Snort.org Ecommerce

The Snort Subscription Store has been experiencing intermittent issues.  The store is temporarily disabled to perform maintenance.  We will announce the return of availability on the snort.org blog at http://blog.snort.org. 

 In the meantime, please email snort-sub@sourcefire.com to process your transaction or call 1-866-505-913 or +1-734-743-6550 for manual processing.

The Vulnerability Research Team is hiring, we want YOU.

Alain wrote a post this morning over on the ClamAV blog, so I thought I'd do the same here on the Snort.org blog and tell people we're hiring.

Have you ever written a Snort rule?  or wanted to?

Like messing about in the newest vulnerabilities or malware?  Like writing exploits?  Enjoy challenges like "Here's a file that crashes -application- , figure out why"?  Want to work with us to design what is next in Snort?  ClamAV?  Razorback?  Or any of the above topics?

We want you.

Alain talked about what he liked about the VRT, so in addition to those, let me follow the same lines and talk about what I like.

1. The smartest people I've ever met all in one room.  We get to bounce ideas off of each other, figure out strange ways of fixing a problem, and come up with a solution.  That means anything from controlling EIP to how to write a rule to compare two things from two different streams using flowbits.
2. We pride ourselves in doing things not only better than the competition, but in the open too.  
3. We work hard.  We play hard.  For instance, today, during break, we played kickball (remember that?) with a big yoga ball, and the ball got stuck in a tree.  Yours truly climbed said tree and retrieved the ball.  Then I came back inside and pulled apart some malware.  Beware of nerf darts, RFI readers, and the 6lb sand-filled ball of doom.
4. Like working in an environment where it doesn't matter how you wind up at the result, as long as you get the correct results?  Tired of being told what OS to use?  Like debating the merits of C, perl, or ruby?  Have a strong opinion between bash and zch?
5. If there's a problem that we don't have a solution for, we invent one.  Last thing we invented resulted in patents that have our people's name on them.
6. Working on next years projects this year.
7. Being the best.
8. When you write protection for a vulnerability or malware here, you cover IDS/IPS, a NGFW, and two antivirus systems.  You protect networks from endpoint to border and into the cloud.
9. If you gag when you hear the word cloud or synergy.
10. Vegetarian?  Paleo? Meat eater?  There is someone here that will sympathize with you.
11. Working for the fastest growing company in security

Honestly there's way too many things to list.

Our currently open job listings are here.  But that's not even the complete list.  We're a growing company, with lots of projects under our purview, and we need people, both junior and senior to be able to fill these roles.

If you like Snort, or ClamAV, or think you can learn, and want to learn, shoot us your resume at research [at] sourcefire [dot] com.

Challenge yourself.  Challenge us.

VRT Rule Release for 02/28/2012

Join us as we welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 24 new rules and made modifications to 388 additional rules.

There were no changes made to the snort.conf in this release.

The VRT would like to acknowledge Jason Wallace for his submission of the following rule(s):
21475(1) "BLACKLIST USER-AGENT known malicious user-agent string core-project"

 In VRT's rule release:

Synopsis: This release adds and modifies rules in several categories. 

Details: The Sourcefire VRT has added and modified multiple rules in the backdoor, blacklist, botnet-cnc, specific-threats and web-misc rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

Community submissions to the VRT Ruleset

Recently, submissions from the Snort community have increased into the VRT ruleset, so I just wanted to share this with you.

We are accepting signatures into the ruleset via our email address at research [at] sourcefire.com.  When we receive a signature we follow our standard internal procedures, which I won't talk a lot about here, but it involves the heavy QA of the signature, testing, optimization for performance, and even sending the rule out our internal and external testing groups.

If you don't know how to write a Snort rule, but have information on a new exploitation method, backdoor, malware, vulnerability, exploit kit, etc.  We'll take that information as well and produce detection (if possible) for you.  For example, sid:21442 for Jason Wallace below.  While Jason didn't write the sig, he did donate the time to scrape together infection information about a machine he manages, and we provided detection for that infection.

These rules are put out in the VRT ruleset, available to our customers and the Snort community as a whole via our normal process, if a submission to our group makes it into the VRT ruleset, we will give the author a free year-long subscription to our ruleset...  we've also been known to send various levels of swag along to our big submitters.  Including our nice professional button down Sourcefire shirts.

Our pledge to you is that we will provide you feedback about how to improve your rules.  What you should and should not do, tips and tricks involved with the latest versions of Snort and it's keywords, as well as giving the author full attribution for their submissions.

