Examining the MPAA University Toolkit

I learned about the MPAA University Toolkit at Brian Krebs' always-excellent SecurityFix blog. If you want to know more about the user experience, please check out that post. Here I take a look at the monitoring software, focusing on Snort, operating on this application.

I downloaded the 534 MB peerwatch-1.2-RC5.iso and started it in a VMware Server session. I used ctrl-c and then 'sudo bash' to exit from the initial script presented within X, set a root password, then used 'apt-get ssh install' to install OpenSSH and thus enable root access. From this point forward I accessed the system using OpenSSH remotely to facilitate copying information into this blog post.

First, this looks like Ubuntu (Xubuntu, if you really care) Feisty Fawn, or 7.04.

root@ubuntu:~# uname -a
Linux ubuntu 2.6.20-15-generic #2 SMP Sun Apr 15 07:36:31 UTC 2007
 i686 GNU/Linux

I was most interested in learning about Snort on this toolkit. I saw this version installed.

root@ubuntu:~# snort -V

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.3.3 (Build 14)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html
           (C) Copyright 1998-2004 Sourcefire Inc., et al.

Wow, that's old. It's probably patched base on the changelog. This is Snort installed via Debian/Ubuntu package:

root@ubuntu:~# dpkg --list | grep snort
rc  snort                                      2.3.3-9
                                Flexible Network Intrusion Detection System
ii  snort-common                               2.3.3-9
                                Flexible Network Intrusion Detection System 
ii  snort-mysql                                2.3.3-9
                                Flexible Network Intrusion Detection System 
ii  snort-rules-default                        2.3.3-9
                                Flexible Network Intrusion Detection System 

Let's see what the snort.conf looks like.

root@ubuntu:/etc/snort# cat snort.conf 
var HOME_NET any
var EXTERNAL_NET !$HOME_NET
var DNS_SERVERS $HOME_NET
var SMTP_SERVERS $HOME_NET
var HTTP_SERVERS $HOME_NET
var SQL_SERVERS $HOME_NET
var TELNET_SERVERS $HOME_NET
var SNMP_SERVERS $HOME_NET

var HTTP_PORTS 80

var RULE_PATH /etc/snort/rules

preprocessor flow: stats_interval 0 hash 2
preprocessor frag2
preprocessor stream4: disable_evasion_alerts detect_scans
preprocessor stream4_reassemble

# preprocessor perfmonitor: time 300 file /var/snort/snort.stats pktcnt 10000

# (#DBSTART#)
output database: log, mysql, user=snort password=snort dbname=snort host=localhost  
# (#DBEND#)

include classification.config
include reference.config

config flowbits_size: 256

include $RULE_PATH/bleeding-p2p.rules
include $RULE_PATH/local-ftp.rules
include $RULE_PATH/local-http.rules
include $RULE_PATH/local-smb.rules
include $RULE_PATH/p2p.rules

include threshold.conf

Excellent, another Snort installation where Snort is logging directly to a MySQL database. That must be the default provided by Debian/Ubuntu. Ouch. Thresholding and suppression are also enabled but the entire contents are commented out in the threshold.conf file.

Let's get a look at those rules.

bleeding-p2p.rules looks like an old copy of the bleeding-p2p.rules, perhaps from mid-year? I think there are 38 rules.

p2p.rules is a really old rule set:

# $Id: p2p.rules,v 1.17.2.1 2004/10/13 20:25:57 bmc Exp $

You may recognize these and the other Snort distributed-rules as being those that accompanied Snort 2.3.3, which pre-dates the new license for Snort rules.

local-ftp.rules is the first rule set written by whomever assembled this toolkit.

