerging-virus.rules)
2010812 - ET TROJAN FakeAlert/FraudPack/FakeAV/Guzz/Dload/Vobfus/ZPack HTTP Post (emerging-virus.rules)
2010813 - ET WEB_CLIENT VLC Media Player smb URI Handling Remote Buffer Overflow Attempt (emerging-web_client.rules)
2010814 - ET WEB_CLIENT Possible AOL 9.5 BindToFile Heap Overflow Attempt (emerging-web_client.rules)
2010815 - ET POLICY Incoming Connection Attempt From Amazon EC2 Cloud (emerging-policy.rules)
2010816 - ET POLICY Incoming Connection Attempt From Amazon EC2 Cloud (emerging-policy.rules)
2010817 - ET CURRENT Possible Cisco ASA 5500 Series Adaptive Security Appliance Remote SIP Inspection Device Reload Denial of Service Attempt (emerging-current_events.rules)
2010818 - ET CURRENT Possible Cisco ASA 5500 Series Adaptive Security Appliance Remote SIP Inspection Device Reload Denial of Service Attempt (emerging-current_events.rules)
2010819 - ET POLICY Facebook Chat using XMPP (emerging-policy.rules)
2010820 - ET WEB_SERVER Tilde in URI, potential .cgi source disclosure vulnerability (emerging-web_server.rules)
2010821 - ET TROJAN Java Downloader likely malicious payload download src=xrun (emerging-virus.rules)
2010822 - ET TROJAN smain?scout=acxc Generic Download landing (emerging-virus.rules)
2010823 - ET TROJAN Torpig Related Fake User-Agent (Apache (compatible...)) (emerging-virus.rules)
2010824 - ET TROJAN Torpig Ping-Pong Keepalives Outbound (emerging-virus.rules)
2010825 - ET TROJAN Torpig Ping-Pong Keepalives Inbound (emerging-virus.rules)
2010826 - ET TROJAN Torpig Initial CnC Connect on port 8392 (emerging-virus.rules)
2010827 - ET TROJAN Torpig CnC Connect on port 8392 (emerging-virus.rules)
2010828 - ET TROJAN Torpig CnC IP Report Command on port 8392 (emerging-virus.rules)
2010829 - ET TROJAN Torpig CnC Report Command on port 8392 (emerging-virus.rules)
2010830 - ET TROJAN Unknown Dropper Checkin (2) (emerging-virus.rules)
Tivemos também adicionada algumas dezenas de regras de comunição com botnet controles e com a famosa RBN (Russian Business Network) como as abaixos:
ET DROP Known Bot C&C Server Traffic
ET RBN Known Russian Business Network IP
Essa regra do IE ET CURRENT_EVENTS Possible Microsoft Internet Explorer URI Validation Remote Code Execution Attempt bem facil de voce ter algo na sua rede exploradas então vale a pena utilizar .
As regras de Torpig acredito ser interessante utilizar por alguns dias visto que pessoas do ET notaram a presença do mesmo .
Enviei também essa semana e com uma melhoria do Joel Esler uma regra para detectar o uso do Chat do Facebook que agora funciona via client-jabber ET POLICY Facebook Chat using XMP .
Não sou de postar sobre as modificações de regras mas fizeram uma mudança interessante numa regra do conficker que acredito que muitas redes antes estejam sujeitas a esse malware.
2009024 - ET CURRENT_EVENTS Downadup/Conficker A or B Worm reporting (emerging-virus.rules)
Para ver a lista completa das novas regras, updates e regras removidas do ET basta acessar http://lists.emergingthreats.net/pipermail/emerging-sigs/2010-February/006326.html
Como sempre saliento cada rede tem suas necessidades específica e a utilização de regras certamente pode ser similar ou não as citadas no SRW . Conheça sua rede pois isso diminui seu trabalho, perda de pacotes e processamento do seu sensor.
Algo importante de observarem é se as regras que vão utilizar possuem flowbits set/isset visto que se não usarmos as regras corretas as mesma nunca serão alertadas . Escreverei durante essa semana um artigo básico sobre flowbits pois acho que pode ser interessante a todos .
Espero que seja de grande utilidade a todos. Até a próxima semana.
Fiquem a vontade pra enviar dúvidas, sugestões e críticas, quero melhorar esse report a cada semana .
Happy Snorting!
Rodrigo Montoro(Sp0oKeR)
Nenhum comentário:
Postar um comentário