"Snort not backdoored, Sourcefire not compromised"

I'm not going to cite the source of the rumors which prompted this story, since I don't want to give publicity to those seeking it for its own sake. Rather, I though it important to post in its entirety a recent message Marty Roesch of Sourcefire sent to the snort-users mailing list. By the way, sign up for one of Marty's seminars, coming to a city near you. I'll see him in DC on 7 Oct. Now for Marty's post:

Date: Sun, 21 Sep 2003 20:44:11 -0400
From: Martin Roesch
To: full-disclosure@xxxxxxxxxxxxxxxx
Subject: [Snort-users] Snort not backdoored, Sourcefire not compromised

--------------------------------------------------------------------------------

It's come to my attention that some group is claiming to have broken into a Sourcefire server and backdoored the Snort source code. First things first, there is no backdoor in Snort nor has there ever been, everyone can relax.

A shell server got compromised well over a year ago, but what these guys aren't telling you is that the network that it was on was not only logically separate from the rest of the sourcefire.com domain, it was also physically removed from it too (by about 23 miles, approximately the distance from the Sourcefire office to my basement). Yes, that's right, they busted into a shell server that was maintained on a physically separate network in my basement. That particular machine was maintained as a shell server for various people to log into so that we can have a sacrificial box to use to chat on IRC without having to worry about our real network getting compromised, and it has served its purpose well.

While we do try to keep that system from suffering break-ins, we also realize that many IRC clients aren't exactly the most secure pieces of code in the world and sometimes there are problems in server code as well (like apache and sshd), so we put together servers like that one so that we can interact with people while minimizing the risks to the company's networks and servers. I thought this was fairly standard practice for many security companies, maybe I'm wrong.

If you're wondering "how do you know the code isn't backdoored?", since we know that that server is an "at risk" server we're not in the habit of checking code into CVS from there. If that's not good enough for you, Snort has been through three code audits since March (one Sourcefire internal, two third-party external) and there are most definitively no backdoors in the code, nor were there any.

Hope that clears things up.

BTW, the sample code that they put into their little screed was nothing more than an update of the 'stick' program from 2001, not really anything to get worked up about.

-Marty


--
Martin Roesch - Founder/CTO Sourcefire Inc. - (410) 290-1616
Sourcefire: Enterprise-class Intrusion detection built on Snort
roesch@sourcefire.com - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more