# cat local-ftp.rules 
# 1 000 500 - 1 000 699

# active
alert tcp any 20 -> any any  (msg: "FTP Download - MPEG Movie File - B2"; \
content: "|00 00 01 B2|"; depth: 6; rawbytes; \
sid: 1000501; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - MPEG Movie File - B3"; \
content: "|00 00 01 B3|"; depth: 6; rawbytes; \
sid: 1000502; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - MPEG Movie File - BA"; \
content: "|00 00 01 BA|"; depth: 6; rawbytes; \
sid: 1000503; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - MPEG Movie File - BB"; \
content: "|00 00 01 BB|"; depth: 6; rawbytes; \
sid: 1000504; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - MPEG-4 Video File"; \
content: "|00 00 00 18 66 74 79 70 6D 70 34|"; depth: 15; rawbytes; \
sid: 1000505; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - Quicktime Movie File - MOOV"; \
content: "|6D 6F 6F 76|"; depth: 10; rawbytes; \
sid: 1000506; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - Quicktime Movie File - MDAT"; \
content: "|6D 64 61 74|"; depth: 10; rawbytes; \
sid: 1000507; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - Audio Video Interleave (AVI) File - AVI"; \
content: "|41 56 49 20|"; depth: 6; rawbytes; \
sid: 1000508; rev: 1; \
)
                                    
alert tcp any 20 -> any any  (msg: "FTP Download - Audio Video Interleave (AVI) File - RIFF"; \
content: "|52 49 46 46|"; depth: 6; rawbytes; \
sid: 1000509; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - Real Media File"; \
content: "|2E 52 4D 46|"; depth: 6; rawbytes; \
sid: 1000510; rev: 1; \
)

alert tcp any 20 -> any any  (msg: "FTP Download - Windows Media File"; \
content: "|30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C|"; depth: 20; rawbytes; \
sid: 1000511; rev: 1; \
)

# passive
alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - MPEG Movie File - B2"; \
content: "|00 00 01 B2|"; depth: 6; rawbytes; \
sid: 1000512; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - MPEG Movie File - B3"; \
content: "|00 00 01 B3|"; depth: 6; rawbytes; \
sid: 1000513; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - MPEG Movie File - BA"; \
content: "|00 00 01 BA|"; depth: 6; rawbytes; \
sid: 1000514; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - MPEG Movie File - BB"; \
content: "|00 00 01 BB|"; depth: 6; rawbytes; \
sid: 1000515; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - MPEG-4 Video File"; \
content: "|00 00 00 18 66 74 79 70 6D 70 34|"; depth: 15; rawbytes; \
sid: 1000516; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - Quicktime Movie File - MOOV"; \
content: "|6D 6F 6F 76|"; depth: 10; rawbytes; \
sid: 1000517; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - Quicktime Movie File - MDAT"; \
content: "|6D 64 61 74|"; depth: 10; rawbytes; \
sid: 1000518; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - Audio Video Interleave (AVI) File - AVI"; \
content: "|41 56 49 20|"; depth: 6; rawbytes; \
sid: 1000519; rev: 1; \
)
                                    
alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - Audio Video Interleave (AVI) File - RIFF"; \
content: "|52 49 46 46|"; depth: 6; rawbytes; \
sid: 1000520; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - Real Media File"; \
content: "|2E 52 4D 46|"; depth: 6; rawbytes; \
sid: 1000521; rev: 1; \
)

alert tcp any 1024: -> any 1024:  (msg: "FTP PASV Download - Windows Media File"; \
content: "|30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C|"; depth: 20; rawbytes; \
sid: 1000522; rev: 1; \
)

Anyone who has written Snort rules is probably going to question the false positive rate on this rule set, especially the "tcp any 1024: -> any 1024:" group. These are straight content matches, and the smaller strings like "|2E 52 4D 46|" are probably going to fire quite a bit on unintended traffic.