We recently had several submissions which I haven't had the chance to acknowledge yet, and I wanted to ensure I called out the authors of the rules and give them credit for their submissions:

Nathan Fowler --
1:21375 <-> WEB-PHP Remote Execution Backdoor Attempt Against Horde
1:21417 <-> SPECIFIC-THREATS hostile PDF associated with Laik exploit kit
1:21438 <-> SPECIFIC-THREATS Blackhole Exploit Kit JavaScript carat string splitting with hostile applet (specific-threats.rules)

Jason Wallace --
1:21246 <-> BLACKLIST USER-AGENT known malicious user-agent string DataCha0s
1:21255 <-> BLACKLIST known malicious FTP login banner - 0wns j0
1:21256 <-> BLACKLIST known malicious FTP quit banner - Goodbye happy r00ting
1:21257 <-> BLACKLIST URI - known scanner tool muieblackcat
1:21442 <-> BLACKLIST URI request for known malicious URI - base64 encoded

We'd like to thank the community for their rule submissions, as well as the continued submission of false positive reports.

Again, if you'd like to submit to the VRT ruleset please email us at research [at] sourcefire.com with your rule and research behind it (pcap, ascii dump, references, anything!) please do!

As always False positive reports belong here: http://www.snort.org/uploads.  This link allows us to process the FP quickly and efficiently.

VRT Rule Update for 02/27/2012

Join us as we welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 15 new rules and made modifications to 9 additional rules.

 There were no changes made to the snort.conf in this release. In VRT's rule release:

Synopsis: This release adds and modifies rules in several categories. Details: The Sourcefire VRT has added and modified multiple rules in the blacklist, botnet-cnc, dos, exploit, policy and web-client rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

VRT Rule Update for 02/23/2012

Join us as we welcome the introduction of the newest rule release for the 23rd from the VRT. In this release we introduced 80 new rules and made modifications to 162 additional rules.

 There were no changes made to the snort.conf in this release. In VRT's rule release:

Synopsis: This release adds and modifies rules in several categories. Details: The Sourcefire VRT has added and modified multiple rules in the backdoor, bad-traffic, botnet-cnc, chat, dos, exploit, file-identify, misc, netbios, policy, smtp and web-client rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

Snort.org restoration

We are still experiencing some problems with certain aspects of Snort.org, however, for most things (such as rule downloads) should be in proper functioning order.  I'll keep you posted on the status of the site.

Thanks for being patient.

Continuing Snort.org problems

We are still experiencing problems with account creation, signup, and rule downloads.  Please be patient with us as our web team works to resolve the problem.

Some current Snort.org errors

We are getting reports of 500 errors when trying to sign up on Snort.org.  Thank you.

We're aware of the issue and the site is currently undergoing some maintenance to make things faster and sustainable for the long term.

I'll update the blog when things seem to be resolved.

Decommissioning of the CVS Server at Snort.org

For years we've had a underused CVS server at the location of cvs.snort.org.  While going back through our assets and taking a look at what we were using and not using, we noticed that cvs.snort.org was barely used.  The server was very old and ran an older OS, so at this point it was becoming more of a liability to keep it up.

This wasn't even a live CVS server and it was only synced when we did a Snort release.

In fact, the only time it was ever used was when people Google a phrase and wind up in the code repository to reference something on a Snort list.  Since the posting of the manual at http://manual.snort.org I felt the server was unneeded and it is now in the process of being decommissioned.  In fact, it's already been brought down.

If people still need the CVS, let me know, and we will explore ways to make the code public in a CVS form again.  You can still download the full source code of Snort at https://www.snort.org/downloads.

VRT Rule Update for 2/21/2012

Join us as we welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 60 new rules and made modifications to 12 additional rules.

 There were no changes made to the snort.conf in this release.

We'd like to than Nathan for his contributions on sid:21375

 In VRT's rule release:

Synopsis: This release adds and modifies rules in several categories. Details: The Sourcefire VRT has added and modified multiple rules in the backdoor, blacklist, botnet-cnc, deleted, exploit, file-identify, netbios, oracle, specific-threats, spyware-put, web-activex, web-client and web-php rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

VRT Rule Update for 02/17/2012

Join us as we welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 44 new rules and made modifications to 16 additional rules.

 There were no changes made to the snort.conf in this release.

 In VRT's rule release:

Synopsis: This release adds and modifies rules in several categories. Details: The Sourcefire VRT has added and modified multiple rules in the bad-traffic, blacklist, botnet-cnc, exploit, netbios, oracle, policy, specific-threats and web-misc rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

VRT Rule Release for 02/14/2012

Sorry for the delay in getting the blog post out, I've been in meetings. Join us as we welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 44 new rules and made modifications to 28 additional rules. There were no changes made to the snort.conf in this release. In VRT's rule release:

Synopsis: The Sourcefire VRT is aware of vulnerabilities affecting Microsoft products. 

Details: Microsoft Security Advisory MS12-008: Apple Safari running on 64-bit Microsoft Windows systems suffers from a programming error that may allow a remote attacker to execute code on an affected system. 

A previously released rule identified with GID 1, SID 20999 has been updated with the relevant reference information and is included in this release. 

Microsoft Security Advisory MS12-010: Microsoft Internet Explorer contains programming errors that may allow a remote attacker to execute code on a vulnerable system. 

Rules to detect these attacks are included in this release and are identified with GID 1, SIDs 21292 and 21300. 