Here is local-http.rules.

root@ubuntu:/etc/snort/rules# cat local-http.rules 
# 1 000 100 - 1 000 299

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - MPEG Movie File - B2"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|00 00 01 B2|"; within: 6; \
sid: 1000101; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - MPEG Movie File - B3"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|00 00 01 B3|"; within: 6; \
sid: 1000102; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - MPEG Movie File - BA"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|00 00 01 BA|"; within: 6; \
sid: 1000103; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - MPEG Movie File - BB"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|00 00 01 BB|"; within: 6; \
sid: 1000104; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - MPEG-4 Video File"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|00 00 00 18 66 74 79 70 6D 70 34|"; within: 15; \
sid: 1000105; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - Quicktime Movie File - MOOV"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|6D 6F 6F 76|"; within: 10; \
sid: 1000106; rev: 1; \
)
alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - Quicktime Movie File - MDAT"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|6D 64 61 74|"; within: 10; \
sid: 1000107; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - Audio Video Interleave (AVI) File - AVI"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|41 56 49 20|"; within: 6; \
sid: 1000108; rev: 1; \
)
                                    
alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - Audio Video Interleave (AVI) File - RIFF"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|52 49 46 46|"; within: 6; \
sid: 1000109; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - Real Media File"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|2E 52 4D 46|"; within: 6; \
sid: 1000110; rev: 1; \
)

alert tcp any 80 -> any any  (msg: "HTTP Download > 100M - Windows Media File"; \
flow: established,from_server; \
content: "HTTP"; depth: 5; nocase; \
content: "200"; within: 8; \
content: "Content-Length\: "; within: 300; nocase; \
pcre: "/^[0-9]{9,}\r\n/R"; \
content: "|0d 0a 0d 0a|"; within: 100; \
content: "|30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C|"; within: 20; \
sid: 1000111; rev: 1; \
)

That's 11 rules. There are 22 more. The middle 11 have port 80 replaced by 3128. The final 11 have port 8080. What does that tell you? It means that you can avoid being detected by these rules if the remote Web server runs on a port other than 80, 3128, or 8080. Note also that the original snort.conf doesn't enable the http_inspect or http_inspect_server preprocessors. These rules are more raw content matches, although their specificity will reduce the number of times they fire. They also introduce more evasion options.

Finally, let's check out local-smb.rules.

root@ubuntu:/etc/snort/rules# cat local-smb.rules 
# 1 000 300 - 1 000 499

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - MPEG Movie File - B2"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|00 00 01 B2|"; distance: 54; within: 4; \
sid: 1000301; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - MPEG Movie File - B3"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|00 00 01 B3|"; distance: 54; within: 4; \
sid: 1000302; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - MPEG Movie File - BA"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|00 00 01 BA|"; distance: 54; within: 4; \
sid: 1000303; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - MPEG Movie File - BB"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|00 00 01 BB|"; distance: 54; within: 4; \
sid: 1000304; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - MPEG-4 Video File"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|00 00 00 18 66 74 79 70 6D 70 34|"; distance: 54; within: 15; \
sid: 1000305; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - Quicktime Movie File - MOOV"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "MOOV"; distance: 54; within: 8; nocase; \
sid: 1000306; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - Quicktime Movie File - MDAT"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "MDAT"; distance: 54; within: 4; nocase; \
sid: 1000307; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - Audio Video Interleave (AVI) File - AVI"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "AVI_"; distance: 54; within: 4; nocase; \
sid: 1000308; rev: 1; \
)
                                    
alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - Audio Video Interleave (AVI) File - RIFF"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "RIFF"; distance: 54; within: 4; nocase; \
sid: 1000309; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - Real Media File"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|2E 52 4D 46|"; distance: 54; within: 4; \
sid: 1000310; rev: 1; \
)

alert tcp any 445 -> any any  (msg: "SMB-445 Download > 100M - Windows Media File"; \
flow: established,from_server; \
content: "SMB|2E|"; offset: 5; within: 4; nocase; \
content: "|30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C|"; distance: 54; within: 16; \
sid: 1000311; rev: 1; \
)

Notice all the port 445 instances? You can evade these if your SMB session uses port 139 TCP.

I thought it might be fun to test these rules. I decided to download a 108 MB .avi file to the toolkit host itself and see if would be observed.

file robert-morris.avi 
robert-morris.avi: RIFF (little-endian) data, AVI, 640 x 480, 30.00 fps,
video: Motion JPEG, audio: uncompressed PCM (mono, 11024 Hz)

Hmm, no alerts. I have Sguil running on my gateway. Let's see what the start of a transcript for this session looks like.

Sensor Name: hacom
Timestamp: 2007-11-23 21:32:47
Connection ID: .hacom_5136151961070210685
Src IP:  69.255.105.234 (c-69-255-105-234.hsd1.va.comcast.net)
Dst IP:  164.106.251.250 (Unknown)
Src Port:  58172
Dst Port:  80
OS Fingerprint: 69.255.105.234:58172 - UNKNOWN
 [S4:61:1:60:M1460,S,T,N,W4:.:?:?] (up: 3 hrs) 
OS Fingerprint:   -> 164.106.251.250:80 (link: ethernet/modem)

SRC: GET /docs/netsec/robert-morris.avi HTTP/1.0
SRC: User-Agent: Wget/1.10.2
SRC: Accept: */*
SRC: Host: 164.106.251.250
SRC: Connection: Keep-Alive
SRC: 
SRC: 
DST: HTTP/1.1 200 OK
DST: Date: Fri, 23 Nov 2007 21:38:16 GMT
DST: Server: Apache/2.0.52 (Red Hat)
DST: Last-Modified: Tue, 23 Aug 2005 21:46:31 GMT
DST: ETag: "37804f-6bfad96-ba9f7bc0"
DST: Accept-Ranges: bytes
DST: Content-Length: 113225110
DST: Connection: close
DST: Content-Type: video/x-msvideo
DST: 
DST: 
DST: RIFF....AVI LISTF...hdrlavih8...5...D.&......................I..
LISTt...strlstrh8...vidsmjpg............5...@B...........I...'..............
strf(...(...............MJPG....................LIST\...strlstrh8...auds....
.................+......\ 
DST: ..+...'..............strf.........+...+......IDIT....
FRI JUL 29 15:54:43 2005
DST: .LIST....INFOISFT....CanonMVI02..JUNK~...

After the HTTP response you see the download begin for the .avi. Presumably this would match, this rule?

"HTTP Download > 100M - Audio Video Interleave (AVI) File - RIFF"

Let's look at the two most important packets in the full content pcap file.