Microsoft Security Advisory MS12-011: Microsoft SharePoint suffers from programming errors that may allow a remote attacker to execute a cross-site scripting attack using a vulnerable system. 

Rules to detect these attacks are included in this release and are identified with GID 1, SIDs 21297 and 21298. Additionally, a previously released rule identified with GID 1, SID 20258 will also detect attempts to leverage this vulnerability and is included in this release with updated reference information. 

Microsoft Security Advisory MS12-012: The Microsoft Color Control Panel application suffers from a programming error that may allow a remote attacker to execute code on an affected system. 

Rules to detect attacks targeting this vulnerability are included in this release and are identified with GID 1, SIDs 21289 and 21290. 

Microsoft Security Advisory MS12-013: The Microsoft Windows operating system suffers from a programming error that may allow a remote attacker to execute code on an affected system. 

A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 1, SID 21308. 

Microsoft Security Advisory MS12-014: The Microsoft Windows Indeo Filter contains a programming error that may allow a remote attacker to execute code on an affected system. 

Previously released rules identified with GID 1, SIDs 18531 and 18532 will detect attacks targeting this vulnerability and are included in this release with updated reference information. 

Microsoft Security Advisory MS12-015: Microsoft Visio contains programming errors that may allow a remote attacker to execute code on an affected system. 

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 21291, 21293, 21301, 21302 and 21307. 

Microsoft Security Advisory MS12-016: Microsoft Silverlight contains programming errors that may allow a remote attacker to execute code on an affected system. 

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 21299 and 21305. 

Additionally, the Sourcefire VRT has added and modified multiple rules in the backdoor, blacklist, botnet-cnc, dos, exploit, file-identify, netbios, policy, specific-threats, web-activex and web-misc rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

VRT Rule release for 02/09/2012

Join us as we welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 10 new rules and made modifications to 4172 additional rules.

There were no changes made to the snort.conf in this release.

Today, we leveled the playing field between the various ways to get Snort rules. It has long been the case where Sourcefire products, by default, enabled rules in the balanced-ips policy.  

When you use PulledPork (http://code.google.com/p/pulledpork/), this is also the default behavior. But when you simply downloaded the rules from Snort.org, the rules were a hodge podge of rules that were enabled or disabled, denoted by whether or not the rule was commented out in the rules file.

In an effort to make the barrier to entry that much easier, the Open Source rule package downloaded on snort.org now exactly mirrors what you would get if you used PulledPork. All rules in balanced-ips are enabled and all rules not in balanced-ips are disabled. The exception to this is that rules that set flowbits that are used by rules that are in balanced-ips are also enabled. This means that the default Open Source ruleset will now provide a good balance between speed, performance, and detection and all rules should work as expected.  Those using Oinkmaster, or simply downloading the ruleset directly, will now be running the "balanced-ips" policy.  A rule's "on/off" state is now dictated by policy.

This change is in no way an indication that PulledPork is not the recommended way to manage your Open Source ruleset. PulledPork also tracks your own custom policy tailored to your environment and provides other benefits. If you want to use the security-ips policy, you may go through and enable these rules by default, or choose the easy way and use PulledPork to manage this for you. So, use PulledPork if you aren't already!

 In VRT's rule release:

Synopsis: This release adds and modifies rules in several categories.

Details: The Sourcefire VRT has added and modified multiple rules in the attack-responses, backdoor, bad-traffic, blacklist, botnet-cnc, chat, dns, dos, exploit, file-identify, finger, icmp, icmp-info, imap, misc, multimedia, netbios, nntp, oracle, p2p, password, policy, pop3, rpc, rservices, scada, scan, shellcode, smtp, specific-threats, spyware-put, sql, username, voip, web-activex, web-cgi, web-client, web-iis, web-misc and x11 rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

VRT Rule Release for 02/07/2012 -- Thanks Jason Wallace

Join us as we welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 70 new rules and made modifications to 64 additional rules.
There were no changes made to the snort.conf in this release.

 In VRT's rule release:

Synopsis: This release adds and modifies rules in several categories. Details: The Sourcefire VRT has added and modified multiple rules in the backdoor, blacklist, botnet-cnc, exploit, file-identify, misc, netbios, policy, shellcode, specific-threats, tftp, web-activex and web-misc rule sets to provide coverage for emerging threats from these technologies.

The VRT would like to acknowledge Jason Wallace's work in submitting the framework for the following rules:

21246
21255
21256
21257

It's great to have community involvement in the ruleset!

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

VRT Rule Release for 02/02/2012

Join us as we welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 20 new rules and made modifications to 15 additional rules.

There were no changes made to the snort.conf in this release.In VRT's rule release:

Synopsis:
This release adds and modifies rules in several categories.

Details:
The Sourcefire VRT has added and modified multiple rules in the backdoor, blacklist, botnet-cnc, file-identify, netbios, oracle, policy, specific-threats, spyware-put and web misc rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!