16:32:47.335530 IP 164.106.251.250.80 > 69.255.105.234.58172:
 P 1:268(267) ack 133 win 1716 <nop,nop,timestamp 2163691250 1274738>
        0x0000:  4520 013f e980 4000 3006 0fca a46a fbfa  E..?..@.0....j..
        0x0010:  45ff 69ea 0050 e33c f12d d653 a3ca 374e  E.i..P.<.-.S..7N
        0x0020:  8018 06b4 ce3b 0000 0101 080a 80f7 4ef2  .....;........N.
        0x0030:  0013 7372 4854 5450 2f31 2e31 2032 3030  ..srHTTP/1.1.200
        0x0040:  204f 4b0d 0a44 6174 653a 2046 7269 2c20  .OK..Date:.Fri,.
        0x0050:  3233 204e 6f76 2032 3030 3720 3231 3a33  23.Nov.2007.21:3
        0x0060:  383a 3136 2047 4d54 0d0a 5365 7276 6572  8:16.GMT..Server
        0x0070:  3a20 4170 6163 6865 2f32 2e30 2e35 3220  :.Apache/2.0.52.
        0x0080:  2852 6564 2048 6174 290d 0a4c 6173 742d  (Red.Hat)..Last-
        0x0090:  4d6f 6469 6669 6564 3a20 5475 652c 2032  Modified:.Tue,.2
        0x00a0:  3320 4175 6720 3230 3035 2032 313a 3436  3.Aug.2005.21:46
        0x00b0:  3a33 3120 474d 540d 0a45 5461 673a 2022  :31.GMT..ETag:."
        0x00c0:  3337 3830 3466 2d36 6266 6164 3936 2d62  37804f-6bfad96-b
        0x00d0:  6139 6637 6263 3022 0d0a 4163 6365 7074  a9f7bc0"..Accept
        0x00e0:  2d52 616e 6765 733a 2062 7974 6573 0d0a  -Ranges:.bytes..
        0x00f0:  436f 6e74 656e 742d 4c65 6e67 7468 3a20  Content-Length:.
        0x0100:  3131 3332 3235 3131 300d 0a43 6f6e 6e65  113225110..Conne
        0x0110:  6374 696f 6e3a 2063 6c6f 7365 0d0a 436f  ction:.close..Co
        0x0120:  6e74 656e 742d 5479 7065 3a20 7669 6465  ntent-Type:.vide
        0x0130:  6f2f 782d 6d73 7669 6465 6f0d 0a0d 0a    o/x-msvideo....
16:32:47.336654 IP 164.106.251.250.80 > 69.255.105.234.58172:
 . 268:1636(1368) ack 133 win 1716 #60;nop,nop,timestamp 2163691250 1274738#62;
        0x0000:  4520 058c e982 4000 3006 0b7b a46a fbfa  E.....@.0..{.j..
        0x0010:  45ff 69ea 0050 e33c f12d d75e a3ca 374e  E.i..P.<.-.^..7N
        0x0020:  8010 06b4 b5f8 0000 0101 080a 80f7 4ef2  ..............N.
        0x0030:  0013 7372 5249 4646 8ead bf06 4156 4920  ..srRIFF....AVI.
        0x0040:  4c49 5354 4601 0000 6864 726c 6176 6968  LISTF...hdrlavih
        0x0050:  3800 0000 3582 0000 44d0 2600 0000 0000  8...5...D.&.....
        0x0060:  1000 0100 0e07 0000 0000 0000 0200 0000  ................
        0x0070:  c649 0100 8002 0000 e001 0000 0000 0000  .I..............
        0x0080:  0000 0000 0000 0000 0000 0000 4c49 5354  ............LIST
        0x0090:  7400 0000 7374 726c 7374 7268 3800 0000  t...strlstrh8...
        0x00a0:  7669 6473 6d6a 7067 0000 0000 0000 0000  vidsmjpg........
        0x00b0:  0000 0000 3582 0000 4042 0f00 0000 0000  ....5...@B......
        0x00c0:  0e07 0000 c649 0100 1027 0000 0000 0000  .....I...'......
        0x00d0:  0000 0000 8002 e001 7374 7266 2800 0000  ........strf(...
        0x00e0:  2800 0000 8002 0000 e001 0000 0100 1800  (...............
        0x00f0:  4d4a 5047 0010 0e00 0000 0000 0000 0000  MJPG............
        0x0100:  0000 0000 0000 0000 4c49 5354 5c00 0000  ........LIST\...
        0x0110:  7374 726c 7374 7268 3800 0000 6175 6473  strlstrh8...auds
        0x0120:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0130:  0100 0000 102b 0000 0000 0000 5c20 0a00  .....+......\...
        0x0140:  102b 0000 1027 0000 0100 0000 0000 0000  .+...'..........
        0x0150:  0000 0000 7374 7266 1000 0000 0100 0100  ....strf........
        0x0160:  102b 0000 102b 0000 0100 0800 4944 4954  .+...+......IDIT
        0x0170:  1a00 0000 4652 4920 4a55 4c20 3239 2031  ....FRI.JUL.29.1
        0x0180:  353a 3534 3a34 3320 3230 3035 0a00 4c49  5:54:43.2005..LI
        0x0190:  5354 1800 0000 494e 464f 4953 4654 0c00  ST....INFOISFT..
        0x01a0:  0000 4361 6e6f 6e4d 5649 3032 0000 4a55  ..CanonMVI02..JU
        0x01b0:  4e4b 7e06 0000 0000 0000 0000 0000 0000  NK~.............
...truncated...

Do you see it? The HTTP response code and the Content-Length statement appear in the first packet. The .avi begins in the second packet with RIFF. Snort doesn't fire an alert because all of the matches needed for the rule are not present in a single packet.

Technically, there's not much to worry about here -- at least not yet. I do worry about putting monitoring tools in the hands of people who don't know what they're doing and seeing them act on misconceptions. It's also important to identify the fact that this activity could violate wiretap and privacy laws.